@bongos/core 1.19.67 → 1.19.69

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.67",
-  "core_contract": "1.19.67",
-  "source_commit": "cd54b1b3803fb68412c34eabaf969761c6b22728",
+  "core_version": "1.19.69",
+  "core_contract": "1.19.69",
+  "source_commit": "d1240d104fd475ebb67216412776c96dbffb1709",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T14:13:54.700Z",
+  "built_at": "2026-08-12T14:45:41.164Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 292,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1222,
+    "functional_verbatim": 1223,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1535,
-  "tree_sha256": "6689b03f0138061c04be8b757cd0a1a13b43f4c64e6d766df97906e306378cf9",
+  "file_count": 1536,
+  "tree_sha256": "d983bcf2513056ef9cb9aca9fb6ecdb74aa1289b7a7601ba3ad00104a26b8992",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1337,7 +1337,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "b7f66c6f1fbed274e5ba3295c06db8fc8edb84edd44f6ce92f6734e18267e3d9"
+      "sha256": "96ae791fc131dc389158f326e5fc698283de3d67d3396003bae2632f24a148b0"
     },
     {
       "path": "docs/design-contract.md",
@@ -2977,7 +2977,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "5bdd907f10ae15f8efdb55adce3ce23991a376122eb79c549e025f8f4845fae5"
+      "sha256": "076103658308541ef6b976bc333c67a2dc0069913fadbd5551c6241cc320bda4"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -3282,7 +3282,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "56c1450dd72fcda19841f3a0a98b918b1b875f49971e93d60218fb62e8a21dad"
+      "sha256": "ac31de1ecb51a0899d043b7fa098693ae69cbc3ebe858c97e6c8df2c4cef8015"
     },
     {
       "path": "modules/hall-ui/public/style.css",
@@ -4042,12 +4042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2e4247ac977969f19efdfa6e7e4c111f131e8e6200e393b7e19393d65b57d6ae"
+      "sha256": "cfa1a680de61b09d8231908031aedaee2c923dc91ccdf933f1e62895f00f681d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a840fe8d34e5195d246bfb20de03cf4864bec50d21ba5d3abe4eb17f8ed47275"
+      "sha256": "314dffe32265d0bade3708b1591061bbfef4cd8f3e8cfcf6e9eb2879f539ecb9"
     },
     {
       "path": "public-docs/index.html",
@@ -4292,7 +4292,7 @@
     {
       "path": "public-landing/create.html",
       "mode": "0000644",
-      "sha256": "a90e1cfe70592338dd9e3bb733a5655f8b772594f74a09b0b2a3075ff90c5487"
+      "sha256": "1874575c2241df1e868d158f3fc4c6c123b8c35531a5b1425de9974230da6510"
     },
     {
       "path": "public-landing/gate/README.md",
@@ -5642,7 +5642,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "2f88796346b1c3a6dc49e25766b223fbf2d99e34b38b9a0f1e64a6fb9a59856d"
+      "sha256": "006a51d3bd71cc496742e9399c53dc5b1ebd18c87a54e675aabda6ac312b4b96"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7f872cf877475c7b89a389c016abb6cdcdbc34a7847b8bf882dd67e8dc49048c"
+      "sha256": "7e3fc1c20665a092ead5773ba12e2714ecce38641335f602abbb0597bb87dc2f"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6697,7 +6697,12 @@
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
-      "sha256": "c2456b6fe8845c5778e9e57323cd7a0f2f9d6e96ef9d3a9d4f47f0312da07964"
+      "sha256": "b0da8fb0e46c57419821dbf8cb5ddeda3c98da76d1b2918c3ce77798ee2768fb"
+    },
+    {
+      "path": "tests/hall_page_gate_map.mjs",
+      "mode": "0000644",
+      "sha256": "1e59d5608c205aa6f271c5efd0acb7899f4996dfbaecbf35c387737f19c735f5"
     },
     {
       "path": "tests/hall_palette.mjs",
@@ -7037,7 +7042,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "93125254eed5a46e933484062942e43966e3cac898e642d546cd467da635223f"
+      "sha256": "6a66477263031b252d6a92d5036304a78e11cbbd9e7230d836c4ec96a9297fdd"
     },
     {
       "path": "tests/onboarding_gate.mjs",

package/docs/canonical-permissions.md

@@ -179,7 +179,9 @@ or missing ranks fail closed.
   **[ADR 0157](adr/<redacted>.md) added the whole operational block here** —
   20 permissions that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
   the governance/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.governance`) and
-  `GET /api/gds/sessions/search`; the **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
+  `GET /api/gds/sessions/search` (whose own `/sessions` page had no server gate at all until
+  task 1002710 put it behind `page.view.governance` alongside its three group-mates); the
+  **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
   `POST /boxes/:b/close`, `PATCH .../block`, `GET /provisioning/fleet[/cost-ledger]`,
   `POST .../force-teardown`); **security adjudication** (`GET /security/reports`,
   `POST /security/reports/:id/{confirm,dispute,fix,link-fix}`, `/security/docs` CRUD);

package/modules/hall-ui/public/builders.js

@@ -493,16 +493,17 @@
   // Roll) stays hidden so a fresh arrival isn't drowned before they've
   // shipped their first works. The Settings link is the exception (task
   // 1291): a newcomer needs it for first-time setup — CLI re-auth (Settings
-  // → CLI Access) and choosing their craft both live there. #766 also hides the
-  // citizen's primer + the "how the system works" maps — a newcomer's path is
-  // action-only. #770: the Work Board link IS shown to a Xenos — a newcomer
-  // needs to find the work they can claim, so the path "find work → claim →
-  // ship three" stays one click away; the rank ladder also stays so they can
-  // see what they're climbing toward. This is cosmetic UX only — every data
-  // endpoint stays server-rank-gated regardless (the Work Board's claimable
-  // feed only returns work accessible to the caller's rank), and a Xenos who
-  // types /primer or /diagrams directly is bounced to /builders/not-ready by
-  // the server (#770). Set early in loadAll so the async karma/acclaim feeds
+  // → CLI Access) and choosing their craft both live there. The citizen's
+  // primer and the "how the system works" maps are ALSO visible to a Xenos as
+  // of task 1002710 — #766/#770 had hidden them on an "action-only path"
+  // reading, but they are the onboarding documents, so the reader they were
+  // written for was the one being turned away. #770: the Work Board link IS
+  // shown to a Xenos — a newcomer needs to find the work they can claim, so the
+  // path "find work → claim → ship three" stays one click away; the rank ladder
+  // also stays so they can see what they're climbing toward. This is cosmetic
+  // UX only — every data endpoint stays server-rank-gated regardless (the Work
+  // Board's claimable feed only returns work accessible to the caller's rank).
+  // Set early in loadAll so the async karma/acclaim feeds
   // (which un-hide their own scroll on data) respect it; the section-hiding
   // sweep then runs before renderNav so the chip strip matches.
   const NEWCOMER_VISIBLE_SECTIONS = new Set([

package/modules/hall-ui/public/shell.js

@@ -136,14 +136,22 @@
     { group: 'Community', gate: 'member', items: [
       { id: 'leaderboard', label: 'Leaderboard', icon: 'leaderboard', href: '/#leaderboard', view: 'leaderboard', gate: 'member' },
       // task 1002577: the cross-project builder directory (/scouting graduated
-      // into the hall). Archon-gated to MATCH its data — /api/gds/scouting is
-      // deliberately "NOT shown to builders" (ADR 0141 §4) until spec R14 widens
-      // it; this gate is cosmetic, requireProjectCuratePage is the wall. The
-      // module gate hides the tab on instances without the platform-identity hub.
-      { id: 'people', label: 'People', icon: 'people', href: '/people', gate: 'archon', module: 'platform-identity' },
+      // into the hall). Gated to MATCH its data — /api/gds/scouting checks
+      // `project.curate`, whose catalog floor is METIC. This read 'archon' until
+      // task 1002710: the nav was stricter than the wall, so a Metic could open
+      // /people by URL but never saw the link. Cosmetic either way —
+      // requireProjectCuratePage is the wall — but a nav that disagrees with the
+      // gate teaches the ladder wrong. The module gate hides the tab on
+      // instances without the platform-identity hub.
+      { id: 'people', label: 'People', icon: 'people', href: '/people', gate: 'governance', module: 'platform-identity' },
     ] },
     { group: 'Docs', gate: 'signed', items: [
-      { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'member' },
+      // task 1002710: primer + diagrams were gate:'member' (rank !== xenos) to
+      // mirror the old thetes+ page gate. That gate is gone — the reading rooms
+      // are for the first-session newcomer above all — so the links follow it
+      // down to 'signed'. Leaving them at 'member' would have ungated the pages
+      // while still hiding them from the only readers the change was for.
+      { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'signed' },
       { id: 'ranks', label: 'Ranks', icon: 'docs', href: '/ranks', gate: 'signed' },
       // task 2175: /drachmae had no nav entry at all — reachable only from prose
       // links since task 2174 moved the bounty rate card onto it. It is reference
@@ -153,7 +161,7 @@
       // stays right whatever `branding.currency.label` is set to. Page is public
       // like /ranks — 'signed' is the same cosmetic "show it once you're in".
       { id: 'economy', label: 'Economy', icon: 'docs', href: '/drachmae', gate: 'signed' },
-      { id: 'diagrams', label: 'Diagrams', icon: 'docs', href: '/diagrams', gate: 'member' },
+      { id: 'diagrams', label: 'Diagrams', icon: 'docs', href: '/diagrams', gate: 'signed' },
       { id: 'atlas', label: 'Repo Atlas', icon: 'docs', href: '/atlas', gate: 'member' },
       { id: 'modules', label: 'Modules', icon: 'docs', href: '/modules', gate: 'member' },
       // The rendered OpenAPI reference lives on the APEX (/docs), not this builders

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.67",
+  "version": "1.19.69",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.67",
+      "version": "1.19.69",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.67",
+  "version": "1.19.69",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/create.html

@@ -251,6 +251,14 @@ input[type=text].bad{border-color:var(--err);}
 }
 .steps b{font-size:15px;}
 .steps p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.55;margin-top:4px;}
+/* live checklist states (task 1002694): a step the platform has verified done, and a
+   step that can't be performed yet (its prerequisite — usually the domain — is missing) */
+.steps>li.sdone{border-color:#bbe7c8;background:linear-gradient(180deg,#f0fdf4 0%,#fcfffc 100%);}
+.steps>li.sdone::before{content:"✓";background:var(--ok);color:#fff;}
+.steps>li.slocked{opacity:.6;}
+.steps details{margin-top:10px;}
+.steps summary{cursor:pointer;font-weight:700;font-size:12.5px;color:var(--ink-faint);}
+.steps details p{margin-top:8px;}
 .kv{
   display:flex;align-items:center;gap:8px;margin-top:9px;background:var(--bg);border:1.5px solid var(--line);
   border-radius:11px;padding:8px 8px 8px 12px;font-size:12.5px;
@@ -727,7 +735,10 @@ input[type=text].bad{border-color:var(--err);}
     } else if (clash) {
       hint.className = 'hint err'; hint.innerHTML = 'You already have a repo named <strong>' + esc(state.repo) + '</strong> — pick another name, or adopt it instead.';
     } else {
-      hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>.';
+      /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
+         public by design (github-repos.js — open-source, capture-resistant); the
+         private path is adopting a private repo the owner makes themselves. */
+      hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty <strong>public</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code> — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead.';
     }
   }
   $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
@@ -983,56 +994,203 @@ input[type=text].bad{border-color:var(--err);}
     });
   });
 
-  /* ── done panel: the canonical human steps (same sequence as the /new-project
-        skill + `bongos onboard` + the hall wizard — goal 35; ADR 0121 branches
-        only the repo leg on greenfield vs adopt) ── */
+  /* ── done panel: rendered FROM the canonical onboard plan (task 1002694, gap 2 /
+        idea 1000675). GET /provisioning/onboard-plan is the single source the
+        /new-project skill + `bongos onboard` read too, so the checklist can't
+        drift. A per-key renderer adds this page's rich UI; an unknown human step
+        falls back to the plan's own label, so a new canonical step surfaces here
+        by default instead of silently vanishing. ── */
   function copyBtn(text) {
     return '<button type="button" class="copy" data-copy="' + esc(text) + '">Copy</button>';
   }
-  function renderDone(data) {
-    var adopt = state.mode === 'adopt';
-    var oa = state.domain ? oauthAppValues(state.domain) : null;
-    $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
-      (adopt ? ' — adopting your existing repo' : '') +
-      '. The platform stands up the server, database, and address on its own — you can watch its live status right here.';
+  var GH_ICON = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
+
+  var instanceId = null;             // set when a create lands / a resumed watch starts
+  var live = { instStatus: null, manifest: null, manifestMsg: '' };
+  var planPromises = {};             // mode|domain → Promise<steps[]>
+  var lastStepsHtml = '';
+  var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall'];
+
+  function fetchPlan() {
+    var domain = state.domain || '';
+    var key = state.mode + '|' + domain;
+    if (!planPromises[key]) {
+      planPromises[key] = fetch(API + '/provisioning/onboard-plan?mode=' + encodeURIComponent(state.mode) + (domain ? '&domain=' + encodeURIComponent(domain) : ''))
+        .then(function (res) { if (!res.ok) throw new Error('plan'); return res.json(); })
+        .then(function (d) { return (d && d.steps) || []; })
+        .catch(function () {
+          delete planPromises[key];  // transient — retried on the next render
+          return FALLBACK_HUMAN_KEYS.map(function (k) { return { key: k, kind: 'human', label: '' }; });
+        });
+    }
+    return planPromises[key];
+  }
 
-    var steps = [];
+  /* github-repo — adopt / auto-created / manual-create, each aware of whether the
+     scaffold has landed (instance active ⇒ the build already pushed). The wizard
+     files onboard_mode to the server, so for adopt the RUNNER clones + layers
+     (task 1002562) — the owner no longer runs `bongos init --adopt` here. */
+  function renderStepGithubRepo() {
+    var landed = live.instStatus === 'active';
     var repoLabel = state.owner && state.repo ? '<strong>' + esc(state.owner + '/' + state.repo) + '</strong>' : 'your new repository';
+    if (state.mode === 'adopt') {
+      return landed
+        ? '<li class="sdone" data-onboard-step="github-repo"><b>Your repo carries the platform</b><p>The build layered the platform onto ' + repoLabel + ' — existing files, history, and backlog kept. Pull to see it.</p></li>'
+        : '<li data-onboard-step="github-repo"><b>Your existing repo</b><p>The build clones ' + repoLabel + ' and layers the platform onto its existing history — nothing is created or emptied, and your backlog is imported. Nothing for you to do here.</p></li>';
+    }
+    if (state.repoAutoCreated) {
+      return landed
+        ? '<li class="sdone" data-onboard-step="github-repo"><b>Repo ready — scaffold landed</b><p>We created ' + repoLabel + ' (public, by design) and the build pushed your project’s starting files to it.</p></li>'
+        : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
+    }
     var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
-    var ghIcon = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
-    steps.push(adopt
-      ? '<li data-onboard-step="github-repo"><b>Layer onto your existing repo</b><p>In your repo run <code style="font-family:var(--font-mono)">bongos init --adopt</code>. It shows a conflict pre-flight and writes <em>nothing</em> until you accept — your files and history stay yours, and your existing backlog is imported. Commit and push.</p></li>'
-      : (state.repoAutoCreated
-        ? '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — empty and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>'
-        : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
-        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>'));
+    return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+      '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
+  }
+
+  /* The manual OAuth-app path stays as a documented fallback (ADR 0133), but the
+     control-plane placement is named as the operator's, never handed to the owner
+     as a command to run (gap 4). */
+  function manualOauthDetails() {
+    var oa = oauthAppValues(state.domain);
+    return '<details><summary>Prefer to create an OAuth app by hand?</summary>' +
+      '<p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
+      '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
+      '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div>' +
+      '<p>The generated credentials are placed on the platform’s control plane by an operator — that part isn’t yours to run (the one-click path above does it all automatically). It’s done when <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> reports <code style="font-family:var(--font-mono)">auth_configured: true</code>.</p></details>';
+  }
+
+  /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
+     (gap 3 / idea 1000676); locked until a domain exists (the App needs the real
+     callback host — the server refuses domainless with domain_required). */
+  function renderStepOauthApp() {
     if (!state.domain) {
-      steps.push('<li><b>Add a domain you own</b><p>Sign-in on your new instance needs a real domain. When you have one, attach it from <a href="/projects">your projects page</a> — the address gets wired in minutes.</p></li>');
+      return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Unlocks once your project has an address — sign-in needs a real domain. Attach one any time from <a href="/projects">your projects page</a>.</p></li>';
+    }
+    if (live.manifest === 'done') {
+      return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(state.domain) + '</code> is live.</p></li>';
+    }
+    if (live.manifest === 'error' || live.manifest === 'expired') {
+      return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' +
+        (live.manifest === 'expired' ? 'That setup link expired (they last 30 minutes) — mint a fresh one.' : 'GitHub setup hit a snag' + (live.manifestMsg ? ': ' + esc(live.manifestMsg) : '') + '. Try again.') + '</p>' +
+        '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+    }
+    if (live.manifest) {   // pending / code_received — GitHub or the runner is mid-flight
+      return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p></li>';
     }
-    if (oa) {
-      steps.push('<li data-onboard-step="oauth-app"><b>Create the GitHub OAuth app</b><p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
-        '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
-        '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div></li>');
-      var cmd = 'bongos oauth-secret place ' + state.slug + ' --client-id <id> --client-secret <secret> --apply';
-      steps.push('<li><b>Place the secret — verified</b><p>Never hand-edit the env file. On the control plane run the placement command; it checks the value is real and confirms sign-in works.</p>' +
-        '<div class="kv"><code>' + esc(cmd) + '</code>' + copyBtn(cmd) + '</div></li>');
-      steps.push('<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '</code> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>');
-      steps.push('<li><b>Verify</b><p><code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> should report <code style="font-family:var(--font-mono)">auth_configured: true</code>. Then the hall is yours.</p></li>');
+    return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in — one click</b><p>Approve a pre-filled GitHub App and the platform wires sign-in by itself: no keys to copy, and the secret never leaves the server side.</p>' +
+      '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+  }
+
+  function renderStepFirstSignIn() {
+    if (!state.domain) {
+      return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks with sign-in above — you’ll open your project’s address, sign in with GitHub once, and be seated as the owner (the founding Archon).</p></li>';
     }
-    steps.push(state.domain
+    return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(state.domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(state.domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
+  }
+
+  function renderStepEnterHall() {
+    return state.domain
       ? '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Your project’s home — open <a href="https://' + esc(state.domain) + '/builders" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(state.domain) + '/builders</code></a> and start building.</p></li>'
-      : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>');
-    $('humanSteps').innerHTML = steps.join('');
-    $('humanSteps').addEventListener('click', function (ev) {
-      var t = ev.target.closest('.copy');
-      if (!t) return;
-      navigator.clipboard.writeText(t.getAttribute('data-copy')).then(function () {
-        t.classList.add('did'); t.textContent = 'Copied';
-        setTimeout(function () { t.classList.remove('did'); t.textContent = 'Copy'; }, 1600);
+      : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>';
+  }
+
+  var STEP_RENDERERS = {
+    'github-repo': renderStepGithubRepo,
+    'oauth-app': renderStepOauthApp,
+    'first-sign-in': renderStepFirstSignIn,
+    'enter-hall': renderStepEnterHall
+  };
+
+  function renderSteps() {
+    fetchPlan().then(function (steps) {
+      var html = steps.filter(function (s) { return s && s.kind === 'human'; }).map(function (s) {
+        var r = STEP_RENDERERS[s.key];
+        return r ? r(s) : '<li data-onboard-step="' + esc(s.key) + '"><b>' + esc(s.label || s.key) + '</b></li>';
+      }).join('');
+      if (html === lastStepsHtml) return;   // change-only re-render — polls never clobber open UI
+      lastStepsHtml = html;
+      $('humanSteps').innerHTML = html;
+    });
+  }
+
+  function renderDone() {
+    var adopt = state.mode === 'adopt';
+    $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
+      (adopt ? ' — adopting your existing repo' : '') +
+      '. The platform stands up the server, database, and address on its own — you can watch its live status right here.';
+    renderSteps();
+  }
+
+  /* One delegated listener — renderSteps swaps innerHTML, so handlers live on the list. */
+  $('humanSteps').addEventListener('click', function (ev) {
+    var mBtn = ev.target.closest('[data-action="manifest-start"]');
+    if (mBtn) { startManifest(mBtn); return; }
+    var t = ev.target.closest('.copy');
+    if (!t) return;
+    navigator.clipboard.writeText(t.getAttribute('data-copy')).then(function () {
+      t.classList.add('did'); t.textContent = 'Copied';
+      setTimeout(function () { t.classList.remove('did'); t.textContent = 'Copy'; }, 1600);
+    });
+  });
+
+  /* ── GitHub-App manifest flow (ADR 0133): mint a one-time state for OUR instance,
+        form-POST the pre-filled manifest to GitHub in a new tab (opened inside the
+        click gesture so popup blockers allow it; blocked → same-tab, the callback
+        page carries the rest), then poll the public status until the control-plane
+        runner has placed + verified the credentials. ── */
+  var manifestPollTimer = null;
+  function stopManifestPoll() { if (manifestPollTimer) { clearTimeout(manifestPollTimer); manifestPollTimer = null; } }
+
+  function startManifest(btn) {
+    if (!instanceId) return;
+    btn.disabled = true; btn.textContent = 'Preparing GitHub…';
+    var tab = window.open('about:blank', 'ghAppSetup');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(instanceId) + '/github-app', {
+      method: 'POST', credentials: 'same-origin',
+      headers: { 'Content-Type': 'application/json' }, body: '{}'
+    }).then(function (res) {
+      if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/create'); throw new Error('signing in'); }
+      return res.json().catch(function () { return {}; }).then(function (d) {
+        if (!res.ok) {
+          var e = new Error((d.error && (d.error.message || d.error.code)) || ('HTTP ' + res.status));
+          throw e;
+        }
+        return d;
       });
+    }).then(function (d) {
+      var form = document.createElement('form');
+      form.method = 'POST'; form.action = d.post_url; form.target = tab ? 'ghAppSetup' : '_self';
+      var inp = document.createElement('input');
+      inp.type = 'hidden'; inp.name = 'manifest'; inp.value = JSON.stringify(d.manifest);
+      form.appendChild(inp); document.body.appendChild(form);
+      form.submit(); form.remove();
+      live.manifest = 'pending'; live.manifestMsg = '';
+      renderSteps();
+      pollManifest(d.state);
+    }).catch(function (err) {
+      if (String(err && err.message) === 'signing in') return;
+      if (tab) { try { tab.close(); } catch (e) {} }
+      live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+      renderSteps();
     });
   }
 
+  function pollManifest(stateToken) {
+    stopManifestPoll();
+    function tick() {
+      fetch(API + '/provisioning/github-app/status?state=' + encodeURIComponent(stateToken))
+        .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
+        .then(function (d) {
+          var next = d.ready ? 'done' : (d.status || 'pending');
+          if (next !== live.manifest) { live.manifest = next; renderSteps(); }
+          if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
+        })
+        .catch(function () { manifestPollTimer = setTimeout(tick, 8000); });
+    }
+    tick();
+  }
+
   /* ── live build progress (task 2083): poll the instance until it's up.
         Read-only — GET /provisioning/instances/:id (own-scoped) every 5s. ── */
   var pollTimer = null;
@@ -1076,6 +1234,7 @@ input[type=text].bad{border-color:var(--err);}
   }
   function startProgress(id) {
     if (!id) return;
+    instanceId = id;   // the manifest flow mints against this instance
     stopPolling();
     var ticks = 0;
     var el = $('liveProgress');
@@ -1100,7 +1259,12 @@ input[type=text].bad{border-color:var(--err);}
           return res.json();
         })
         .then(function (data) {
-          var terminal = renderProgress(data.instance);
+          var inst = data.instance;
+          /* the checklist reflects live state (task 1002694): a status transition —
+             e.g. the scaffold landing — re-renders the steps (change-only, so the
+             5s tick never clobbers an open dropdown or mid-flight button) */
+          if (inst && inst.status !== live.instStatus) { live.instStatus = inst.status; renderSteps(); }
+          var terminal = renderProgress(inst);
           if (!terminal) pollTimer = setTimeout(tick, 5000);
           else stopPolling();
         })
@@ -1124,6 +1288,10 @@ input[type=text].bad{border-color:var(--err);}
     again.type = 'button'; again.className = 'again'; again.textContent = 'Start another project';
     again.addEventListener('click', function () {
       stopPolling();
+      stopManifestPoll();
+      instanceId = null;
+      live = { instStatus: null, manifest: null, manifestMsg: '' };
+      lastStepsHtml = '';
       try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
       state = { step: 1, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '' };
       $('f-name').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';

package/src/bongos/serve-internal.js

@@ -696,6 +696,13 @@ function mountInternalSurfaces(app) {
   const WATCH_PAGE_RE = /^\/builders\/watch(?:\.html)?\/?$/;
   const HARBOR_PAGE_RE = /^\/builders\/harbor(?:\.html)?\/?$/;
   const GATE_PAGE_RE = /^\/builders\/gate(?:\.html)?\/?$/;
+  // /sessions (the session-log ledger) belongs to that same Governance group and
+  // its data route (`session.search`) carries the same metic floor since ADR 0157
+  // — but it had NO page gate at all: sessions.js only called showSealed() after
+  // /api/bongos/me, so the shell was served to anyone who asked for the URL. The
+  // data never leaked (the route gate held), but the page was the one item in the
+  // group without a wall. Gated here so the group is uniform (task 1002710).
+  const SESSIONS_PAGE_RE = /^\/builders\/sessions(?:\.html)?\/?$/;
   // The /governance roles-and-permissions tab (BV1.R113) sits one floor higher:
   // the `governance.manage` atom itself (archon), the same key its data routes
   // check — requireGovernanceManagePage, not the metic-floored gate above.
@@ -704,17 +711,25 @@ function mountInternalSurfaces(app) {
   // exact permission its data route (GET /scouting) checks — same posture as the
   // /governance tab above (the page can never drift wider than the API it fronts).
   const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
+  // /scouting is the LEGACY twin of /people — the same /api/gds/scouting directory,
+  // left behind when task 1002577 graduated it into the hall. It has no nav entry
+  // and its own header claims "Archon-only", but it was never page-gated: the page
+  // rendered for anyone and leaned entirely on the data route's 403. Gated on the
+  // same atom as /people so the two can't drift apart (task 1002710). Deleting it
+  // in favour of /people is a separate call — it is walled, not removed, here.
+  const SCOUTING_PAGE_RE = /^\/builders\/scouting(?:\.html)?\/?$/;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (!req.path.startsWith('/builders')) return next();
     const norm = path.posix.normalize(req.path);
-    if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)) {
+    if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)
+      || SESSIONS_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernancePage(req, res, next);
     }
     if (GOVERNANCE_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernanceManagePage(req, res, next);
     }
-    if (PEOPLE_PAGE_RE.test(norm)) {
+    if (PEOPLE_PAGE_RE.test(norm) || SCOUTING_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);
     }
     next();
@@ -820,24 +835,28 @@ function mountInternalSurfaces(app) {
   // (style.css, *.js, fonts, cursors), the not-ready notice, and the sign-in flow
   // itself stay PUBLIC so the landing card + GitHub button render for a stranger.
   //
-  // Two tiers of gate (#770):
-  //   * NON-XENOS (Thetes+) — the orientation reading rooms (primer, diagrams).
-  //     A Xenos's path is action-only; an unauth visitor is sent to sign-in, a
-  //     Xenos to the friendly /builders/not-ready notice.
-  //   * ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals page, the
-  //     task-detail page, the Repo Atlas, the Dev Box pair page,
-  //     and Settings (#748, #904, task 1293, task 1757, task 751): a Xenos IS
-  //     allowed, but an unauthenticated visitor is bounced into sign-in rather
-  //     than served the page shell. Settings sits in THIS tier (not the
-  //     reading-room tier) because a newcomer needs it for first-time setup —
-  //     CLI re-auth (the "CLI Access" section) and choosing their craft both
-  //     live there (task 1291). It must still stay behind sign-in: it shows
-  //     personal prefs and mints CLI tokens.
-  // The link-hiding in builders.js is only cosmetic; these are the real gates.
-  const NONXENOS_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:primer(?:\.md|\.html)?|diagrams(?:\.html)?)\/?$/;
-  const NONXENOS_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;
-  const SIGNEDIN_BUILDERS_PAGE_RE = /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap)(?:\.html)?\/?$/;
+  // ONE tier of gate: ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals
+  // page, the task-detail page, the Repo Atlas, the Dev Box pair page, Settings
+  // (#748, #904, task 1293, task 1757, task 751) and, since task 1002710, the
+  // orientation reading rooms (primer, diagrams). A Xenos IS allowed; an
+  // unauthenticated visitor is bounced into sign-in rather than served the shell.
+  // Settings is in here (not gated higher) because a newcomer needs it for
+  // first-time setup — CLI re-auth and choosing their craft both live there
+  // (task 1291) — while still staying behind sign-in: it shows personal prefs
+  // and mints CLI tokens.
+  //
+  // The reading rooms USED to sit a tier above this, behind requireNonXenosPage
+  // (page.view.builder, thetes+), on #770's reasoning that a Xenos's path is
+  // action-only. That got it backwards: the citizen's primer and the onboarding
+  // diagrams are written FOR the first-session newcomer, and gating them at
+  // thetes redirected exactly that reader to /builders/not-ready. Owner's call
+  // (task 1002710) — the RANK floor is gone; sign-in is unchanged.
+  // The link-hiding in shell.js is only cosmetic; these are the real gates.
+  const SIGNEDIN_BUILDERS_PAGE_RE =
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+  // The diagram image assets under /builders/diagrams/ ride the same tier as the
+  // page that embeds them.
+  const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     // Cheap early-out: only /builders/* paths can ever be gated, so skip the
@@ -850,10 +869,8 @@ function mountInternalSurfaces(app) {
     // closes that bypass so the gate holds at the application layer, not just
     // behind the proxy's path normalization.
     const norm = path.posix.normalize(req.path);
-    if (NONXENOS_BUILDERS_PAGE_RE.test(norm) || NONXENOS_BUILDERS_PREFIX_RE.test(norm)) {
-      return gdsAuth.requireNonXenosPage(req, res, next);
-    }
-    if (SIGNEDIN_BUILDERS_PAGE_RE.test(norm) || TASK_DETAIL_PAGE_RE.test(norm)) {
+    if (SIGNEDIN_BUILDERS_PAGE_RE.test(norm) || SIGNEDIN_BUILDERS_PREFIX_RE.test(norm)
+      || TASK_DETAIL_PAGE_RE.test(norm)) {
       return gdsAuth.requireBuilderPage(req, res, next);
     }
     next();

package/src/module-api.js

@@ -561,8 +561,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.65 with no explicit bump. run 31599966075. (task 1002620)
 //   1.19.67 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.66 with no explicit bump. run 31605591253. (task 1002620)
+//   1.19.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.67 with no explicit bump. run 31608183268. (task 1002620)
+//   1.19.69 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.68 with no explicit bump. run 31608503813. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.67'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.69'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_nav.mjs

@@ -134,8 +134,9 @@ test('sidebar groups read by audience, in order', () => {
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.
-  // Archon-gated cosmetically to match its data endpoint; requireProjectCuratePage
-  // is the wall server-side.
+  // Gated cosmetically to match its data endpoint — `project.curate`, floor METIC,
+  // so the nav entry reads 'governance' since task 1002710 (it said 'archon', which
+  // was stricter than the wall). requireProjectCuratePage is the wall server-side.
   assert.deepEqual(nav[2].items.map((i) => i.id), ['leaderboard', 'people'], 'Community = everyone else');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');

package/tests/hall_page_gate_map.mjs

@@ -0,0 +1,166 @@
+// tests/hall_page_gate_map.mjs
+//
+// GUARD (task 1002710): pins WHICH page gate each hall URL routes to.
+//
+// tests/governance_page_gates.mjs proves each gate FUNCTION admits the right
+// audience. Nothing proved the other half — that a given /builders/* URL is
+// wired to the gate it is supposed to be wired to. That gap is not theoretical:
+// /sessions and /scouting each shipped with NO page gate at all, relying on a
+// client-side showSealed() and a data-route 403 respectively, and no test
+// noticed. A page whose shell is served to everyone is not a data leak while
+// its API holds, but it is a wall that exists only in the reviewer's head.
+//
+// It parses serve-internal.js STATICALLY (no import — that pulls the whole app),
+// in the style of tests/served_paths_shipped.mjs: pull the `*_PAGE_RE` literals
+// out of the source, pull the `if (…) return gdsAuth.<gate>(…)` dispatch out of
+// the same source, and run the oracle's URLs through the reconstructed map.
+//
+// Run:  node tests/hall_page_gate_map.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { posix as posixPath } from 'node:path';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
+
+// ═══ the ORACLE — hand-written, one row per gated hall URL ═══════════════════
+// `null` means "no page gate": the shell is served to anyone who asks. That is
+// correct for the genuinely public pages and a BUG anywhere else, so every such
+// row is spelled out rather than left to a default.
+//
+// Audiences (the floors live in modules/governance/catalog.js; the gate
+// functions in src/bongos/auth.js):
+//   requireBuilderPage          page.view.public    any signed-in builder (xenos+)
+//   requireGovernancePage       page.view.governance  metic+   (ADR 0157)
+//   requireProjectCuratePage    project.curate        metic+
+//   requireGovernanceManagePage governance.manage     archon
+const ORACLE = {
+  // Any signed-in builder — no rank floor.
+  '/builders/work': 'requireBuilderPage',
+  '/builders/pair': 'requireBuilderPage',
+  '/builders/settings': 'requireBuilderPage',
+  '/builders/atlas': 'requireBuilderPage',
+  '/builders/modules': 'requireBuilderPage',
+  '/builders/goals': 'requireBuilderPage',
+  '/builders/roadmap': 'requireBuilderPage',
+  // task 1002710: the orientation reading rooms moved DOWN to this tier from
+  // requireNonXenosPage (thetes+). They are the onboarding documents, so gating
+  // them above xenos turned away the exact reader they were written for. The
+  // sign-in requirement is unchanged — only the RANK floor is gone.
+  '/builders/primer': 'requireBuilderPage',
+  '/builders/primer.md': 'requireBuilderPage',
+  '/builders/diagrams': 'requireBuilderPage',
+  '/builders/diagrams/02-b.png': 'requireBuilderPage',
+
+  // Metic+ operator surfaces (the Governance nav group).
+  '/builders/watch': 'requireGovernancePage',
+  '/builders/harbor': 'requireGovernancePage',
+  '/builders/gate': 'requireGovernancePage',
+  '/builders/sessions': 'requireGovernancePage',
+
+  // Metic+ via the `project.curate` atom — the exact permission GET /scouting
+  // checks, so neither page can drift wider than the API it fronts.
+  '/builders/people': 'requireProjectCuratePage',
+  '/builders/scouting': 'requireProjectCuratePage',
+
+  // Archon.
+  '/builders/governance': 'requireGovernanceManagePage',
+
+  // Deliberately UNGATED — the landing card, the rank ladder, the reward
+  // schedule and a builder's public portfolio all render for a stranger.
+  '/builders/': null,
+  '/builders/ranks': null,
+  '/builders/drachmae': null,
+  '/builders/profile': null,
+  '/builders/not-ready': null,
+};
+
+// ─── reconstruct the URL→gate map from the source ───────────────────────────
+// 1. every `const NAME_RE = /…/;` (the page-matching regexes)
+function readRegexes(src) {
+  const out = new Map();
+  const re = /const\s+([A-Z0-9_]+_RE)\s*=\s*(\/(?:\\.|\[(?:\\.|[^\]])*\]|[^/\\])+\/[gimsuy]*)\s*;/g;
+  for (const m of src.matchAll(re)) out.set(m[1], eval(m[2])); // eslint-disable-line no-eval
+  return out;
+}
+
+// 2. every `if (<condition>) { return gdsAuth.<gate>(req, res, next); }`
+function readDispatch(src) {
+  const out = [];
+  // `[^{};]` keeps the condition capture INSIDE one if-header. A permissive
+  // `[^]*?` looks lazy enough but will happily start at some earlier `if (` and
+  // swallow every intervening line, hoovering up unrelated *_RE names and
+  // mapping them all to the first gate it reaches.
+  const re = /if\s*\(([^{};]*?)\)\s*\{\s*return\s+gdsAuth\.(\w+)\(req,\s*res,\s*next\);/g;
+  for (const m of src.matchAll(re)) {
+    const names = [...m[1].matchAll(/([A-Z0-9_]+_RE)/g)].map((x) => x[1]);
+    if (names.length) out.push({ names, gate: m[2] });
+  }
+  return out;
+}
+
+const REGEXES = readRegexes(SRC);
+const DISPATCH = readDispatch(SRC);
+
+// The gate a URL resolves to, mirroring the middleware: first matching branch wins.
+function gateFor(urlPath) {
+  const norm = posixPath.normalize(urlPath);
+  for (const { names, gate } of DISPATCH) {
+    for (const name of names) {
+      const rx = REGEXES.get(name);
+      if (rx && rx.test(norm)) return gate;
+    }
+  }
+  return null;
+}
+
+test('the static parse actually found the gate wiring', () => {
+  assert.ok(REGEXES.size >= 8, `expected the *_PAGE_RE literals, found ${REGEXES.size}`);
+  assert.ok(DISPATCH.length >= 3, `expected the gdsAuth dispatch branches, found ${DISPATCH.length}`);
+  // If this file is ever restructured past the parser, these two fail LOUDLY
+  // rather than letting every row below pass vacuously against an empty map.
+  assert.ok(DISPATCH.some((d) => d.gate === 'requireBuilderPage'));
+  assert.ok(DISPATCH.some((d) => d.gate === 'requireGovernancePage'));
+});
+
+test('every hall URL routes to the page gate the oracle names', () => {
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    assert.equal(gateFor(urlPath), expected,
+      `${urlPath} → ${gateFor(urlPath) ?? 'NO GATE'} (expected ${expected ?? 'NO GATE'})`);
+  }
+});
+
+test('the .html twin of a gated page is gated identically', () => {
+  // express.static resolves /builders/watch from watch.html via extensions:['html'],
+  // so the explicit .html form must not slip past the gate the bare form carries.
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    if (expected === null || urlPath.includes('.')) continue;
+    assert.equal(gateFor(`${urlPath}.html`), expected, `${urlPath}.html must match ${urlPath}`);
+  }
+});
+
+test('path-normalization tricks do not slip past a gate', () => {
+  // The middleware normalizes before matching precisely so these forms — which
+  // express.static WILL resolve to the same file — cannot bypass an anchored RE.
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    if (expected === null) continue;
+    const tail = urlPath.replace(/^\/builders\//, '');
+    for (const sneaky of [`/builders//${tail}`, `/builders/./${tail}`]) {
+      assert.equal(gateFor(sneaky), expected, `${sneaky} must resolve to ${expected}`);
+    }
+  }
+});
+
+test('no gated page is left matching only a REMOVED gate function', () => {
+  // requireNonXenosPage still EXISTS in auth.js (page.view.builder is a live
+  // catalog atom an Archon can attach to a custom role) but task 1002710 left it
+  // guarding nothing. If someone re-points a URL at it, that is a deliberate act
+  // that should update this oracle — not something to happen silently.
+  const wired = new Set(DISPATCH.map((d) => d.gate));
+  assert.ok(!wired.has('requireNonXenosPage'),
+    'requireNonXenosPage guards no hall URL since task 1002710 — update the ORACLE if that changes');
+});

package/tests/onboard.mjs

@@ -93,6 +93,23 @@ test('every render surface carries the terminal hall step (task 1002703)', () =>
   assert.match(enterHall.join(''), /bongos dev/, '/create offers the local hall when no domain');
 });
 
+test('the /create done panel is plan-driven, manifest-driven, and owner-honest (task 1002694)', () => {
+  // Gaps 2/3/4/14 of the project-creation audit (docs/audits/project-creation-gap-list.md).
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/create.html'), 'utf8');
+  // gap 2 (idea 1000675): the checklist renders FROM the canonical plan endpoint
+  assert.match(src, /provisioning\/onboard-plan/, 'the done panel fetches the canonical plan');
+  // gap 3 (idea 1000676): the ADR 0133 one-click manifest flow has a UI caller again
+  assert.match(src, /\/github-app/, 'the done panel drives the GitHub-App manifest flow');
+  assert.match(src, /github-app\/status/, 'and polls its progress to reflect live state');
+  // gap 4: the operator-only control-plane command never reaches a new owner
+  assert.doesNotMatch(src, /oauth-secret place/, 'owners are never handed the control-plane placement command');
+  // gap 14 (idea 1000684): repo visibility is stated, with the private path named
+  assert.match(src, /public/, 'visibility is stated');
+  assert.match(src, /adopt/i, 'the private path (adopt your own private repo) is named');
+});
+
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {
   const oa = ob.oauthAppInstructions('mercury.example.com');
   assert.equal(oa.homepageUrl, 'https://mercury.example.com');
@@ -154,7 +171,10 @@ test('the web form (/create) declares EXACTLY the canonical human steps — drif
   };
   for (const [name, rel] of Object.entries(surfaces)) {
     const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
-    const found = [...src.matchAll(/data-onboard-step="([^"]+)"/g)].map((m) => m[1]);
+    // keys are kebab-case literals; the charset excludes the page's DYNAMIC fallback
+    // tag (data-onboard-step="' + esc(s.key) + '"), which renders unknown plan steps
+    // at runtime and has no literal key to pin here (task 1002694).
+    const found = [...src.matchAll(/data-onboard-step="([a-z0-9-]+)"/g)].map((m) => m[1]);
     const uniq = [...new Set(found)].sort();
     assert.deepEqual(uniq, humanKeys, `${name} (${rel}) must tag exactly the canonical human steps [${humanKeys}], found [${uniq}]`);
   }