@bongos/core 1.19.714 → 1.19.724

package/modules/lifecycle/routes/artist-gate.js

@@ -0,0 +1,101 @@
+'use strict';
+
+// modules/lifecycle/routes/artist-gate.js — the artist gate's STATE, in one read
+// (ADR 0241, task 1003575).
+//
+// WHY A ROUTE. The gate's two halves live on opposite sides of the wire. The
+// POLICY (`artist_gate`) is pushed into this instance's branding pack by the
+// platform and read by the core; the STATE it reads — which artist review tasks
+// are still open — is this instance's own board. The thing that has to consult
+// both is `scripts/gds/go-live.js`, the pin move, which runs from a core checkout
+// against a LIVE instance and can see neither from where it stands. So the
+// instance answers the question about itself, in one call, and the deploy script
+// decides what to do with the answer.
+//
+// IT DECIDES NOTHING AND HOLDS NOTHING. This route is a read: it reports the mode,
+// the open reviews and the halt sentence that would be shown. Nothing about a ship,
+// a land or a grade passes through here — ADR 0241's whole reconciliation with ADR
+// 0162 is that the artist's authority attaches to the DEPLOY, and a read surface
+// that could reach the ship path would smuggle that back in.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway
+// `../../../src/module-api` (which carries the one artist-gate reader); `../db` is
+// this module's own data layer.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const db = require('../db');
+
+const log = api.logger('lifecycle');
+
+module.exports = function buildArtistGateRouter() {
+  const router = express.Router();
+
+  // GET /artist-gate — this project's artist strictness and what it is holding.
+  //
+  // rank: any authenticated builder. The payload is ordinary board state — a
+  // policy value the instance already publishes as its own behaviour, and task
+  // ids/titles any builder can read on the hall — so a floor above requireBuilder
+  // would gate a fact the board already shows. Nothing here is writable.
+  //
+  // Response:
+  //   mode      'off' | 'advisory' | 'strict'  the project's setting as resolved
+  //   since     ISO string | null              when it was last RAISED to strict
+  //   holds     boolean                        does anything hold a deploy now?
+  //   truncated boolean                        `reviews` hit the scan cap — a floor
+  //   reviews   [{ id, created_at }]           the open reviews that count
+  //   halt      { code, message, detail } | null   the refusal, pre-composed
+  //
+  // `halt` is composed HERE rather than by the caller on purpose: ADR 0241 §4's
+  // second guard is that the refusal must name what holds the deploy and which
+  // control releases it, and a sentence assembled independently by each caller is
+  // a sentence that eventually says something different. One composer, one wording.
+  router.get('/artist-gate', api.requireBuilder, async (req, res) => {
+    try {
+      const gate = api.artistGate;
+      const mode = gate.artistGateMode();
+      const since = gate.artistGateSince();
+
+      // At 'off' no reviews are filed, so there is nothing to read and nothing to
+      // hold — answer without touching the database.
+      const scan = mode === 'off' ? { reviews: [], truncated: false } : await db.listOpenArtistReviews({
+        source: gate.ARTIST_REVIEW_SOURCE,
+        refPrefix: gate.ARTIST_REVIEW_REF_PREFIX,
+        resolvedStatuses: gate.RESOLVED_REVIEW_STATUSES,
+      });
+      const open = gate.unresolvedArtistReviews(scan.reviews, { since });
+      // `truncated` only survives if the cutoff did not itself empty the page:
+      // reporting "200+" over a list the non-retroactivity filter cut to three
+      // would be a worse lie than the number it replaced.
+      const truncated = scan.truncated && open.length === scan.reviews.length;
+      const halt = gate.artistGateHalt({ mode, reviews: open, truncated });
+
+      // A gate read is a policy comparison — a cached one is wrong the moment a
+      // review is dismissed (the project-settings / rot.js precedent).
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        ok: true,
+        mode,
+        since,
+        holds: !!halt,
+        // A floor, not a census, when the scan hit its cap — said out loud so a
+        // caller never reads this list as "and that is all of them".
+        truncated,
+        // IDS AND DATES ONLY — deliberately no TITLE. A title is builder-written
+        // board text, and it was the only untrusted string this payload carried;
+        // nothing consumes it (go-live names ids, and a reader who wants the title
+        // has the board). Carrying it would have left a value that is safe as JSON
+        // today and becomes an injection vector the first time some surface renders
+        // it as HTML. Dropping it is the fix rather than escaping it, because an
+        // HTML-escaped value in a JSON API is wrong for every correct consumer.
+        reviews: open.map((t) => ({ id: String(t.id), created_at: t.created_at })),
+        halt,
+      });
+    } catch (err) {
+      log.error('[lifecycle] GET /artist-gate', err);
+      res.fail('artist_gate_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/lifecycle/routes/claims.js

@@ -85,9 +85,21 @@ function taskNotReadyHint(taskId, currentStatus) {
 // Ordering is the fix: the universally-available command leads, /merge-mode is
 // marked as needing a push credential rather than dropped (it is still the right
 // tool on a credentialed machine), and /builder-release stays as the give-up exit.
+//
+// AND THE VERB CHANGED (task 1002788). It used to say "rebase the branch and
+// re-ship", which is advice that can DEADLOCK the builder who follows it. The
+// branch is already published; server-mediated publish is append-only by
+// deliberate design (github-push.js: "Refuse non-fast-forward implicitly (no
+// --force, ever)"), so a rebase rewrites history the server already holds and
+// every subsequent publish is rejected non-fast-forward. The builder is then
+// gated from new claims AND unable to land the one they hold. Reproduced
+// end-to-end on task 1002485. `git merge origin/main` reaches the same
+// up-to-date branch and stays a fast-forward, which is why the recovery text in
+// ship-land.js already names merge and explicitly says "Do NOT reset or
+// re-rebase". This is the same advice, given BEFORE the deadlock instead of after.
 function rebaseRequiredHint(rebaseTasks) {
   const ids = (rebaseTasks || []).map((t) => `task ${t.id}`);
-  return `Your queue is gated: ${ids.length} confirmed task(s) await your rebase (${ids.join(', ') || 'unknown'}). Clear it with /strand-fix N (works on any machine), or rebase the branch and re-ship — /merge-mode only if this machine has a GitHub push credential. To give up on one instead, /builder-release it. If CI is simply backed up, waiting is correct: a task already landed clears the gate on its own.`;
+  return `Your queue is gated: ${ids.length} confirmed task(s) are waiting to land (${ids.join(', ') || 'unknown'}). Clear it with /strand-fix N (works on any machine), or bring the branch up to date with \`git merge origin/main\` and re-ship — MERGE, never rebase: server-mediated publish is append-only, and rewriting a published branch makes it un-pushable (task 1002788). /merge-mode only if this machine has a GitHub push credential. To give up on one instead, /builder-release it. If CI is simply backed up, waiting is correct: a task already landed clears the gate on its own.`;
 }
 
 // task 1642 (+ the worktree-keying fix) — the pure one-active-claim decision.

package/modules/lifecycle/routes/lifecycle.js

@@ -54,6 +54,12 @@ function registerSeams() {
     getTask: (id) => db.getTask(id),
     findTaskBySourceRef: (ref) => db.findTaskBySourceRef(ref),
     createTask: (spec) => db.createTask(spec),
+    // The project's artist gate (ADR 0241, task 1003575). Resolved through the
+    // doorway's one reader rather than from branding().project, so the level that
+    // decides whether a review is FILED and the level that decides whether one
+    // HOLDS a deploy can never be read differently. At 'off' the artist-review
+    // rule files nothing.
+    artistGateMode: () => api.artistGate.artistGateMode(),
     log: api.logger ? api.logger('lifecycle') : null,
   }));
 }

package/modules/lifecycle/routes/task-write-routes.js

@@ -26,6 +26,7 @@ const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, VOTABLE_TASK_STATUSES,
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
 const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, detectsMigration } = require('./task-route-helpers.js');
+const { describeCheckViolation } = require('../pg-constraint-fail.js');
 const { goalNotOpenRefusal } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
@@ -275,6 +276,12 @@ module.exports = function registerTaskWriteRoutes(router) {
       });
     } catch (err) {
       log.error('[gds] POST /tasks', err);
+      // task 1002845: a CHECK violation is a CLIENT-correctable problem wearing a
+      // 500. Name the constraint so the next validator/DB range mismatch is
+      // self-diagnosing instead of costing another round of blind retries. The
+      // constraint name only — err.detail carries the failing row's values.
+      const cv = describeCheckViolation(err);
+      if (cv) return res.fail(cv.code, { status: cv.status, message: cv.message, details: cv.details });
       res.fail('create_failed', { status: 500, message: 'internal error' });
     }
   });

package/modules/lifecycle/routes/tasks.js

@@ -997,6 +997,12 @@ module.exports = function buildTasksRouter() {
   // asks an Archon to flip the task to confirmed anyway. Audit-logged via the
   // global write-audit middleware. Open requests surface in the Archon queue.
   // rank: any-builder — opens a request; the decision still rests with Archon.
+  //
+  // The SAME route also opens the artist gate's release (ADR 0241 §3, task
+  // 1003575): a request whose target is an unresolved artist review is admitted
+  // at ANY status, because such a review sits at `backlog` and a completed-only
+  // check would make the one documented escape hatch unusable for the exact case
+  // it was written for. Who may DECIDE it is narrower — see the decide route.
   router.post('/tasks/:id/override-request', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res, { code: 'bad_task_id' });
     if (id === null) return;
@@ -1328,6 +1334,14 @@ module.exports = function buildTasksRouter() {
   // updates; the task stays at completed and the builder must release or
   // re-ship after fixing whatever the grader caught.
   // rank: archon — grader-bypass authority; same gate as POST /tasks/:id/confirm.
+  //
+  // ONE EXCEPTION, and it is NARROWER than this gate rather than wider: a request
+  // whose target is an unresolved ARTIST REVIEW is a gate release (ADR 0241 §3,
+  // db-overrides.js), and only the PROJECT OWNER may decide it. That check lives
+  // in decideOverrideRequest, not here, so it cannot be bypassed by a second
+  // caller; this route only renders its refusal (403 override_owner_only).
+  // Approving one confirms nothing and pays nothing — it stops the review holding
+  // the DEPLOY and leaves it open on the board.
   router.post('/override-requests/:id/decide', auth.requireBuilder, auth.requirePermission('override_request.decide'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
@@ -1351,6 +1365,16 @@ module.exports = function buildTasksRouter() {
       if (err.code === 'REQUEST_NOT_OPEN') {
         return res.fail('request_not_open', 409);
       }
+      if (err.code === 'OVERRIDE_OWNER_ONLY') {
+        // The artist gate's release is narrower than this route's Archon floor
+        // (ADR 0241 §3): the PROJECT OWNER decides it, nobody else. 403 with the
+        // reason spelled out — an Archon refused here is not a bug, and a refusal
+        // that does not say which authority is missing sends them hunting.
+        return res.fail('override_owner_only', {
+          status: 403,
+          message: 'Releasing a deploy held by an artist review is the project owner\'s call alone — not an Archon\'s (ADR 0241). Resolve or dismiss the review instead, or ask the owner to decide this request.',
+        });
+      }
       if (err.code === 'OVERRIDE_NO_REQUESTER') {
         // Data-integrity guard (#538): an approved override with no requester to
         // credit. Should never happen (NOT NULL column); refuse rather than

package/modules/lifecycle/task-classifier.js

@@ -173,9 +173,18 @@ const VALID_DISCIPLINES = new Set(['engineer', 'artist', 'ideator', 'ui', 'uncla
 // `create_failed` constraint-violation message, and taught the context pack the
 // wrong range — task 1233.) `convention` is retained so the pack can surface the
 // human-facing "use P1–P5 tiers" label alongside the accepted range.
+// task 1002845: `manual_degree` had the SAME defect priority had, and is fixed the
+// same way — tighten the validator to the DB, never migrate the DB to the
+// validator. The CHECK is `manual_degree BETWEEN 1 AND 5`
+// (migrations/003_pms.sql, never widened since), so min:0 let a 0 pass the route
+// and then die in the INSERT as a 23514, which the generic catch answered as an
+// opaque 500 `create_failed` with the constraint name never reaching the caller.
+// Measured against the live API before the fix: POST /tasks {manual_degree:0}
+// → 500 "internal error". Idea 1000456 records roughly four blind retries spent
+// on this during task 1604.
 const TASK_FIELD_BOUNDS = {
   priority: { min: 1, max: 5, convention: { min: 1, max: 5, label: 'P1–P5 planning tiers' } },
-  manual_degree: { min: 0, max: 5 },
+  manual_degree: { min: 1, max: 5 },
 };
 
 // Task statuses that can receive peer-acclaim votes (a work must be at least

package/modules/lifecycle/tests/cascade.mjs

@@ -250,5 +250,48 @@ await test('the review inherits the shipped task goal and version, not goal 1000
   assert.equal(matched[0].spec.versionId, 'BONGOS-V1');
 });
 
+// --- the project's artist gate decides whether it is filed at all (ADR 0241) --
+
+await test("artist_gate 'off' files NO artist review — the one level at which the rule is silent", () => {
+  assert.equal(cascade.cascadesFor(shippedCopy(), cascade.CASCADES, { artistGate: 'off' }).matched.length, 0);
+  // The other two levels both FILE; what separates them is whether an open review
+  // holds a deploy, which is not this file's business at all.
+  assert.equal(cascade.cascadesFor(shippedCopy(), cascade.CASCADES, { artistGate: 'advisory' }).matched.length, 1);
+  assert.equal(cascade.cascadesFor(shippedCopy(), cascade.CASCADES, { artistGate: 'strict' }).matched.length, 1);
+});
+
+await test('an UNREAD policy files — silence is never read as an opt-out', () => {
+  // No context at all (an old caller), and an explicitly-undefined level (a reader
+  // that threw) must both behave like the gate's default, which is 'strict'.
+  assert.equal(cascade.cascadesFor(shippedCopy()).matched.length, 1);
+  assert.equal(cascade.cascadesFor(shippedCopy(), cascade.CASCADES, {}).matched.length, 1);
+  assert.equal(cascade.cascadesFor(shippedCopy(), cascade.CASCADES, { artistGate: undefined }).matched.length, 1);
+});
+
+await test('a gate reader that THROWS costs the run nothing — it is reported, and the review is still filed', async () => {
+  const created = [];
+  const report = await cascade.runCascadesForShip({ id: '7001' }, {
+    getTask: async () => shippedCopy(),
+    findTaskBySourceRef: async () => null,
+    createTask: async (spec) => { created.push(spec); return { id: '7002' }; },
+    artistGateMode: () => { throw new Error('pack unreadable'); },
+  });
+  assert.equal(created.length, 1, 'an unreadable policy must not silently behave like off');
+  assert.ok(report.errors.some((e) => /artistGateMode\(\) threw/.test(e)), 'and it says so');
+});
+
+await test("runCascadesForShip honours 'off' end to end — nothing is created, nothing errors", async () => {
+  let creates = 0;
+  const report = await cascade.runCascadesForShip({ id: '7001' }, {
+    getTask: async () => shippedCopy(),
+    findTaskBySourceRef: async () => null,
+    createTask: async () => { creates++; return { id: '7002' }; },
+    artistGateMode: () => 'off',
+  });
+  assert.equal(creates, 0);
+  assert.deepEqual(report.created, []);
+  assert.deepEqual(report.errors, [], 'a project that switched the gate off has no problem to report');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/modules/provisioning/provisioning.js

@@ -159,17 +159,34 @@ const RESTART_SHAPES = new Set(['co-tenant', 'standalone']);
 // which is why it is the default — DEFAULT_SETTINGS must be today's behaviour, and
 // today a public project runs whatever door its joinability runs. Composed at the
 // door by src/bongos/project-door.js; ADR 0247.
+//
+// `artist_gate` is the project's ARTIST STRICTNESS (ADR 0241, task 1003575) — the
+// owner's constraint from goal 1000074, verbatim: blocking strictness is per
+// project, not global. `off` generates no artist review tasks at all; `advisory`
+// generates them and blocks nothing; `strict` generates them and an unresolved one
+// holds the DEPLOY — the instance's pin may not move while one is open. It never
+// holds a builder's SHIP: that is the line ADR 0241 draws to keep this compatible
+// with ADR 0162, and it is why a gate that stops work can exist here at all.
+//
+// It is the only key here whose default is NOT today's behaviour. `strict` is an
+// owner ruling (ADR 0241 §4), recorded there against its author's recommendation
+// and coherent because strict holds only the pin: the worst case is a project whose
+// deploy waits on a review nobody has done, which is visible and owner-releasable,
+// never a stranded builder.
 const SETTINGS_VOCAB = Object.freeze({
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
   visibility: ['public', 'private', 'stealth'],
   join_grant: ['view', 'apply', 'full'],
+  artist_gate: ['off', 'advisory', 'strict'],
 });
 // Default = today's behavior on every axis, including the join door: ADR 0182's
 // migration gives the hub column the same `public` default, "existing rows keep
-// today's behaviour".
+// today's behaviour". The one exception is `artist_gate`, whose default is the
+// owner's ruling rather than the status quo — see the note above it.
 const DEFAULT_SETTINGS = Object.freeze({
   platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full',
+  artist_gate: 'strict',
 });
 
 // The project's PLANET (task 1003347, direction record §16): how the platform
@@ -422,9 +439,28 @@ function publicGithubApp(manifestRow) {
 // and the live push (the runner's settings-apply leg patches exactly these lines).
 function settingsEnvVars(row, prefix) {
   const s = effectiveSettings(row);
-  return Object.fromEntries(Object.keys(SETTINGS_VOCAB).map((key) => [`${prefix}_${key.toUpperCase()}`, s[key]]));
+  const vars = Object.fromEntries(Object.keys(SETTINGS_VOCAB).map((key) => [`${prefix}_${key.toUpperCase()}`, s[key]]));
+  for (const [suffix, read] of Object.entries(SETTINGS_COMPANION_ENV)) vars[`${prefix}_${suffix}`] = read(row);
+  return vars;
 }
 
+// COMPANION variables: env the instance needs to OBEY a setting, which is not
+// itself a setting anyone chooses (task 1003575). Declared as a closed table for
+// the same reason SETTINGS_VOCAB is — the drift test asserts the transport carries
+// exactly the vocabulary plus these, so a companion can be added deliberately and
+// never by accident.
+//
+// ARTIST_GATE_SINCE is the only one today: ADR 0241 §5 makes a tightening
+// non-retroactive, and an instance cannot honour that without knowing WHEN the
+// gate was raised. Always emitted — the runner patches these lines in place, and a
+// key that came and went would leave a stale line behind — with empty meaning "no
+// cutoff". src/branding.js skips an empty override, so the instance reads no
+// cutoff and every unresolved review counts, which is the right answer for a
+// project that has been strict since it stood up.
+const SETTINGS_COMPANION_ENV = Object.freeze({
+  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '',
+});
+
 // The web.env block the runner writes at STANDUP (task 1003139): a comment that
 // tells the truth about where the values come from, then the settingsEnvVars
 // lines. Changing one on an ALREADY-RUNNING instance is the 'settings-apply'
@@ -496,6 +532,44 @@ function settingsPushOwed(row) {
   return stored[SETTINGS_PUSH_OWED_KEY] === true;
 }
 
+// The moment `artist_gate` was last RAISED to 'strict' (ADR 0241 §5, task
+// 1003575). Same reserved-key shape and rationale as SETTINGS_PUSH_OWED_KEY
+// above — platform bookkeeping, not a setting an owner declares, so it is
+// deliberately out of SETTINGS_VOCAB and can neither leak through
+// effectiveSettings nor be written by a client patch.
+//
+// WHY IT HAS TO EXIST. ADR 0241 §5: tightening applies to work that ships AFTER
+// the change, never backwards. Without a stamp, flipping advisory → strict would
+// hand the next deploy a backlog of review tasks for work nobody remembers — the
+// exact thing that makes a setting frightening to raise. The stamp is what lets
+// the gate ignore them.
+const ARTIST_GATE_STRICT_SINCE_KEY = 'artist_gate_strict_since';
+
+// Read the stamp, or null. An unparseable value reads as null (no cutoff) rather
+// than as a date nobody can name. PURE.
+function artistGateStrictSince(row) {
+  const stored = row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings)
+    ? row.settings : {};
+  const v = stored[ARTIST_GATE_STRICT_SINCE_KEY];
+  if (typeof v !== 'string' || !v) return null;
+  return Number.isNaN(Date.parse(v)) ? null : v;
+}
+
+// The extra jsonb keys a settings save must ALSO store, given what the row holds
+// now and what is being patched onto it. Today that is exactly the strict stamp,
+// and it is written only on a RAISE — a save that leaves the gate where it was,
+// or lowers it, must not move the cutoff forward, or every unrelated settings
+// change would quietly re-date the gate and un-hold reviews it was already
+// holding. Lowering deliberately LEAVES the stamp: nothing reads it below
+// 'strict', and keeping it means a project that goes strict → advisory → strict
+// by mistake does not lose its history. PURE (row + patch + clock in, object out).
+function artistGateStamp(row, patch, now = new Date()) {
+  const next = (patch || {}).artist_gate;
+  if (next !== 'strict') return {};
+  if (effectiveSettings(row).artist_gate === 'strict') return {};
+  return { [ARTIST_GATE_STRICT_SINCE_KEY]: new Date(now).toISOString() };
+}
+
 // A description as it may be STORED: trimmed, collapsed of runaway whitespace,
 // capped, and empty-means-absent. Returns null for anything that isn't real prose,
 // because null is what leaves the project dark-matter — an empty string stored in a
@@ -1334,12 +1408,14 @@ module.exports = {
   SETTINGS_APPLY_FROM, SETTINGS_APPLY_SHAPES,
   RESTART_FROM, RESTART_SHAPES,
   TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
-  SETTINGS_VOCAB, DEFAULT_SETTINGS, PROJECT_DETAIL_VOCAB, DESCRIPTION_MAX,
+  SETTINGS_VOCAB, DEFAULT_SETTINGS, SETTINGS_COMPANION_ENV, PROJECT_DETAIL_VOCAB, DESCRIPTION_MAX,
   PLANET_TEMPLATES, PLANET_ACCENTS, PLANET_VOCAB,
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   defaultDomainForSlug, isReservedHostname, effectiveSettings, planetChoice,
   settingsPushOwed,
+  // pure — the artist gate's non-retroactivity stamp (ADR 0241 §5, task 1003575)
+  ARTIST_GATE_STRICT_SINCE_KEY, artistGateStrictSince, artistGateStamp,
   normalizeDescription, normalizeProjectDetail, projectDetailPatch, projectDetail,
   // pure — GitHub App Manifest flow (task 2080)
   githubAppName, buildGithubAppManifest, manifestPostUrl, publicGithubApp,

package/modules/provisioning/routes/provisioning.js

@@ -908,7 +908,12 @@ module.exports = function provisioningRoutes() {
       // true: the re-send is unchanged, so it would otherwise hit "No change".
       const pushOwed = provisioning.settingsPushOwed(inst);
       const policyResent = (!!inst.error_note || pushOwed) && policyTouched;
-      const updated = changed ? await provisioning.updateInstanceSettings(pool, id, patch) : inst;
+      // Raising `artist_gate` to 'strict' also stamps WHEN (ADR 0241 §5 makes the
+      // tightening non-retroactive, and the instance cannot honour that without the
+      // date). It rides the same single UPDATE as the setting it belongs to, and is
+      // empty on every other save — see artistGateStamp.
+      const storedPatch = { ...patch, ...provisioning.artistGateStamp(inst, patch) };
+      const updated = changed ? await provisioning.updateInstanceSettings(pool, id, storedPatch) : inst;
       if (changed) {
         await provisioning.recordEvent(pool, {
           instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'settings',

package/modules/provisioning/tests/provisioning.mjs

@@ -263,27 +263,27 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted', join_grant: 'everything' } }),
-    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full' },
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'a non-object settings value reads as defaults');
   // the join door reads back like any other policy key (task 1002324)
   assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full' }, 'a stored door overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict' }, 'a stored door overlays only itself');
   // what a public join grants is a policy key like any other (task 1002331)
   assert.deepEqual(P.effectiveSettings({ settings: { join_grant: 'view' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view' }, 'the grant overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view', artist_gate: 'strict' }, 'the grant overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {

package/modules/security/secret-scrub.js

@@ -132,11 +132,47 @@ function looksHighEntropySecret(tok) {
 // floor and slip the entropy net — but layers 1–4 (literal env values, PEM,
 // known shapes, key=value assignments) already cover the realistic ways such a
 // value reaches a transcript.
+const DOC_EXTS = ['.md', '.sql'];
 const ENTROPY_CANDIDATE_RE = /[A-Za-z0-9_-]{20,}/g;
-function redactHighEntropy(text) {
-  return text.replace(ENTROPY_CANDIDATE_RE, (tok) => (looksHighEntropySecret(tok) ? REDACTED : tok));
+
+// DOC-PATH EXEMPTION (task 1002460) — an ALLOWLIST, not a shape guess.
+//
+// THE FALSE POSITIVE. A long filename slug is lowercase + digits + hyphens with
+// H >= 3.7, so rule B fires and package-core collapsed every ADR and migration
+// filename to `<redacted>.md` on the publish path.
+//
+// WHY NOT A SHAPE RULE. Three were tried and each leaked. Any predicate built on
+// what a filename LOOKS like also admits a secret dressed that way, because a
+// random lowercase run is shape-identical to words — and entropy cannot separate
+// them either (real filenames measure up to H=4.35, random lowercase words 4.54).
+// scrubSecrets feeds the PUBLIC mirror (scripts/gds/mirror-redact.js,
+// scripts/public-mirror-export.js), so a shape hole is a smuggling channel.
+//
+// WHAT THIS DOES INSTEAD. The caller passes the set of filenames it is actually
+// publishing; a candidate is spared only when the token plus its extension IS one
+// of them. A secret is not a file in the tree, so it cannot be in the set.
+//
+// RECALL IS UNCHANGED BY CONSTRUCTION, and that is the point. With no set — every
+// transcript scrub, every caller that does not opt in — there is no exemption at
+// all and the verdict is byte-identical to before this task. Only the publish path,
+// which enumerates the tree anyway, supplies one.
+function redactHighEntropy(text, opts) {
+  const known = opts && opts.knownDocNames;
+  if (!known || !known.size) {
+    return text.replace(ENTROPY_CANDIDATE_RE, (tok) => (looksHighEntropySecret(tok) ? REDACTED : tok));
+  }
+  return text.replace(ENTROPY_CANDIDATE_RE, (tok, offset, whole) => {
+    if (!looksHighEntropySecret(tok)) return tok;
+    // Cheap boundary reads at a known offset — no slicing of the surrounding
+    // document, which runs over whole markdown files and whole transcripts.
+    for (const ext of DOC_EXTS) {
+      if (whole.startsWith(ext, offset + tok.length) && known.has(tok + ext)) return tok;
+    }
+    return REDACTED;
+  });
 }
 
+
 // ENV secret collection — literal secret VALUES from the process env, so they are
 // redacted wherever they appear even with no recognizable shape (Apple/MAC_* CI
 // secrets, a baked GDS_TOKEN, GITHUB_TOKEN, DO_API_TOKEN, …). Key match mirrors
@@ -164,7 +200,7 @@ function collectEnvSecrets(env = process.env) {
   return out;
 }
 
-function scrubSecrets(text, extraSecrets = []) {
+function scrubSecrets(text, extraSecrets = [], opts = undefined) {
   if (typeof text !== 'string' || text.length === 0) return text;
   let out = text;
   // Literal dynamic secrets first (longest first so a substring can't shadow a
@@ -190,7 +226,7 @@ function scrubSecrets(text, extraSecrets = []) {
   // Catch-all LAST: an unkeyed, unknown-shape, high-entropy token. The earlier
   // layers have already collapsed known secrets to "<redacted>" (no candidate),
   // so this only sweeps what survived.
-  out = redactHighEntropy(out);
+  out = redactHighEntropy(out, opts);
   return out;
 }
 

package/modules/status-ui/public/README.md

@@ -1,6 +1,6 @@
 # `modules/status-ui/public/` — the status dashboard ("The Watch")
 
-These files are the source of `status.example.com`. The surface moved here from `public-status/` in **BV1.R84** when the status dashboard became a first-class module ([ADR 0093](../../../docs/adr/<redacted>.md) §1); the loader's web-surface seam serves this `public/` dir on the `status.` host (see [`../CLAUDE.md`](../CLAUDE.md)). As of **#566 / [ADR 0029](../../../docs/adr/<redacted>.md)** they are **mirrored OFF-BOX** so the status page survives a droplet outage.
+These files are the source of `status.example.com`. The surface moved here from `public-status/` in **BV1.R84** when the status dashboard became a first-class module ([ADR 0093](../../../docs/adr/0093-tranche-2-core-carve-sequence.md) §1); the loader's web-surface seam serves this `public/` dir on the `status.` host (see [`../CLAUDE.md`](../CLAUDE.md)). As of **#566 / [ADR 0029](../../../docs/adr/0029-status-page-outage-resilience.md)** they are **mirrored OFF-BOX** so the status page survives a droplet outage.
 
 ## Why off-box
 

package/modules/ui-design/docs/design-contract.md

@@ -1,6 +1,6 @@
 # Design contract — neutral adapter interface
 
-**Status:** Accepted · authored by [task 1377](https://example.com/builders#/task/1377) · governed by [ADR 0081](../../../docs/adr/<redacted>.md) · lives in the `ui-design` module since [task 1003324](https://cloudbongos.com/builders#/task/1003324) ([ADR 0197](../../../docs/adr/<redacted>.md)) — the token files it names stay in `config/` as the host boundary
+**Status:** Accepted · authored by [task 1377](https://example.com/builders#/task/1377) · governed by [ADR 0081](../../../docs/adr/0081-tool-agnostic-design-layer.md) · lives in the `ui-design` module since [task 1003324](https://cloudbongos.com/builders#/task/1003324) ([ADR 0197](../../../docs/adr/0197-the-ui-design-module.md)) — the token files it names stay in `config/` as the host boundary
 
 The repo is the single source of truth for design. Every design tool is a swappable adapter that reads from and writes to this contract — it does not own the source. This file is the contract every adapter must conform to. The minimal validator (`modules/ui-design/scripts/validate-design.js`; `node scripts/gds/validate-design.js` is a thin shim over it) enforces the machine-checkable parts.
 
@@ -96,7 +96,7 @@ Rules:
 | Freeform canvas art | — | `assets/ui/<surface>/` | Asset |
 | Pixel-art game tiles | see `art/` pipeline | — | Art pipeline (not this contract) |
 
-Pixel-art game tiles (world tiles, characters, objects) are out of scope for this contract — they are governed by the `art/` pipeline and [ADR 0088](../../../docs/adr/<redacted>.md).
+Pixel-art game tiles (world tiles, characters, objects) are out of scope for this contract — they are governed by the `art/` pipeline and [ADR 0088](../../../docs/adr/0088-consistent-character-generative-animation.md).
 
 ---
 

package/modules/ui-design/kit/README.md

@@ -1,6 +1,6 @@
 # `modules/ui-design/kit/` — look before you ship
 
-The stub, the renderer/auditor, the interaction probes, the mock checker and the contrast probe any builder points at any surface of any instance ([task 1003320](https://cloudbongos.com/builders#/task/1003320), [ADR 0197](../../../docs/adr/<redacted>.md)). Plain Node; the browser is the system Edge or Chrome via `playwright-core` (a devDependency — nothing is downloaded).
+The stub, the renderer/auditor, the interaction probes, the mock checker and the contrast probe any builder points at any surface of any instance ([task 1003320](https://cloudbongos.com/builders#/task/1003320), [ADR 0197](../../../docs/adr/0197-the-ui-design-module.md)). Plain Node; the browser is the system Edge or Chrome via `playwright-core` (a devDependency — nothing is downloaded).
 
 ```
 node modules/ui-design/kit/serve.js                     # the stub (SURFACE, PREFIX, AUTH=1, CHILD=1, LIVE=…, FAIL=…, STYLE=<look>, STUB_PORT)

package/modules/ui-design/kit/serve.js

@@ -188,6 +188,7 @@ const STUB_VOCAB = {
   joinability: ['open', 'apply', 'invite_only'],
   visibility: ['public', 'private', 'stealth'],
   join_grant: ['view', 'apply', 'full'],
+  artist_gate: ['off', 'advisory', 'strict'],
   planet_template: null,   // the template set is long; shape is checked, not membership
   planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
   card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],