@bongos/core 1.19.532 → 1.19.534

package/modules/provisioning/routes/provisioning.js

@@ -42,6 +42,7 @@ const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
+const catalogBridge = require('../catalog-bridge');
 const { callbackPage } = require('./callback-page');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
@@ -479,6 +480,12 @@ module.exports = function provisioningRoutes() {
           actor: 'api:self',
         }).catch(() => {});
       }
+      // The project joins the hub catalog the moment it EXISTS, not when (or whether) it
+      // later federates as a co-tenant (task 1003576, ADR 0246). It is dark matter until a
+      // description exists — the publish gate alone decides that — but the row has to be
+      // there for the gate to have anything to decide about, and for the wizard's invite
+      // step to have a project to invite into while standup is still running.
+      await catalogBridge.publishInstanceToCatalog(pool, instance).catch(() => {});
       // A re-request cannot change an existing instance's domain — SAY so instead of
       // silently dropping it (task 1002692); the domain route is the real path.
       let domainIgnored;
@@ -520,14 +527,13 @@ module.exports = function provisioningRoutes() {
           hint: `a re-request never changes an existing instance's project detail — PATCH /provisioning/instances/${instance.id}/detail instead`,
         };
       }
-      // And the same for the picker's module set (task 1002339). Like `type` —
-      // and unlike detail — there is no mutation route yet (R23, task 1002342 is
-      // "add modules later"), so the receipt says the answer was kept rather
-      // than naming a way back that does not exist.
+      // And the same for the picker's module set (task 1002339). Like detail —
+      // and unlike `type` — this one HAS a way back since BV1.R23 (task 1002342),
+      // so the receipt names it instead of leaving the owner to hunt for one.
       let modulesIgnored;
       if (!created && body.modules !== undefined) {
         modulesIgnored = {
-          hint: "a re-request never changes an existing instance's module selection",
+          hint: `a re-request never changes an existing instance's module selection — PATCH /provisioning/instances/${instance.id}/detail with { modules } instead`,
         };
       }
       res.status(created ? 201 : 200).json({
@@ -653,9 +659,9 @@ module.exports = function provisioningRoutes() {
 
   // ── The optional project detail (task 1002334, goal 1000046) ──────────────
   // PATCH /provisioning/instances/:id/detail — answer (or re-answer) the
-  // "tell us about your project" step after creation. Body: any subset of
-  // { description, detail }. rank: any authenticated builder (own resource;
-  // archon may change any — same gate as settings).
+  // wizard's OPTIONAL creation steps after creation. Body: any subset of
+  // { description, detail, modules }. rank: any authenticated builder (own
+  // resource; archon may change any — same gate as settings).
   //
   // THIS ROUTE IS WHAT MAKES THE STEP SKIPPABLE. Skipping at creation leaves the
   // project dark-matter — off the map and un-joinable (ADR 0182 D4) — and that is
@@ -668,19 +674,31 @@ module.exports = function provisioningRoutes() {
   // answers live on the platform row until a catalog row materializes (the
   // provisioning_007 `type` precedent), and R16 (task 1002335) is the surface that
   // reads `description` to compute publishability and name what is still missing.
+  //
+  // `modules` rides the SAME route for the same reason (BV1.R23, task 1002342,
+  // ADR 0245): step 4 of the wizard is skippable exactly as step 3 is, so it needs
+  // the same way back, and it lands on the same platform row under the same
+  // ownership gate. Only an ARRAY is a change — an omitted or null key leaves the
+  // column alone, so the "never asked" NULL (ADR 0240 §2) can never be written by
+  // a later edit. The always-on core stays unremovable by construction:
+  // badModuleSelection refuses its keys and `effectiveModules` re-adds it on read.
   router.patch('/provisioning/instances/:id/detail', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, {
       description: { type: 'string', maxLength: provisioning.DESCRIPTION_MAX },
       detail: { type: 'object' },
+      modules: { type: 'array', itemsType: 'string', maxItems: 50 },
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
     if (detailFault) return res.fail(detailFault.code, { status: 400, message: detailFault.message });
-    if (body.description === undefined && body.detail === undefined) {
+    const modulesFault = badModuleSelection(body.modules);
+    if (modulesFault) return res.fail(modulesFault.code, { status: 400, message: modulesFault.message });
+    const wantsModules = Array.isArray(body.modules);
+    if (body.description === undefined && body.detail === undefined && !wantsModules) {
       return res.fail('bad_detail', { status: 400,
-        message: 'The body carries nothing to change — send description, detail, or both.' });
+        message: 'The body carries nothing to change — send description, detail, modules, or any mix.' });
     }
     try {
       const inst = await provisioning.getInstanceById(pool, id);
@@ -692,12 +710,18 @@ module.exports = function provisioningRoutes() {
       const patch = {};
       if (body.description !== undefined) patch.description = provisioning.normalizeDescription(body.description);
       if (body.detail !== undefined) patch.detail = body.detail;
+      if (wantsModules) patch.modules = body.modules;
       const updated = await provisioning.updateInstanceDetail(pool, id, patch);
       await provisioning.recordEvent(pool, {
         instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'detail',
         detail: `project detail changed: ${Object.keys(patch).join(', ')}`,
         actor,
       }).catch(() => {});
+      // Re-take the catalog projection (task 1003576, ADR 0246) — this is THE write the
+      // R18 proof caught going nowhere. A description added here has to reach the map, and
+      // one CLEARED here has to leave it, which is why the hub assigns `description`
+      // rather than COALESCEing it.
+      await catalogBridge.publishInstanceToCatalog(pool, updated).catch(() => {});
       res.json({
         ok: true,
         description: updated.description || null,
@@ -809,6 +833,11 @@ module.exports = function provisioningRoutes() {
           detail: `settings changed: ${Object.entries(patch).map(([k, v]) => `${k}=${v}`).join(', ')}`,
           actor,
         }).catch(() => {});
+        // The door the owner just set is what the map draws this project's orb from
+        // (planet / star / black hole), so the catalog projection is re-taken here as well
+        // as on the detail write (task 1003576, ADR 0246). Unlike the push below this
+        // needs no restart and no reachable shape — it is the PLATFORM's own row.
+        await catalogBridge.publishInstanceToCatalog(pool, updated).catch(() => {});
       }
       // The push (task 1003140). The row is now the platform's truth, but a
       // RUNNING instance reads its settings from web.env through a pack memoized
@@ -1054,7 +1083,12 @@ module.exports = function provisioningRoutes() {
       // Record BEFORE enqueueing: the runner reads the row's domain, so the intent
       // must never race ahead of the column it wires. The release queue rides the
       // SAME statement — see updateInstanceDomain.
-      await provisioning.updateInstanceDomain(pool, id, domain, releasing);
+      const rewired = await provisioning.updateInstanceDomain(pool, id, domain, releasing);
+      // The catalog is keyed on ORIGIN, so an address change moves the project's row (task
+      // 1003576, ADR 0246). `retireOrigin` takes the abandoned one off the map in the same
+      // call — a row left `active` at a hostname the project no longer answers on is the
+      // ADR 0181 §2 leak, in the catalog instead of in DNS.
+      await catalogBridge.publishInstanceToCatalog(pool, rewired, { retireOrigin: current }).catch(() => {});
       let queued = false;
       if (inst.status === 'active') {
         const { intent, created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');

package/modules/provisioning/tests/provisioning.mjs

@@ -263,24 +263,27 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
-    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted' } }),
-    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public' },
+    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted', join_grant: 'everything' } }),
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'a non-object settings value reads as defaults');
   // the join door reads back like any other policy key (task 1002324)
   assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth' }, 'a stored door overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full' }, 'a stored door overlays only itself');
+  // what a public join grants is a policy key like any other (task 1002331)
+  assert.deepEqual(P.effectiveSettings({ settings: { join_grant: 'view' } }),
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view' }, 'the grant overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {

package/modules/public-landing/public/assets/cosmos.css

@@ -1368,6 +1368,21 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-manage .visOpt:has(input:checked) b::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
 #view-manage .visOpt:focus-within{outline:2px solid var(--accent);outline-offset:3px;}
 #view-manage #mVisRuns b,#view-manage #mJoinRuns b{color:var(--ok);font-weight:500;}
+/* the project's extras (task 1002342): the creation picker's own band, asked
+   again after the project exists. Stacked full width rather than side by side
+   like the choice bands above, because each row carries a sentence saying what
+   the part is for — and because these are independent facts, not one choice. */
+#view-manage .modBand{display:grid;border-top:1px solid var(--rule);border-bottom:1px solid var(--rule);}
+#view-manage .modOpt{display:grid;grid-template-columns:auto 1fr;gap:2px 10px;margin:0;padding:16px 0 18px;border:0;border-top:1px solid var(--rule-soft);border-radius:0;background:none;text-align:left;cursor:pointer;}
+#view-manage .modOpt:first-child{border-top:0;}
+#view-manage .modOpt::before{content:"";grid-column:1;grid-row:1;width:7px;height:7px;margin-top:6px;border-radius:50%;border:1px solid var(--rule);background:var(--bg);}
+#view-manage .modOpt>b,#view-manage .modOpt>small{grid-column:2;min-width:0;}
+#view-manage .modOpt[aria-pressed="true"]::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+#view-manage .modOpt b{font-family:var(--font-body);font-weight:500;font-size:15px;color:var(--ink);}
+#view-manage .modOpt small{font-family:var(--font-body);font-size:13px;font-weight:400;line-height:1.45;color:var(--ink-faint);max-width:62ch;}
+#view-manage .modOpt:hover::before{border-color:var(--ink-faint);}
+#view-manage .modOpt[disabled]{cursor:default;opacity:.55;}
+#view-manage .modOpt:focus-visible{outline:2px solid var(--accent);outline-offset:3px;}
 /* ── its planet (task 1003347; direction record §16, v1 the bands): the preview
    planet left; four bands right — shape · material · style as hairline cells of
    one band, a word each, the chosen one carrying the dot; the colour as five

package/modules/public-landing/public/projects.html

@@ -829,6 +829,26 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- live since task 1002342 (BV1.R23): the way back into the creation
+           wizard's module picker. Step 4 of the wizard is skippable, and an
+           optional step is a default rather than a dead end only if there is a
+           way back — the same argument the About step's PATCH …/detail was built
+           on, which is why this section saves through THAT route and not the
+           settings channel beside it: a module set is a declaration on the
+           platform row, not a policy a running instance obeys (ADR 0240 §3,
+           ADR 0245). So, unlike its three siblings above, nothing is pushed to
+           the project and nothing restarts — and there is no "what your project
+           runs" read-back line, because there is nothing to read back. The fold
+           is a SIBLING of the volatile slot so no re-render can drop it. -->
+      <div class="card mSec" id="mModules">
+        <h2>Its extras</h2>
+        <div id="mMods"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mModsWhat">
+          <summary>What an extra is — and what is always on</summary>
+          <p>Extras are the optional parts a project can run — a shared dev box, a Discord mirror, and the rest. You picked a set when you created the project, or took the suggested set by skipping that step; this is where you change your mind. Switching one on or off saves straight away and changes nothing that is already running: nothing restarts, and no work is lost either way. The parts every project runs — the platform itself, the way it tracks work, the builders’ hall — were never part of the choice, so they are not listed here and cannot be switched off.</p>
+        </details>
+      </div>
+
       <!-- the planet picker (task 1003347; direction record §16, v1 the bands): the
            owner's own choice of how the platform draws this project — the sky,
            the list, this page's head and the card read the same row. The pick is
@@ -1028,6 +1048,14 @@ summary{min-height:24px;padding:3px 0;}
             <p class="lede">Optional — skip it and you get the suggested set below, shaped by what you just told us. These are extras on top of everything every project already has, and you can switch any of them on or off later.</p>
             <form data-next="5">
               <div class="wizField"><span id="modLbl">Extras for this project</span>
+                <!-- the catalog search (task 1002340, BV1.R21). The wizard's own
+                     search idiom (#ghSearch): a plain field on one hairline, no
+                     new class and no icon. It filters the band below and NOTHING
+                     else — what is switched on is unaffected by what is on
+                     screen, and the line under it counts the ones it is hiding
+                     (ADR 0245). -->
+                <input type="text" id="modQ" placeholder="Search extras…" autocomplete="off" aria-label="Search the extras by name" aria-describedby="modFilterNote">
+                <div class="hint" id="modFilterNote" aria-live="polite"></div>
                 <div class="typeCards" id="modCards" role="group" aria-labelledby="modLbl"></div>
               </div>
               <div class="modWhy" id="modWhy" aria-live="polite"></div>
@@ -1177,6 +1205,9 @@ summary{min-height:24px;padding:3px 0;}
             <div id="liveProgress" role="status" aria-live="polite"></div>
             <h2 class="stepsHead">Your steps — the parts only you can play</h2>
             <ol class="humanSteps" id="humanSteps"></ol>
+            <!-- the modules step was optional (task 1002342, BV1.R23) — one line
+                 saying where it lives afterwards, so a skip is never a dead end -->
+            <p class="samePath" id="doneModules"></p>
             <p class="samePath">These are the same steps however a project is created — nothing here is special to this page.</p>
           </section>
         </div>
@@ -3262,10 +3293,52 @@ summary{min-height:24px;padding:3px 0;}
       for (var i = 0; i < rows.length; i++) if (rows[i].key === key) return rows[i].label;
       return key;
     }
+    /* ── the catalog search (task 1002340, BV1.R21) ──
+       Lexical and deliberately dumb: it matches the words the owner can already
+       see. Search by MEANING ("somewhere to chat") is a different feature and is
+       deferred (idea 1000552), so nothing here pretends to understand a query.
+
+       It is a VIEW over the rows and never an edit to the answer (ADR 0245):
+       filtering paints fewer rows, and state.modules does not move. That is what
+       lets a switched-on module be off screen without being switched off — the
+       count under the field says so rather than leaving it to be discovered. */
+    var moduleQuery = '';   /* what is typed in the search box; never saved to the draft */
+    /* A query as the terms to match: lower-cased, split on whitespace, empties
+       dropped — so a box holding only spaces is the same as an empty one. */
+    function searchTerms(q) {
+      return String(q == null ? '' : q).toLowerCase().split(/\s+/).filter(function (t) { return t.length > 0; });
+    }
+    /* Does one catalog row answer this search? Every term must appear somewhere in
+       the row's own words — its name, its one-line summary, or its key — as a
+       substring, case-insensitively. AND across terms, so adding a word narrows;
+       substring, so a half-typed word still finds its module. */
+    function moduleMatches(mod, terms) {
+      if (!terms.length) return true;
+      var hay = (((mod && mod.label) || '') + ' ' + ((mod && mod.summary) || '') + ' ' + ((mod && mod.key) || '')).toLowerCase();
+      for (var i = 0; i < terms.length; i++) if (hay.indexOf(terms[i]) === -1) return false;
+      return true;
+    }
+    /* The catalog rows the current search leaves on screen, in catalog order. */
+    function visibleModules() {
+      var terms = searchTerms(moduleQuery);
+      return ((starterBundles && starterBundles.optional) || []).filter(function (m) { return moduleMatches(m, terms); });
+    }
+    /* The line under the search box. Silent with nothing typed — there is nothing
+       to explain. Once a search is hiding rows it says how many are left AND how
+       many extras are on, counting the hidden ones: a switched-on module a filter
+       took off screen would otherwise read as switched off. */
+    function filterNote(shown, total, onCount) {
+      if (!searchTerms(moduleQuery).length) return '';
+      var line = shown ? 'Showing ' + shown + ' of ' + total + '.' : 'No extras match what you typed.';
+      return onCount
+        ? line + ' ' + onCount + (onCount === 1 ? ' extra is' : ' extras are') + ' switched on, including any this search is hiding.'
+        : line;
+    }
     function renderModules() {
       ensureBundles();
       var band = $('modCards');
       var note = $('modCoreNote');
+      $('modQ').hidden = !starterBundles;   /* a search box over a list that is not there can only disappoint */
       if (!starterBundles) {
         /* nothing yet. While the read is still in flight that is a blank band for
            a moment; only a read that ANSWERED badly gets the clause, so a slow
@@ -3273,6 +3346,7 @@ summary{min-height:24px;padding:3px 0;}
         band.innerHTML = '';
         $('modWhy').innerHTML = '';
         $('modWhy').classList.remove('on');
+        $('modFilterNote').textContent = '';
         note.textContent = bundlesFailed
           ? 'We couldn’t load the list of extras just now. Your project is created with everything it needs either way, and you can add extras from its settings.'
           : '';
@@ -3280,11 +3354,13 @@ summary{min-height:24px;padding:3px 0;}
         return;
       }
       var on = pickedModules();
-      band.innerHTML = (starterBundles.optional || []).map(function (m) {
+      var offered = visibleModules();
+      band.innerHTML = offered.map(function (m) {
         return '<button type="button" class="tpill" data-mod="' + esc(m.key) + '" aria-pressed="'
           + (on.indexOf(m.key) === -1 ? 'false' : 'true') + '"><span><b>' + esc(m.label)
           + '</b><small>' + esc(m.summary) + '</small></span></button>';
       }).join('');
+      $('modFilterNote').textContent = filterNote(offered.length, (starterBundles.optional || []).length, on.length);
       /* The tailoring, said out loud (task 1002341). A preselect an owner cannot
          see the reason for is one they have to audit, which is the thing ADR 0237
          says is worse than no preselect at all. Rendered as its own block above the
@@ -3317,6 +3393,13 @@ summary{min-height:24px;padding:3px 0;}
       renderModules();
       saveDraft();
     });
+    /* Typing repaints the band and nothing else (task 1002340): no read (the
+       catalog is already here) and no saveDraft — a search is not an answer, so
+       it must not be able to turn an untouched picker into an answered one. */
+    $('modQ').addEventListener('input', function (ev) {
+      moduleQuery = (ev && ev.target && ev.target.value) || '';
+      renderModules();
+    });
     /* Next off this panel CONFIRMS what is on screen — the owner looked at the
        set and accepted it, which is a different fact from never being asked. */
     root.querySelector('#panel-modules form').addEventListener('submit', function () {
@@ -4011,6 +4094,10 @@ summary{min-height:24px;padding:3px 0;}
       $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
         (adopt ? ' — adopting your existing repo' : '') +
         '. The platform stands up the server, database, and address on its own — watch it right here, or any time on <a href="?view=mine">your projects page</a>.';
+      /* the picker's later half (task 1002342, BV1.R23). The modules step is
+         skippable, so this panel names where it lives afterwards rather than
+         leaving an owner to go looking for it. */
+      $('doneModules').innerHTML = 'Add or remove modules later in ' + projectPageLink('the project’s settings') + '.';
       renderSteps();
     }
 
@@ -4024,7 +4111,14 @@ summary{min-height:24px;padding:3px 0;}
       var a = ev.target.closest && ev.target.closest('a[href^="?view="]');
       if (!a || !root.contains(a)) return;
       ev.preventDefault();
-      setView((a.getAttribute('href').match(/view=(\w+)/) || [])[1], true);
+      var href = a.getAttribute('href');
+      var to = (href.match(/view=(\w+)/) || [])[1];
+      /* a manage link names its project in the query, and setView reads manageId
+         rather than the href — so the id has to be handed over or every link on
+         this panel lands on a manage page with no project (task 1002342) */
+      var mid = (href.match(/[?&]id=([^&]*)/) || [])[1];
+      if (to === 'manage' && mid) return goToManage(decodeURIComponent(mid));
+      setView(to, true);
     });
 
     /* One delegated listener — renderSteps swaps innerHTML, so handlers live on the list. */
@@ -5439,6 +5533,9 @@ summary{min-height:24px;padding:3px 0;}
            guard because its card holds a textarea the in-flight tick must
            never repaint out from under a typing owner. */
         if (!keepRepo) renderPublish(inst);
+        /* the extras band (task 1002342) rides the same guard: its own toggles
+           are the only thing that should ever repaint it, never the tick */
+        if (!keepRepo) renderMods(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -6219,6 +6316,128 @@ summary{min-height:24px;padding:3px 0;}
     if (t && t.hasAttribute('data-join-save')) doJoinSave();
   });
 
+  /* ── the project's extras (task 1002342, BV1.R23) ──
+     The way back into the creation wizard's module picker. Step 4 is skippable,
+     and an optional step is a default rather than a dead end only if there is a
+     way back — the argument PATCH …/detail was built on for the About step
+     beside it, which is why this saves through THAT route rather than the
+     settings channel its three neighbours use: a module set is a declaration on
+     the platform row, not a policy a running instance obeys (ADR 0240 §3, ADR
+     0245). Nothing is pushed and nothing restarts, so this section has no "what
+     your project runs" line — there is nothing to read back.
+
+     Two reads, and only one is new. The CURRENT selection rides in on the
+     instance itself (publicInstance resolves it, so a project that skipped the
+     picker reads as its own starter bundle and this page never re-derives that
+     rule); the CATALOG — what may be chosen, and the owner-facing line for each
+     — is the same public GET /provisioning/starter-bundles the wizard reads.
+
+     A toggle IS the save. The band is a list of independent facts rather than
+     one choice, so a Save button would only add a way to lose one. The write
+     sends the WHOLE list because that is what the column stores, and the band
+     repaints from the server's own answer — never from the list we sent — so it
+     can never show a set the platform did not accept. ── */
+
+  var modsCatalog = null;    /* { core, optional } — the public catalog, read once */
+  var modsPromise = null;
+  var modsFailed = false;    /* asked and did not get it; distinct from not yet asked */
+  var modsBusy = false;      /* a write is in flight — the band is inert until it answers */
+
+  function modsSlot(html) { $('mMods').innerHTML = html; }
+
+  /* Lazy and memoised, the wizard picker's rule: /projects serves four views
+     from one file and the map has no business paying for this read. */
+  function ensureModsCatalog() {
+    if (modsPromise) return modsPromise;
+    modsPromise = fetch(API + '/provisioning/starter-bundles', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (data) {
+        if (data && data.optional) modsCatalog = data; else modsFailed = true;
+        if (manageInst) renderMods(manageInst);
+      })
+      .catch(function () { modsFailed = true; if (manageInst) renderMods(manageInst); });
+    return modsPromise;
+  }
+
+  /* What this project runs today, straight off the instance read — never
+     re-derived here, or a skipped picker would read differently on two pages. */
+  function modsSelected(inst) {
+    return ((inst && inst.modules && inst.modules.selected) || []).slice();
+  }
+
+  function renderMods(inst) {
+    ensureModsCatalog();
+    if (!modsCatalog) {
+      /* a read still in flight is a quiet slot; only one that ANSWERED badly
+         gets the clause, so a slow network never reports a break that isn't */
+      modsSlot(modsFailed
+        ? '<p class="finePrint">We couldn’t load the list of extras just now — refresh in a moment. Nothing about your project has changed.</p>'
+        : '<p class="finePrint">Reading the project…</p>');
+      return;
+    }
+    var on = modsSelected(inst);
+    var core = (modsCatalog.core || []).length;
+    modsSlot('<div class="modBand" id="mModBand" role="group" aria-label="Extras">' +
+      (modsCatalog.optional || []).map(function (m) {
+        return '<button type="button" class="modOpt" data-mod="' + esc(m.key) + '" aria-pressed="' +
+          (on.indexOf(m.key) === -1 ? 'false' : 'true') + '"' + (modsBusy ? ' disabled' : '') +
+          '><b>' + esc(m.label) + '</b><small>' + esc(m.summary) + '</small></button>';
+      }).join('') + '</div>' +
+      (core ? '<p class="finePrint">Every project also starts with the same ' + core +
+        ' core parts — the platform itself, the way it tracks work, and the builders’ hall. They are always on, so they are not part of this choice.</p>' : '') +
+      '<div class="projMsg" id="mModMsg" role="status" aria-live="polite"></div>');
+  }
+
+  /* One toggle, sent as the whole list: the column stores a list, so a delta
+     would have to be re-assembled somewhere and the two copies would drift. */
+  function doModToggle(key) {
+    if (!manageInst || !modsCatalog || modsBusy) return;
+    var on = modsSelected(manageInst);
+    var want = on.indexOf(key) === -1 ? on.concat([key]) : on.filter(function (k) { return k !== key; });
+    /* CATALOG order — the order the picker paints and the server stores, so a
+       re-read of what we just wrote can never look like a change */
+    var next = (modsCatalog.optional || []).map(function (m) { return m.key; })
+      .filter(function (k) { return want.indexOf(k) !== -1; });
+    modsBusy = true;
+    renderMods(manageInst);
+    var box = $('mModMsg');
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/detail', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ modules: next })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        modsBusy = false;
+        if (res.ok) {
+          /* the platform's own answer, never the list we sent */
+          manageInst.modules = data.modules || manageInst.modules;
+          renderMods(manageInst);
+          var ok = $('mModMsg');
+          ok.className = 'projMsg ok';
+          ok.textContent = 'Saved. Nothing on the project itself changes — there is nothing to restart.';
+          return;
+        }
+        renderMods(manageInst);   /* the band goes back to what the row still says */
+        var e = apiError(data, res.status);
+        var m = $('mModMsg');
+        if (res.status === 401) { m.className = 'projMsg err'; m.innerHTML = signInAgain(); return; }
+        m.className = 'projMsg err';
+        m.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      modsBusy = false;
+      renderMods(manageInst);
+      var m = $('mModMsg');
+      m.className = 'projMsg err';
+      m.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    });
+  }
+
+  $('mMods').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('.modOpt[data-mod]');
+    if (t && !t.disabled) doModToggle(t.getAttribute('data-mod'));
+  });
+
   /* ── on the map (task 1002324): the join door, ADR 0182 D1 — the third axis,
      beside "who can see it" (the project's own sign-in door) and "how people
      join" (its membership door). The two reads above, key for key: the CHOICE

package/modules/public-landing/public/projects.states.json

@@ -30,7 +30,8 @@
     "out-new": { "auth": false, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "in-new-type": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-type"],"hidden":["#panel-name","#qWrap"]} },
     "in-new-about": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-detail"],"hidden":["#panel-type","#qWrap"]} },
-    "in-new-modules": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900]], "expect": {"visible":["#panel-modules","#modCards .tpill[aria-pressed=\"true\"]","#modCoreNote"],"hidden":["#panel-detail","#qWrap"]} },
+    "in-new-modules": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900]], "expect": {"visible":["#panel-modules","#modQ","#modCards .tpill[aria-pressed=\"true\"]","#modCoreNote"],"hidden":["#panel-detail","#qWrap"]} },
+    "in-new-modules-search": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["fill","#modQ","discord"],["wait",200]], "expect": {"visible":["#panel-modules","#modQ"],"value":[["#modQ","discord"]],"count":[["#modCards .tpill",1],["#modCards .tpill[data-mod=\"discord\"]",1]],"text":[["#modFilterNote","Showing 1 of 3. 2 extras are switched on, including any this search is hiding."]]} },
     "in-new-home": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-home"],"hidden":["#panel-detail","#qWrap"]} },
     "in-new-address": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-address"],"hidden":["#panel-home","#qWrap"]} },
     "in-new-review": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-review","#reviewList li"],"hidden":["#panel-address","#qWrap"]} },

package/modules/ui-design/kit/serve.js

@@ -187,6 +187,7 @@ const STUB_VOCAB = {
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
   visibility: ['public', 'private', 'stealth'],
+  join_grant: ['view', 'apply', 'full'],
   planet_template: null,   // the template set is long; shape is checked, not membership
   planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
   card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.532",
+  "version": "1.19.534",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.532",
+      "version": "1.19.534",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.532",
+  "version": "1.19.534",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -529,6 +529,15 @@ const KERNEL_FILES = [
   // KERNEL (already in the module-scope-map kernel key) and imports only the
   // kernel (instance-config) + node built-ins, so it joins the roster cleanly.
   'src/bongos/repo-info.js',
+  // task 1002331 (ADR 0182 D6 / ADR 0247): the project's composed join/apply door —
+  // a deterministic classifier over three policy values, the same category as
+  // route-rank-check.js and goal-scope-check.js above (a trust decision the doorway
+  // hands to modules so no module re-derives it). The doorway re-exports it, so
+  // leaving it off this roster reads as a kernel->non-kernel leak; it imports only
+  // branding.js and auth-admission.js — both on this roster — so joining costs
+  // nothing and buys the import-direction guarantee on the file that decides who
+  // may knock.
+  'src/bongos/project-door.js',
 ];
 
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a

package/scripts/gds/provision-net.js

@@ -22,6 +22,13 @@ function federationHubOrigin() {
 }
 
 // Whether provisioning should federate this instance's sign-in through the hub.
+//
+// THIS GATE DECIDES A CREDENTIAL, NOT CATALOG MEMBERSHIP (task 1003576, ADR 0246). It used
+// to decide both by accident — federateInstance was the only writer of the hub catalog — so
+// a `standalone` project could never appear on the public map. That hop now runs at every
+// provisioning write (modules/provisioning/catalog-bridge.js → the `project.catalog` port),
+// for every hosting shape. What survives here is the narrow question this gate is actually
+// about: whose web.env does the platform write, and therefore who can hold a client secret.
 // Dormant-by-default: true ONLY when the control plane is hub-configured (the
 // platform-identity module is present, a signing key is loadable, AND a hub origin
 // resolves), the instance is a CO-TENANT (the mothership-hosted shape whose web.env is