@bongos/core 1.19.533 → 1.19.535

package/modules/public-landing/public/assets/cosmos.css

@@ -1368,6 +1368,21 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-manage .visOpt:has(input:checked) b::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
 #view-manage .visOpt:focus-within{outline:2px solid var(--accent);outline-offset:3px;}
 #view-manage #mVisRuns b,#view-manage #mJoinRuns b{color:var(--ok);font-weight:500;}
+/* the project's extras (task 1002342): the creation picker's own band, asked
+   again after the project exists. Stacked full width rather than side by side
+   like the choice bands above, because each row carries a sentence saying what
+   the part is for — and because these are independent facts, not one choice. */
+#view-manage .modBand{display:grid;border-top:1px solid var(--rule);border-bottom:1px solid var(--rule);}
+#view-manage .modOpt{display:grid;grid-template-columns:auto 1fr;gap:2px 10px;margin:0;padding:16px 0 18px;border:0;border-top:1px solid var(--rule-soft);border-radius:0;background:none;text-align:left;cursor:pointer;}
+#view-manage .modOpt:first-child{border-top:0;}
+#view-manage .modOpt::before{content:"";grid-column:1;grid-row:1;width:7px;height:7px;margin-top:6px;border-radius:50%;border:1px solid var(--rule);background:var(--bg);}
+#view-manage .modOpt>b,#view-manage .modOpt>small{grid-column:2;min-width:0;}
+#view-manage .modOpt[aria-pressed="true"]::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+#view-manage .modOpt b{font-family:var(--font-body);font-weight:500;font-size:15px;color:var(--ink);}
+#view-manage .modOpt small{font-family:var(--font-body);font-size:13px;font-weight:400;line-height:1.45;color:var(--ink-faint);max-width:62ch;}
+#view-manage .modOpt:hover::before{border-color:var(--ink-faint);}
+#view-manage .modOpt[disabled]{cursor:default;opacity:.55;}
+#view-manage .modOpt:focus-visible{outline:2px solid var(--accent);outline-offset:3px;}
 /* ── its planet (task 1003347; direction record §16, v1 the bands): the preview
    planet left; four bands right — shape · material · style as hairline cells of
    one band, a word each, the chosen one carrying the dot; the colour as five

package/modules/public-landing/public/projects.html

@@ -829,6 +829,26 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- live since task 1002342 (BV1.R23): the way back into the creation
+           wizard's module picker. Step 4 of the wizard is skippable, and an
+           optional step is a default rather than a dead end only if there is a
+           way back — the same argument the About step's PATCH …/detail was built
+           on, which is why this section saves through THAT route and not the
+           settings channel beside it: a module set is a declaration on the
+           platform row, not a policy a running instance obeys (ADR 0240 §3,
+           ADR 0245). So, unlike its three siblings above, nothing is pushed to
+           the project and nothing restarts — and there is no "what your project
+           runs" read-back line, because there is nothing to read back. The fold
+           is a SIBLING of the volatile slot so no re-render can drop it. -->
+      <div class="card mSec" id="mModules">
+        <h2>Its extras</h2>
+        <div id="mMods"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mModsWhat">
+          <summary>What an extra is — and what is always on</summary>
+          <p>Extras are the optional parts a project can run — a shared dev box, a Discord mirror, and the rest. You picked a set when you created the project, or took the suggested set by skipping that step; this is where you change your mind. Switching one on or off saves straight away and changes nothing that is already running: nothing restarts, and no work is lost either way. The parts every project runs — the platform itself, the way it tracks work, the builders’ hall — were never part of the choice, so they are not listed here and cannot be switched off.</p>
+        </details>
+      </div>
+
       <!-- the planet picker (task 1003347; direction record §16, v1 the bands): the
            owner's own choice of how the platform draws this project — the sky,
            the list, this page's head and the card read the same row. The pick is
@@ -1033,7 +1053,7 @@ summary{min-height:24px;padding:3px 0;}
                      new class and no icon. It filters the band below and NOTHING
                      else — what is switched on is unaffected by what is on
                      screen, and the line under it counts the ones it is hiding
-                     (ADR 0244). -->
+                     (ADR 0245). -->
                 <input type="text" id="modQ" placeholder="Search extras…" autocomplete="off" aria-label="Search the extras by name" aria-describedby="modFilterNote">
                 <div class="hint" id="modFilterNote" aria-live="polite"></div>
                 <div class="typeCards" id="modCards" role="group" aria-labelledby="modLbl"></div>
@@ -1185,6 +1205,9 @@ summary{min-height:24px;padding:3px 0;}
             <div id="liveProgress" role="status" aria-live="polite"></div>
             <h2 class="stepsHead">Your steps — the parts only you can play</h2>
             <ol class="humanSteps" id="humanSteps"></ol>
+            <!-- the modules step was optional (task 1002342, BV1.R23) — one line
+                 saying where it lives afterwards, so a skip is never a dead end -->
+            <p class="samePath" id="doneModules"></p>
             <p class="samePath">These are the same steps however a project is created — nothing here is special to this page.</p>
           </section>
         </div>
@@ -3275,7 +3298,7 @@ summary{min-height:24px;padding:3px 0;}
        see. Search by MEANING ("somewhere to chat") is a different feature and is
        deferred (idea 1000552), so nothing here pretends to understand a query.
 
-       It is a VIEW over the rows and never an edit to the answer (ADR 0244):
+       It is a VIEW over the rows and never an edit to the answer (ADR 0245):
        filtering paints fewer rows, and state.modules does not move. That is what
        lets a switched-on module be off screen without being switched off — the
        count under the field says so rather than leaving it to be discovered. */
@@ -4071,6 +4094,10 @@ summary{min-height:24px;padding:3px 0;}
       $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
         (adopt ? ' — adopting your existing repo' : '') +
         '. The platform stands up the server, database, and address on its own — watch it right here, or any time on <a href="?view=mine">your projects page</a>.';
+      /* the picker's later half (task 1002342, BV1.R23). The modules step is
+         skippable, so this panel names where it lives afterwards rather than
+         leaving an owner to go looking for it. */
+      $('doneModules').innerHTML = 'Add or remove modules later in ' + projectPageLink('the project’s settings') + '.';
       renderSteps();
     }
 
@@ -4084,7 +4111,14 @@ summary{min-height:24px;padding:3px 0;}
       var a = ev.target.closest && ev.target.closest('a[href^="?view="]');
       if (!a || !root.contains(a)) return;
       ev.preventDefault();
-      setView((a.getAttribute('href').match(/view=(\w+)/) || [])[1], true);
+      var href = a.getAttribute('href');
+      var to = (href.match(/view=(\w+)/) || [])[1];
+      /* a manage link names its project in the query, and setView reads manageId
+         rather than the href — so the id has to be handed over or every link on
+         this panel lands on a manage page with no project (task 1002342) */
+      var mid = (href.match(/[?&]id=([^&]*)/) || [])[1];
+      if (to === 'manage' && mid) return goToManage(decodeURIComponent(mid));
+      setView(to, true);
     });
 
     /* One delegated listener — renderSteps swaps innerHTML, so handlers live on the list. */
@@ -5499,6 +5533,9 @@ summary{min-height:24px;padding:3px 0;}
            guard because its card holds a textarea the in-flight tick must
            never repaint out from under a typing owner. */
         if (!keepRepo) renderPublish(inst);
+        /* the extras band (task 1002342) rides the same guard: its own toggles
+           are the only thing that should ever repaint it, never the tick */
+        if (!keepRepo) renderMods(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -6279,6 +6316,128 @@ summary{min-height:24px;padding:3px 0;}
     if (t && t.hasAttribute('data-join-save')) doJoinSave();
   });
 
+  /* ── the project's extras (task 1002342, BV1.R23) ──
+     The way back into the creation wizard's module picker. Step 4 is skippable,
+     and an optional step is a default rather than a dead end only if there is a
+     way back — the argument PATCH …/detail was built on for the About step
+     beside it, which is why this saves through THAT route rather than the
+     settings channel its three neighbours use: a module set is a declaration on
+     the platform row, not a policy a running instance obeys (ADR 0240 §3, ADR
+     0245). Nothing is pushed and nothing restarts, so this section has no "what
+     your project runs" line — there is nothing to read back.
+
+     Two reads, and only one is new. The CURRENT selection rides in on the
+     instance itself (publicInstance resolves it, so a project that skipped the
+     picker reads as its own starter bundle and this page never re-derives that
+     rule); the CATALOG — what may be chosen, and the owner-facing line for each
+     — is the same public GET /provisioning/starter-bundles the wizard reads.
+
+     A toggle IS the save. The band is a list of independent facts rather than
+     one choice, so a Save button would only add a way to lose one. The write
+     sends the WHOLE list because that is what the column stores, and the band
+     repaints from the server's own answer — never from the list we sent — so it
+     can never show a set the platform did not accept. ── */
+
+  var modsCatalog = null;    /* { core, optional } — the public catalog, read once */
+  var modsPromise = null;
+  var modsFailed = false;    /* asked and did not get it; distinct from not yet asked */
+  var modsBusy = false;      /* a write is in flight — the band is inert until it answers */
+
+  function modsSlot(html) { $('mMods').innerHTML = html; }
+
+  /* Lazy and memoised, the wizard picker's rule: /projects serves four views
+     from one file and the map has no business paying for this read. */
+  function ensureModsCatalog() {
+    if (modsPromise) return modsPromise;
+    modsPromise = fetch(API + '/provisioning/starter-bundles', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (data) {
+        if (data && data.optional) modsCatalog = data; else modsFailed = true;
+        if (manageInst) renderMods(manageInst);
+      })
+      .catch(function () { modsFailed = true; if (manageInst) renderMods(manageInst); });
+    return modsPromise;
+  }
+
+  /* What this project runs today, straight off the instance read — never
+     re-derived here, or a skipped picker would read differently on two pages. */
+  function modsSelected(inst) {
+    return ((inst && inst.modules && inst.modules.selected) || []).slice();
+  }
+
+  function renderMods(inst) {
+    ensureModsCatalog();
+    if (!modsCatalog) {
+      /* a read still in flight is a quiet slot; only one that ANSWERED badly
+         gets the clause, so a slow network never reports a break that isn't */
+      modsSlot(modsFailed
+        ? '<p class="finePrint">We couldn’t load the list of extras just now — refresh in a moment. Nothing about your project has changed.</p>'
+        : '<p class="finePrint">Reading the project…</p>');
+      return;
+    }
+    var on = modsSelected(inst);
+    var core = (modsCatalog.core || []).length;
+    modsSlot('<div class="modBand" id="mModBand" role="group" aria-label="Extras">' +
+      (modsCatalog.optional || []).map(function (m) {
+        return '<button type="button" class="modOpt" data-mod="' + esc(m.key) + '" aria-pressed="' +
+          (on.indexOf(m.key) === -1 ? 'false' : 'true') + '"' + (modsBusy ? ' disabled' : '') +
+          '><b>' + esc(m.label) + '</b><small>' + esc(m.summary) + '</small></button>';
+      }).join('') + '</div>' +
+      (core ? '<p class="finePrint">Every project also starts with the same ' + core +
+        ' core parts — the platform itself, the way it tracks work, and the builders’ hall. They are always on, so they are not part of this choice.</p>' : '') +
+      '<div class="projMsg" id="mModMsg" role="status" aria-live="polite"></div>');
+  }
+
+  /* One toggle, sent as the whole list: the column stores a list, so a delta
+     would have to be re-assembled somewhere and the two copies would drift. */
+  function doModToggle(key) {
+    if (!manageInst || !modsCatalog || modsBusy) return;
+    var on = modsSelected(manageInst);
+    var want = on.indexOf(key) === -1 ? on.concat([key]) : on.filter(function (k) { return k !== key; });
+    /* CATALOG order — the order the picker paints and the server stores, so a
+       re-read of what we just wrote can never look like a change */
+    var next = (modsCatalog.optional || []).map(function (m) { return m.key; })
+      .filter(function (k) { return want.indexOf(k) !== -1; });
+    modsBusy = true;
+    renderMods(manageInst);
+    var box = $('mModMsg');
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/detail', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ modules: next })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        modsBusy = false;
+        if (res.ok) {
+          /* the platform's own answer, never the list we sent */
+          manageInst.modules = data.modules || manageInst.modules;
+          renderMods(manageInst);
+          var ok = $('mModMsg');
+          ok.className = 'projMsg ok';
+          ok.textContent = 'Saved. Nothing on the project itself changes — there is nothing to restart.';
+          return;
+        }
+        renderMods(manageInst);   /* the band goes back to what the row still says */
+        var e = apiError(data, res.status);
+        var m = $('mModMsg');
+        if (res.status === 401) { m.className = 'projMsg err'; m.innerHTML = signInAgain(); return; }
+        m.className = 'projMsg err';
+        m.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      modsBusy = false;
+      renderMods(manageInst);
+      var m = $('mModMsg');
+      m.className = 'projMsg err';
+      m.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    });
+  }
+
+  $('mMods').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('.modOpt[data-mod]');
+    if (t && !t.disabled) doModToggle(t.getAttribute('data-mod'));
+  });
+
   /* ── on the map (task 1002324): the join door, ADR 0182 D1 — the third axis,
      beside "who can see it" (the project's own sign-in door) and "how people
      join" (its membership door). The two reads above, key for key: the CHOICE

package/modules/ui-design/kit/serve.js

@@ -187,6 +187,7 @@ const STUB_VOCAB = {
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
   visibility: ['public', 'private', 'stealth'],
+  join_grant: ['view', 'apply', 'full'],
   planet_template: null,   // the template set is long; shape is checked, not membership
   planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
   card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.533",
+  "version": "1.19.535",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.533",
+      "version": "1.19.535",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.533",
+  "version": "1.19.535",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -529,6 +529,15 @@ const KERNEL_FILES = [
   // KERNEL (already in the module-scope-map kernel key) and imports only the
   // kernel (instance-config) + node built-ins, so it joins the roster cleanly.
   'src/bongos/repo-info.js',
+  // task 1002331 (ADR 0182 D6 / ADR 0247): the project's composed join/apply door —
+  // a deterministic classifier over three policy values, the same category as
+  // route-rank-check.js and goal-scope-check.js above (a trust decision the doorway
+  // hands to modules so no module re-derives it). The doorway re-exports it, so
+  // leaving it off this roster reads as a kernel->non-kernel leak; it imports only
+  // branding.js and auth-admission.js — both on this roster — so joining costs
+  // nothing and buys the import-direction guarantee on the file that decides who
+  // may knock.
+  'src/bongos/project-door.js',
 ];
 
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a

package/scripts/gds/provision-net.js

@@ -22,6 +22,13 @@ function federationHubOrigin() {
 }
 
 // Whether provisioning should federate this instance's sign-in through the hub.
+//
+// THIS GATE DECIDES A CREDENTIAL, NOT CATALOG MEMBERSHIP (task 1003576, ADR 0246). It used
+// to decide both by accident — federateInstance was the only writer of the hub catalog — so
+// a `standalone` project could never appear on the public map. That hop now runs at every
+// provisioning write (modules/provisioning/catalog-bridge.js → the `project.catalog` port),
+// for every hosting shape. What survives here is the narrow question this gate is actually
+// about: whose web.env does the platform write, and therefore who can hold a client secret.
 // Dormant-by-default: true ONLY when the control plane is hub-configured (the
 // platform-identity module is present, a signing key is loadable, AND a hub origin
 // resolves), the instance is a CO-TENANT (the mothership-hosted shape whose web.env is

package/scripts/hall-preview/refresh-fixtures.js

@@ -63,6 +63,12 @@ const SNAPSHOTS = [
   ['public/progress', 'public__progress'],
   ['public/recent-shipped', 'public__recent-shipped'],
   ['public/repo-info', 'public__repo-info'],
+  // The roadmap's OTHER read (task 1003447). It was missing, so /roadmap has
+  // always 404'd here and fallen through its `.catch(() => [])` — which meant
+  // no track chip and no shipped date in preview, and (once the deck learned to
+  // draw them) no timeline. `versions` above is the AUTHENTICATED list; this is
+  // the public one the page actually calls, and the two are not interchangeable.
+  ['public/versions', 'public__versions'],
 ];
 
 (async () => {

package/src/bongos/project-door.js

@@ -0,0 +1,138 @@
+// src/bongos/project-door.js — THE project's join/apply door, composed from every
+// knob that can close it (BV1.R12, task 1002331; ADR 0182 D6, ADR 0247).
+//
+// WHAT IT ANSWERS: "a stranger has arrived at this project's door — what happens?"
+// One value, so no two surfaces can answer it differently:
+//
+//   open         no request needed; signing in is the way in
+//   apply        an application is accepted and queued for the owner
+//   invite_only  no application is taken; an invite is the only way in
+//   locked       nothing — the project is not published, so there is no door
+//
+// WHY IT EXISTS. Three separate owner-set knobs each narrow the same door, and
+// before this file only one of them (`joinability`) was read at the door — so an
+// owner could set their project `private` or `stealth` on the platform's map and
+// still have its public application endpoint behave exactly as before. ADR 0182 D6
+// wrote the composition rule down ("visibility sets the ceiling; join policy may
+// only narrow it; the stricter of the two always wins, and neither can widen the
+// other") and left it unimplemented. This is that rule, as code, in one place.
+//
+// THE THREE KNOBS (all owner-set on the platform, pushed into this instance's
+// branding pack by the provisioning runner, applied by a restart):
+//
+//   visibility   public | private | stealth   how the project stands on the map
+//   joinGrant    view | apply | full          what a PUBLIC join grants (R12)
+//   joinability  open | apply | invite_only   how someone becomes a member (ADR 0194)
+//
+// plus `publishable`, which is DERIVED and never stored (ADR 0182 D1/D4: a project
+// with no name or no description is "dark matter" — off the map and un-joinable).
+//
+// THE REFUSAL NEVER NAMES THE STATE. `stealth`, `public`+`view`, and an explicit
+// `invite_only` all answer with the SAME door, so a refusal can never be read
+// backwards to learn which state a project is in. That is not a nicety: ADR 0182
+// D2a makes stealth's anonymity a privacy primitive, and a door that said "this
+// project is stealth" would hand back exactly what the feed redaction protects.
+// A refused application is also never STORED, so a closed project accumulates no
+// queue to leak (D6).
+//
+// FAIL CLOSED. An unreadable value — a truncated env write, a fourth enum value a
+// future release adds, a pack this core cannot parse — is never the wider door.
+// Same rule ADR 0194 D2 applies to `joinability` alone, and the same direction R06
+// took for the feed (an unrecognised visibility draws as a black hole, not a planet).
+
+'use strict';
+
+// The door vocabulary, ORDERED widest → strictest. The order IS the composition
+// rule: two knobs never negotiate, the higher index simply wins.
+const JOIN_DOORS = Object.freeze(['open', 'apply', 'invite_only', 'locked']);
+const DOOR_RANK = Object.freeze(Object.fromEntries(JOIN_DOORS.map((d, i) => [d, i])));
+
+// What a join of a PUBLIC project grants — the owner's own words from the project
+// interview (BV1.R12). It is a CEILING on the visibility axis, not a second
+// admission policy: `full` means "this axis does not narrow anything", which is
+// why it is the default (DEFAULT_SETTINGS must be today's behaviour).
+const PROJECT_JOIN_GRANTS = Object.freeze(['view', 'apply', 'full']);
+const DOOR_BY_GRANT = Object.freeze({ full: 'open', apply: 'apply', view: 'invite_only' });
+
+// The ceiling each stored visibility state sets (ADR 0182 D6's table). `public` is
+// absent on purpose — it is the one state that defers to the grant.
+const DOOR_BY_VISIBILITY = Object.freeze({ private: 'apply', stealth: 'invite_only' });
+
+// The joinability policies this core can read (ADR 0194). Its own reader is already
+// fail-closed, so this is the guard against a caller that bypassed it.
+const JOINABILITY_DOOR = Object.freeze({ open: 'open', apply: 'apply', invite_only: 'invite_only' });
+
+// The strictest of two doors. PURE. An unknown name is treated as the strictest
+// door there is rather than ignored, so a caller can never widen this by passing
+// a value the table does not carry.
+function strictestDoor(a, b) {
+  const ra = DOOR_RANK[a] === undefined ? DOOR_RANK.locked : DOOR_RANK[a];
+  const rb = DOOR_RANK[b] === undefined ? DOOR_RANK.locked : DOOR_RANK[b];
+  return JOIN_DOORS[Math.max(ra, rb)];
+}
+
+// The ceiling the project's place on the map sets, before `joinability` narrows it
+// (ADR 0182 D6). PURE. `public` hands the answer to the grant; every other value —
+// including one this core does not recognise — is at most `invite_only`.
+function visibilityCeiling(visibility, joinGrant) {
+  if (visibility === 'public') {
+    return DOOR_BY_GRANT[joinGrant] || 'invite_only';
+  }
+  return DOOR_BY_VISIBILITY[visibility] || 'invite_only';
+}
+
+// projectJoinDoor — the whole decision, PURE, from the four inputs a door surface
+// holds. This is the function every join/apply surface must call instead of reading
+// any single knob, so the public application endpoint, the hall's landing form, the
+// CLI and the hub's join relay cannot disagree about which door this project runs.
+//
+// `publishable` is a TRI-STATE and the third value matters: `false` locks the door
+// (dark matter — ADR 0182 D6: "refused — there is no door to knock on"), `true`
+// does not open anything on its own, and `null`/undefined means NO VERDICT — the
+// caller does not hold a publish gate and must not invent one (the same word
+// `provisioning.publishVerdict` uses when the `project.publishGate` port is absent).
+// A caller with no verdict is answered on the three stored knobs alone.
+function projectJoinDoor({ visibility, joinGrant, joinability, publishable = null } = {}) {
+  if (publishable === false) return 'locked';
+  const ceiling = visibilityCeiling(visibility, joinGrant);
+  // An unreadable `joinability` closes to `invite_only`, not to `locked`: its own
+  // reader already chose that value for this failure (ADR 0194 D2), and `locked`
+  // is a specific CLAIM — "this project is not published" — that an unknown policy
+  // is no evidence for. Refusing honestly matters more than refusing hardest.
+  return strictestDoor(ceiling, JOINABILITY_DOOR[joinability] || 'invite_only');
+}
+
+// effectiveJoinDoor — this project's LIVE door: projectJoinDoor() over the policy
+// this instance actually resolved. The one call a door surface makes; published
+// through the module doorway as `api.projectJoinDoor()` so a module never
+// re-derives the composition (the drift `joinabilityMode` exists to prevent).
+//
+// The requires are deliberately lazy: this file's pure half must stay importable by
+// a test with no branding pack, no env and no database behind it.
+//
+// A pack that will not load leaves BOTH visibility and the grant unknown, and
+// `visibilityCeiling` answers that with `invite_only` — the same fail-closed door
+// ADR 0194 D2 chose for the same failure, so this composition never reopens
+// something that reader had already closed.
+function effectiveJoinDoor(deps = {}) {
+  const readBranding = deps.branding || require('../branding').branding; // eslint-disable-line global-require
+  const readJoinability = deps.joinabilityMode || require('./auth-admission').joinabilityMode; // eslint-disable-line global-require
+  let project = {};
+  try { project = readBranding().project || {}; } catch { project = {}; }
+  return projectJoinDoor({
+    visibility: project.visibility,
+    joinGrant: project.joinGrant,
+    joinability: readJoinability(),
+    publishable: deps.publishable === undefined ? null : deps.publishable,
+  });
+}
+
+module.exports = {
+  JOIN_DOORS,
+  DOOR_RANK,
+  PROJECT_JOIN_GRANTS,
+  strictestDoor,
+  visibilityCeiling,
+  projectJoinDoor,
+  effectiveJoinDoor,
+};

package/src/branding.js

@@ -65,6 +65,10 @@ const ENV_OVERRIDES = [
   // this instance's own sign-in door; this one is how the project stands on the
   // platform's map, and D6 makes it the ceiling JOINABILITY may only narrow.
   ['VISIBILITY', ['project', 'visibility']],
+  // What a join of this project grants while it is PUBLIC (BV1.R12, task 1002331) —
+  // view | apply | full. The ceiling on the visibility axis that JOINABILITY may
+  // only narrow; composed into one door by src/bongos/project-door.js.
+  ['JOIN_GRANT', ['project', 'joinGrant']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);
@@ -224,6 +228,10 @@ function clientBranding(b = branding()) {
       // two neighbours: it is how the project asks to be seen on the map, and it is
       // the READ-BACK a manage page needs to tell a saved choice from a live one.
       visibility: b.project?.visibility || 'public',
+      // What a public join grants (task 1002331). Public for the same reason: a
+      // stranger's client should be able to say what THIS door does before knocking.
+      // `full` = this axis narrows nothing, so an un-pushed instance is unchanged.
+      joinGrant: b.project?.joinGrant || 'full',
     },
   };
 }

package/src/module-api.js

@@ -15,6 +15,7 @@ const util = require('node:util');
 const { logger: coreLogger } = require('./bongos/logger');
 const { pool, instanceDbName } = require('./bongos/pool');
 const branding = require('./branding');
+const projectDoor = require('./bongos/project-door');
 const instanceConfig = require('./instance-config');
 const staleTimer = require('./stale-timer');
 // Destructured, not namespaced, deliberately — the same form src/bongos/routes/
@@ -45,7 +46,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.533'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.535'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -242,6 +243,16 @@ module.exports = {
   //     reader, and the sign-in flows and the public access-request route
   //     must answer with the same door (SR-19).
   joinabilityMode: auth.joinabilityMode,
+  // projectJoinDoor() — the project's COMPOSED join/apply door: 'open' | 'apply' |
+  //     'invite_only' | 'locked' (BV1.R12, task 1002331; ADR 0182 D6, ADR 0247).
+  //     `joinabilityMode` above answers one knob; this answers the whole door,
+  //     because the project's place on the platform's map (`visibility`) and what a
+  //     public join grants (`joinGrant`) each narrow it too, and "the stricter of
+  //     the two always wins" is only true if one function says so. Every join/apply
+  //     surface calls THIS; a module that read a single knob would re-open a door
+  //     the other two had closed. Optional `{ publishable }` for a caller that
+  //     holds a publish verdict — see src/bongos/project-door.js.
+  projectJoinDoor: (opts) => projectDoor.effectiveJoinDoor(opts),
   // userAgent — the instance's HTTP User-Agent string (branding-derived). The
   // carved lifecycle module's github-push.js stamps every GitHub API request with
   // it instead of reaching into src/branding.js directly (BV1.R86).

package/tests/access_requests_invite.mjs

@@ -9,7 +9,7 @@
 // The doorway is stubbed in require.cache BEFORE the route loads (the route
 // destructures pool/validators at require time — the web_admission_status
 // pattern): the session gates admit a fixed Archon, the pool replays a script
-// of results and records every query, and joinabilityMode is a switch.
+// of results and records every query, and projectJoinDoor is a switch.
 //
 // Run:  node --test tests/access_requests_invite.mjs
 
@@ -39,7 +39,7 @@ const pool = {
 require.cache[apiPath].exports = {
   ...realApi,
   pool,
-  joinabilityMode: () => mode,
+  projectJoinDoor: () => mode,
   requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'archon' }; next(); },
   requirePermission: () => (_req, _res, next) => next(),
 };

package/tests/application_lifecycle.mjs

@@ -252,6 +252,7 @@ require.cache[apiPath].exports = {
   ...realApi,
   pool,
   joinabilityMode: () => 'apply',
+  projectJoinDoor: () => 'apply',
   logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
   requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'owner' }; next(); },
   // requirePermission is NOT stubbed: realApi's own gate is used, so the denial