@bongos/core 1.19.533 → 1.19.534

package/modules/provisioning/routes/provisioning.js

@@ -42,6 +42,7 @@ const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
+const catalogBridge = require('../catalog-bridge');
 const { callbackPage } = require('./callback-page');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
@@ -479,6 +480,12 @@ module.exports = function provisioningRoutes() {
           actor: 'api:self',
         }).catch(() => {});
       }
+      // The project joins the hub catalog the moment it EXISTS, not when (or whether) it
+      // later federates as a co-tenant (task 1003576, ADR 0246). It is dark matter until a
+      // description exists — the publish gate alone decides that — but the row has to be
+      // there for the gate to have anything to decide about, and for the wizard's invite
+      // step to have a project to invite into while standup is still running.
+      await catalogBridge.publishInstanceToCatalog(pool, instance).catch(() => {});
       // A re-request cannot change an existing instance's domain — SAY so instead of
       // silently dropping it (task 1002692); the domain route is the real path.
       let domainIgnored;
@@ -520,14 +527,13 @@ module.exports = function provisioningRoutes() {
           hint: `a re-request never changes an existing instance's project detail — PATCH /provisioning/instances/${instance.id}/detail instead`,
         };
       }
-      // And the same for the picker's module set (task 1002339). Like `type` —
-      // and unlike detail — there is no mutation route yet (R23, task 1002342 is
-      // "add modules later"), so the receipt says the answer was kept rather
-      // than naming a way back that does not exist.
+      // And the same for the picker's module set (task 1002339). Like detail —
+      // and unlike `type` — this one HAS a way back since BV1.R23 (task 1002342),
+      // so the receipt names it instead of leaving the owner to hunt for one.
       let modulesIgnored;
       if (!created && body.modules !== undefined) {
         modulesIgnored = {
-          hint: "a re-request never changes an existing instance's module selection",
+          hint: `a re-request never changes an existing instance's module selection — PATCH /provisioning/instances/${instance.id}/detail with { modules } instead`,
         };
       }
       res.status(created ? 201 : 200).json({
@@ -653,9 +659,9 @@ module.exports = function provisioningRoutes() {
 
   // ── The optional project detail (task 1002334, goal 1000046) ──────────────
   // PATCH /provisioning/instances/:id/detail — answer (or re-answer) the
-  // "tell us about your project" step after creation. Body: any subset of
-  // { description, detail }. rank: any authenticated builder (own resource;
-  // archon may change any — same gate as settings).
+  // wizard's OPTIONAL creation steps after creation. Body: any subset of
+  // { description, detail, modules }. rank: any authenticated builder (own
+  // resource; archon may change any — same gate as settings).
   //
   // THIS ROUTE IS WHAT MAKES THE STEP SKIPPABLE. Skipping at creation leaves the
   // project dark-matter — off the map and un-joinable (ADR 0182 D4) — and that is
@@ -668,19 +674,31 @@ module.exports = function provisioningRoutes() {
   // answers live on the platform row until a catalog row materializes (the
   // provisioning_007 `type` precedent), and R16 (task 1002335) is the surface that
   // reads `description` to compute publishability and name what is still missing.
+  //
+  // `modules` rides the SAME route for the same reason (BV1.R23, task 1002342,
+  // ADR 0245): step 4 of the wizard is skippable exactly as step 3 is, so it needs
+  // the same way back, and it lands on the same platform row under the same
+  // ownership gate. Only an ARRAY is a change — an omitted or null key leaves the
+  // column alone, so the "never asked" NULL (ADR 0240 §2) can never be written by
+  // a later edit. The always-on core stays unremovable by construction:
+  // badModuleSelection refuses its keys and `effectiveModules` re-adds it on read.
   router.patch('/provisioning/instances/:id/detail', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, {
       description: { type: 'string', maxLength: provisioning.DESCRIPTION_MAX },
       detail: { type: 'object' },
+      modules: { type: 'array', itemsType: 'string', maxItems: 50 },
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
     if (detailFault) return res.fail(detailFault.code, { status: 400, message: detailFault.message });
-    if (body.description === undefined && body.detail === undefined) {
+    const modulesFault = badModuleSelection(body.modules);
+    if (modulesFault) return res.fail(modulesFault.code, { status: 400, message: modulesFault.message });
+    const wantsModules = Array.isArray(body.modules);
+    if (body.description === undefined && body.detail === undefined && !wantsModules) {
       return res.fail('bad_detail', { status: 400,
-        message: 'The body carries nothing to change — send description, detail, or both.' });
+        message: 'The body carries nothing to change — send description, detail, modules, or any mix.' });
     }
     try {
       const inst = await provisioning.getInstanceById(pool, id);
@@ -692,12 +710,18 @@ module.exports = function provisioningRoutes() {
       const patch = {};
       if (body.description !== undefined) patch.description = provisioning.normalizeDescription(body.description);
       if (body.detail !== undefined) patch.detail = body.detail;
+      if (wantsModules) patch.modules = body.modules;
       const updated = await provisioning.updateInstanceDetail(pool, id, patch);
       await provisioning.recordEvent(pool, {
         instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'detail',
         detail: `project detail changed: ${Object.keys(patch).join(', ')}`,
         actor,
       }).catch(() => {});
+      // Re-take the catalog projection (task 1003576, ADR 0246) — this is THE write the
+      // R18 proof caught going nowhere. A description added here has to reach the map, and
+      // one CLEARED here has to leave it, which is why the hub assigns `description`
+      // rather than COALESCEing it.
+      await catalogBridge.publishInstanceToCatalog(pool, updated).catch(() => {});
       res.json({
         ok: true,
         description: updated.description || null,
@@ -809,6 +833,11 @@ module.exports = function provisioningRoutes() {
           detail: `settings changed: ${Object.entries(patch).map(([k, v]) => `${k}=${v}`).join(', ')}`,
           actor,
         }).catch(() => {});
+        // The door the owner just set is what the map draws this project's orb from
+        // (planet / star / black hole), so the catalog projection is re-taken here as well
+        // as on the detail write (task 1003576, ADR 0246). Unlike the push below this
+        // needs no restart and no reachable shape — it is the PLATFORM's own row.
+        await catalogBridge.publishInstanceToCatalog(pool, updated).catch(() => {});
       }
       // The push (task 1003140). The row is now the platform's truth, but a
       // RUNNING instance reads its settings from web.env through a pack memoized
@@ -1054,7 +1083,12 @@ module.exports = function provisioningRoutes() {
       // Record BEFORE enqueueing: the runner reads the row's domain, so the intent
       // must never race ahead of the column it wires. The release queue rides the
       // SAME statement — see updateInstanceDomain.
-      await provisioning.updateInstanceDomain(pool, id, domain, releasing);
+      const rewired = await provisioning.updateInstanceDomain(pool, id, domain, releasing);
+      // The catalog is keyed on ORIGIN, so an address change moves the project's row (task
+      // 1003576, ADR 0246). `retireOrigin` takes the abandoned one off the map in the same
+      // call — a row left `active` at a hostname the project no longer answers on is the
+      // ADR 0181 §2 leak, in the catalog instead of in DNS.
+      await catalogBridge.publishInstanceToCatalog(pool, rewired, { retireOrigin: current }).catch(() => {});
       let queued = false;
       if (inst.status === 'active') {
         const { intent, created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');

package/modules/provisioning/tests/provisioning.mjs

@@ -263,24 +263,27 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
-    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted' } }),
-    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public' },
+    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted', join_grant: 'everything' } }),
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'a non-object settings value reads as defaults');
   // the join door reads back like any other policy key (task 1002324)
   assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth' }, 'a stored door overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full' }, 'a stored door overlays only itself');
+  // what a public join grants is a policy key like any other (task 1002331)
+  assert.deepEqual(P.effectiveSettings({ settings: { join_grant: 'view' } }),
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view' }, 'the grant overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {

package/modules/public-landing/public/assets/cosmos.css

@@ -1368,6 +1368,21 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-manage .visOpt:has(input:checked) b::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
 #view-manage .visOpt:focus-within{outline:2px solid var(--accent);outline-offset:3px;}
 #view-manage #mVisRuns b,#view-manage #mJoinRuns b{color:var(--ok);font-weight:500;}
+/* the project's extras (task 1002342): the creation picker's own band, asked
+   again after the project exists. Stacked full width rather than side by side
+   like the choice bands above, because each row carries a sentence saying what
+   the part is for — and because these are independent facts, not one choice. */
+#view-manage .modBand{display:grid;border-top:1px solid var(--rule);border-bottom:1px solid var(--rule);}
+#view-manage .modOpt{display:grid;grid-template-columns:auto 1fr;gap:2px 10px;margin:0;padding:16px 0 18px;border:0;border-top:1px solid var(--rule-soft);border-radius:0;background:none;text-align:left;cursor:pointer;}
+#view-manage .modOpt:first-child{border-top:0;}
+#view-manage .modOpt::before{content:"";grid-column:1;grid-row:1;width:7px;height:7px;margin-top:6px;border-radius:50%;border:1px solid var(--rule);background:var(--bg);}
+#view-manage .modOpt>b,#view-manage .modOpt>small{grid-column:2;min-width:0;}
+#view-manage .modOpt[aria-pressed="true"]::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+#view-manage .modOpt b{font-family:var(--font-body);font-weight:500;font-size:15px;color:var(--ink);}
+#view-manage .modOpt small{font-family:var(--font-body);font-size:13px;font-weight:400;line-height:1.45;color:var(--ink-faint);max-width:62ch;}
+#view-manage .modOpt:hover::before{border-color:var(--ink-faint);}
+#view-manage .modOpt[disabled]{cursor:default;opacity:.55;}
+#view-manage .modOpt:focus-visible{outline:2px solid var(--accent);outline-offset:3px;}
 /* ── its planet (task 1003347; direction record §16, v1 the bands): the preview
    planet left; four bands right — shape · material · style as hairline cells of
    one band, a word each, the chosen one carrying the dot; the colour as five

package/modules/public-landing/public/projects.html

@@ -829,6 +829,26 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- live since task 1002342 (BV1.R23): the way back into the creation
+           wizard's module picker. Step 4 of the wizard is skippable, and an
+           optional step is a default rather than a dead end only if there is a
+           way back — the same argument the About step's PATCH …/detail was built
+           on, which is why this section saves through THAT route and not the
+           settings channel beside it: a module set is a declaration on the
+           platform row, not a policy a running instance obeys (ADR 0240 §3,
+           ADR 0245). So, unlike its three siblings above, nothing is pushed to
+           the project and nothing restarts — and there is no "what your project
+           runs" read-back line, because there is nothing to read back. The fold
+           is a SIBLING of the volatile slot so no re-render can drop it. -->
+      <div class="card mSec" id="mModules">
+        <h2>Its extras</h2>
+        <div id="mMods"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mModsWhat">
+          <summary>What an extra is — and what is always on</summary>
+          <p>Extras are the optional parts a project can run — a shared dev box, a Discord mirror, and the rest. You picked a set when you created the project, or took the suggested set by skipping that step; this is where you change your mind. Switching one on or off saves straight away and changes nothing that is already running: nothing restarts, and no work is lost either way. The parts every project runs — the platform itself, the way it tracks work, the builders’ hall — were never part of the choice, so they are not listed here and cannot be switched off.</p>
+        </details>
+      </div>
+
       <!-- the planet picker (task 1003347; direction record §16, v1 the bands): the
            owner's own choice of how the platform draws this project — the sky,
            the list, this page's head and the card read the same row. The pick is
@@ -1033,7 +1053,7 @@ summary{min-height:24px;padding:3px 0;}
                      new class and no icon. It filters the band below and NOTHING
                      else — what is switched on is unaffected by what is on
                      screen, and the line under it counts the ones it is hiding
-                     (ADR 0244). -->
+                     (ADR 0245). -->
                 <input type="text" id="modQ" placeholder="Search extras…" autocomplete="off" aria-label="Search the extras by name" aria-describedby="modFilterNote">
                 <div class="hint" id="modFilterNote" aria-live="polite"></div>
                 <div class="typeCards" id="modCards" role="group" aria-labelledby="modLbl"></div>
@@ -1185,6 +1205,9 @@ summary{min-height:24px;padding:3px 0;}
             <div id="liveProgress" role="status" aria-live="polite"></div>
             <h2 class="stepsHead">Your steps — the parts only you can play</h2>
             <ol class="humanSteps" id="humanSteps"></ol>
+            <!-- the modules step was optional (task 1002342, BV1.R23) — one line
+                 saying where it lives afterwards, so a skip is never a dead end -->
+            <p class="samePath" id="doneModules"></p>
             <p class="samePath">These are the same steps however a project is created — nothing here is special to this page.</p>
           </section>
         </div>
@@ -3275,7 +3298,7 @@ summary{min-height:24px;padding:3px 0;}
        see. Search by MEANING ("somewhere to chat") is a different feature and is
        deferred (idea 1000552), so nothing here pretends to understand a query.
 
-       It is a VIEW over the rows and never an edit to the answer (ADR 0244):
+       It is a VIEW over the rows and never an edit to the answer (ADR 0245):
        filtering paints fewer rows, and state.modules does not move. That is what
        lets a switched-on module be off screen without being switched off — the
        count under the field says so rather than leaving it to be discovered. */
@@ -4071,6 +4094,10 @@ summary{min-height:24px;padding:3px 0;}
       $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
         (adopt ? ' — adopting your existing repo' : '') +
         '. The platform stands up the server, database, and address on its own — watch it right here, or any time on <a href="?view=mine">your projects page</a>.';
+      /* the picker's later half (task 1002342, BV1.R23). The modules step is
+         skippable, so this panel names where it lives afterwards rather than
+         leaving an owner to go looking for it. */
+      $('doneModules').innerHTML = 'Add or remove modules later in ' + projectPageLink('the project’s settings') + '.';
       renderSteps();
     }
 
@@ -4084,7 +4111,14 @@ summary{min-height:24px;padding:3px 0;}
       var a = ev.target.closest && ev.target.closest('a[href^="?view="]');
       if (!a || !root.contains(a)) return;
       ev.preventDefault();
-      setView((a.getAttribute('href').match(/view=(\w+)/) || [])[1], true);
+      var href = a.getAttribute('href');
+      var to = (href.match(/view=(\w+)/) || [])[1];
+      /* a manage link names its project in the query, and setView reads manageId
+         rather than the href — so the id has to be handed over or every link on
+         this panel lands on a manage page with no project (task 1002342) */
+      var mid = (href.match(/[?&]id=([^&]*)/) || [])[1];
+      if (to === 'manage' && mid) return goToManage(decodeURIComponent(mid));
+      setView(to, true);
     });
 
     /* One delegated listener — renderSteps swaps innerHTML, so handlers live on the list. */
@@ -5499,6 +5533,9 @@ summary{min-height:24px;padding:3px 0;}
            guard because its card holds a textarea the in-flight tick must
            never repaint out from under a typing owner. */
         if (!keepRepo) renderPublish(inst);
+        /* the extras band (task 1002342) rides the same guard: its own toggles
+           are the only thing that should ever repaint it, never the tick */
+        if (!keepRepo) renderMods(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -6279,6 +6316,128 @@ summary{min-height:24px;padding:3px 0;}
     if (t && t.hasAttribute('data-join-save')) doJoinSave();
   });
 
+  /* ── the project's extras (task 1002342, BV1.R23) ──
+     The way back into the creation wizard's module picker. Step 4 is skippable,
+     and an optional step is a default rather than a dead end only if there is a
+     way back — the argument PATCH …/detail was built on for the About step
+     beside it, which is why this saves through THAT route rather than the
+     settings channel its three neighbours use: a module set is a declaration on
+     the platform row, not a policy a running instance obeys (ADR 0240 §3, ADR
+     0245). Nothing is pushed and nothing restarts, so this section has no "what
+     your project runs" line — there is nothing to read back.
+
+     Two reads, and only one is new. The CURRENT selection rides in on the
+     instance itself (publicInstance resolves it, so a project that skipped the
+     picker reads as its own starter bundle and this page never re-derives that
+     rule); the CATALOG — what may be chosen, and the owner-facing line for each
+     — is the same public GET /provisioning/starter-bundles the wizard reads.
+
+     A toggle IS the save. The band is a list of independent facts rather than
+     one choice, so a Save button would only add a way to lose one. The write
+     sends the WHOLE list because that is what the column stores, and the band
+     repaints from the server's own answer — never from the list we sent — so it
+     can never show a set the platform did not accept. ── */
+
+  var modsCatalog = null;    /* { core, optional } — the public catalog, read once */
+  var modsPromise = null;
+  var modsFailed = false;    /* asked and did not get it; distinct from not yet asked */
+  var modsBusy = false;      /* a write is in flight — the band is inert until it answers */
+
+  function modsSlot(html) { $('mMods').innerHTML = html; }
+
+  /* Lazy and memoised, the wizard picker's rule: /projects serves four views
+     from one file and the map has no business paying for this read. */
+  function ensureModsCatalog() {
+    if (modsPromise) return modsPromise;
+    modsPromise = fetch(API + '/provisioning/starter-bundles', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (data) {
+        if (data && data.optional) modsCatalog = data; else modsFailed = true;
+        if (manageInst) renderMods(manageInst);
+      })
+      .catch(function () { modsFailed = true; if (manageInst) renderMods(manageInst); });
+    return modsPromise;
+  }
+
+  /* What this project runs today, straight off the instance read — never
+     re-derived here, or a skipped picker would read differently on two pages. */
+  function modsSelected(inst) {
+    return ((inst && inst.modules && inst.modules.selected) || []).slice();
+  }
+
+  function renderMods(inst) {
+    ensureModsCatalog();
+    if (!modsCatalog) {
+      /* a read still in flight is a quiet slot; only one that ANSWERED badly
+         gets the clause, so a slow network never reports a break that isn't */
+      modsSlot(modsFailed
+        ? '<p class="finePrint">We couldn’t load the list of extras just now — refresh in a moment. Nothing about your project has changed.</p>'
+        : '<p class="finePrint">Reading the project…</p>');
+      return;
+    }
+    var on = modsSelected(inst);
+    var core = (modsCatalog.core || []).length;
+    modsSlot('<div class="modBand" id="mModBand" role="group" aria-label="Extras">' +
+      (modsCatalog.optional || []).map(function (m) {
+        return '<button type="button" class="modOpt" data-mod="' + esc(m.key) + '" aria-pressed="' +
+          (on.indexOf(m.key) === -1 ? 'false' : 'true') + '"' + (modsBusy ? ' disabled' : '') +
+          '><b>' + esc(m.label) + '</b><small>' + esc(m.summary) + '</small></button>';
+      }).join('') + '</div>' +
+      (core ? '<p class="finePrint">Every project also starts with the same ' + core +
+        ' core parts — the platform itself, the way it tracks work, and the builders’ hall. They are always on, so they are not part of this choice.</p>' : '') +
+      '<div class="projMsg" id="mModMsg" role="status" aria-live="polite"></div>');
+  }
+
+  /* One toggle, sent as the whole list: the column stores a list, so a delta
+     would have to be re-assembled somewhere and the two copies would drift. */
+  function doModToggle(key) {
+    if (!manageInst || !modsCatalog || modsBusy) return;
+    var on = modsSelected(manageInst);
+    var want = on.indexOf(key) === -1 ? on.concat([key]) : on.filter(function (k) { return k !== key; });
+    /* CATALOG order — the order the picker paints and the server stores, so a
+       re-read of what we just wrote can never look like a change */
+    var next = (modsCatalog.optional || []).map(function (m) { return m.key; })
+      .filter(function (k) { return want.indexOf(k) !== -1; });
+    modsBusy = true;
+    renderMods(manageInst);
+    var box = $('mModMsg');
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/detail', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ modules: next })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        modsBusy = false;
+        if (res.ok) {
+          /* the platform's own answer, never the list we sent */
+          manageInst.modules = data.modules || manageInst.modules;
+          renderMods(manageInst);
+          var ok = $('mModMsg');
+          ok.className = 'projMsg ok';
+          ok.textContent = 'Saved. Nothing on the project itself changes — there is nothing to restart.';
+          return;
+        }
+        renderMods(manageInst);   /* the band goes back to what the row still says */
+        var e = apiError(data, res.status);
+        var m = $('mModMsg');
+        if (res.status === 401) { m.className = 'projMsg err'; m.innerHTML = signInAgain(); return; }
+        m.className = 'projMsg err';
+        m.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      modsBusy = false;
+      renderMods(manageInst);
+      var m = $('mModMsg');
+      m.className = 'projMsg err';
+      m.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    });
+  }
+
+  $('mMods').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('.modOpt[data-mod]');
+    if (t && !t.disabled) doModToggle(t.getAttribute('data-mod'));
+  });
+
   /* ── on the map (task 1002324): the join door, ADR 0182 D1 — the third axis,
      beside "who can see it" (the project's own sign-in door) and "how people
      join" (its membership door). The two reads above, key for key: the CHOICE

package/modules/ui-design/kit/serve.js

@@ -187,6 +187,7 @@ const STUB_VOCAB = {
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
   visibility: ['public', 'private', 'stealth'],
+  join_grant: ['view', 'apply', 'full'],
   planet_template: null,   // the template set is long; shape is checked, not membership
   planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
   card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.533",
+  "version": "1.19.534",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.533",
+      "version": "1.19.534",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.533",
+  "version": "1.19.534",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -529,6 +529,15 @@ const KERNEL_FILES = [
   // KERNEL (already in the module-scope-map kernel key) and imports only the
   // kernel (instance-config) + node built-ins, so it joins the roster cleanly.
   'src/bongos/repo-info.js',
+  // task 1002331 (ADR 0182 D6 / ADR 0247): the project's composed join/apply door —
+  // a deterministic classifier over three policy values, the same category as
+  // route-rank-check.js and goal-scope-check.js above (a trust decision the doorway
+  // hands to modules so no module re-derives it). The doorway re-exports it, so
+  // leaving it off this roster reads as a kernel->non-kernel leak; it imports only
+  // branding.js and auth-admission.js — both on this roster — so joining costs
+  // nothing and buys the import-direction guarantee on the file that decides who
+  // may knock.
+  'src/bongos/project-door.js',
 ];
 
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a

package/scripts/gds/provision-net.js

@@ -22,6 +22,13 @@ function federationHubOrigin() {
 }
 
 // Whether provisioning should federate this instance's sign-in through the hub.
+//
+// THIS GATE DECIDES A CREDENTIAL, NOT CATALOG MEMBERSHIP (task 1003576, ADR 0246). It used
+// to decide both by accident — federateInstance was the only writer of the hub catalog — so
+// a `standalone` project could never appear on the public map. That hop now runs at every
+// provisioning write (modules/provisioning/catalog-bridge.js → the `project.catalog` port),
+// for every hosting shape. What survives here is the narrow question this gate is actually
+// about: whose web.env does the platform write, and therefore who can hold a client secret.
 // Dormant-by-default: true ONLY when the control plane is hub-configured (the
 // platform-identity module is present, a signing key is loadable, AND a hub origin
 // resolves), the instance is a CO-TENANT (the mothership-hosted shape whose web.env is

package/src/bongos/project-door.js

@@ -0,0 +1,138 @@
+// src/bongos/project-door.js — THE project's join/apply door, composed from every
+// knob that can close it (BV1.R12, task 1002331; ADR 0182 D6, ADR 0247).
+//
+// WHAT IT ANSWERS: "a stranger has arrived at this project's door — what happens?"
+// One value, so no two surfaces can answer it differently:
+//
+//   open         no request needed; signing in is the way in
+//   apply        an application is accepted and queued for the owner
+//   invite_only  no application is taken; an invite is the only way in
+//   locked       nothing — the project is not published, so there is no door
+//
+// WHY IT EXISTS. Three separate owner-set knobs each narrow the same door, and
+// before this file only one of them (`joinability`) was read at the door — so an
+// owner could set their project `private` or `stealth` on the platform's map and
+// still have its public application endpoint behave exactly as before. ADR 0182 D6
+// wrote the composition rule down ("visibility sets the ceiling; join policy may
+// only narrow it; the stricter of the two always wins, and neither can widen the
+// other") and left it unimplemented. This is that rule, as code, in one place.
+//
+// THE THREE KNOBS (all owner-set on the platform, pushed into this instance's
+// branding pack by the provisioning runner, applied by a restart):
+//
+//   visibility   public | private | stealth   how the project stands on the map
+//   joinGrant    view | apply | full          what a PUBLIC join grants (R12)
+//   joinability  open | apply | invite_only   how someone becomes a member (ADR 0194)
+//
+// plus `publishable`, which is DERIVED and never stored (ADR 0182 D1/D4: a project
+// with no name or no description is "dark matter" — off the map and un-joinable).
+//
+// THE REFUSAL NEVER NAMES THE STATE. `stealth`, `public`+`view`, and an explicit
+// `invite_only` all answer with the SAME door, so a refusal can never be read
+// backwards to learn which state a project is in. That is not a nicety: ADR 0182
+// D2a makes stealth's anonymity a privacy primitive, and a door that said "this
+// project is stealth" would hand back exactly what the feed redaction protects.
+// A refused application is also never STORED, so a closed project accumulates no
+// queue to leak (D6).
+//
+// FAIL CLOSED. An unreadable value — a truncated env write, a fourth enum value a
+// future release adds, a pack this core cannot parse — is never the wider door.
+// Same rule ADR 0194 D2 applies to `joinability` alone, and the same direction R06
+// took for the feed (an unrecognised visibility draws as a black hole, not a planet).
+
+'use strict';
+
+// The door vocabulary, ORDERED widest → strictest. The order IS the composition
+// rule: two knobs never negotiate, the higher index simply wins.
+const JOIN_DOORS = Object.freeze(['open', 'apply', 'invite_only', 'locked']);
+const DOOR_RANK = Object.freeze(Object.fromEntries(JOIN_DOORS.map((d, i) => [d, i])));
+
+// What a join of a PUBLIC project grants — the owner's own words from the project
+// interview (BV1.R12). It is a CEILING on the visibility axis, not a second
+// admission policy: `full` means "this axis does not narrow anything", which is
+// why it is the default (DEFAULT_SETTINGS must be today's behaviour).
+const PROJECT_JOIN_GRANTS = Object.freeze(['view', 'apply', 'full']);
+const DOOR_BY_GRANT = Object.freeze({ full: 'open', apply: 'apply', view: 'invite_only' });
+
+// The ceiling each stored visibility state sets (ADR 0182 D6's table). `public` is
+// absent on purpose — it is the one state that defers to the grant.
+const DOOR_BY_VISIBILITY = Object.freeze({ private: 'apply', stealth: 'invite_only' });
+
+// The joinability policies this core can read (ADR 0194). Its own reader is already
+// fail-closed, so this is the guard against a caller that bypassed it.
+const JOINABILITY_DOOR = Object.freeze({ open: 'open', apply: 'apply', invite_only: 'invite_only' });
+
+// The strictest of two doors. PURE. An unknown name is treated as the strictest
+// door there is rather than ignored, so a caller can never widen this by passing
+// a value the table does not carry.
+function strictestDoor(a, b) {
+  const ra = DOOR_RANK[a] === undefined ? DOOR_RANK.locked : DOOR_RANK[a];
+  const rb = DOOR_RANK[b] === undefined ? DOOR_RANK.locked : DOOR_RANK[b];
+  return JOIN_DOORS[Math.max(ra, rb)];
+}
+
+// The ceiling the project's place on the map sets, before `joinability` narrows it
+// (ADR 0182 D6). PURE. `public` hands the answer to the grant; every other value —
+// including one this core does not recognise — is at most `invite_only`.
+function visibilityCeiling(visibility, joinGrant) {
+  if (visibility === 'public') {
+    return DOOR_BY_GRANT[joinGrant] || 'invite_only';
+  }
+  return DOOR_BY_VISIBILITY[visibility] || 'invite_only';
+}
+
+// projectJoinDoor — the whole decision, PURE, from the four inputs a door surface
+// holds. This is the function every join/apply surface must call instead of reading
+// any single knob, so the public application endpoint, the hall's landing form, the
+// CLI and the hub's join relay cannot disagree about which door this project runs.
+//
+// `publishable` is a TRI-STATE and the third value matters: `false` locks the door
+// (dark matter — ADR 0182 D6: "refused — there is no door to knock on"), `true`
+// does not open anything on its own, and `null`/undefined means NO VERDICT — the
+// caller does not hold a publish gate and must not invent one (the same word
+// `provisioning.publishVerdict` uses when the `project.publishGate` port is absent).
+// A caller with no verdict is answered on the three stored knobs alone.
+function projectJoinDoor({ visibility, joinGrant, joinability, publishable = null } = {}) {
+  if (publishable === false) return 'locked';
+  const ceiling = visibilityCeiling(visibility, joinGrant);
+  // An unreadable `joinability` closes to `invite_only`, not to `locked`: its own
+  // reader already chose that value for this failure (ADR 0194 D2), and `locked`
+  // is a specific CLAIM — "this project is not published" — that an unknown policy
+  // is no evidence for. Refusing honestly matters more than refusing hardest.
+  return strictestDoor(ceiling, JOINABILITY_DOOR[joinability] || 'invite_only');
+}
+
+// effectiveJoinDoor — this project's LIVE door: projectJoinDoor() over the policy
+// this instance actually resolved. The one call a door surface makes; published
+// through the module doorway as `api.projectJoinDoor()` so a module never
+// re-derives the composition (the drift `joinabilityMode` exists to prevent).
+//
+// The requires are deliberately lazy: this file's pure half must stay importable by
+// a test with no branding pack, no env and no database behind it.
+//
+// A pack that will not load leaves BOTH visibility and the grant unknown, and
+// `visibilityCeiling` answers that with `invite_only` — the same fail-closed door
+// ADR 0194 D2 chose for the same failure, so this composition never reopens
+// something that reader had already closed.
+function effectiveJoinDoor(deps = {}) {
+  const readBranding = deps.branding || require('../branding').branding; // eslint-disable-line global-require
+  const readJoinability = deps.joinabilityMode || require('./auth-admission').joinabilityMode; // eslint-disable-line global-require
+  let project = {};
+  try { project = readBranding().project || {}; } catch { project = {}; }
+  return projectJoinDoor({
+    visibility: project.visibility,
+    joinGrant: project.joinGrant,
+    joinability: readJoinability(),
+    publishable: deps.publishable === undefined ? null : deps.publishable,
+  });
+}
+
+module.exports = {
+  JOIN_DOORS,
+  DOOR_RANK,
+  PROJECT_JOIN_GRANTS,
+  strictestDoor,
+  visibilityCeiling,
+  projectJoinDoor,
+  effectiveJoinDoor,
+};