@bongos/core 1.19.68 → 1.19.70

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.68",
-  "core_contract": "1.19.68",
-  "source_commit": "0b0e7e636f0a28d01e1bc8f354a06981d6f1ef70",
+  "core_version": "1.19.70",
+  "core_contract": "1.19.70",
+  "source_commit": "b92ae4a4d4458ff81409d2aff12bfc88bd0ef50d",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T14:42:16.480Z",
+  "built_at": "2026-08-12T15:26:39.115Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 292,
+    "docs_redacted": 293,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1222,
+    "functional_verbatim": 1223,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1535,
-  "tree_sha256": "cc9278ac9df146953fa33e771313791e8ce82f5d69b05a307763c48bae6207e9",
+  "file_count": 1537,
+  "tree_sha256": "56c1de962c6965257fb63c72e0201b2a0652833acf9ade499ed57c96e9650adb",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1304,10 +1304,15 @@
       "mode": "0000644",
       "sha256": "3d260a52d4aa494e2df58f0db1c038c091786fbea99bad77d35b86b1a2024cf3"
     },
+    {
+      "path": "docs/adr/0167-gate-trust-link-agpl-default.md",
+      "mode": "0000644",
+      "sha256": "bb187a29953ba5c316977f09fe86e26ca200693b23cf5c41ece93e9dd24f337e"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "59110e7260facffd2771e1b3a4c411f238cd95d49ff07f1ac2be9541b9fda4c2"
+      "sha256": "b0387cdc43a67c4b9834691155d1fa9454930cb70b0660bb55a0f7e819c7ec90"
     },
     {
       "path": "docs/api-reference.md",
@@ -1337,7 +1342,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "b7f66c6f1fbed274e5ba3295c06db8fc8edb84edd44f6ce92f6734e18267e3d9"
+      "sha256": "96ae791fc131dc389158f326e5fc698283de3d67d3396003bae2632f24a148b0"
     },
     {
       "path": "docs/design-contract.md",
@@ -2977,7 +2982,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "5bdd907f10ae15f8efdb55adce3ce23991a376122eb79c549e025f8f4845fae5"
+      "sha256": "076103658308541ef6b976bc333c67a2dc0069913fadbd5551c6241cc320bda4"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -3282,7 +3287,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "56c1450dd72fcda19841f3a0a98b918b1b875f49971e93d60218fb62e8a21dad"
+      "sha256": "ac31de1ecb51a0899d043b7fa098693ae69cbc3ebe858c97e6c8df2c4cef8015"
     },
     {
       "path": "modules/hall-ui/public/style.css",
@@ -4042,12 +4047,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9319b9acd693e6a9804c215db5ed78ae38f4caf1a698e0596972bfef9555b91c"
+      "sha256": "68b3bc7974e4f90d5291ba89dc3451d1cde4db4cff174ba3ed1347e4599c77da"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "147790e86972f4273aa18bd24bf508797c4470a4491a20a9614207edeb2e3478"
+      "sha256": "505474194374951dfc13ffca64f10c469da2782e1756214c3efb3a60b8151b68"
     },
     {
       "path": "public-docs/index.html",
@@ -4292,7 +4297,7 @@
     {
       "path": "public-landing/create.html",
       "mode": "0000644",
-      "sha256": "1874575c2241df1e868d158f3fc4c6c123b8c35531a5b1425de9974230da6510"
+      "sha256": "419539862b5453d613a5ed3758a7d8fa677d16e463895ae64e6268a8d59372ba"
     },
     {
       "path": "public-landing/gate/README.md",
@@ -5642,7 +5647,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "2f88796346b1c3a6dc49e25766b223fbf2d99e34b38b9a0f1e64a6fb9a59856d"
+      "sha256": "006a51d3bd71cc496742e9399c53dc5b1ebd18c87a54e675aabda6ac312b4b96"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -5672,7 +5677,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "28675b76775e2936b6ba819fa37c6628f96b259b850248f2ce1033e9bcd7fe20"
+      "sha256": "993ad9f8c4be17c840767dff8c4e092a2ea55c5cbe73a09a53371e31cccfa720"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6697,7 +6702,12 @@
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
-      "sha256": "c2456b6fe8845c5778e9e57323cd7a0f2f9d6e96ef9d3a9d4f47f0312da07964"
+      "sha256": "b0da8fb0e46c57419821dbf8cb5ddeda3c98da76d1b2918c3ce77798ee2768fb"
+    },
+    {
+      "path": "tests/hall_page_gate_map.mjs",
+      "mode": "0000644",
+      "sha256": "1e59d5608c205aa6f271c5efd0acb7899f4996dfbaecbf35c387737f19c735f5"
     },
     {
       "path": "tests/hall_palette.mjs",
@@ -7037,7 +7047,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "6a66477263031b252d6a92d5036304a78e11cbbd9e7230d836c4ec96a9297fdd"
+      "sha256": "40d4656e2170370cd3b662911502579fed595fd66fd25b8add65d488a28bb834"
     },
     {
       "path": "tests/onboarding_gate.mjs",

package/docs/adr/0167-gate-trust-link-agpl-default.md

@@ -0,0 +1,24 @@
+# 0167 — The /create gate trust link defaults to the AGPL license text, not the npm package page
+
+- **Status:** Accepted — built in task 1002705.
+- **Date:** 2026-08-12
+- **Deciders:** jaxri (Archon) — autonomous session; the residual choice is the owner's (idea 1000700).
+- **Task:** task 1002705 · **Goal:** 1000059 (projects surface revamp) · gap 1 of [`docs/audits/project-creation-gap-list.md`](../audits/project-creation-gap-list.md).
+
+## Context
+
+The /create gate's "open source" trust link pointed at `github.com/example-owner/Claude-OTB` — a 404 even authenticated (the real core repo is private). Task 1002705's brief said to "default to the npm link so the 404 dies now," on the premise that `@cloudbongos/core` is public on the registry.
+
+That premise is false, verified 2026-08-12 against `registry.npmjs.org`: **both `@cloudbongos/core` and `@bongos/core` 404 anonymously** — they are private scoped packages (ADR 0134 publishes the core privately; npm shows private packages as 404 to signed-out visitors). The [ADR 0099](<redacted>.md) public mirror is deliberately dormant until history clears the 180-day redaction window (~2026-11). So today there is **no browsable public code artifact at all** — following the brief literally would swap one dead link for another.
+
+## Decision
+
+Point the gate's "open source" link at the **AGPL-3.0 license text** (`https://www.gnu.org/licenses/agpl-3.0.html`) and tighten the copy to "open source (AGPL-3.0)". The license is the one live, instance-neutral artifact behind the claim today ([ADR 0065](<redacted>.md) — AGPL is the governance keystone), and the link carries no instance identity into the portable core.
+
+The upgrade to a *browsable-code* link is the owner's call, filed as **idea 1000700** with three options: flip the repo public now (forfeits the redaction window — weigh ADR 0065 §4), publish a public npm package, or wait for the ADR 0099 mirror (~2026-11, zero extra work). When one lands, repoint the `finePrint` link in `public-landing/create.html`; the pin is `tests/onboard.mjs` "the /create gate trust link points at a live artifact".
+
+## Alternatives considered
+
+- **The npm package page (the brief's default)** — rejected: verified 404 for anonymous visitors; the gate's audience is exactly the signed-out visitor.
+- **Make the repo public now** — not a builder's call; forfeits the deliberate 6-month redaction window (ADR 0065/0099). Surfaced to the owner instead (idea 1000700).
+- **Drop the link, keep plain text** — dies the 404 but weakens the claim; the license link is strictly more information at the same cost.

package/docs/adr/README.md

@@ -239,5 +239,6 @@ This keeps the decision history honest and traceable.
 | 0164 | [**The implausible-pass guard reads substance + evidence; the Metic+ honor-system residual is explicit** ([task 1002658](https://cloudbongos.com/builders#/task/1002658); grader-hardening goal 1000056). The guard fired only on `issues.length===0` — one fabricated `{}` defeated it, its magnitude inputs are client-supplied, and every in-sample firing (eval 2-for-2, tasks 1002643 ×2, 1002663) was a false positive on an honest unanimous zero-issue panel PASS. Redesign: count only SUBSTANTIVE issues (known severity + non-empty summary — padding trips the guard regardless), and waive the zero-issue pass when `signals.workers` carries the full &ge;3-worker panel shape, stamped `implausible_pass_waived` for /grade-audit. The residual is named, not hidden: every grade-time input is client-authored, so plausibility at grade time is honest-mistake hygiene; the binding authorities on the real diff are land-time (CI unit, gate-review, main audit) — Metic+ grade-time honesty is accepted honor-system per this ADR. The ADR-0042 CI grade-gate (land it vs record permanent deferral) goes to the owner as a blocker, not decided here. No approval step added or removed (ADR 0162).](<redacted>.md) | GDS / grading |
 | 0165 | [**Instances are hookless by default: no scaffolded `.husky/`; local hooks stay an instance-owned opt-in** ([task 1002641](https://cloudbongos.com/builders#/task/1002641); idea 1000655). Task 1002608 delivered the ADR 0043 Layer 1 pre-push gate for the CORE repo, but nothing materializes `.husky/` on a scaffolded standalone instance (`publish-manifest.js` excludes it by design). Decision: that is the accepted posture, not a gap. Sub-Metic instance builders hold no push credential at all (server-mediated publish, ADR 0053/0055) — a client pre-push hook guards a push that cannot happen; a client hook is not a security boundary (ADR 0016); the core cannot maintain hooks it deliberately does not ship (scaffolded hooks would be born orphans — the audit-authorship rot lesson, task 1002640); and ADR 0162 puts gates in CI, rank-consistent and hands-free. Secrets hooks follow the same rule (the PR-time CI secret scan enforces). The opt-in stays real and instance-owned: an instance commits its own `.husky/` and the core's `install-git-hooks.js` (already run by `/builder-setup`) activates it. Rejected: scaffolding wrappers at init, an `--with-hooks` flag (speculative), treating hooklessness as a regression. Revisit if an instance model has builders pushing directly with their own credentials.](<redacted>.md) | provisioning / trust boundary |
 | 0166 | [**Module maintenance & deprecation policy: upkeep is a declared `maintenance` block, and `bongos upgrade` surfaces rot in DISABLED modules too** ([task 1001773](https://cloudbongos.com/builders#/task/1001773)). Implements [ADR 0107](<redacted>.md) §7, which named the catalog-rot problem and deferred the mechanics. `module.json` gains an optional-in-schema, required-to-upstream `maintenance` block — `status` one of `core-maintained` / `maintained` / `deprecated` / `orphaned`, plus `since` / `removeAfter` / `successor` / `note`. Each status owes something the validator enforces: `maintained` requires a named top-level `maintainer` (an unnamed owner IS the orphaning failure), a sunset status requires a deprecation path, and `removeAfter` is rejected on a non-sunset status. `orphaned` is deliberately first-class — a policy that only permits happy statuses gets satisfied by lying. The load-bearing fix: accepted modules ship `default:false` (§6), so every rotted catalog entry is DISABLED by construction — and `preflightModules()` returned only `blocking`, discarding `warnings`, so a real `bongos upgrade --to X` reported `"all enabled modules satisfy the target"` while saying nothing about them. It now returns + prints `warnings`/`deprecations`/`expired` with the maintainer NAMED, before the blocking check returns (so a refused bump reports them too). Enabled mismatches still refuse; disabled ones still never block — report, don't block, because blocking an instance's bump on a catalog entry it never opted into makes the shared catalog a liability. `bongos module check`/`submit` refuse an undeclared posture or an already-sunset module; `GET /modules` + the hall Modules tab show an `upkeep:` chip (incl. `undeclared`); all 17 bundled modules stamped `core-maintained` with a unit test holding the line. Rejected: blocking on disabled rot, a required manifest field (breaks every existing manifest), DB-tracked upkeep (must travel with the module, ADR 0107 §2), auto-deprecating on incompatibility (a fact is not a decision), a separate MAINTAINERS file.](<redacted>.md) | modules / upstreaming |
+| 0167 | [**The /create gate trust link defaults to the AGPL-3.0 license text, not the npm package page** ([task 1002705](https://cloudbongos.com/builders#/task/1002705); gap 1 of the project-creation audit). The gate's "open source" link pointed at a nonexistent repo (404); the task brief's suggested default — the npm package page — is ALSO dead for the gate's actual audience (signed-out visitors): `@cloudbongos/core` and `@bongos/core` both 404 anonymously (private scopes, ADR 0134), and the ADR 0099 public mirror stays dormant until ~2026-11. The license text is the one live, instance-neutral artifact behind the claim today. The browsable-code upgrade is the owner's filed choice (idea 1000700): public repo now (forfeits the ADR 0065 §4 redaction window) / public npm package / wait for the mirror. Rejected: the npm link (verified dead), flipping the repo public (not a builder's call), plain unlinked text (less information, same cost).](<redacted>.md) | public landing / governance |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/canonical-permissions.md

@@ -179,7 +179,9 @@ or missing ranks fail closed.
   **[ADR 0157](adr/<redacted>.md) added the whole operational block here** —
   20 permissions that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
   the governance/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.governance`) and
-  `GET /api/gds/sessions/search`; the **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
+  `GET /api/gds/sessions/search` (whose own `/sessions` page had no server gate at all until
+  task 1002710 put it behind `page.view.governance` alongside its three group-mates); the
+  **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
   `POST /boxes/:b/close`, `PATCH .../block`, `GET /provisioning/fleet[/cost-ledger]`,
   `POST .../force-teardown`); **security adjudication** (`GET /security/reports`,
   `POST /security/reports/:id/{confirm,dispute,fix,link-fix}`, `/security/docs` CRUD);

package/modules/hall-ui/public/builders.js

@@ -493,16 +493,17 @@
   // Roll) stays hidden so a fresh arrival isn't drowned before they've
   // shipped their first works. The Settings link is the exception (task
   // 1291): a newcomer needs it for first-time setup — CLI re-auth (Settings
-  // → CLI Access) and choosing their craft both live there. #766 also hides the
-  // citizen's primer + the "how the system works" maps — a newcomer's path is
-  // action-only. #770: the Work Board link IS shown to a Xenos — a newcomer
-  // needs to find the work they can claim, so the path "find work → claim →
-  // ship three" stays one click away; the rank ladder also stays so they can
-  // see what they're climbing toward. This is cosmetic UX only — every data
-  // endpoint stays server-rank-gated regardless (the Work Board's claimable
-  // feed only returns work accessible to the caller's rank), and a Xenos who
-  // types /primer or /diagrams directly is bounced to /builders/not-ready by
-  // the server (#770). Set early in loadAll so the async karma/acclaim feeds
+  // → CLI Access) and choosing their craft both live there. The citizen's
+  // primer and the "how the system works" maps are ALSO visible to a Xenos as
+  // of task 1002710 — #766/#770 had hidden them on an "action-only path"
+  // reading, but they are the onboarding documents, so the reader they were
+  // written for was the one being turned away. #770: the Work Board link IS
+  // shown to a Xenos — a newcomer needs to find the work they can claim, so the
+  // path "find work → claim → ship three" stays one click away; the rank ladder
+  // also stays so they can see what they're climbing toward. This is cosmetic
+  // UX only — every data endpoint stays server-rank-gated regardless (the Work
+  // Board's claimable feed only returns work accessible to the caller's rank).
+  // Set early in loadAll so the async karma/acclaim feeds
   // (which un-hide their own scroll on data) respect it; the section-hiding
   // sweep then runs before renderNav so the chip strip matches.
   const NEWCOMER_VISIBLE_SECTIONS = new Set([

package/modules/hall-ui/public/shell.js

@@ -136,14 +136,22 @@
     { group: 'Community', gate: 'member', items: [
       { id: 'leaderboard', label: 'Leaderboard', icon: 'leaderboard', href: '/#leaderboard', view: 'leaderboard', gate: 'member' },
       // task 1002577: the cross-project builder directory (/scouting graduated
-      // into the hall). Archon-gated to MATCH its data — /api/gds/scouting is
-      // deliberately "NOT shown to builders" (ADR 0141 §4) until spec R14 widens
-      // it; this gate is cosmetic, requireProjectCuratePage is the wall. The
-      // module gate hides the tab on instances without the platform-identity hub.
-      { id: 'people', label: 'People', icon: 'people', href: '/people', gate: 'archon', module: 'platform-identity' },
+      // into the hall). Gated to MATCH its data — /api/gds/scouting checks
+      // `project.curate`, whose catalog floor is METIC. This read 'archon' until
+      // task 1002710: the nav was stricter than the wall, so a Metic could open
+      // /people by URL but never saw the link. Cosmetic either way —
+      // requireProjectCuratePage is the wall — but a nav that disagrees with the
+      // gate teaches the ladder wrong. The module gate hides the tab on
+      // instances without the platform-identity hub.
+      { id: 'people', label: 'People', icon: 'people', href: '/people', gate: 'governance', module: 'platform-identity' },
     ] },
     { group: 'Docs', gate: 'signed', items: [
-      { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'member' },
+      // task 1002710: primer + diagrams were gate:'member' (rank !== xenos) to
+      // mirror the old thetes+ page gate. That gate is gone — the reading rooms
+      // are for the first-session newcomer above all — so the links follow it
+      // down to 'signed'. Leaving them at 'member' would have ungated the pages
+      // while still hiding them from the only readers the change was for.
+      { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'signed' },
       { id: 'ranks', label: 'Ranks', icon: 'docs', href: '/ranks', gate: 'signed' },
       // task 2175: /drachmae had no nav entry at all — reachable only from prose
       // links since task 2174 moved the bounty rate card onto it. It is reference
@@ -153,7 +161,7 @@
       // stays right whatever `branding.currency.label` is set to. Page is public
       // like /ranks — 'signed' is the same cosmetic "show it once you're in".
       { id: 'economy', label: 'Economy', icon: 'docs', href: '/drachmae', gate: 'signed' },
-      { id: 'diagrams', label: 'Diagrams', icon: 'docs', href: '/diagrams', gate: 'member' },
+      { id: 'diagrams', label: 'Diagrams', icon: 'docs', href: '/diagrams', gate: 'signed' },
       { id: 'atlas', label: 'Repo Atlas', icon: 'docs', href: '/atlas', gate: 'member' },
       { id: 'modules', label: 'Modules', icon: 'docs', href: '/modules', gate: 'member' },
       // The rendered OpenAPI reference lives on the APEX (/docs), not this builders

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.68",
+  "version": "1.19.70",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.68",
+      "version": "1.19.70",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.68",
+  "version": "1.19.70",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/create.html

@@ -387,7 +387,11 @@ input[type=text].bad{border-color:var(--err);}
         <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
         Sign in with GitHub
       </a>
-      <p class="finePrint">Free while we find our feet. Your project's repo and server are yours — Cloud Bongos is <a href="https://github.com/lars589/Claude-OTB" style="color:inherit">open source</a> and capture-resistant by design.</p>
+      <!-- Trust link → the AGPL license text (task 1002705): the old private-repo URL
+           404ed, and no public code artifact exists until the ADR 0099 mirror flips
+           (~2026-11; npm scopes are private too) — the license is the one live,
+           instance-neutral artifact behind the claim today. -->
+      <p class="finePrint">Free while we find our feet. Your project's repo and server are yours — Cloud Bongos is <a href="https://www.gnu.org/licenses/agpl-3.0.html" style="color:inherit" target="_blank" rel="noopener">open source (AGPL-3.0)</a> and capture-resistant by design.</p>
       <div class="alert" id="gateAlert" role="alert"></div>
     </section>
 

package/src/bongos/serve-internal.js

@@ -696,6 +696,13 @@ function mountInternalSurfaces(app) {
   const WATCH_PAGE_RE = /^\/builders\/watch(?:\.html)?\/?$/;
   const HARBOR_PAGE_RE = /^\/builders\/harbor(?:\.html)?\/?$/;
   const GATE_PAGE_RE = /^\/builders\/gate(?:\.html)?\/?$/;
+  // /sessions (the session-log ledger) belongs to that same Governance group and
+  // its data route (`session.search`) carries the same metic floor since ADR 0157
+  // — but it had NO page gate at all: sessions.js only called showSealed() after
+  // /api/bongos/me, so the shell was served to anyone who asked for the URL. The
+  // data never leaked (the route gate held), but the page was the one item in the
+  // group without a wall. Gated here so the group is uniform (task 1002710).
+  const SESSIONS_PAGE_RE = /^\/builders\/sessions(?:\.html)?\/?$/;
   // The /governance roles-and-permissions tab (BV1.R113) sits one floor higher:
   // the `governance.manage` atom itself (archon), the same key its data routes
   // check — requireGovernanceManagePage, not the metic-floored gate above.
@@ -704,17 +711,25 @@ function mountInternalSurfaces(app) {
   // exact permission its data route (GET /scouting) checks — same posture as the
   // /governance tab above (the page can never drift wider than the API it fronts).
   const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
+  // /scouting is the LEGACY twin of /people — the same /api/gds/scouting directory,
+  // left behind when task 1002577 graduated it into the hall. It has no nav entry
+  // and its own header claims "Archon-only", but it was never page-gated: the page
+  // rendered for anyone and leaned entirely on the data route's 403. Gated on the
+  // same atom as /people so the two can't drift apart (task 1002710). Deleting it
+  // in favour of /people is a separate call — it is walled, not removed, here.
+  const SCOUTING_PAGE_RE = /^\/builders\/scouting(?:\.html)?\/?$/;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (!req.path.startsWith('/builders')) return next();
     const norm = path.posix.normalize(req.path);
-    if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)) {
+    if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)
+      || SESSIONS_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernancePage(req, res, next);
     }
     if (GOVERNANCE_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernanceManagePage(req, res, next);
     }
-    if (PEOPLE_PAGE_RE.test(norm)) {
+    if (PEOPLE_PAGE_RE.test(norm) || SCOUTING_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);
     }
     next();
@@ -820,24 +835,28 @@ function mountInternalSurfaces(app) {
   // (style.css, *.js, fonts, cursors), the not-ready notice, and the sign-in flow
   // itself stay PUBLIC so the landing card + GitHub button render for a stranger.
   //
-  // Two tiers of gate (#770):
-  //   * NON-XENOS (Thetes+) — the orientation reading rooms (primer, diagrams).
-  //     A Xenos's path is action-only; an unauth visitor is sent to sign-in, a
-  //     Xenos to the friendly /builders/not-ready notice.
-  //   * ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals page, the
-  //     task-detail page, the Repo Atlas, the Dev Box pair page,
-  //     and Settings (#748, #904, task 1293, task 1757, task 751): a Xenos IS
-  //     allowed, but an unauthenticated visitor is bounced into sign-in rather
-  //     than served the page shell. Settings sits in THIS tier (not the
-  //     reading-room tier) because a newcomer needs it for first-time setup —
-  //     CLI re-auth (the "CLI Access" section) and choosing their craft both
-  //     live there (task 1291). It must still stay behind sign-in: it shows
-  //     personal prefs and mints CLI tokens.
-  // The link-hiding in builders.js is only cosmetic; these are the real gates.
-  const NONXENOS_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:primer(?:\.md|\.html)?|diagrams(?:\.html)?)\/?$/;
-  const NONXENOS_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;
-  const SIGNEDIN_BUILDERS_PAGE_RE = /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap)(?:\.html)?\/?$/;
+  // ONE tier of gate: ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals
+  // page, the task-detail page, the Repo Atlas, the Dev Box pair page, Settings
+  // (#748, #904, task 1293, task 1757, task 751) and, since task 1002710, the
+  // orientation reading rooms (primer, diagrams). A Xenos IS allowed; an
+  // unauthenticated visitor is bounced into sign-in rather than served the shell.
+  // Settings is in here (not gated higher) because a newcomer needs it for
+  // first-time setup — CLI re-auth and choosing their craft both live there
+  // (task 1291) — while still staying behind sign-in: it shows personal prefs
+  // and mints CLI tokens.
+  //
+  // The reading rooms USED to sit a tier above this, behind requireNonXenosPage
+  // (page.view.builder, thetes+), on #770's reasoning that a Xenos's path is
+  // action-only. That got it backwards: the citizen's primer and the onboarding
+  // diagrams are written FOR the first-session newcomer, and gating them at
+  // thetes redirected exactly that reader to /builders/not-ready. Owner's call
+  // (task 1002710) — the RANK floor is gone; sign-in is unchanged.
+  // The link-hiding in shell.js is only cosmetic; these are the real gates.
+  const SIGNEDIN_BUILDERS_PAGE_RE =
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+  // The diagram image assets under /builders/diagrams/ ride the same tier as the
+  // page that embeds them.
+  const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     // Cheap early-out: only /builders/* paths can ever be gated, so skip the
@@ -850,10 +869,8 @@ function mountInternalSurfaces(app) {
     // closes that bypass so the gate holds at the application layer, not just
     // behind the proxy's path normalization.
     const norm = path.posix.normalize(req.path);
-    if (NONXENOS_BUILDERS_PAGE_RE.test(norm) || NONXENOS_BUILDERS_PREFIX_RE.test(norm)) {
-      return gdsAuth.requireNonXenosPage(req, res, next);
-    }
-    if (SIGNEDIN_BUILDERS_PAGE_RE.test(norm) || TASK_DETAIL_PAGE_RE.test(norm)) {
+    if (SIGNEDIN_BUILDERS_PAGE_RE.test(norm) || SIGNEDIN_BUILDERS_PREFIX_RE.test(norm)
+      || TASK_DETAIL_PAGE_RE.test(norm)) {
       return gdsAuth.requireBuilderPage(req, res, next);
     }
     next();

package/src/module-api.js

@@ -563,8 +563,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.66 with no explicit bump. run 31605591253. (task 1002620)
 //   1.19.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.67 with no explicit bump. run 31608183268. (task 1002620)
+//   1.19.69 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.68 with no explicit bump. run 31608503813. (task 1002620)
+//   1.19.70 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.69 with no explicit bump. run 31612248859. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.68'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.70'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_nav.mjs

@@ -134,8 +134,9 @@ test('sidebar groups read by audience, in order', () => {
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.
-  // Archon-gated cosmetically to match its data endpoint; requireProjectCuratePage
-  // is the wall server-side.
+  // Gated cosmetically to match its data endpoint — `project.curate`, floor METIC,
+  // so the nav entry reads 'governance' since task 1002710 (it said 'archon', which
+  // was stricter than the wall). requireProjectCuratePage is the wall server-side.
   assert.deepEqual(nav[2].items.map((i) => i.id), ['leaderboard', 'people'], 'Community = everyone else');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');

package/tests/hall_page_gate_map.mjs

@@ -0,0 +1,166 @@
+// tests/hall_page_gate_map.mjs
+//
+// GUARD (task 1002710): pins WHICH page gate each hall URL routes to.
+//
+// tests/governance_page_gates.mjs proves each gate FUNCTION admits the right
+// audience. Nothing proved the other half — that a given /builders/* URL is
+// wired to the gate it is supposed to be wired to. That gap is not theoretical:
+// /sessions and /scouting each shipped with NO page gate at all, relying on a
+// client-side showSealed() and a data-route 403 respectively, and no test
+// noticed. A page whose shell is served to everyone is not a data leak while
+// its API holds, but it is a wall that exists only in the reviewer's head.
+//
+// It parses serve-internal.js STATICALLY (no import — that pulls the whole app),
+// in the style of tests/served_paths_shipped.mjs: pull the `*_PAGE_RE` literals
+// out of the source, pull the `if (…) return gdsAuth.<gate>(…)` dispatch out of
+// the same source, and run the oracle's URLs through the reconstructed map.
+//
+// Run:  node tests/hall_page_gate_map.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { posix as posixPath } from 'node:path';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
+
+// ═══ the ORACLE — hand-written, one row per gated hall URL ═══════════════════
+// `null` means "no page gate": the shell is served to anyone who asks. That is
+// correct for the genuinely public pages and a BUG anywhere else, so every such
+// row is spelled out rather than left to a default.
+//
+// Audiences (the floors live in modules/governance/catalog.js; the gate
+// functions in src/bongos/auth.js):
+//   requireBuilderPage          page.view.public    any signed-in builder (xenos+)
+//   requireGovernancePage       page.view.governance  metic+   (ADR 0157)
+//   requireProjectCuratePage    project.curate        metic+
+//   requireGovernanceManagePage governance.manage     archon
+const ORACLE = {
+  // Any signed-in builder — no rank floor.
+  '/builders/work': 'requireBuilderPage',
+  '/builders/pair': 'requireBuilderPage',
+  '/builders/settings': 'requireBuilderPage',
+  '/builders/atlas': 'requireBuilderPage',
+  '/builders/modules': 'requireBuilderPage',
+  '/builders/goals': 'requireBuilderPage',
+  '/builders/roadmap': 'requireBuilderPage',
+  // task 1002710: the orientation reading rooms moved DOWN to this tier from
+  // requireNonXenosPage (thetes+). They are the onboarding documents, so gating
+  // them above xenos turned away the exact reader they were written for. The
+  // sign-in requirement is unchanged — only the RANK floor is gone.
+  '/builders/primer': 'requireBuilderPage',
+  '/builders/primer.md': 'requireBuilderPage',
+  '/builders/diagrams': 'requireBuilderPage',
+  '/builders/diagrams/02-b.png': 'requireBuilderPage',
+
+  // Metic+ operator surfaces (the Governance nav group).
+  '/builders/watch': 'requireGovernancePage',
+  '/builders/harbor': 'requireGovernancePage',
+  '/builders/gate': 'requireGovernancePage',
+  '/builders/sessions': 'requireGovernancePage',
+
+  // Metic+ via the `project.curate` atom — the exact permission GET /scouting
+  // checks, so neither page can drift wider than the API it fronts.
+  '/builders/people': 'requireProjectCuratePage',
+  '/builders/scouting': 'requireProjectCuratePage',
+
+  // Archon.
+  '/builders/governance': 'requireGovernanceManagePage',
+
+  // Deliberately UNGATED — the landing card, the rank ladder, the reward
+  // schedule and a builder's public portfolio all render for a stranger.
+  '/builders/': null,
+  '/builders/ranks': null,
+  '/builders/drachmae': null,
+  '/builders/profile': null,
+  '/builders/not-ready': null,
+};
+
+// ─── reconstruct the URL→gate map from the source ───────────────────────────
+// 1. every `const NAME_RE = /…/;` (the page-matching regexes)
+function readRegexes(src) {
+  const out = new Map();
+  const re = /const\s+([A-Z0-9_]+_RE)\s*=\s*(\/(?:\\.|\[(?:\\.|[^\]])*\]|[^/\\])+\/[gimsuy]*)\s*;/g;
+  for (const m of src.matchAll(re)) out.set(m[1], eval(m[2])); // eslint-disable-line no-eval
+  return out;
+}
+
+// 2. every `if (<condition>) { return gdsAuth.<gate>(req, res, next); }`
+function readDispatch(src) {
+  const out = [];
+  // `[^{};]` keeps the condition capture INSIDE one if-header. A permissive
+  // `[^]*?` looks lazy enough but will happily start at some earlier `if (` and
+  // swallow every intervening line, hoovering up unrelated *_RE names and
+  // mapping them all to the first gate it reaches.
+  const re = /if\s*\(([^{};]*?)\)\s*\{\s*return\s+gdsAuth\.(\w+)\(req,\s*res,\s*next\);/g;
+  for (const m of src.matchAll(re)) {
+    const names = [...m[1].matchAll(/([A-Z0-9_]+_RE)/g)].map((x) => x[1]);
+    if (names.length) out.push({ names, gate: m[2] });
+  }
+  return out;
+}
+
+const REGEXES = readRegexes(SRC);
+const DISPATCH = readDispatch(SRC);
+
+// The gate a URL resolves to, mirroring the middleware: first matching branch wins.
+function gateFor(urlPath) {
+  const norm = posixPath.normalize(urlPath);
+  for (const { names, gate } of DISPATCH) {
+    for (const name of names) {
+      const rx = REGEXES.get(name);
+      if (rx && rx.test(norm)) return gate;
+    }
+  }
+  return null;
+}
+
+test('the static parse actually found the gate wiring', () => {
+  assert.ok(REGEXES.size >= 8, `expected the *_PAGE_RE literals, found ${REGEXES.size}`);
+  assert.ok(DISPATCH.length >= 3, `expected the gdsAuth dispatch branches, found ${DISPATCH.length}`);
+  // If this file is ever restructured past the parser, these two fail LOUDLY
+  // rather than letting every row below pass vacuously against an empty map.
+  assert.ok(DISPATCH.some((d) => d.gate === 'requireBuilderPage'));
+  assert.ok(DISPATCH.some((d) => d.gate === 'requireGovernancePage'));
+});
+
+test('every hall URL routes to the page gate the oracle names', () => {
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    assert.equal(gateFor(urlPath), expected,
+      `${urlPath} → ${gateFor(urlPath) ?? 'NO GATE'} (expected ${expected ?? 'NO GATE'})`);
+  }
+});
+
+test('the .html twin of a gated page is gated identically', () => {
+  // express.static resolves /builders/watch from watch.html via extensions:['html'],
+  // so the explicit .html form must not slip past the gate the bare form carries.
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    if (expected === null || urlPath.includes('.')) continue;
+    assert.equal(gateFor(`${urlPath}.html`), expected, `${urlPath}.html must match ${urlPath}`);
+  }
+});
+
+test('path-normalization tricks do not slip past a gate', () => {
+  // The middleware normalizes before matching precisely so these forms — which
+  // express.static WILL resolve to the same file — cannot bypass an anchored RE.
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    if (expected === null) continue;
+    const tail = urlPath.replace(/^\/builders\//, '');
+    for (const sneaky of [`/builders//${tail}`, `/builders/./${tail}`]) {
+      assert.equal(gateFor(sneaky), expected, `${sneaky} must resolve to ${expected}`);
+    }
+  }
+});
+
+test('no gated page is left matching only a REMOVED gate function', () => {
+  // requireNonXenosPage still EXISTS in auth.js (page.view.builder is a live
+  // catalog atom an Archon can attach to a custom role) but task 1002710 left it
+  // guarding nothing. If someone re-points a URL at it, that is a deliberate act
+  // that should update this oracle — not something to happen silently.
+  const wired = new Set(DISPATCH.map((d) => d.gate));
+  assert.ok(!wired.has('requireNonXenosPage'),
+    'requireNonXenosPage guards no hall URL since task 1002710 — update the ORACLE if that changes');
+});

package/tests/onboard.mjs

@@ -110,6 +110,19 @@ test('the /create done panel is plan-driven, manifest-driven, and owner-honest (
   assert.match(src, /adopt/i, 'the private path (adopt your own private repo) is named');
 });
 
+test('the /create gate trust link points at a live artifact, not the dead private-repo URL (task 1002705)', () => {
+  // Gap 1 of the project-creation audit: the gate linked a nonexistent private repo
+  // (404 even authenticated — ADR 0167 names it). No public code artifact exists yet
+  // (the ADR 0099 mirror is dormant until ~2026-11, and both npm scopes 404 anonymously
+  // — verified 2026-08-12), so the one live, instance-neutral artifact behind
+  // "open source" is the license itself.
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/create.html'), 'utf8');
+  assert.doesNotMatch(src, /Claude-OTB/, 'the dead repo link is gone');
+  assert.match(src, /https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0/, 'the trust link resolves (the AGPL-3.0 license text)');
+});
+
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {
   const oa = ob.oauthAppInstructions('mercury.example.com');
   assert.equal(oa.homepageUrl, 'https://mercury.example.com');