@bongos/core 1.19.511 → 1.19.513

package/modules/provisioning/recommendations.js

@@ -0,0 +1,260 @@
+// modules/provisioning/recommendations.js — the RULE ENGINE that turns what an
+// owner said during project creation into a recommended starter bundle, a
+// recommended governance preset, and an invite suggestion (BV1.R17, task
+// 1002336; goal 1000046 criteria `proj-module-select`, `proj-governance-reco`,
+// `proj-invite-builders`).
+//
+// WHY. Goal 1000046 pins the near term as RULE-BASED and defers the semantic
+// layer: "near-term recommendations are rule-based and module search is lexical;
+// the AI/embeddings layer … is a deferred follow-up captured in the idea inbox"
+// (idea 1000552, task 1003500). So this file is a set of small declarative
+// TABLES — condition -> effect -> a one-line `reason` in the owner's own words —
+// and a resolver over them. Not a model, not a scoring function, and nothing
+// that reads the free-text description: a rule an owner cannot be told the
+// reason for is a recommendation they cannot audit.
+//
+// TWO INPUTS, AND ONLY TWO. `type` is the DECLARED project type (a column, the
+// closed set task 1002772 fixed) and `team_shape` is the one closed-answer key
+// the R15 interview collects (`PROJECT_DETAIL_VOCAB` in provisioning.js beside
+// this file). The interview deliberately does not re-ask the type (ADR 0237 §2),
+// so the two arrive separately and this is the file that puts them together.
+//
+// SKIPPING IS A SUPPORTED ANSWER, NOT A GAP. The interview is optional (ADR 0182
+// D4), so every table has a stated DEFAULT for "nobody said" and the defaults are
+// deliberately the narrowest option — the type's own bundle unadjusted, the
+// governance preset that grants nobody anything, and no invites. An off-vocabulary
+// team shape reads as no answer for the same reason `normalizeProjectDetail` drops
+// one: inventing an answer nobody gave feeds the recommendation a lie. R18 (task
+// 1002337) is the live proof of exactly that split.
+//
+// PURE — no I/O, no core import, no sibling-module import; requires only its own
+// module's `starter-bundles.js` and `provisioning.js`, both of which are pure
+// themselves. That is what lets a route, a script and a test read one answer.
+// It is also why `invites.suggested` is always empty here: ranking builders means
+// querying the leaderboard, which lives in a sibling module (`economy`) this one
+// may not import (the one-way rule, ADR 0083). The engine states WHAT to look for
+// in `invites.seeking`; R28 (task 1002347) owns the lookup that fills it.
+//
+// Decision record: ADR 0239.
+
+'use strict';
+
+const { bundleForProjectType, ALWAYS_ON_CORE } = require('./starter-bundles');
+const { PROJECT_DETAIL_VOCAB } = require('./provisioning');
+
+// How the team shape adjusts the type's starter bundle, in application order.
+// Each entry is one condition (`teamShape`) and one effect on ONE opt-in module,
+// carrying the sentence a picker shows when it fires. Deliberately tiny: ADR 0237
+// already made the per-type preset the opinion, and today's opt-in catalog is
+// three modules wide (`agents`, `dev-box`, `discord`) — so this table's job is to
+// correct a preset the owner's answer contradicts, not to re-derive it.
+//
+// A rule may only ever name an OPT-IN module. Adding or removing an always-on one
+// would be a toggle that toggles nothing (ADR 0237 §3's argument, and
+// `tests/provisioning_recommendations.mjs` fails the build over it).
+const TEAM_SHAPE_RULES = Object.freeze([
+  Object.freeze({
+    id: 'a-community-needs-somewhere-to-gather',
+    teamShape: 'community',
+    effect: 'add',
+    module: 'discord',
+    reason: 'You said an open community is building this, so somewhere for it to gather is switched on.',
+  }),
+  Object.freeze({
+    id: 'a-team-shares-one-environment',
+    teamShape: 'small-team',
+    effect: 'add',
+    module: 'dev-box',
+    reason: 'A small team gets one shared environment to build in, so nobody is debugging their own laptop.',
+  }),
+  Object.freeze({
+    id: 'building-alone-needs-no-shared-environment',
+    teamShape: 'solo',
+    effect: 'remove',
+    module: 'dev-box',
+    reason: 'You are building this alone, so the shared cloud environment is off — your own machine is the setup.',
+  }),
+]);
+
+// The governance presets, by key. A preset is a NAME plus the one sentence that
+// says what living under it feels like — never a set of roles or permissions,
+// because there is nowhere to put them: the governance module is planned (goal
+// 1000030) and unbuilt, which criterion `proj-governance-reco` says out loud.
+// R25 (task 1002344) is the spike that fits these to the real module when it
+// exists; until then every recommendation carries `applied: false` so a form can
+// label it a preview without hardcoding that fact in four places.
+const GOVERNANCE_PRESETS = Object.freeze({
+  'owner-only': Object.freeze({
+    label: 'You decide',
+    preview: 'You hold every role. Nothing waits on anyone else, and nothing changes without you.',
+  }),
+  'trusted-team': Object.freeze({
+    label: 'A trusted team',
+    preview: 'Everyone you invite can build and ship. You keep the decisions that spend money or change the shape of the project.',
+  }),
+  'open-contribution': Object.freeze({
+    label: 'Open contribution',
+    preview: 'Anyone can turn up and propose work. A small circle you choose reviews what actually lands.',
+  }),
+});
+
+// Team shape -> governance preset. One row per shape the interview can return;
+// the integrity test fails the build if a shape in `PROJECT_DETAIL_VOCAB` has no
+// row here, so a fourth answer can never be added and silently unhandled.
+const GOVERNANCE_RULES = Object.freeze([
+  Object.freeze({
+    teamShape: 'solo',
+    preset: 'owner-only',
+    reason: 'You said you are building this alone.',
+  }),
+  Object.freeze({
+    teamShape: 'small-team',
+    preset: 'trusted-team',
+    reason: 'You said a small team is building this, so the people you invite can get on with it without asking first.',
+  }),
+  Object.freeze({
+    teamShape: 'community',
+    preset: 'open-contribution',
+    reason: 'You said an open community is building this, so people can arrive and propose work without an invite.',
+  }),
+]);
+
+// What a skipped interview gets. The narrowest preset on purpose: widening later
+// costs one setting, while a project that quietly granted strangers a role it was
+// never asked to grant is not recoverable by changing the setting back.
+const GOVERNANCE_DEFAULT = Object.freeze({
+  preset: 'owner-only',
+  reason: 'Nobody has said who is building this yet, so this is the narrowest setup — widen it whenever you like.',
+});
+
+// Team shape -> who is worth suggesting, as a SEEK — the kind of builder to look
+// for and how many. This engine is pure and cannot run the lookup (the
+// leaderboard lives in the `economy` module, which this one may not import), so
+// `seeking` is the seam R28 (task 1002347) reads and `suggested` stays empty.
+// `seeking: null` means "suggest nobody", which is a real answer and not a
+// missing one.
+const INVITE_RULES = Object.freeze([
+  Object.freeze({
+    teamShape: 'solo',
+    seeking: null,
+    reason: 'You said you are building alone, so nobody is suggested. You can invite anyone later from the project settings.',
+  }),
+  Object.freeze({
+    teamShape: 'small-team',
+    seeking: Object.freeze({ kind: 'top-builders', limit: 3 }),
+    reason: 'A small team is the shape that fills fastest, so here is a short list of the builders with the strongest recent record.',
+  }),
+  Object.freeze({
+    teamShape: 'community',
+    seeking: Object.freeze({ kind: 'top-builders', limit: 5 }),
+    reason: 'An open community wants a wider first circle, so the list runs longer. Guilds join it once guilds can be invited.',
+  }),
+]);
+
+// What a skipped interview gets: nobody. Same reasoning as the governance
+// default — an invite suggested on an answer nobody gave is a stranger the owner
+// never asked for.
+const INVITE_DEFAULT = Object.freeze({
+  seeking: null,
+  reason: 'Nobody has said who is building this yet, so nothing is suggested. Invites can be sent any time from the project settings.',
+});
+
+// The interview's answer, or null. Anything outside `PROJECT_DETAIL_VOCAB` —
+// absent, misspelled, or a value that was valid when it was stored and has since
+// left the vocabulary — reads as NO ANSWER, exactly as `normalizeProjectDetail`
+// drops it on the way in. PURE.
+function normalizeTeamShape(value) {
+  return PROJECT_DETAIL_VOCAB.team_shape.includes(value) ? value : null;
+}
+
+// Apply the team-shape rules to one type's opt-in bundle. Returns the adjusted
+// list plus the adjustments that ACTUALLY changed it — a rule whose module the
+// bundle already carries (or already lacks) records nothing, because a stated
+// reason for a change that did not happen is a lie the owner cannot check.
+// Never touches the always-on core. PURE.
+function adjustBundle(bundle, teamShape) {
+  const modules = [...bundle];
+  const adjustments = [];
+  for (const rule of TEAM_SHAPE_RULES) {
+    if (rule.teamShape !== teamShape) continue;
+    const at = modules.indexOf(rule.module);
+    if (rule.effect === 'add' && at === -1) modules.push(rule.module);
+    else if (rule.effect === 'remove' && at !== -1) modules.splice(at, 1);
+    else continue;
+    adjustments.push({ rule: rule.id, effect: rule.effect, module: rule.module, reason: rule.reason });
+  }
+  return { modules, adjustments };
+}
+
+// The whole recommendation for one set of creation answers:
+//
+//   {
+//     type, teamShape,          // what was actually declared/answered (null = not)
+//     tailored,                 // did a DETAIL answer shape any of this?
+//     bundle:     { type, label, summary, core, bundle, modules, adjustments },
+//     governance: { preset, label, preview, reason, applied },
+//     invites:    { suggested, seeking, reason },
+//   }
+//
+// `bundle` is ADR 0237 §5's shape with one key added, so R20's picker and this
+// engine can never name different modules; `adjustments` is the delta the rules
+// made to it and is empty when nothing fired. `tailored` is false when the
+// interview was skipped — the machine-readable half of criterion
+// `proj-detail-interview`'s "completing it produces tailored recommendations;
+// skipping produces sensible defaults", and what R18 (task 1002337) proves.
+//
+// Accepts a flat object because the two answers live in two places: `type` is a
+// column and `team_shape` is a key of the `detail` jsonb, so a caller holding a
+// row passes `{ type: row.type, ...projectDetail(row) }`. Never throws and never
+// invents an answer. PURE — result arrays and objects are fresh, so a caller may
+// sort or splice them without corrupting the frozen tables.
+function recommendationsForDetails(answers) {
+  const given = answers && typeof answers === 'object' && !Array.isArray(answers) ? answers : {};
+  const teamShape = normalizeTeamShape(given.team_shape);
+  const preset = bundleForProjectType(given.type);
+  const { modules, adjustments } = adjustBundle(preset.bundle, teamShape);
+
+  const gov = GOVERNANCE_RULES.find((r) => r.teamShape === teamShape) || GOVERNANCE_DEFAULT;
+  const invite = INVITE_RULES.find((r) => r.teamShape === teamShape) || INVITE_DEFAULT;
+
+  return {
+    type: preset.type,
+    teamShape,
+    tailored: teamShape !== null,
+    bundle: {
+      type: preset.type,
+      label: preset.label,
+      summary: preset.summary,
+      core: [...ALWAYS_ON_CORE],
+      bundle: modules,
+      modules: [...ALWAYS_ON_CORE, ...modules],
+      adjustments,
+    },
+    governance: {
+      preset: gov.preset,
+      label: GOVERNANCE_PRESETS[gov.preset].label,
+      preview: GOVERNANCE_PRESETS[gov.preset].preview,
+      reason: gov.reason,
+      // Always false until the governance module ships (goal 1000030). A named
+      // recommendation, never an applied setting — criterion `proj-governance-reco`.
+      applied: false,
+    },
+    invites: {
+      // The seam, not an omission: ranking builders is a leaderboard query this
+      // pure file may not run. R28 (task 1002347) fills this from `seeking`.
+      suggested: [],
+      seeking: invite.seeking ? { ...invite.seeking } : null,
+      reason: invite.reason,
+    },
+  };
+}
+
+module.exports = {
+  TEAM_SHAPE_RULES,
+  GOVERNANCE_PRESETS,
+  GOVERNANCE_RULES,
+  GOVERNANCE_DEFAULT,
+  INVITE_RULES,
+  INVITE_DEFAULT,
+  recommendationsForDetails,
+};

package/modules/provisioning/routes/provisioning.js

@@ -23,6 +23,7 @@
 //     GET    /provisioning/health                   — liveness + core version
 //     GET    /provisioning/onboard-plan             — the canonical onboarding step sequence
 //     GET    /provisioning/starter-bundles          — the curated module preset per project type
+//     GET    /provisioning/recommendations          — bundle/governance/invite recommendations from the answers
 //
 // Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
 // 0083); it requires this module's own provisioning.js (same-dir), never a sibling.
@@ -36,6 +37,7 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, allStarterBundles } = require('../starter-bundles');
+const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
@@ -1282,6 +1284,33 @@ module.exports = function provisioningRoutes() {
     res.json({ core: [...ALWAYS_ON_CORE], bundles: allStarterBundles() });
   });
 
+  // GET /provisioning/recommendations?type=<project type>&team_shape=<interview answer>
+  // — the RULE-BASED recommendation for one set of creation answers (BV1.R17, task
+  // 1002336; goal 1000046 criteria `proj-module-select`, `proj-governance-reco`,
+  // `proj-invite-builders`). Returns `{ recommendations: { type, teamShape, tailored,
+  // bundle, governance, invites } }` — the starter bundle adjusted by the interview
+  // answer with a `reason` per adjustment, a named governance preset with its preview
+  // (`applied: false` until the governance module ships, goal 1000030), and the invite
+  // SEEK that R28 (task 1002347) turns into names.
+  //
+  // The two answers arrive separately because they are stored separately: `type` is a
+  // column and `team_shape` a key of the `detail` jsonb, so a caller passes back
+  // exactly what it holds. Both are optional and neither is validated by rejection —
+  // an absent or off-vocabulary value reads as NO ANSWER and yields the stated
+  // defaults, which is the supported path (ADR 0182 D4: skipping the interview is a
+  // real answer), never a 400.
+  //
+  // A pure read over modules/provisioning/recommendations.js — no database, no
+  // per-request state. rank: public — the same absent gate as `starter-bundles` and
+  // `onboard-plan` above: the signed-out hub wizard (/projects?view=new) asks while
+  // the owner is still answering, before any row exists to be own-scoped against, and
+  // the answer is a declaration that names nothing private.
+  router.get('/provisioning/recommendations', (req, res) => {
+    const type = typeof req.query.type === 'string' ? req.query.type : null;
+    const teamShape = typeof req.query.team_shape === 'string' ? req.query.team_shape : null;
+    res.json({ recommendations: recommendationsForDetails({ type, team_shape: teamShape }) });
+  });
+
   // GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST
   // (ADR 0111 §4, task P4 #1945). Caddy's global `on_demand_tls { ask … }` calls
   // this before fetching a Let's Encrypt cert for an SNI it doesn't already have:

package/modules/provisioning/tests/provisioning.mjs

@@ -263,21 +263,24 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
-    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x' } }),
-    { platform_visibility: 'public', joinability: 'invite_only' },
+    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted' } }),
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'a non-object settings value reads as defaults');
+  // the join door reads back like any other policy key (task 1002324)
+  assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth' }, 'a stored door overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {
@@ -336,7 +339,7 @@ t('the planet (task 1003347): PLANET_TEMPLATES mirrors platform-identity\'s PROJ
   assert.equal(P.PLANET_TEMPLATES.length, 36);
   assert.deepEqual([...P.PLANET_ACCENTS], ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent']);
   for (const a of P.PLANET_ACCENTS) assert.doesNotMatch(a, /^#|rgb|hsl/, 'a name, never a colour (the Fifteen Rule)');
-  assert.deepEqual(Object.keys(P.PLANET_VOCAB), ['planet_template', 'planet_accent']);
+  assert.deepEqual(Object.keys(P.PLANET_VOCAB), ['planet_template', 'planet_accent', 'card_backdrop']);
   // the deliberate asymmetry: the planet is NOT a setting — no default, never in SETTINGS_VOCAB
   for (const k of Object.keys(P.PLANET_VOCAB)) {
     assert.ok(!(k in P.SETTINGS_VOCAB), `${k} is not a policy the instance obeys`);
@@ -345,12 +348,12 @@ t('the planet (task 1003347): PLANET_TEMPLATES mirrors platform-identity\'s PROJ
 });
 
 t('planetChoice: null for a bare row or an unset key; a stored on-vocabulary value reads back; junk reads null, never leaks', () => {
-  assert.deepEqual(P.planetChoice(null), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({}), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: { platform_visibility: 'gated' } }), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' } }), { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' });
-  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'cube', planet_accent: '#fff' } }), { planet_template: null, planet_accent: null });
-  assert.deepEqual(P.planetChoice({ settings: ['nope'] }), { planet_template: null, planet_accent: null });
+  assert.deepEqual(P.planetChoice(null), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({}), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { platform_visibility: 'gated' } }), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit' } }), { planet_template: 'pair-frost-tint', planet_accent: 'sun-lit', card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: { planet_template: 'cube', planet_accent: '#fff' } }), { planet_template: null, planet_accent: null, card_backdrop: null });
+  assert.deepEqual(P.planetChoice({ settings: ['nope'] }), { planet_template: null, planet_accent: null, card_backdrop: null });
 });
 
 t('publicInstance carries the planet — both keys, null when unset — so the list and the manage page read it off the row', () => {

package/modules/public-landing/public/projects.html

@@ -792,6 +792,25 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- live since task 1002324: the join door (ADR 0182 D1) — how the project
+           stands on the platform's map. The third axis, deliberately its own
+           section: the two above are about the project's OWN pages and its OWN
+           membership; this one is about the map everyone else reads. Same two
+           reads, key for key, as its siblings: the choice shown is the platform's
+           REQUEST (its settings row) and the save's reply is a receipt, never a
+           claim the project already runs it. Plain labels only — Public, Private,
+           Stealth — because the space words are the drawn orb's, not the copy's
+           (the goal's interview decision). The fold is a SIBLING of the volatile
+           slot so no re-render can drop it. -->
+      <div class="card mSec" id="mDoorState">
+        <h2>On the map</h2>
+        <div id="mDoor"><p class="finePrint">Reading the project’s settings…</p></div>
+        <details class="finePrint" id="mDoorWhat">
+          <summary>What each choice changes</summary>
+          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
+        </details>
+      </div>
+
       <!-- the planet picker (task 1003347; direction record §16, v1 the bands): the
            owner's own choice of how the platform draws this project — the sky,
            the list, this page's head and the card read the same row. The pick is
@@ -5168,6 +5187,7 @@ summary{min-height:24px;padding:3px 0;}
            the GitHub read: entry + tab return, never the in-flight tick */
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
+        if (!keepRepo) loadDoor();
         /* the publish gate (task 1002335) needs no second read — the verdict
            rode in on the instance itself. It sits behind the same keepRepo
            guard because its card holds a textarea the in-flight tick must
@@ -5953,6 +5973,111 @@ summary{min-height:24px;padding:3px 0;}
     if (t && t.hasAttribute('data-join-save')) doJoinSave();
   });
 
+  /* ── on the map (task 1002324): the join door, ADR 0182 D1 — the third axis,
+     beside "who can see it" (the project's own sign-in door) and "how people
+     join" (its membership door). The two reads above, key for key: the CHOICE
+     comes from the platform's settings row and the save's reply is a RECEIPT —
+     its push.message is shown verbatim and never painted as the live state,
+     because the value reaches a running project only by the restart the runner
+     performs. Unlike its siblings this section asks the project's manifest
+     nothing: an already-deployed project reports no door yet, and a line that
+     could only ever say "your project doesn't report this" is worse than no
+     line. The read-back arrives with the enforcement (BV1.R11/R12).
+     Labels are PLAIN — Public / Private / Stealth — per the goal's interview:
+     the space metaphor is the drawn orb's, never the copy's. ── */
+
+  var DOOR_OPTIONS = {
+    public: { label: 'Public', blurb: 'The project is on the map under its name, and anyone who finds it can join.' },
+    private: { label: 'Private', blurb: 'On the map under its name, but nobody joins on their own — people ask, and you decide.' },
+    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join.' }
+  };
+  var mDoorSettings = null;  /* the platform row's last answer: { value, options } */
+
+  function doorMsg(html) { $('mDoor').innerHTML = html; }
+
+  function renderDoor() {
+    var s = mDoorSettings;
+    if (!s) return;
+    var opts = (s.options || []).filter(function (v) { return !!DOOR_OPTIONS[v]; });
+    doorMsg('<div role="radiogroup" aria-label="On the map">' + opts.map(function (v) {
+      var o = DOOR_OPTIONS[v];
+      return '<label class="visOpt"><input type="radio" name="mDoorPick" value="' + esc(v) + '"' +
+        (v === s.value ? ' checked' : '') + '><span><b>' + esc(o.label) + '</b>' + esc(o.blurb) + '</span></label>';
+    }).join('') + '</div>' +
+      '<div class="actions"><button type="button" class="btn small" data-door-save>Save</button></div>' +
+      '<div class="projMsg" id="mDoorMsg" role="status" aria-live="polite"></div>');
+  }
+
+  function loadDoor() {
+    mDoorSettings = null;
+    doorMsg('<p class="finePrint">Reading the project’s settings…</p>');
+    var asked = manageId; /* a stale answer must never describe a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        return jsonOrEmpty(res).then(function (data) {
+          if (res.ok) {
+            mDoorSettings = {
+              value: (data.settings || {}).visibility,
+              options: (data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
+            };
+            renderDoor();
+            return;
+          }
+          doorMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
+        });
+      })
+      .catch(function (err) {
+        if (String(err && err.message) === 'stale') return;
+        doorMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
+      });
+  }
+
+  /* the save sends the CHOICE and shows the platform's receipt verbatim */
+  function doDoorSave() {
+    if (!manageInst || !mDoorSettings) return;
+    var picked = document.querySelector('#mDoor input[name="mDoorPick"]:checked');
+    if (!picked) return;
+    var value = picked.value;
+    var box = $('mDoorMsg');
+    var btn = document.querySelector('#mDoor [data-door-save]');
+    if (btn) btn.disabled = true;
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ visibility: value })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the row now holds the choice — the radio follows it, and nothing
+             here claims the project is already running it */
+          mDoorSettings.value = (data.saved || {}).visibility || value;
+          box.className = 'projMsg ok';
+          box.textContent = (data.push && data.push.message) || 'Saved.';
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+        /* 409 intent_conflict: the change IS saved (recorded) — the server's
+           sentence says so and names the run holding the slot; show it as is */
+        box.className = e.code === 'intent_conflict' ? 'projMsg' : 'projMsg err';
+        box.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () {
+      if (btn) btn.disabled = false;
+      /* the strip + the sibling sections read open_intent — re-read it */
+      loadManage(true, true);
+    });
+  }
+
+  $('mDoor').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-door-save')) doDoorSave();
+  });
+
   /* ── delete the project (task 1003042): the manage page's teardown control.
      It renders from status + open_intent only — no second request — so the
      minute tick can repaint it and a queued teardown appears without a reload.

package/modules/ui-design/kit/serve.js

@@ -134,7 +134,7 @@ const FLOW_RECEIPTS = {
   domain: { recorded: true, queued: true, message: 'Address recorded.' },
   // the wizard's filing (task 1003346): the receipt names the instance the page then polls — Harbor, the fixture's standing-up row — and the address the page promises is the one the server assigned
   provision: { queued: true, message: 'Queued. The platform picks it up from here.', instance: { id: 102, domain: 'mercury.cloudbongos.com' } },
-  settings: { settings: { platform_visibility: 'public', joinability: 'open' }, push: { queued: true, message: 'Saved. The project restarts to apply it.' } },
+  settings: { settings: { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, push: { queued: true, message: 'Saved. The project restarts to apply it.' } },
 };
 // a teardown or restart ask is REMEMBERED for the run: the page re-reads the project right
 // after a receipt (doDelete → loadManage), and what it must then see is the queued intent —
@@ -160,6 +160,7 @@ function readBody(req, cb) {
 const STUB_VOCAB = {
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
+  visibility: ['public', 'private', 'stealth'],
   planet_template: null,   // the template set is long; shape is checked, not membership
   planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
   card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],
@@ -178,7 +179,7 @@ function settingsPatch(res, id, body) {
   const bad = settingsRejection(body);
   if (bad) return json(res, 400, { error: { code: 'validation_failed', message: bad } });
   if (PLANET_KEYS.some((k) => k in body)) PLANETS.set(String(id), Object.fromEntries(PLANET_KEYS.map((k) => [k, body[k] || null])));
-  const policy = ['platform_visibility', 'joinability'].some((k) => k in body);
+  const policy = ['platform_visibility', 'joinability', 'visibility'].some((k) => k in body);
   const push = policy ? FLOW_RECEIPTS.settings.push
     : { queued: false, restart: false, message: 'Saved. The sky, your list and the card draw it this way from here; nothing on your project restarts for it.' };
   return json(res, 200, { ok: true, saved: FLOW_RECEIPTS.settings.settings, planet: PLANETS.get(String(id)) || NO_PLANET, push });
@@ -209,7 +210,7 @@ function instances(res, id, settings) {
   if (id === null) return json(res, 200, { instances: list });
   const inst = list.find((i) => String(i.id) === String(id));
   if (!inst) return json(res, 404, { error: { code: 'not_found', message: 'no such instance' } });
-  if (settings) return json(res, 200, { settings: { platform_visibility: 'public', joinability: 'open' }, planet: PLANETS.get(String(id)) || NO_PLANET, options: { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'] } });
+  if (settings) return json(res, 200, { settings: { platform_visibility: 'public', joinability: 'open', visibility: 'public' }, planet: PLANETS.get(String(id)) || NO_PLANET, options: { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'], visibility: ['public', 'private', 'stealth'] } });
   return json(res, 200, { instance: inst, open_intent: inst.open_intent || null });
 }
 // A project's art in the featured fixture may be root-relative (the surface's

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.511",
+  "version": "1.19.513",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.511",
+      "version": "1.19.513",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.511",
+  "version": "1.19.513",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/branding.js

@@ -60,6 +60,11 @@ const ENV_OVERRIDES = [
   // — which is exactly why applying a change RESTARTS the instance.
   ['PLATFORM_VISIBILITY', ['project', 'platformVisibility']],
   ['JOINABILITY', ['project', 'joinability']],
+  // The join door the owner set on the platform (ADR 0182 D1, task 1002324) —
+  // public | private | stealth. Distinct from PLATFORM_VISIBILITY above, which is
+  // this instance's own sign-in door; this one is how the project stands on the
+  // platform's map, and D6 makes it the ceiling JOINABILITY may only narrow.
+  ['VISIBILITY', ['project', 'visibility']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);
@@ -215,6 +220,10 @@ function clientBranding(b = branding()) {
     project: {
       platformVisibility: b.project?.platformVisibility || 'public',
       joinability: b.project?.joinability || 'apply',
+      // The join door (task 1002324). Public by nature for the same reason as its
+      // two neighbours: it is how the project asks to be seen on the map, and it is
+      // the READ-BACK a manage page needs to tell a saved choice from a live one.
+      visibility: b.project?.visibility || 'public',
     },
   };
 }

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.511'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.513'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/currency_label.mjs

@@ -48,10 +48,11 @@ test('R57: clientBranding exposes theme.ui (web), NOT theme.palette (server-only
 });
 
 test('clientBranding exposes project policy — the settings read-back (task 1003140), defaulting to today\'s behavior', () => {
-  assert.deepEqual(clientBranding({}).project, { platformVisibility: 'public', joinability: 'apply' });
+  // `visibility` — the join door — joined the block in task 1002324 (ADR 0182 D1)
+  assert.deepEqual(clientBranding({}).project, { platformVisibility: 'public', joinability: 'apply', visibility: 'public' });
   assert.deepEqual(
-    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only' } }).project,
-    { platformVisibility: 'gated', joinability: 'invite_only' },
+    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth' } }).project,
+    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth' },
     'what the instance actually resolved (env override included) is what it publishes');
 });
 
@@ -70,7 +71,7 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
   // `project` joined the allow-list in task 1003140: the per-project policy is public
   // by nature and is the settings read-back a manage page needs (see clientBranding).
   assert.deepEqual(Object.keys(projected).sort(), ['copy', 'currency', 'identity', 'project', 'rankLabels', 'reward', 'theme']);
-  assert.deepEqual(Object.keys(projected.project).sort(), ['joinability', 'platformVisibility']);
+  assert.deepEqual(Object.keys(projected.project).sort(), ['joinability', 'platformVisibility', 'visibility']);
   for (const leak of ['domains', 'repo', 'db', 'envPrefix', 'llmProjectName']) {
     assert.equal(projected[leak], undefined, `${leak} must not reach the client`);
   }