@bongos/core 1.19.667 → 1.19.669

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.667",
-  "core_contract": "1.19.667",
-  "source_commit": "fde10b200283c5047be40d5fc05a7489f3d5b73c",
+  "core_version": "1.19.669",
+  "core_contract": "1.19.669",
+  "source_commit": "db01ff449e0ec3309c33d4eae81dfdedad7b5a62",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T07:58:55.399Z",
+  "built_at": "2026-09-11T16:04:31.249Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 473,
+    "docs_redacted": 474,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 2117,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2614,
-  "tree_sha256": "cbb2d92ddbc241d615a5a7b105b021310b739c85b8709fd9479d256ceba573e5",
+  "file_count": 2615,
+  "tree_sha256": "5afa597392cde4d8a5783032728f5ea81ba2c271f4226d71e893d0fc19f2cf04",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1899,10 +1899,15 @@
       "mode": "0000644",
       "sha256": "e5e99f19152b5a98c21f70fc0e54a09e9ae59beeb81fea8d26df2de4ef196b90"
     },
+    {
+      "path": "docs/adr/0278-a-gated-project-still-takes-applications.md",
+      "mode": "0000644",
+      "sha256": "3d941c0e1f1ce5618fa6861a720a4ac1c1988495c5f17aed77a348a4a3b7b718"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "5ee80f0739cfbe9543f746ed13efbfeeaa56c350fb4e9570c7c122723b86a34a"
+      "sha256": "d9dcea00e72214a902f4c4b49f996645495df14334eea2b4baf53af5e55dbcc2"
     },
     {
       "path": "docs/api-reference.md",
@@ -2787,7 +2792,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "65505f4ffa0193c1827059d16ce364257fdfdc076f5585544e1d037f2bda40a8"
+      "sha256": "f2ca27e78e014e1980d45622dbd0ff7e71f049c69e7ac84485fb6d12cac8aa23"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7757,12 +7762,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e6a26c726108246ac30f4250a93e1fd7965dba6bd5dfcd950b849357634ddb02"
+      "sha256": "11cc0033b8ee7fa774319888e0f0fe6dc24af043e607d5d99ce59bfc7969efba"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "30fa12bd80546328d075b3d2b251c528c59ec033b486a6084bcca3b3d5c6f703"
+      "sha256": "8d94b2f718aeb052f7e3c0464fbde8afa6f06c2a8096c90f26abddbf368aeb9f"
     },
     {
       "path": "public-docs/index.html",
@@ -9357,7 +9362,7 @@
     {
       "path": "src/bongos/platform-visibility-gate.js",
       "mode": "0000644",
-      "sha256": "eea15ebe44e9450f2d62040c239828008e8953ea5ee465085d5f0e8e63fe6233"
+      "sha256": "f422cf189a4d29fd2cc9a0ff4a6c71f4032f7cb56eab254f9b304a973afbb88d"
     },
     {
       "path": "src/bongos/pool.js",
@@ -9522,7 +9527,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c0e7feb5829d3c421b86a6a9a6465b05f495e66679c91688a41d0eb23d1c3207"
+      "sha256": "5c09f13b72c589166b1fb7152b89bb76cccbef4475ae7d3047a515a59cfb31a2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11867,7 +11872,7 @@
     {
       "path": "tests/platform_visibility_gate.mjs",
       "mode": "0000644",
-      "sha256": "2dc7a56caeababd5bf249e968e4353f8c738aef459947fde15c7c511640c13aa"
+      "sha256": "bc2cf20f85fa231b0a8edf7bbf6eef4ef698674397ad9a7009aaaa3399e2dd1f"
     },
     {
       "path": "tests/post_login_landing.mjs",

package/docs/adr/0278-a-gated-project-still-takes-applications.md

@@ -0,0 +1,112 @@
+# ADR 0278 — A gated project still takes applications, and the exemption is scoped to the verb
+
+- **Status:** Accepted
+- **Date:** 2026-09-11
+- **Tasks:** [task 1003525](https://cloudbongos.com/builders#/task/1003525) (this decision + the applicant's poll), with the apply write itself in [task 1003624](https://cloudbongos.com/builders#/task/1003624).
+- **Goal:** [#1000106](https://cloudbongos.com/builders#/goal/1000106) — Working area 1, Project creation.
+- **Decider:** the owner, 2026-09-11. The question was raised as an owner decision by task 1003525's own body and by [ADR 0192](<redacted>.md) §3, and is answered here rather than by whoever held the task.
+- **Extends, does not amend:** [ADR 0192](<redacted>.md) (the member door and its exempt list), [ADR 0194](<redacted>.md) (the join door), [ADR 0209](<redacted>.md) (one budget across the two account-existence reads; the response-collapse question, still open).
+
+## Context
+
+A project's owner sets two things on the hub independently:
+
+- **who may SEE it** — `project.platformVisibility`, `public` or `gated` (ADR 0192);
+- **who may JOIN it** — `project.joinability`, `open`, `apply` or `invite_only` (ADR 0194).
+
+Set both to their middle values — members-only *and* apply-to-join — and the
+project took no applications at all. `platform-visibility-gate.js` mounts ahead
+of every surface and refused each cookie-less request with `401` before the
+public `POST <api>/access-requests` could answer, because that write was not on
+the exempt list. The two settings composed into **"nobody can apply"**, a state
+the owner never chose and no surface offered them.
+
+Nothing lied about it, which is why it survived: the hub's join box reported the
+project's own relayed `401` honestly as `members_only`
+(`my-projects.js joinRelayOutcome`), and the hall's landing — where the apply
+form lives — is itself behind the door. The composition was simply unreachable.
+Found by the R14 proof ([task 1002333](https://cloudbongos.com/builders#/task/1002333)).
+
+## The question, and why it was the owner's
+
+ADR 0192 §3 fixed the exempt list at "the door, the manifest, the probes and the
+downloads — and nothing wider", and named the cost of the one subtree it exempts
+whole (`auth/*`). Widening it is a judgement about what a members-only project
+owes a stranger, not an engineering detail, so §3 left it and task 1003525 asked
+it directly: **may a gated project take applications from outside?**
+
+The alternative was coherent and was genuinely on the table: gated means gated,
+and the fix is to stop offering a door that cannot work — say so in the manage
+page's joinability blurb, and hide *Apply to join* while visibility is gated.
+
+## Decision
+
+**Yes. A gated project still takes applications, and both halves of that are
+exempted — each scoped to one path and one verb.**
+
+1. **`POST <api>/access-requests` is exempt** (task 1003624). The application
+   itself. It grants nothing: an application is a row in a queue the owner still
+   reviews (ADR 0201), it carries its own per-IP and per-login limits, and it is
+   public on every non-gated project already.
+
+2. **`GET <api>/access-requests/status` is exempt** (task 1003525). Without it
+   the answer is half an answer. `bongos login` cannot re-poll the device flow
+   after a `not_approved` — the `device_code` is spent — so it polls this route
+   instead and restarts sign-in once admitted. Exempting only the write would
+   let an applicant file a request and then wait on an approval they can never
+   observe.
+
+3. **The exempt list learns about verbs, and the new entries use them.**
+   `EXEMPT` entries may now be `{ re, methods }` beside the existing bare
+   `RegExp`s, and `isExempt(path, method)` takes the method as an OPTIONAL second
+   argument that **fails closed** for a scoped entry when no verb is given — so
+   the existing one-argument static callers (`tests/version_literals.mjs`,
+   `tests/prelaunch_gate.mjs`) are unchanged and cannot accidentally widen.
+
+   The verb is load-bearing, not tidiness. The bare `GET` on
+   `<api>/access-requests` is the **owner's queue**
+   (`requireBuilder` + `access_request.review`) — the surface that lists
+   would-be builders by name, with their vouch state. A path-only exemption
+   would have silently removed the member door from in front of it, leaving only
+   its own rank check where there had been two layers. `…/invite` and the
+   per-row review routes sit one segment over and stay gated for the same reason.
+
+## Consequences
+
+- On a gated + apply project a stranger can reach exactly two routes: file an
+  application, and ask after their own. Every other surface still meets the door.
+- **This opens no oracle the gate was closing.** The boolean twin of the status
+  route, `GET <api>/auth/web/admission-status`, is *already* reachable on a gated
+  project inside the `auth/*` subtree ADR 0192 §3 exempts whole — §3 records that
+  cost in as many words. The two routes deliberately share ONE per-IP budget
+  (`accountExistenceReadRateLimit`, ADR 0209) precisely so neither can be
+  alternated against the other for double the rate, and that stays true here.
+- **What it does add is applicant detail**, and this is the honest cost: over the
+  twin's bare `admitted`, the status route distinguishes `pending` / `dismissed` /
+  `none`. Whether *that* answer should collapse is ADR 0209's open owner question,
+  filed as a blocker against [task 1003339](https://cloudbongos.com/builders#/task/1003339).
+  It is unchanged by this decision — the question was already live on a public
+  project, and a gated one now reaches the same route under the same budget.
+- **The hub needed no change.** `joinRelayOutcome` maps the *relayed* status
+  (`401` → `members_only`), so the moment the project stops answering `401` the
+  hub relays the project's real answer — the door refusal, the `409`, or the
+  receipt — with no second edit.
+- A project whose pinned core predates this keeps the old behaviour and refuses
+  applications; like every `project.*` setting it is applied by the pin, not by
+  the hub's row (ADR 0190).
+
+## Rejected
+
+- **"Gated means gated" — no exemption, and hide the apply door instead.** The
+  coherent alternative, and the owner's call went the other way. It would have
+  made the two settings honest by removing a choice rather than by honouring it.
+- **Exempting the path without the verb.** One line shorter and it hands the
+  owner's applicant queue a demotion from two layers to one. The queue's own
+  `requirePermission` would still hold, which is exactly what makes the loss easy
+  to miss.
+- **Exempting the write alone**, leaving the poll gated. Cheaper, and it produces
+  an applicant who has applied and cannot be told they were admitted.
+- **Collapsing the status response here**, while the route was already being
+  touched. It is ADR 0209's deferred owner question with its own evidence and its
+  own blocker; answering it as a side effect of a visibility fix is how a
+  deferred decision gets made by accident.

package/docs/adr/README.md

@@ -369,3 +369,4 @@ This keeps the decision history honest and traceable.
 | 0275 | [**A role's written responsibility has one source, and the pack's copy is generated** ([task 1003732](https://cloudbongos.com/builders#/task/1003732) · goal 1000095 — *Working area 6*, criterion `wa6-written-responsibilities`; statements fixed by the area owner 2026-09-08). The criterion is one sentence — *"one source, shown on the profile, injected into the pack, referenced by grading"* — and before this task the three statements existed only in the criterion record, nowhere in the tree. The interesting half is why ONE source and not three good copies: if each consumer holds its own, they drift, and the drift has a specific unfair shape — the project shows a builder one standard on their profile, teaches their session a second, and grades the shipped work against a third, so someone is judged by a rule they were never shown. **Decision: a frozen map at `src/role-responsibilities.js` (verbatim owner text, imports nothing), read by three consumers, with the one copy that CAN drift generated and CI-gated.** The hall reads it through `clientModules()` — already injected into every served page as `window.__MODULES__` and already carrying the discipline roster the statements are keyed by, so the profile renders with no new route, no fetch and no copy. The grader reads `responsibilityFor()` through the module doorway and states the standard in the prompt as the project's, not its own. The PACKS get a generated block: markdown cannot require a JS module, so their copy is the only one that can go stale — and it is the worst to lose, being what a session is actually instructed by. `gen-role-responsibilities.js` writes it from the ROLE REGISTRY (so a renamed pack, or Governor when the owner decides, needs no edit), and `role-pack-guard.js` fails CI on drift. Three consequences worth the record. (1) `fitness.js` needed an EXEMPTION for the owner's own prose: the ideator's statement opens "Make good ideas" and `ideas` is a module key, so the no-module-keys scan flagged an English word — paraphrasing to satisfy a scanner is precisely what the task forbids, so the reason is written down and the file's import DIRECTION is still guarded. (2) Registering the freshness check inside `checkGeneratedArtifactsFresh` pushed `fitness.js` one line past its 1,500-line ratchet; rather than raise the baseline (which the check forbids in its own message) the assertion MOVED into `role-pack-guard.js`, which already owns the packs — one check now answers "are the packs correct". (3) The generator matches each pack's own line ending, because `.md` checks out CRLF on Windows and LF in CI, and a generator that always wrote `\n` would make the gate red on one checkout and green on the other for a file nobody touched. A craft with no statement (`ui`, module-contributed per [ADR 0272](<redacted>.md); Governor, deferred per [ADR 0274](<redacted>.md)) renders NOTHING everywhere — no empty quote, no grader line — because a grader told a role has no written standard would supply its own. The profile's avatar was repinned to the top row (the head grid is `align-items:center`, fine for three short lines, wrong once the block made the column tall); verified in both themes in the hall preview. `tests/role_responsibilities.mjs` asserts the criterion's actual content by sweeping `src/`, `scripts/`, `modules/`, `tests/` and `docs/packs/` for any second copy. Rejected: three hand-written paragraphs (the drift would be invisible); a dedicated route for the hall (a fetch and a failure mode for static text already on a rail); storing the statements in the DB (not live state — a row puts the project's written standard outside code review); letting the grader describe a craft from its name (the invented standard this removes); raising `oversized_file_count` to let `fitness.js` grow.](<redacted>.md) | roles / grading / generated artifacts |
 | 0276 | [**The skill-listing budget cannot hold 64 skills and every trigger, so the number is ratcheted and the choice goes to the owner** ([task 1003620](https://cloudbongos.com/builders#/task/1003620) · goal 1000095 — *Working area 6*, criterion `wa6-role-experience`). Every SKILL.md description is resident in EVERY session for every craft, and `skill-lint` budgets the whole listing at 8,000 chars. It has been trimmed twice ([#1003548], [#1003587]) and grown back both times, because the 400-char per-description aim was a WARNING THAT ACCUMULATES. This task rewrote 49 of the 50 `.claude/skills/` descriptions — 17 warnings to 0, listing 25,624 → 19,316 chars, about 1,570 tokens returned to every session — with every trigger phrase preserved and CHECKED MECHANICALLY (a checker diffed the quoted phrases against HEAD and caught five real losses, all restored; four dropped strings were UI labels, not triggers). **8,000 was not reached, and the arithmetic says it cannot be:** across 64 skills the names (880) plus the mandatory quoted triggers (~5,370) are an irreducible ~6,250, leaving ~27 chars per skill to say what the skill DOES. Reaching the budget means trigger-only descriptions — trading truncation for the loss of the semantic signal routing leans on when the user’s words do not literally match a trigger. **Decision: ratchet `skill_listing_chars` at 19,316** in `fitness-ratchets.js` (fails open if the linter cannot load), so it cannot grow while the real question is open; the baseline is deliberately ABOVE skill-lint’s budget and is not a claim the budget is met. **Open and owner-gated:** delist skills (64 is a menu), scale the budget with the roster, or accept trigger-only text — recommendation is delist then rescale, filed as a blocker. `fitness.js`’s over-budget warning STAYS, as the visible trace of that question. Rejected: raising `LISTING_BUDGET_CHARS` to silence the warning (deletes the signal, not the debt); re-cutting the 14 module ui-design descriptions a week after [#1003587] wrote them, for ~2,000 chars toward a target still 9,000 away.](<redacted>.md) | skills / context budget / routing |
 | 0277 | [**A box is "in use" only while a human is attached, and the claim expires** ([task 1003507](https://cloudbongos.com/builders#/task/1003507) · goal 1000095 — *Working area 6*, criterion `wa6-role-experience`). `sweep-idle` skipped any box with `claude_active = true` at ANY age, and `claude_active` is a LATCH, not a level: only a heartbeat ping writes it, and `infra/box-heartbeat.sh` exits WITHOUT pinging when it sees nothing — so silence, the very signal the sweep exists to act on, could never clear it. Reproduced against the shipped selector: skipped at `idleMinutes` of 10, 120, 1440 and **5,256,000** (ten years). Not reaped late; never. The second leg is that `load > 0.2` kept `last_activity_at` bumping every 5 minutes anyway (a devcontainer plus an idle `claude` clears that floor on its own), so EITHER leg alone kept a box alive — which is why bounding only the veto looks like a fix and is not: the incident box's heartbeat was FRESH. Measured: `example-owner`'s box up since 2026-08-12, tmux `otb` UNATTACHED since 2026-08-15 18:01 UTC, `claude` burning 16 min of CPU across 25h of wall clock, **$20.21** of mostly-unattended compute. A THIRD defect, found while testing this and confirmed on clean `origin/main`, made the sweep inert regardless: `loadDeps()` read `_deps` before anything declared it, so it threw `ReferenceError` on first call and every command resolving a DigitalOcean client went with it — including `sweep-idle --apply`, which builds that client before the park loop. **The idle sweep could not park any box at all**, hidden because the suite's only `apply: true` test relied on the veto emptying the idle set before `makeDo()` was reached: one bug shielded by the other. **Decision: a box may not stay active longer than `BOX_UNATTENDED_MAX_HOURS` (12) without evidence a HUMAN was attached.** The heartbeat already computed that signal and folded it into one boolean; it now reports `attached` separately (login session, inbound SSH, open ttyd, or an ATTACHED tmux client via `#{session_attached}` — the signal that separates this box from a working one) and the server stamps `last_attached_at`. `claude_active` keeps its veto but it EXPIRES, bounded by a `claude_active_since` edge stamp. `pgrep -x claude` and the load floor remain reasons the box PINGS, never evidence anyone is THERE — a running process is not a person, and that distinction is the whole decision. The two `NULL` defaults deliberately DISAGREE: `last_attached_at` NULL means "no data" and keeps a pre-1003507 box on the old behaviour (core_238 pointedly does NOT backfill it — a backfilled `now()` starts a clock nothing can advance and parks every un-upgraded box one cap later, and box source sync is not prompt: idea 1000745 records 257 commits behind for three days), while `claude_active_since` NULL is REFUSED because an unknown latch age is the forever-latch itself, and is backfilled so the state is unreachable after deploy. 12h because parking is reversible since task 1002726 (snapshot kept), so a false positive costs one wake against $20.21 for no cap. Both clocks clear at park/wake/deprovision, or a woken box inherits an expired latch and is parked instantly — the fix reintroducing the bug from the far side. Rejected: tracking attachment INSTEAD of bounding the latch (the silent box keeps `true` forever, so the reported hole survives); bounding the latch alone (built first, and the verification probe caught it — the fresh heartbeat meant lifting the veto changed nothing); deleting the load floor (it is what makes an autonomous run count); measuring from `active_since` (that is uptime — parks a box worked on for days); raising `BOX_IDLE_MINUTES` (no threshold reaches an unbounded veto).](<redacted>.md) | dev box / cost / idle sweep |
+| 0278 | [**A gated project still takes applications, and the exemption is scoped to the verb** ([task 1003525](https://cloudbongos.com/builders#/task/1003525) · the apply write itself in [task 1003624](https://cloudbongos.com/builders#/task/1003624) · goal 1000106 — *Working area 1, Project creation*; owner decision 2026-09-11). A project's owner sets who may SEE it (`platformVisibility`, [ADR 0192](<redacted>.md)) and who may JOIN it (`joinability`, [ADR 0194](<redacted>.md)) independently — and set to their middle values, members-only AND apply-to-join, the project took no applications at all: the member door refused every cookie-less request with `401` before the public `POST <api>/access-requests` could answer, because that write was not on the exempt list. The two settings composed into **"nobody can apply"**, which nobody chose. It survived because nothing LIED about it — the hub's join box relayed the project's own `401` honestly as `members_only`, and the hall's landing, where the apply form lives, is itself behind the door; the composition was simply unreachable. Found by the R14 proof ([task 1002333](https://cloudbongos.com/builders#/task/1002333)). ADR 0192 §3 had fixed the exempt list at "the door, the manifest, the probes and the downloads — and nothing wider" and left widening it as an owner call, which is what this is. **Decision: yes — and BOTH halves are exempted, each scoped to one path and one verb.** `POST <api>/access-requests` (it grants nothing — an application is a row in a queue the owner still reviews, [ADR 0201](<redacted>.md), already public on every non-gated project) and `GET <api>/access-requests/status` (without it the answer is half an answer: `bongos login` cannot re-poll the device flow after a `not_approved` — the `device_code` is spent — so an applicant would file a request and then wait on an approval they can never observe). `EXEMPT` entries may now be `{ re, methods }` beside the bare `RegExp`s, and `isExempt(path, method)` takes the verb as an OPTIONAL second argument that **fails closed** for a scoped entry when none is given, so the one-argument static callers cannot accidentally widen. **The verb is load-bearing, not tidiness:** the bare `GET` on `<api>/access-requests` is the OWNER'S QUEUE (`requireBuilder` + `access_request.review`), the surface listing would-be builders by name with their vouch state — a path-only exemption would have silently taken the member door off the front of it, leaving one layer where there were two, and the queue's own `requirePermission` still holding is exactly what makes that loss easy to miss. **It opens no oracle the gate was closing:** the status route's boolean twin `GET <api>/auth/web/admission-status` is ALREADY reachable on a gated project inside the `auth/*` subtree §3 exempts whole (§3 records that cost in as many words), and the two share ONE per-IP budget on purpose ([ADR 0209](<redacted>.md)) so neither can be alternated against the other. What it DOES add, stated as the honest cost: applicant detail — `pending`/`dismissed`/`none` over the twin's bare `admitted`. Whether that answer should collapse is ADR 0209's still-open owner question and is deliberately NOT decided here. No hub change: `joinRelayOutcome` maps the RELAYED status, so it carries the project's real answer the moment the `401` stops. Rejected: "gated means gated" — hide *Apply to join* and say so in the manage blurb (coherent, and the call went the other way); exempting the path without the verb; exempting the write alone; collapsing the status response while the route happened to be open (that is how a deferred decision gets made by accident).](<redacted>.md) | project visibility / join door / member door |

package/docs/module-api-changelog.md

@@ -1793,5 +1793,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.665 with no explicit bump. run 34567142386. (task 1002620)
   1.19.667 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.666 with no explicit bump. run 34576878372. (task 1002620)
+  1.19.668 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.667 with no explicit bump. run 34618700494. (task 1002620)
+  1.19.669 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.668 with no explicit bump. run 34619821252. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.667",
+  "version": "1.19.669",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.667",
+      "version": "1.19.669",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.667",
+  "version": "1.19.669",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/platform-visibility-gate.js

@@ -70,6 +70,32 @@ const API = `(?:${ALL_API_PREFIXES.map(escRe).join('|')})`;
 //   /__prelaunch         the pre-launch gate's own submit, when both gates are on.
 //                        /__stealth is its pre-rename alias (task 1003152) and is
 //                        exempt for as long as the gate still accepts it.
+//   <api>/access-requests  POST ONLY — a stranger's application to a project that is
+//                        BOTH gated and "apply to join" (task 1003624). The owner
+//                        turned that door on deliberately; without this exemption the
+//                        member door answers 401 first and the two settings compose
+//                        into "nobody can apply", which nobody chose. The write is
+//                        public on every other project and carries its own per-IP and
+//                        per-login limits, and it GRANTS nothing — an application is a
+//                        row in a queue the owner still reviews (ADR 0201). The bare
+//                        GET on the same path is the owner's QUEUE (requireBuilder +
+//                        access_request.review), so the exemption is scoped to the
+//                        VERB and the queue keeps the member door ahead of its own
+//                        rank check.
+//   <api>/access-requests/status  GET ONLY — the other half of the same door (task
+//                        1003525). `bongos login` cannot re-poll the device flow
+//                        after a not_approved (the device_code is spent), so it polls
+//                        this instead and restarts sign-in once admitted; without it
+//                        an applicant to a gated project is told to wait for an
+//                        approval they can never observe. It opens no oracle the
+//                        gate was closing: its boolean twin, <api>/auth/web/admission-
+//                        status, is ALREADY reachable on a gated project inside the
+//                        exempt auth/* subtree (ADR 0192 §3 names that cost), and both
+//                        routes spend ONE shared per-IP budget on purpose, so neither
+//                        can be alternated against the other (ADR 0209). What this
+//                        adds over the twin is applicant detail — pending vs dismissed
+//                        vs none — and whether THAT answer should collapse is the
+//                        owner's open question in ADR 0209, unchanged by being here.
 const EXEMPT = [
   new RegExp(`^${API}/auth(/|$)`),
   new RegExp(`^${API}/instance$`),
@@ -81,6 +107,8 @@ const EXEMPT = [
   /^\/__prelaunch$/,
   /^\/__stealth$/,
   /^\/downloads\//,
+  { re: new RegExp(`^${API}/access-requests$`), methods: ['POST'] },
+  { re: new RegExp(`^${API}/access-requests/status$`), methods: ['GET'] },
 ];
 
 // The policy, read through the memoized pack. A pack that cannot be read at all
@@ -106,9 +134,16 @@ function normalizePath(p) {
   return s;
 }
 
-function isExempt(path) {
+// `method` is OPTIONAL, and each entry decides whether it matters: a bare RegExp
+// exempts the path whatever the verb, while a method-scoped entry matches only the
+// verbs it names. A caller that passes no method therefore gets the fail-CLOSED
+// answer for the scoped entries (the static path checks in tests/version_literals.mjs
+// and tests/prelaunch_gate.mjs call it that way) — never an accidental exemption of a
+// sibling route that shares a path with an exempt one.
+function isExempt(path, method) {
   const p = normalizePath(path);
-  return EXEMPT.some((re) => re.test(p));
+  const m = String(method || '').toUpperCase();
+  return EXEMPT.some((e) => (e instanceof RegExp ? e.test(p) : e.re.test(p) && e.methods.includes(m)));
 }
 
 function isApiPath(path) { return /^\/api\//i.test(String(path || '')); }
@@ -233,7 +268,7 @@ function platformVisibilityGate(deps = {}) {
   return function platformVisibility(req, res, next) {
     if (!gated()) return next();
     if (req.method === 'OPTIONS') return next();     // a CORS preflight carries no identity
-    if (isExempt(req.path)) return next();
+    if (isExempt(req.path, req.method)) return next();
     // Async middleware must own its rejection (Express 4 drops the promise) —
     // and it FAILS CLOSED: if the session cannot be resolved, the caller's
     // identity is unknown, and admitting is never an option (auth.js's rule).

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.667'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.669'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/platform_visibility_gate.mjs

@@ -171,9 +171,60 @@ test('the exempt list: the door, the manifest, the probes, the downloads — on
     '/api/bongos/public/progress', '/api/gds/public/leaderboard', '/api/bongos/instances', '/api/gds/authors',
     '/api/bongos/v1/public/progress', '/api/gds/instance/anything', '/instance', '/healthzz', '/downloads',
     '/api/other/instance', '/api/bongos/provisioning/instances',
+    // the apply door is METHOD-scoped, so the bare path — no verb — is not exempt
+    '/api/gds/access-requests', '/api/gds/access-requests/status',
   ]) assert.equal(isExempt(p), false, `${p} must be gated`);
 });
 
+// task 1003624. A project can be BOTH gated and "apply to join"; before this the
+// member door answered 401 ahead of the apply route, so the two settings the owner
+// set composed into "nobody can apply". The exemption is the narrowest thing that
+// fixes it: one path, one verb.
+test('the apply door: POST <api>/access-requests answers a stranger — and only that verb, only that path', () => {
+  for (const p of [
+    '/api/gds/access-requests', '/api/bongos/access-requests', '/api/bongos/v1/access-requests',
+    // the router's own tolerances, the same ones the rest of the list is held to
+    '/API/BONGOS/ACCESS-REQUESTS', '/api/gds/access-requests/',
+  ]) assert.equal(isExempt(p, 'POST'), true, `POST ${p} must reach the apply route`);
+
+  // The bare GET on that path is the OWNER'S QUEUE (requireBuilder +
+  // access_request.review). It has its own rank check, and the member door stays
+  // in front of it regardless — an exemption that ignored the verb would have
+  // silently removed a layer from the queue that lists would-be builders by name.
+  for (const m of ['GET', 'HEAD', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', '']) {
+    assert.equal(isExempt('/api/gds/access-requests', m), false, `${m || '(no verb)'} on the queue must stay gated`);
+  }
+  // and the exemption does not spread down the path
+  for (const p of ['/api/gds/access-requests/status', '/api/gds/access-requests/invite', '/api/gds/access-requests/1']) {
+    assert.equal(isExempt(p, 'POST'), false, `POST ${p} must stay gated`);
+  }
+  // a method-BLIND entry is unchanged by the new shape: it still exempts any verb
+  assert.equal(isExempt('/healthz', 'POST'), true, 'a bare-RegExp entry ignores the verb');
+  assert.equal(isExempt('/api/gds/instance', 'GET'), true);
+});
+
+// task 1003525 — the other half of the apply door. `bongos login` cannot re-poll the
+// device flow after a not_approved (the device_code is spent), so it polls the status
+// route instead; gated, an applicant waits for an approval they can never observe.
+test('the status poll: GET <api>/access-requests/status answers a stranger — that verb, that path', () => {
+  for (const p of [
+    '/api/gds/access-requests/status', '/api/bongos/access-requests/status',
+    '/api/bongos/v1/access-requests/status',
+    '/API/BONGOS/ACCESS-REQUESTS/STATUS', '/api/gds/access-requests/status/',
+  ]) assert.equal(isExempt(p, 'GET'), true, `GET ${p} must reach the status route`);
+
+  // the two halves do not lend each other their verbs
+  assert.equal(isExempt('/api/gds/access-requests/status', 'POST'), false, 'the status route takes no write');
+  assert.equal(isExempt('/api/gds/access-requests', 'GET'), false, 'the owner queue is still not a status poll');
+
+  // and neither opens the review surfaces that share the prefix
+  for (const p of ['/api/gds/access-requests/invite', '/api/gds/access-requests/1/approve', '/api/gds/access-requests/1']) {
+    for (const m of ['GET', 'POST']) {
+      assert.equal(isExempt(p, m), false, `${m} ${p} must stay gated`);
+    }
+  }
+});
+
 test('gated mode: an exempt path is never looked up, and a CORS preflight passes', async () => {
   let looked = 0;
   const mw = platformVisibilityGate({ isGated: () => true, resolveSession: async () => { looked += 1; return null; } });
@@ -272,6 +323,51 @@ test('booted gated: the door, the manifest, the probes and the downloads still a
   assert.doesNotMatch(dl.body, /Sign in to continue/);
 });
 
+// task 1003624, end to end on the booted app. The pack at the top of this file is
+// the composition that was broken: platformVisibility 'gated' AND joinability
+// 'apply'. The stranger's application must now reach the apply route; the owner's
+// queue on the same path must not.
+test('booted gated + apply: the application reaches the door it was refused at, and the owner queue does not', async () => {
+  for (const p of ['/api/gds/access-requests', '/api/bongos/access-requests', '/api/bongos/v1/access-requests']) {
+    const res = await request(p, { method: 'POST' });
+    assert.doesNotMatch(res.body, /Sign in to continue/, `POST ${p}: never the HTML door`);
+    // The route is reached, so whatever it answers is ITS answer (a bodiless POST
+    // is refused by the join door or by validation — both ahead of any query).
+    // What must not come back is the member door's own refusal.
+    let j = null;
+    try { j = JSON.parse(res.body); } catch { /* not JSON — asserted below */ }
+    assert.ok(j && j.error, `POST ${p}: the API envelope, from the route`);
+    assert.notEqual(j.error.code, 'unauthenticated', `POST ${p}: the member door must not answer first`);
+
+    // the same path, the owner's verb: still the member door
+    const q = await request(p, { method: 'GET' });
+    assert.equal(q.status, 401, `GET ${p}: the owner queue stays behind the member door`);
+    assert.equal(JSON.parse(q.body).error.code, 'unauthenticated');
+  }
+});
+
+// task 1003525, end to end. The applicant's poll must survive the member door; the
+// review surfaces one path segment over must not.
+test('booted gated + apply: the status poll answers, and the review surfaces beside it do not', async () => {
+  for (const p of [
+    '/api/gds/access-requests/status', '/api/bongos/access-requests/status',
+    '/api/bongos/v1/access-requests/status',
+  ]) {
+    // no ?github_login: the route's OWN validation answers, ahead of any query
+    const res = await request(p);
+    assert.doesNotMatch(res.body, /Sign in to continue/, `GET ${p}: never the HTML door`);
+    const j = JSON.parse(res.body);
+    assert.ok(j.error, `GET ${p}: the API envelope, from the route`);
+    assert.equal(j.error.code, 'bad_github_login', `GET ${p}: the status route answered, not the member door`);
+  }
+  // the owner's review surfaces share the prefix and stay behind the door
+  for (const p of ['/api/gds/access-requests', '/api/gds/access-requests/invite']) {
+    const res = await request(p);
+    assert.equal(res.status, 401, `GET ${p} stays gated`);
+    assert.equal(JSON.parse(res.body).error.code, 'unauthenticated');
+  }
+});
+
 test('booted gated: a bogus session cookie is not a member', async () => {
   // resolves to no session (or fails closed if there is no database here) —
   // either way the stranger stays outside