@bongos/core 1.19.508 → 1.19.510

package/docs/module-api-changelog.md

@@ -1453,5 +1453,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.506 with no explicit bump. run 33788726591. (task 1002620)
   1.19.508 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.507 with no explicit bump. run 33790206682. (task 1002620)
+  1.19.509 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.508 with no explicit bump. run 33790542026. (task 1002620)
+  1.19.510 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.509 with no explicit bump. run 33791237400. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -670,6 +670,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/modules/platform-identity/module.json

@@ -14,6 +14,6 @@
     "migrations": true,
     "pollers": ["code-sweep"]
   },
-  "provides": ["platform-identity.hub"],
+  "provides": ["platform-identity.hub", "project.publishGate"],
   "consumes": []
 }

package/modules/platform-identity/platform-identity.js

@@ -300,38 +300,18 @@ const PROJECT_TEMPLATE_WALK = ['blob-tint', 'pair-gold-wash', 'bead-obsidian-pla
 // `private` and let two sources of truth for one question drift apart.
 const PROJECT_VISIBILITIES = ['public', 'private', 'stealth'];
 
-// The publish gate is IDENTITY ONLY (ADR 0182 D4, owner interview on R16): a name and a
-// description. Not tagline, art, modules, governance, or a completed interview — the bar
-// exists to keep empty husks off the map, not to enforce completeness.
-const PUBLISH_GATE_FIELDS = ['name', 'description'];
-
-// Is this project on the map at all? Returns the verdict AND what is missing, because
-// ADR 0182 D4 requires the gate to NAME what is missing rather than merely refuse: a
-// project that cannot be published and is not told why is indistinguishable from a
-// broken one. R16 (task 1002335) renders `missing`; R06 (task 1002325) reads `publishable`.
-function projectPublishability(project) {
-  const missing = PUBLISH_GATE_FIELDS.filter((f) => !String(project?.[f] ?? '').trim());
-  return { publishable: missing.length === 0, missing };
-}
-
-// The boolean alone, for predicates that do not care which field is absent.
-function projectIsPublishable(project) {
-  return projectPublishability(project).publishable;
-}
-
-// The SAME gate as a SQL fragment, so the feed predicate (R06) and the owner-facing
-// refusal (R16) cannot drift from projectPublishability() or from each other. `alias`
-// qualifies the columns for a joined query (e.g. publishableSql('p')).
-function publishableSql(alias) {
-  // The alias is INTERPOLATED, so it is the one thing here that could carry SQL. Callers
-  // pass a literal, but a helper that builds SQL should refuse anything that is not a
-  // bare identifier rather than trust every future caller to remember that.
-  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
-    throw new Error('publishableSql: alias must be a bare SQL identifier');
-  }
-  const q = alias ? `${alias}.` : '';
-  return `(btrim(coalesce(${q}name, '')) <> '' AND btrim(coalesce(${q}description, '')) <> '')`;
-}
+// The publish gate — the derived "is this project on the map at all" bar — lives in
+// its own file (ADR 0182 D4; the account-visibility.js precedent). Every symbol is
+// re-exported below, so this module's public surface is exactly what it was before
+// the split and no caller has to know about it.
+const {
+  PUBLISH_GATE_FIELDS,
+  projectPublishability,
+  projectIsPublishable,
+  publishableSql,
+  missingPhrase,
+  publishGatePort,
+} = require('./publish-gate');
 
 // Upsert a catalog row (keyed by origin). Called when a client registers (so every
 // federated project is catalogued, unfeatured) and by the Archon create/curate route.
@@ -412,14 +392,26 @@ async function listAllProjects({ pool = defaultPool } = {}) {
   return rows.map((r) => ({ ...r, missing: projectPublishability(r).missing }));
 }
 
-// Archon-only: flip the Explore feature flag on a catalog row.
+// Archon-only: flip the Explore feature flag — BOUNDED BY THE PUBLISH GATE (ADR 0182
+// D3, task 1002335). Featuring may rank among projects ALREADY on the map, never put
+// one there. The bound rides the UPDATE's own WHERE, not a read-then-write, so a
+// description cleared mid-flight cannot slip a husk on; un-featuring is never blocked,
+// since an already-featured husk must stay removable. Answers a VERDICT rather than a
+// row — { project } | { blocked, missing } | { notFound } — because a bare null
+// collapsed "the gate refused" into "no such row", and a curator is owed each.
 async function setProjectFeatured(id, featured, { pool = defaultPool } = {}) {
+  const on = !!featured;
   const { rows } = await pool.query(
     `UPDATE platform_identity_projects SET featured = $2, updated_at = now()
-      WHERE id = $1 RETURNING id, origin, name, featured, status`,
-    [id, !!featured],
+      WHERE id = $1 AND ($2 = false OR ${publishableSql()})
+      RETURNING id, origin, name, featured, status`,
+    [id, on],
   );
-  return rows[0] || null;
+  if (rows[0]) return { project: rows[0] };
+  // Re-read only to tell the two failures apart — and, when it was the gate, to name
+  // the identity field that is still missing (D4: never merely refuse).
+  const project = await getProject(id, { pool });
+  return project ? { blocked: true, missing: project.missing } : { notFound: true };
 }
 
 // -------------------------------------------------------------------------
@@ -1435,6 +1427,8 @@ module.exports = {
   projectPublishability,
   projectIsPublishable,
   publishableSql,
+  missingPhrase,
+  publishGatePort,
   upsertProject,
   PROJECT_TYPES,
   PROJECT_TEMPLATES,

package/modules/platform-identity/publish-gate.js

@@ -0,0 +1,103 @@
+// modules/platform-identity/publish-gate.js — THE project publish gate, published
+// in all three forms it is asked in, so no two of them can drift (ADR 0182 D4; the
+// account-visibility.js precedent, which took this file's shape for the same reason).
+//
+// WHAT IT ANSWERS: "is this project on the public map at all?" — and, when the answer
+// is no, WHICH identity field is absent. The bar is IDENTITY ONLY: a `name` and a
+// `description`. Not tagline, art, modules, governance, or a completed interview. It
+// exists to keep empty husks off the map, never to enforce completeness — a higher bar
+// would make skipping the optional project-detail step (task 1002334) a dead end
+// rather than the supported default the goal explicitly wants.
+//
+// "Dark matter" — off the map and un-joinable — is the ABSENCE of a met bar, derived
+// here and never stored. A stored fourth visibility value would compete with `private`
+// and give one question two sources of truth that can drift apart (ADR 0182 D1).
+//
+// THE THREE FORMS, and why they live together:
+//   • projectPublishability(row) — the verdict + `missing`, for JS callers
+//   • publishableSql(alias)      — the identical predicate as SQL, for the feed
+//   • publishGatePort            — the kernel seam port, for another module
+// A caller that reached only one of these could not have drifted; a caller that
+// re-implements a two-field rule inevitably does. That is the whole point of the file.
+//
+// WHY ITS OWN FILE. Same reason account-visibility.js is: platform-identity.js sits at
+// the file-size ratchet (scripts/gds/fitness-ratchets.js), and R16 (task 1002335) added
+// the port + the phrase. platform-identity.js re-exports every symbol here, so the
+// module's public surface is unchanged and no caller has to know about the split.
+//
+// WHAT IT IS NOT. Not the join door: `visibility ∈ (public|private|stealth)` is a
+// stored, owner-set policy and all three of its values are VISIBLE (ADR 0182 D2). Not
+// curation: `featured` may rank among projects already on the map, never put one there
+// (D3) — setProjectFeatured enforces that bound with publishableSql(). Not authority.
+'use strict';
+
+// The two fields, and only these two (ADR 0182 D4, owner interview on R16).
+const PUBLISH_GATE_FIELDS = Object.freeze(['name', 'description']);
+
+// Is this project on the map at all? Returns the verdict AND what is missing, because
+// ADR 0182 D4 requires the gate to NAME what is missing rather than merely refuse: a
+// project that cannot be published and is not told why is indistinguishable from a
+// broken one. R16 (task 1002335) renders `missing`; R06 (task 1002325) reads `publishable`.
+function projectPublishability(project) {
+  const missing = PUBLISH_GATE_FIELDS.filter((f) => !String(project?.[f] ?? '').trim());
+  return { publishable: missing.length === 0, missing };
+}
+
+// The boolean alone, for predicates that do not care which field is absent.
+function projectIsPublishable(project) {
+  return projectPublishability(project).publishable;
+}
+
+// The SAME gate as a SQL fragment, so the feed predicate (R06) and the owner-facing
+// refusal (R16) cannot drift from projectPublishability() or from each other. `alias`
+// qualifies the columns for a joined query (e.g. publishableSql('p')).
+function publishableSql(alias) {
+  // The alias is INTERPOLATED, so it is the one thing here that could carry SQL. Callers
+  // pass a literal, but a helper that builds SQL should refuse anything that is not a
+  // bare identifier rather than trust every future caller to remember that.
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('publishableSql: alias must be a bare SQL identifier');
+  }
+  const q = alias ? `${alias}.` : '';
+  return `(btrim(coalesce(${q}name, '')) <> '' AND btrim(coalesce(${q}description, '')) <> '')`;
+}
+
+// What is missing, as a PHRASE, so every surface that refuses says it the same way
+// (task 1002335). ADR 0182 D4 requires the gate to NAME what is absent, and a list
+// rendered ad hoc at each call site is how two surfaces end up telling one owner two
+// different stories about one rule. ['description'] → "no description";
+// ['name','description'] → "no name and no description". PURE.
+function missingPhrase(missing) {
+  const list = (missing || []).filter(Boolean);
+  if (!list.length) return '';
+  if (list.length === 1) return `no ${list[0]}`;
+  return `no ${list.slice(0, -1).join(', no ')} and no ${list[list.length - 1]}`;
+}
+
+// The gate as a KERNEL SEAM PORT — `project.publishGate` (R16, task 1002335),
+// registered by routes/projects.js and declared in module.json.
+//
+// The module one-way rule (ADR 0083) forbids `provisioning` from importing this file,
+// and provisioning is the plane an owner actually stands on BEFORE their project is
+// ever catalogued here — so without a port it would have to keep its own copy of the
+// rule, which is exactly the drift publishableSql() exists to prevent. One definition,
+// reached through the kernel switchboard.
+//
+// `evaluate` is deliberately tolerant of a FOREIGN row shape: a consumer maps its own
+// columns onto { name, description } — provisioning's `slug` IS its project's name —
+// so the gate never learns another module's schema. `fields` is published so a consumer
+// can render the bar without hardcoding it.
+const publishGatePort = Object.freeze({
+  fields: PUBLISH_GATE_FIELDS,
+  evaluate: (project) => projectPublishability(project),
+  missingPhrase,
+});
+
+module.exports = {
+  PUBLISH_GATE_FIELDS,
+  projectPublishability,
+  projectIsPublishable,
+  publishableSql,
+  missingPhrase,
+  publishGatePort,
+};

package/modules/platform-identity/routes/projects.js

@@ -24,7 +24,23 @@ function hostOfOrigin(origin) {
   try { return new URL(String(origin)).hostname.replace(/^www\./, '').toLowerCase(); } catch { return ''; }
 }
 
+// Register this module's publish-gate seam (R16, task 1002335; the
+// registerProvisioningSeams precedent). Idempotent — the loader calls the factory
+// once at boot, but tests instantiate the router repeatedly, and a port is
+// single-provider so a second registration throws.
+//
+//   • PROVIDES port `project.publishGate` → { fields, evaluate(project) }.
+//     Lets provisioning — the plane an owner stands on before their project is
+//     catalogued here — ask THIS module's gate whether a project is on the map,
+//     without importing it (the ADR 0083 one-way rule) and without keeping a
+//     second copy of the rule that could drift from publishableSql().
+function registerPublishGateSeam() {
+  if (api.hasProvider('project.publishGate')) return;
+  api.registerProvider('project.publishGate', pi.publishGatePort);
+}
+
 module.exports = function projectsRoutes() {
+  registerPublishGateSeam();
   const router = express.Router();
 
   // rank: metic+archon — the full curation list (includes unfeatured + owner attribution).
@@ -99,15 +115,26 @@ module.exports = function projectsRoutes() {
     }
   });
 
-  // rank: archon — the feature / unfeature control (the ADR 0141 §5 curation gate).
+  // rank: archon — the feature / unfeature control (the ADR 0141 §5 curation gate),
+  // BOUNDED BY THE PUBLISH GATE (ADR 0182 D3, task 1002335). Featuring ranks among
+  // projects already on the map; it is not a way ONTO it, so featuring a dark-matter
+  // row is refused — and the refusal names the identity field that is missing rather
+  // than merely saying no (D4). Un-featuring is never refused.
   router.patch('/projects/:id/featured', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_project_id', positiveInt: true });
     if (id === null) return;
     if (validateOrRespond(req, res, { featured: { required: true, type: 'boolean' } })) return;
     try {
-      const project = await pi.setProjectFeatured(id, req.body.featured, { pool });
-      if (!project) return res.fail('project_not_found', 404);
-      res.json({ project });
+      const out = await pi.setProjectFeatured(id, req.body.featured, { pool });
+      if (out.notFound) return res.fail('project_not_found', 404);
+      if (out.blocked) {
+        return res.fail('not_publishable', {
+          status: 409,
+          message: `This project is not on the public map yet, so it cannot be featured — it still has ${pi.missingPhrase(out.missing)}. Featuring promotes a project that is already published; it cannot publish one.`,
+          details: { missing: out.missing },
+        });
+      }
+      res.json({ project: out.project });
     } catch (err) {
       console.error('[platform-identity] PATCH /projects/:id/featured', err);
       res.fail('feature_toggle_failed', { status: 500, message: 'internal error' });

package/modules/platform-identity/tests/platform-identity.mjs

@@ -286,12 +286,17 @@ await ta('listFeaturedProjects returns a PUBLIC projection (featured+active only
   assert.doesNotMatch(sel, /updated_at/, 'updated_at is curation noise — never projected');
 });
 
-await ta('setProjectFeatured flips the flag (Archon curation)', async () => {
+await ta('setProjectFeatured flips the flag (Archon curation) — and answers with a VERDICT', async () => {
   const pool = mockPool([{ rows: [{ id: '1', featured: true }] }]);
   const out = await P.setProjectFeatured(1, true, { pool });
-  assert.equal(out.featured, true);
+  assert.equal(out.project.featured, true);
   assert.match(pool.calls[0].text, /UPDATE platform_identity_projects SET featured = \$2/);
   assert.deepEqual(pool.calls[0].params, [1, true]);
+  // Bounded by the publish gate since task 1002335 (ADR 0182 D3): featuring may
+  // promote among projects already on the map, never put one there. The full
+  // refusal contract — blocked vs notFound, and the un-feature escape — lives in
+  // tests/publish_gate.mjs.
+  assert.ok(pool.calls[0].text.includes(P.publishableSql()), 'the gate rides in the WHERE');
 });
 
 console.log('\nproject visibility: the stored door + the DERIVED publish gate (BV1.R04, ADR 0182):');

package/modules/provisioning/routes/provisioning.js

@@ -21,6 +21,8 @@
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
 //   public:
 //     GET    /provisioning/health                   — liveness + core version
+//     GET    /provisioning/onboard-plan             — the canonical onboarding step sequence
+//     GET    /provisioning/starter-bundles          — the curated module preset per project type
 //
 // Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
 // 0083); it requires this module's own provisioning.js (same-dir), never a sibling.
@@ -33,6 +35,7 @@ const auth = api;
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
+const { ALWAYS_ON_CORE, allStarterBundles } = require('../starter-bundles');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
@@ -262,12 +265,48 @@ function registerProvisioningSeams() {
   api.registerProvider('provisioning.projectPlanets', (hosts) => provisioning.planetChoicesForHosts(pool, hosts));
 }
 
+// Is this project on the public map, and if not, what is it still missing?
+// (R16, task 1002335 — the surface R15 pointed at by name.)
+//
+// The rule itself is ADR 0182 D4's and lives in `platform-identity`; this module
+// reaches it through the kernel port `project.publishGate` rather than keeping a
+// copy, because a second copy of a two-field rule is exactly the drift that
+// module's single SQL definition exists to prevent (ADR 0083 forbids the import).
+//
+// resolveOptional, not resolve, and NOT declared in `consumes` (the lifecycle →
+// reward precedent): platform-identity is hub-only (`default: false`), and the
+// public map is a HUB concept — an instance running provisioning without it has no
+// map to be on. The honest answer there is "no verdict" (null), never a locally
+// invented one, and every surface below hides the section rather than guessing.
+//
+// The MAPPING is the one part this module owns: an instance's `slug` IS its
+// project's name on this plane — there is no `name` column and a slug can never be
+// empty — so the only identity field this plane can be missing is the description
+// the optional About step (task 1002334) asks for.
+function publishVerdict(row) {
+  const gate = api.resolveOptional('project.publishGate');
+  if (!gate || !row) return null;
+  const { publishable, missing } = gate.evaluate({ name: row.slug, description: row.description });
+  // The phrase travels with the verdict so the owner-facing surfaces and the hub's
+  // own refusal cannot word one rule two different ways.
+  return { publishable, missing, missing_phrase: gate.missingPhrase(missing) };
+}
+
+// The owner-facing projection every instance read returns: the allow-listed row
+// plus the derived publish verdict. One helper so a new read cannot ship the row
+// without the verdict and leave an owner unable to see why they are dark matter.
+function ownerInstance(row) {
+  return { ...provisioning.publicInstance(row), publish: publishVerdict(row) };
+}
+
 // Project an instance row for the fleet view — the owner identity + the same
-// allow-listed public projection an owner sees.
+// projection an owner sees, verdict included: "why is this project not on the map"
+// is a support question, and an operator who has to re-derive the answer will
+// eventually derive a different one.
 function fleetInstance(row) {
   return {
     owner: { id: row.owner_builder_id, github_login: row.github_login, display_name: row.display_name, rank: row.rank },
-    ...provisioning.publicInstance(row),
+    ...ownerInstance(row),
   };
 }
 
@@ -575,7 +614,7 @@ module.exports = function provisioningRoutes() {
         };
       }
       res.status(created ? 201 : 200).json({
-        instance: provisioning.publicInstance(instance),
+        instance: ownerInstance(instance),
         open_intent: intent ? { action: intent.action, state: intent.state } : null,
         queued: intentCreated,
         created,
@@ -647,7 +686,7 @@ module.exports = function provisioningRoutes() {
       for (const row of rows) {
         const open = await provisioning.getOpenIntent(pool, row.id);
         instances.push({
-          ...provisioning.publicInstance(row),
+          ...ownerInstance(row),
           open_intent: open ? { action: open.action, state: open.state } : null,
         });
       }
@@ -684,7 +723,7 @@ module.exports = function provisioningRoutes() {
       // panel recovers it from server state after a reload — not from sessionStorage.
       const manifest = await provisioning.getLatestOAuthManifestForInstance(pool, id);
       res.json({
-        instance: provisioning.publicInstance(inst),
+        instance: ownerInstance(inst),
         open_intent: open ? { action: open.action, state: open.state } : null,
         github_app: provisioning.publicGithubApp(manifest),
       });
@@ -746,6 +785,11 @@ module.exports = function provisioningRoutes() {
         description: updated.description || null,
         detail: provisioning.projectDetail(updated),
         options: provisioning.PROJECT_DETAIL_VOCAB,
+        // The whole point of the step, answered in the same breath (R16, task
+        // 1002335): an owner who just wrote a description learns HERE that the
+        // project is now on the map, and one who cleared it learns it just left.
+        // Re-deriving it from a follow-up GET would let the two answers disagree.
+        publish: publishVerdict(updated),
       });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/detail', err);
@@ -1222,6 +1266,22 @@ module.exports = function provisioningRoutes() {
     res.json({ mode, steps: stepsForShape(onboardPlan(mode, { domain }), shape) });
   });
 
+  // GET /provisioning/starter-bundles — the curated module preset for each declared
+  // project type (BV1.R19, task 1002338; goal 1000046 criterion `proj-module-select`).
+  // Returns the always-on core once, then one resolved bundle per type:
+  // `{ type, label, summary, core, bundle, modules }`. The whole table in one read,
+  // because the creation picker (R20, task 1002339) re-preselects as the owner flips
+  // the type question and must not refetch to do it; R17's rule engine reads the same
+  // shape so a recommendation and a preselect can never name different modules.
+  // A DECLARATION, not a query — modules/provisioning/starter-bundles.js is pure, so
+  // this route touches no database and no per-request state.
+  // rank: public — the signed-out hub wizard (/projects?view=new) reads it while
+  // choosing a type, exactly like onboard-plan above; no write, no secret, and the
+  // module catalog it names is already public at GET /public/modules.
+  router.get('/provisioning/starter-bundles', (req, res) => {
+    res.json({ core: [...ALWAYS_ON_CORE], bundles: allStarterBundles() });
+  });
+
   // GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST
   // (ADR 0111 §4, task P4 #1945). Caddy's global `on_demand_tls { ask … }` calls
   // this before fetching a Let's Encrypt cert for an SNI it doesn't already have:
@@ -1342,3 +1402,8 @@ module.exports = function provisioningRoutes() {
 
 // Re-export the seam registrar for tests that assert the port is registered.
 module.exports.registerProvisioningSeams = registerProvisioningSeams;
+// …and the publish-gate projection (task 1002335), so a test can pin the one
+// thing this module owns about the gate — the slug-is-the-name mapping — and
+// prove it answers with the REAL port rather than a copy of the rule.
+module.exports.publishVerdict = publishVerdict;
+module.exports.ownerInstance = ownerInstance;

package/modules/provisioning/starter-bundles.js

@@ -0,0 +1,159 @@
+// modules/provisioning/starter-bundles.js — the curated STARTER BUNDLE for each
+// declared project type (BV1.R19, task 1002338; goal 1000046 criterion
+// `proj-module-select`).
+//
+// WHY. Every Cloud Bongos instance boots with the same always-on core — the
+// methodology modules a project cannot sensibly run without. What differs between
+// a game, a research project and a business is the handful of OPT-IN modules on
+// top, and an owner creating their first project has no way to know which of
+// those they want before they have used any of them. A bundle is that opinion,
+// written down once: a project type maps to a short list of opt-in module keys,
+// PRESELECTED for the owner and freely toggled off in the creation picker (R20,
+// task 1002339). It is the answer the flow STARTS from, never a decision it makes
+// on the owner's behalf, and never a thing an owner is stuck with — modules are
+// added and removed after creation too (R23, task 1002342).
+//
+// THE ARROW RUNS TYPE -> MODULES, NEVER BACK. Task 1002772 rejected inferring a
+// project's type from its enabled module set: flags flip all through setup, so a
+// half-configured project would show a confidently wrong type. The type is
+// DECLARED at creation and everything downstream reads off that declaration. R15
+// wrote the same rule into the interview's vocabulary — "the module bundle R19
+// recommends comes off the separately-declared `type`, so the interview
+// deliberately does not ask it a second time" (PROJECT_DETAIL_VOCAB in
+// provisioning.js beside this file).
+//
+// A BUNDLE IS NOT A PUBLISH PRECONDITION. ADR 0182 D4 fixes the publish bar at
+// identity alone — a name and a description, "not tagline, art, modules,
+// governance, or a completed interview" — so taking or declining a bundle must
+// never change whether a project is on the map.
+//
+// PURE — no I/O, no core imports, no sibling-module imports; safe to require from
+// a route, a script or a test, exactly like onboard-plan.js beside it. That purity
+// is why the module keys below are DECLARED here rather than read off the live
+// catalog (src/module-loader/catalog.js, which a module may not import — the
+// one-way rule, ADR 0083). tests/provisioning_starter_bundles.mjs is the pin that
+// keeps the declaration true: it reads every modules/*/module.json off disk and
+// fails the build if a bundle names a module that does not exist, if a bundle
+// names an always-on module (a preselect that toggles nothing), or if
+// ALWAYS_ON_CORE drifts from the manifests' `default: true` set.
+
+'use strict';
+
+// The modules every instance gets whichever type it declares — the manifests'
+// `default: true` set (docs/modules-contract.md: "core-domain modules that are
+// `default: true` (always on unless disabled)"). They are the FLOOR a bundle
+// layers on, not part of any bundle, and they are listed here so a creation form
+// can show an owner what they already have without a second round trip.
+const ALWAYS_ON_CORE = Object.freeze([
+  'autonomy',
+  'builder-settings',
+  'copy-desk',
+  'economy',
+  'government',
+  'grading',
+  'hall-ui',
+  'ideas',
+  'lifecycle',
+  'memory',
+  'onboarding',
+  'public-landing',
+  'security',
+  'sessions',
+  'status-ui',
+  'ui-design',
+]);
+
+// The control plane's own modules. `platform-identity` is the hub identity
+// provider ("enabled ONLY on the hub instance") and `provisioning` is the surface
+// that stands other instances up — a project created THROUGH the hub is a
+// consumer of both, never a second copy of them. Named so the integrity test can
+// refuse them by construction rather than by anyone remembering.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning']);
+
+// The curated presets, keyed by the declared project type (the closed vocabulary
+// owner-decided 2026-08-13 and mirrored in provisioning.PROJECT_TYPES + the
+// provisioning_007 CHECK). `label` and `summary` are the owner-facing copy the
+// picker renders — plain language, no module jargon, because the owner choosing
+// here has not met any of these modules yet.
+//
+// The lists are SHORT on purpose. A preselect an owner has to audit is worse than
+// none, and today's opt-in catalog is genuinely small (`agents`, `dev-box`,
+// `discord`); a bundle grows as the catalog does, which is exactly why this is a
+// declaration and not a rule engine. Enabling `dev-box` opens the door to a cloud
+// dev environment — it provisions nothing and bills nothing until a builder asks
+// for a box — so preselecting it costs the owner nothing but a toggle.
+const STARTER_BUNDLES = Object.freeze({
+  game: Object.freeze({
+    label: 'Game starter',
+    summary: 'Somewhere for players to gather, and a place to walk a change through before anyone plays it.',
+    modules: Object.freeze(['dev-box', 'discord']),
+  }),
+  research: Object.freeze({
+    label: 'Research starter',
+    summary: 'Extra agents to run the reading and the experiments the question needs.',
+    modules: Object.freeze(['agents']),
+  }),
+  business: Object.freeze({
+    label: 'Business starter',
+    summary: 'A place to try a change before customers see it, and agents to look it over first.',
+    modules: Object.freeze(['agents', 'dev-box']),
+  }),
+  'non-profit': Object.freeze({
+    label: 'Non-profit starter',
+    summary: 'Somewhere the community around the cause can gather and be heard.',
+    modules: Object.freeze(['discord']),
+  }),
+  'not-sure': Object.freeze({
+    label: 'Core only',
+    summary: 'Just the core, and nothing else to decide today. Add modules whenever you know what you need.',
+    modules: Object.freeze([]),
+  }),
+});
+
+// The copy an undeclared project gets. Deliberately NOT one of the bundles above:
+// `type` is nullable because every row predates the field and must never be
+// back-filled with a guess (migration provisioning_007), so "nobody said" has to
+// read differently from "the owner said not sure".
+const UNDECLARED = Object.freeze({
+  label: 'Core only',
+  summary: 'No project type yet, so nothing is preselected — every project starts with the core.',
+});
+
+// Resolve one project type to what the creation flow should preselect:
+// `{ type, label, summary, core, bundle, modules }`, where `bundle` is the type's
+// opt-in additions, `core` the always-on floor, and `modules` the union in that
+// order — what the owner ends up with if they change nothing. An unknown or
+// absent type resolves to the core with `type: null`; this never throws and never
+// invents a type, because a recommendation built on an answer nobody gave is
+// worse than no recommendation. Arrays are fresh copies, so a caller may sort or
+// splice its result without corrupting the frozen declaration.
+function bundleForProjectType(type) {
+  const declared = typeof type === 'string' && Object.prototype.hasOwnProperty.call(STARTER_BUNDLES, type)
+    ? type
+    : null;
+  const preset = declared ? STARTER_BUNDLES[declared] : UNDECLARED;
+  const bundle = declared ? [...STARTER_BUNDLES[declared].modules] : [];
+  return {
+    type: declared,
+    label: preset.label,
+    summary: preset.summary,
+    core: [...ALWAYS_ON_CORE],
+    bundle,
+    modules: [...ALWAYS_ON_CORE, ...bundle],
+  };
+}
+
+// Every curated bundle, resolved, in declaration order — the whole table in one
+// read. The creation picker wants all of them up front so flipping the type
+// question re-preselects without another round trip.
+function allStarterBundles() {
+  return Object.keys(STARTER_BUNDLES).map(bundleForProjectType);
+}
+
+module.exports = {
+  ALWAYS_ON_CORE,
+  HUB_ONLY_MODULES,
+  STARTER_BUNDLES,
+  bundleForProjectType,
+  allStarterBundles,
+};