@bongos/core 1.19.826 → 1.19.827

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.826",
-  "core_contract": "1.19.826",
-  "source_commit": "9871f72043eb86daa58427159fe170b869c6f8b9",
+  "core_version": "1.19.827",
+  "core_contract": "1.19.827",
+  "source_commit": "4fe673594c63823c15cf02108dde24ac25c40757",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T13:41:33.888Z",
+  "built_at": "2026-09-17T13:57:26.543Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 491,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2234,
+    "functional_verbatim": 2236,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2751,
-  "tree_sha256": "32197a053d73c55f5800a78d0d66c04463154f6439996ac03cd6079f1e5ca82c",
+  "file_count": 2753,
+  "tree_sha256": "a39afbe8aa551c281c44ae315b31b984c38436ff1e4f632f3a70c67c30d6bb15",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1722,7 +1722,7 @@
     {
       "path": "docs/adr/0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md",
       "mode": "0000644",
-      "sha256": "7a6e0c05fefab97043641232b2f1c514a4161de451b5c59e26be5bfdaa8b1ede"
+      "sha256": "b7146a1b5f563657371935ad6e71013b9ce89a13f814300efc8ea1d2b815f0f3"
     },
     {
       "path": "docs/adr/0248-a-hub-project-s-owner-is-the-provisioning-row-carried-on-a-port.md",
@@ -2552,7 +2552,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "819da3ee2c3e79b97d42df736f3bd9af57baffa1d21234532b611acf42a878ac"
+      "sha256": "dc603258b3556e3044710de8bf32a074d12865b74f0e25b93a9944720771962a"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6257,7 +6257,7 @@
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
-      "sha256": "972bddd1e772649379960c873376243de62da2ee01ee481a5da4e2f31ada7112"
+      "sha256": "c920f13eea6bdfc2f361d7c23500d295bb87066205ee2f4792adc22fc5dfa715"
     },
     {
       "path": "modules/platform-identity/routes/profile.js",
@@ -6442,7 +6442,7 @@
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
-      "sha256": "5ddd201b98f799f4f3cf6d889dea8d4e0196732e3bab67cf752e95e045724ede"
+      "sha256": "b3ec65266823f6f50cdfaf839f579411b68b91e2fe5652a6e7736d8a3024c5ca"
     },
     {
       "path": "modules/provisioning/onboard-plan.js",
@@ -6502,7 +6502,12 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "616fa85cebc85241a1283b3493caaa2bb93a20b18ea6ea8e9b9fd0969f2ccc49"
+      "sha256": "e9eb66469fc14adc526f97815ef61f4145cf17bbf36bdb638a2ed4db897149b7"
+    },
+    {
+      "path": "modules/provisioning/seams.js",
+      "mode": "0000644",
+      "sha256": "68ba324773bbd9a347ef682c5b1f105b447c6760f24595b8850590ed6d64d78e"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -7817,12 +7822,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "639ff75dd31684341558f62220e1a7d358484ab8f994ebe9cc036335f2c7e5bb"
+      "sha256": "15fdc8e49c1219b3d4f3ebca13c55e530d02b9ad469163a82749d7999d37314d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3f63f0df3e2a39105a2d73c03f418e48b72b303d0aa3d2acd3f34ea8a81c738c"
+      "sha256": "c7e6e06cc67ddfd968ac745b125971e1097dfe56b4e7e428c6331ffdc39de325"
     },
     {
       "path": "public-docs/index.html",
@@ -9742,7 +9747,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "204763d74db8bd35283f77922256bafe1885e1d173b36a730053190f6110501d"
+      "sha256": "e674350e5eca098fd473e43be69fc725f8ec211cb13d5541bfd6c70c6d5133c3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11829,6 +11834,11 @@
       "mode": "0000644",
       "sha256": "2cdb7e9ecd4652e2c09e4809e465943709aa9f7fbeda53fdff5cdbd0c50aa653"
     },
+    {
+      "path": "tests/join_dark_matter.mjs",
+      "mode": "0000644",
+      "sha256": "5f736541695c8786b2579c5c08d037479b40dc7096718b1ab5f36499b65c5898"
+    },
     {
       "path": "tests/join_relay_outcome.mjs",
       "mode": "0000644",
@@ -12492,7 +12502,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "4b8127e09422e68898109779f34257cb92c3504a6660130c227a17551a82f371"
+      "sha256": "8898b1a4458b0d76c071c901f89eacc21fb64cbfed37614afad5bdea16bef4b3"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",

package/docs/adr/0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md

@@ -200,3 +200,20 @@ now, with the code, rather than when the verdict is wired.
 - **Making the composed door fail to `locked` when the pack is unreadable.** Rejected: it
   contradicts ADR 0194 D2 for no safety gain, and it tells an applicant a specific untruth
   about the project's publication state.
+
+## Amendment — 2026-09-17 (task 1003578): the verdict is wired at the hub relay, from the provisioning row
+
+Decision 4's filed follow-up, built the way it named. `modules/provisioning/seams.js` provides
+`provisioning.<redacted>` (`{ slug, host }` → `{ name, description }` or `null`),
+keyed on both halves of the ADR 0246 projection like `provisioning.projectOwnedBy`. The hub's
+`POST /my-projects/join` asks it before relaying and judges the answer with its own
+`projectPublishability`, so the mapping stays in provisioning and the rule stays in the hub.
+A positive `publishable: false` answers `not_published` with no relay and no echo.
+
+Everything else is still **no verdict**, per Decision 4's tri-state: no port, no provisioning
+row (a self-hosted or hand-seeded project, whose hub copy remains a cache) or a failed read.
+The request is relayed as before, because relaying grants nothing and a refusal on a guess
+would be an untruth about someone else's project. The instance's own door is unchanged: it
+still passes no verdict, so an applicant arriving at the project directly is answered on the
+stored knobs alone. The rejected alternative above still stands. This reads the provisioning
+row, not `platform_identity_projects`.

package/docs/module-api-changelog.md

@@ -2126,5 +2126,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.824 with no explicit bump. run 35227529838. (task 1002620)
   1.19.826 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.825 with no explicit bump. run 35228618989. (task 1002620)
+  1.19.827 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.826 with no explicit bump. run 35230339528. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/routes/my-projects.js

@@ -6,7 +6,8 @@
 //                                    asked to join and when (ADR 0201 D1.3)
 //   POST /my-projects/join         — apply to a project: one click plus an optional
 //                                    note in the applicant's own words (task 1002330).
-//                                    Relayed; the project executes and decides.
+//                                    Relayed; the project executes and decides —
+//                                    unless the platform's record says it is unpublished.
 //   POST /my-projects/:clientId/leave — self-service offboard (reflected to the hub)
 //
 // All gated on a live HUB session (requireBuilder). Authority stays LOCAL: JOIN only
@@ -24,9 +25,30 @@ const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const projectStats = require('../project-stats');
 const applicationEcho = require('../application-echo');
+const { projectPublishability } = require('../publish-gate');
 
 const { pool, requireBuilder, validateOrRespond, userAgent } = api;
 
+// Dark matter, refused before the relay (task 1003578, ADR 0247 D4). The project's own
+// door cannot lock itself — its instance never holds its description — so the hub asks the
+// provisioning row, the one live copy, through a port resolved by name (ADR 0083; optional,
+// the `provisioning.projectOwnedBy` precedent). Only a POSITIVE verdict refuses. No port, no
+// row (a self-hosted or hand-seeded project) or a failed read is no verdict, and the request
+// is relayed as before: relaying grants nothing, and refusing on a guess would tell an
+// applicant something untrue about someone else's project.
+const PUBLISH_IDENTITY_PORT = 'provisioning.projectPublishIdentity';
+async function isDarkMatter(client) {
+  const identityOf = api.resolveOptional(PUBLISH_IDENTITY_PORT);
+  if (typeof identityOf !== 'function') return false;
+  try {
+    const identity = await identityOf({ slug: client.client_id, host: new URL(client.origin).hostname });
+    return !!identity && projectPublishability(identity).publishable === false;
+  } catch (e) {
+    api.logger('platform-identity').warn(`publish verdict read failed, relaying (non-fatal): ${e && e.message}`);
+    return false;
+  }
+}
+
 // joinRelayOutcome — what the project's own admission surface answered, said in
 // the HUB's words (task 1003044). The project decides; the hub relays and must
 // never paint a refusal as "requested" — nor as "unreachable". A 2xx is a filed
@@ -172,6 +194,10 @@ module.exports = function myProjectsRoutes() {
       if (!client || client.status !== 'active' || !client.origin) {
         return res.fail('unknown_project', 404);
       }
+      if (await isDarkMatter(client)) {
+        return res.json({ ok: true, status: 'not_published', project: { name: client.name, origin: client.origin },
+          message: RELAY_SENTENCE.not_published });
+      }
       // Relay an access request to the project's OWN (public) admission endpoint —
       // the project decides (open-join, or request/invite per ADR 0112). We post to
       // the registry-trusted origin, never the caller's raw input.

package/modules/provisioning/module.json

@@ -14,6 +14,6 @@
     "migrations": true,
     "pollers": ["liveness-sweep", "catalog-backfill"]
   },
-  "provides": ["provisioning.instanceState", "provisioning.projectPlanets", "provisioning.projectOwnedBy"],
+  "provides": ["provisioning.instanceState", "provisioning.projectPlanets", "provisioning.projectOwnedBy", "provisioning.projectPublishIdentity"],
   "consumes": []
 }

package/modules/provisioning/routes/provisioning.js

@@ -58,6 +58,8 @@ const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285,
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
 const { badProjectDetail, badModuleSelection, badProjectType } = require('./body-validators');
+// the kernel ports this module provides (moved out at the size ratchet, task 1003578)
+const { registerProvisioningSeams } = require('../seams');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
 
@@ -110,28 +112,6 @@ function ownerFromTargetRef(ref) {
   return m ? m[1] : null;
 }
 
-// Register this module's kernel seam (ADR 0083 / the registerBoxSeams precedent).
-// Idempotent — the loader calls this factory once at boot, but tests may
-// instantiate the router repeatedly; gating on hasProvider keeps the port
-// single-registered.
-//   • PROVIDES port `provisioning.instanceState` (slug) → { status, … } | null.
-//     Lets other code read an instance's provisioning status via
-//     resolveOptional without importing this module (box.hasEverConnected pattern).
-//   • PROVIDES port `provisioning.projectPlanets` (hosts[]) → { host: { planet_template,
-//     planet_accent } } — the owners' planet choices (task 1003347), so the hub's
-//     public featured feed can carry them without importing this module.
-//   • PROVIDES port `provisioning.projectOwnedBy` ({ slug, host, builderId }) → boolean —
-//     the OWNERSHIP fact behind a hub catalog row (task 1003580), so a hub surface can
-//     own-scope a project without importing this module and without treating the hub's
-//     `owner_github_id` columns as authority (ADR 0238). See projectOwnedBy for why the
-//     question names both halves of the ADR 0246 projection.
-function registerProvisioningSeams() {
-  if (api.hasProvider('provisioning.instanceState')) return;
-  api.registerProvider('provisioning.instanceState', (slug) => provisioning.instanceStateForSlug(pool, slug));
-  api.registerProvider('provisioning.projectPlanets', (hosts) => provisioning.planetChoicesForHosts(pool, hosts));
-  api.registerProvider('provisioning.projectOwnedBy', (target) => provisioning.projectOwnedBy(pool, target));
-}
-
 // Is this project on the public map, and if not, what is it still missing?
 // (R16, task 1002335 — the surface R15 pointed at by name.)
 //

package/modules/provisioning/seams.js

@@ -0,0 +1,54 @@
+// modules/provisioning/seams.js — the kernel ports this module provides (ADR 0083 / the
+// registerBoxSeams precedent). Moved out of routes/provisioning.js under task 1003578,
+// because that file sits at the 1500-line fitness ratchet and a new port needed a line.
+'use strict';
+
+const api = require('../../src/module-api');
+const { pool } = api;
+const provisioning = require('./provisioning');
+
+// The `provisioning.projectPublishIdentity` port (task 1003578, ADR 0247 D4): the name and
+// description the publish gate judges, for the control-plane project a hub catalog row was
+// projected from. This row is the one LIVE copy of a control-plane project's description;
+// the hub's catalog column is a cache (ADR 0182 D5), so the hub's join relay asks here.
+//
+// Keyed on BOTH halves of the ADR 0246 projection (`client_id = slug` at `https://<domain>`),
+// the `projectOwnedBy` rule: a hand-seeded catalog row's name is squattable in this table,
+// and a stranger's instance must not answer for it. The slug IS the name on this plane, so
+// the mapping stays here and the rule stays in the hub. `null` = no row = NO verdict.
+async function projectPublishIdentity(db, { slug, host } = {}) {
+  if (typeof slug !== 'string' || !slug) return null;
+  const { rows } = await db.query(
+    `SELECT slug, description FROM provisioning_instances
+      WHERE slug = $1 AND lower(domain) = $2
+      LIMIT 1`,
+    [slug, typeof host === 'string' ? host.toLowerCase() : ''],
+  );
+  return rows[0] ? { name: rows[0].slug, description: rows[0].description } : null;
+}
+
+// Idempotent — the loader calls the routes factory once at boot, but tests may
+// instantiate the router repeatedly; gating on hasProvider keeps each port
+// single-registered.
+//   • PROVIDES port `provisioning.instanceState` (slug) → { status, … } | null.
+//     Lets other code read an instance's provisioning status via
+//     resolveOptional without importing this module (box.hasEverConnected pattern).
+//   • PROVIDES port `provisioning.projectPlanets` (hosts[]) → { host: { planet_template,
+//     planet_accent } } — the owners' planet choices (task 1003347), so the hub's
+//     public featured feed can carry them without importing this module.
+//   • PROVIDES port `provisioning.projectOwnedBy` ({ slug, host, builderId }) → boolean —
+//     the OWNERSHIP fact behind a hub catalog row (task 1003580), so a hub surface can
+//     own-scope a project without importing this module and without treating the hub's
+//     `owner_github_id` columns as authority (ADR 0238). See projectOwnedBy for why the
+//     question names both halves of the ADR 0246 projection.
+//   • PROVIDES port `provisioning.projectPublishIdentity` ({ slug, host }) → { name,
+//     description } | null — see projectPublishIdentity above.
+function registerProvisioningSeams() {
+  if (api.hasProvider('provisioning.instanceState')) return;
+  api.registerProvider('provisioning.instanceState', (slug) => provisioning.instanceStateForSlug(pool, slug));
+  api.registerProvider('provisioning.projectPlanets', (hosts) => provisioning.planetChoicesForHosts(pool, hosts));
+  api.registerProvider('provisioning.projectOwnedBy', (target) => provisioning.projectOwnedBy(pool, target));
+  api.registerProvider('provisioning.projectPublishIdentity', (target) => projectPublishIdentity(pool, target));
+}
+
+module.exports = { registerProvisioningSeams, projectPublishIdentity };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.826",
+  "version": "1.19.827",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.826",
+      "version": "1.19.827",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.826",
+  "version": "1.19.827",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.826'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.827'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/join_dark_matter.mjs

@@ -0,0 +1,208 @@
+// tests/join_dark_matter.mjs — the hub's join relay refuses a project the platform's own
+// record says is unpublished, before it relays anything (task 1003578, ADR 0247 D4).
+//
+// TWO HALVES.
+//
+//   Part A — the provider: `provisioning.projectPublishIdentity` reads the provisioning row
+//   (the one LIVE copy of a control-plane project's description) keyed on BOTH halves of the
+//   ADR 0246 projection, and maps slug → name so the hub's gate never learns this schema.
+//
+//   Part B — the real POST /my-projects/join with the port scripted. Only a positive
+//   "unpublished" verdict refuses. No port, no row (a self-hosted or hand-seeded project),
+//   or a failed read is NO verdict, and the request is relayed exactly as before — the
+//   project's own door still decides, and the hub grants nothing by relaying.
+//
+// DB-free. Run:  node --test tests/join_dark_matter.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+// ESM import so the knip ratchet credits the exports this file consumes
+// (a createRequire() import does not credit a CJS export).
+import { projectPublishIdentity, registerProvisioningSeams } from '../modules/provisioning/seams.js';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const PORT_NAME = 'provisioning.projectPublishIdentity';
+
+// ── the doorway, with the port scripted ──────────────────────────────────────
+
+let portMode = 'present';        // 'present' | 'absent' | 'throws'
+let identity = null;             // what the port answers
+let portCalls = [];
+let fetches = [];
+let echoWrites = 0;
+
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    if (/FROM platform_identity_sso_clients WHERE origin = \$1 AND status = 'active'/.test(sql)) {
+      return { rows: params[0] === 'https://Target.example'
+        ? [{ client_id: 'proj-open', name: 'Target', origin: 'https://Target.example', status: 'active' }]
+        : [] };
+    }
+    if (/^INSERT INTO platform_identity_application_echoes/.test(sql)) { echoWrites++; return { rows: [] }; }
+    throw new Error(`fake pool: unsupported statement — ${sql}`);
+  },
+};
+
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool,
+  logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
+  requireBuilder: (req, _res, next) => {
+    req.builder = { id: 1, github_id: 4242, github_login: 'octo', display_name: 'Octo' };
+    next();
+  },
+  resolveOptional: (name, fallback = null) => {
+    if (name !== PORT_NAME) return realApi.resolveOptional(name, fallback);
+    if (portMode === 'absent') return fallback;
+    return async (target) => {
+      portCalls.push(target);
+      if (portMode === 'throws') throw new Error('provisioning is down');
+      return identity;
+    };
+  },
+};
+
+const statsPath = require.resolve('../modules/platform-identity/project-stats.js');
+require.cache[statsPath] = {
+  id: statsPath, filename: statsPath, loaded: true,
+  exports: { getProjectStats: async () => ({}) },
+};
+
+const myProjectsRoutes = require('../modules/platform-identity/routes/my-projects.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const realFetch = globalThis.fetch;
+globalThis.fetch = async (url) => {
+  fetches.push(String(url));
+  return { status: 201, json: async () => ({ ok: true }) };
+};
+after(() => { globalThis.fetch = realFetch; });
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', myProjectsRoutes());
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function join(origin = 'https://Target.example') {
+  return new Promise((resolve, reject) => {
+    const payload = Buffer.from(JSON.stringify({ origin }));
+    const req = http.request({ host: '127.0.0.1', port, method: 'POST', path: '/api/bongos/my-projects/join',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': payload.length } }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: data ? JSON.parse(data) : null }));
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+function reset(mode, answer) {
+  portMode = mode; identity = answer; portCalls = []; fetches = []; echoWrites = 0;
+}
+
+// ── Part A — the provider ────────────────────────────────────────────────────
+
+function recorder(rows = []) {
+  const calls = [];
+  return { calls, query: async (sql, params) => { calls.push({ sql: String(sql).replace(/\s+/g, ' ').trim(), params }); return { rows }; } };
+}
+
+test('projectPublishIdentity asks the provisioning row for BOTH halves of the projection', async () => {
+  const db = recorder([{ slug: 'spike', description: 'A harbour of builders' }]);
+  const got = await projectPublishIdentity(db, { slug: 'spike', host: 'Spike.Example.com' });
+  assert.deepEqual(got, { name: 'spike', description: 'A harbour of builders' },
+    'the slug IS the name on this plane — the mapping stays here, the rule stays in the hub');
+  const [{ sql, params }] = db.calls;
+  assert.match(sql, /FROM provisioning_instances WHERE slug = \$1 AND lower\(domain\) = \$2/);
+  assert.deepEqual(params, ['spike', 'spike.example.com']);
+});
+
+test('projectPublishIdentity answers null — no verdict — when no row carries both halves', async () => {
+  assert.equal(await projectPublishIdentity(recorder([]), { slug: 'spike', host: 'h.test' }), null);
+});
+
+test('projectPublishIdentity never queries for a target that names no project', async () => {
+  for (const target of [{}, { slug: '', host: 'h.test' }, { slug: ['spike'], host: 'h.test' }, undefined]) {
+    const db = recorder([{ slug: 'spike', description: 'x' }]);
+    assert.equal(await projectPublishIdentity(db, target), null, JSON.stringify(target));
+    assert.equal(db.calls.length, 0);
+  }
+});
+
+test('the port is registered once, declared by provisioning, and not required by the hub', () => {
+  registerProvisioningSeams();
+  registerProvisioningSeams();
+  assert.equal(typeof realApi.resolveOptional(PORT_NAME), 'function');
+  const read = (rel) => JSON.parse(readFileSync(new URL(rel, import.meta.url), 'utf8'));
+  assert.ok(read('../modules/provisioning/module.json').provides.includes(PORT_NAME), 'declared');
+  assert.ok(!(read('../modules/platform-identity/module.json').consumes || []).includes(PORT_NAME),
+    'optional — a hub with no provisioning module must still boot and relay');
+});
+
+// ── Part B — the relay ───────────────────────────────────────────────────────
+
+test('an unpublished project is refused at the hub: not_published, no relay, no echo', async () => {
+  reset('present', { name: 'proj-open', description: null });
+  const r = await join();
+  assert.equal(r.status, 200);
+  assert.equal(r.body.status, 'not_published');
+  assert.match(r.body.message, /isn’t published yet/);
+  assert.deepEqual(r.body.project, { name: 'Target', origin: 'https://Target.example' });
+  assert.deepEqual(fetches, [], 'the request never reaches a project with no door');
+  assert.equal(echoWrites, 0, 'a refusal is not an application');
+  assert.deepEqual(portCalls, [{ slug: 'proj-open', host: 'target.example' }],
+    'asked about the client row the relay would have used: client_id + its origin host');
+});
+
+test('a blank description is dark matter too — the gate trims, so the relay does', async () => {
+  reset('present', { name: 'proj-open', description: '   ' });
+  const r = await join();
+  assert.equal(r.body.status, 'not_published');
+  assert.deepEqual(fetches, []);
+});
+
+test('a published project is relayed exactly as before', async () => {
+  reset('present', { name: 'proj-open', description: 'A harbour of builders' });
+  const r = await join();
+  assert.equal(r.body.status, 'requested');
+  assert.equal(fetches.length, 1);
+  assert.equal(echoWrites, 1);
+});
+
+for (const [label, mode, answer] of [
+  ['no provisioning module (no port)', 'absent', null],
+  ['no provisioning row (self-hosted or hand-seeded)', 'present', null],
+  ['a verdict read that fails', 'throws', null],
+]) {
+  test(`${label} is NO verdict: the request is relayed and the project decides`, async () => {
+    reset(mode, answer);
+    const r = await join();
+    assert.equal(r.body.status, 'requested');
+    assert.equal(fetches.length, 1, 'never refused on a guess');
+  });
+}
+
+test('an unknown project is still a 404 and the port is never asked', async () => {
+  reset('present', { name: 'x', description: null });
+  const r = await join('https://nowhere.example');
+  assert.equal(r.status, 404);
+  assert.deepEqual(portCalls, []);
+});

package/tests/projects_hub.mjs

@@ -1950,7 +1950,8 @@ test('the feed carries the owner\'s choice through a seam: platform-identity res
   assert.ok(manifest.provides.includes('provisioning.projectPlanets'), 'the port is declared');
   const pi = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'platform-identity', 'module.json'), 'utf8'));
   assert.ok(!(pi.consumes || []).includes('provisioning.projectPlanets'), 'not a required capability — the hub must boot without provisioning');
-  const prov = fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'routes', 'provisioning.js'), 'utf8');
+  // the registrations moved to seams.js at the routes file's size ratchet (task 1003578)
+  const prov = fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'seams.js'), 'utf8');
   assert.match(prov, /api\.registerProvider\('provisioning\.projectPlanets', \(hosts\) => provisioning\.planetChoicesForHosts\(pool, hosts\)\);/, 'registered beside instanceState');
 });