@bongos/core 1.19.826 → 1.19.828

package/modules/hall-ui/public/blockers-lib.js

@@ -0,0 +1,110 @@
+// blockers-lib.js — the ONE blocker-row renderer (task 1003455, goal 1000089).
+//
+// GET /blockers (modules/ideas/routes/blockers.js) had zero consumers — not the
+// hall, not status-ui — and the only blocker a builder could ever see was
+// GET /blockers/:id, reachable only by typing #/blocker/N into the address bar.
+// Owner decision 2026-08-30: BOTH surfaces, from ONE code path — the open-blocker
+// queue gets a real page (modules/hall-ui/public/blockers.js), and open blockers
+// also become line items in the existing Needs-attention inbox
+// (modules/hall-ui/public/goal-inbox.js), because hall-ui/CLAUDE.md's placement
+// rule says an action awaiting a human is an inbox line, never a new Home card.
+//
+// This file is the shared middle: the goals-lib.js / goalRenderFacts precedent —
+// ONE facts source that both callers render from their own DOM shape, so the two
+// surfaces cannot drift apart the way ~10 hand-rolled pagers did before the kit.
+// The two callers do not share a visual family (the inbox nests inside
+// .ginbox__item, the page's rows are the oversight family's .ov-row), so — unlike
+// goalRenderFacts, whose two callers share one family and one fixed class — the
+// class names are the caller's own, passed in `opts`; only the FACTS (title, the
+// filed date, the note, which tasks it blocks) are shared.
+//
+// Pure: no window.OTB, no DOM, no fetch — Node-require-safe like goals-lib.js /
+// hall-kit.js, so a test can run the real arithmetic instead of agreeing with a
+// copy of it.
+(function (root, factory) {
+  var mod = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = mod;
+  else root.OTBBlockersLib = mod;
+}(typeof self !== 'undefined' ? self : this, function () {
+  'use strict';
+
+  function esc(s) {
+    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
+      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
+    });
+  }
+
+  function fmtDate(iso) {
+    if (!iso) return '';
+    var d = new Date(iso);
+    if (isNaN(d.getTime())) return '';
+    return d.toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' });
+  }
+
+  // A blocker's body_md is the owner's own words, quoted the way goal-inbox.js's
+  // invitation/join rows already quote a note (the SAME convention, not a new
+  // one). It can run to a paragraph, and the row is a summary, so it is clipped —
+  // CSS line-clamp handles visual overflow on both surfaces, this just keeps one
+  // enormous blocker from making the row's own text node absurd.
+  function noteHtml(bodyMd, noteClass) {
+    var t = String(bodyMd || '').trim();
+    if (!t) return '';
+    var clipped = t.length > 240 ? t.slice(0, 239).replace(/\s+$/, '') + '…' : t;
+    return '<p class="' + esc(noteClass) + '">“' + esc(clipped) + '”</p>';
+  }
+
+  // `taskHref(id)` is the caller's own link builder (window.OTBTaskDetail.href on
+  // a live page) — kept OUT of this pure module the way hall-kit.js stays
+  // date-agnostic: the lib never learns what a task URL looks like.
+  function blockingLine(b, taskHref) {
+    var ids = Array.isArray(b.blocking_task_ids) ? b.blocking_task_ids : [];
+    if (!ids.length) return 'Blocking nothing yet';
+    var links = ids.map(function (id) {
+      var label = '#' + id;
+      return taskHref ? '<a href="' + esc(taskHref(id)) + '">' + esc(label) + '</a>' : esc(label);
+    }).join(', ');
+    var noun = ids.length === 1 ? 'task' : 'tasks';
+    return 'Blocking ' + ids.length + ' ' + noun + ': ' + links;
+  }
+
+  // blockerFacts(b, opts) — the shared render. `opts`:
+  //   titleClass  (default 'ov-row__title')
+  //   noteClass   (default 'ov-row__sub')
+  //   whenClass   (default 'ov-row__when')
+  //   blockerHref(id)  — the title's own link (both surfaces point at the SAME
+  //                      #/blocker/N overlay task-detail.js already renders —
+  //                      the "reachable only by typing the URL" bug this task
+  //                      fixes is exactly that overlay having no door INTO it).
+  //   taskHref(id)     — see blockingLine above.
+  // Returns { titleHtml, noteHtml, factsHtml } — fragments, not a wrapped row;
+  // each caller nests them in its OWN <li> (goal-inbox.js's .ginbox__item,
+  // blockers.js's .ov-row), the goalRenderFacts idiom.
+  function blockerFacts(b, opts) {
+    opts = opts || {};
+    var titleClass = opts.titleClass || 'ov-row__title';
+    var noteClass = opts.noteClass || 'ov-row__sub';
+    var whenClass = opts.whenClass || 'ov-row__when';
+    var blockerHref = opts.blockerHref || null;
+    var taskHref = opts.taskHref || null;
+
+    var titleText = esc(b.title || ('Blocker #' + b.id));
+    var titleHtml = blockerHref
+      ? '<a class="' + esc(titleClass) + '" href="' + esc(blockerHref(b.id)) + '">' + titleText + '</a>'
+      : '<span class="' + esc(titleClass) + '">' + titleText + '</span>';
+
+    // ONE fact line, `·`-joined — the watch.js convention (its box/report rows
+    // join multiple facts into a single .ov-row__when span the same way) rather
+    // than several sibling spans, which need a flex-gapped parent to space
+    // themselves and the attention-inbox context (.ginbox__sub) is not one.
+    var facts = 'Filed ' + esc(fmtDate(b.created_at)) + ' · ' + blockingLine(b, taskHref);
+    var factsHtml = '<span class="' + esc(whenClass) + '">' + facts + '</span>';
+
+    return {
+      titleHtml: titleHtml,
+      noteHtml: noteHtml(b.body_md, noteClass),
+      factsHtml: factsHtml,
+    };
+  }
+
+  return { esc: esc, fmtDate: fmtDate, blockingLine: blockingLine, blockerFacts: blockerFacts };
+}));

package/modules/hall-ui/public/blockers.html

@@ -0,0 +1,65 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Blockers — {{worldName}}</title>
+  <meta name="description" content="What is stuck on the owner right now: open blockers and the work they hold up.">
+  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <!-- task 1003455: the row shape (title + facts) is the oversight family's,
+       the same archetype collab/copy-desk/watch/gate already ride. -->
+  <link rel="stylesheet" href="/builders/oversight.css">
+</head>
+<body data-page="blockers" data-page-title="Blockers">
+
+<div class="app">
+  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
+  <div class="app-scrim" id="app-scrim" hidden></div>
+  <div class="app-body">
+    <header class="app-topbar" id="app-topbar"></header>
+    <div class="app-content">
+      <div class="page-head page-head--board">
+        <h1 class="page-head__h">Blockers</h1>
+        <p class="page-head__sub" id="blockers-sub">Things stuck on the owner — a credential, a purchase, a product call only they can make. Resolving one un-sticks every task waiting on it automatically.</p>
+      </div>
+
+      <main id="hall-main">
+        <!-- task 1003455 (goal 1000089): the queue GET /blockers had no page for
+             — the only door in used to be typing #/blocker/N into the address
+             bar. This is the read half; filing/resolving/linking is task 1003456. -->
+        <section class="scroll" id="blockers-scroll" aria-labelledby="blockers-h">
+          <h2 id="blockers-h" class="scroll__h">Open blockers<span class="count-pill" id="blockers-count" hidden></span></h2>
+          <div id="blockers-body">
+            <p class="profile__placeholder">Loading…</p>
+          </div>
+        </section>
+      </main>
+
+      <footer class="app-foot" id="app-foot"></footer>
+    </div>
+  </div>
+</div>
+
+<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
+
+<!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
+     chrome exists before the page script runs. -->
+<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
+<script src="/builders/palette.js" defer></script>
+<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
+     branding pack's currency label, loaded BEFORE blockers.js. -->
+<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
+<script src="/builders/brand-apply.js"></script>
+<script src="/builders/hall-kit.js"></script>
+<!-- task-detail.js still owns the #/blocker/N deep-link overlay every row's
+     title opens into — this page needs its link-builder (OTBTaskDetail.href)
+     for the "blocking N tasks" facts line, but not the overlay's own render. -->
+<script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
+<script src="/builders/blockers-lib.js"></script>
+<script src="/builders/blockers.js"></script>
+</body>
+</html>

package/modules/hall-ui/public/blockers.js

@@ -0,0 +1,88 @@
+// blockers.js — the Blockers page: the full open-blocker queue (task 1003455,
+// goal 1000089).
+//
+// GET /blockers (modules/ideas/routes/blockers.js) is PUBLIC and had ZERO hall
+// consumers before this task — the only blocker a builder could ever see was the
+// #/blocker/N overlay task-detail.js already renders, reachable only by typing
+// the id into the address bar. Owner decision 2026-08-30: BOTH surfaces, from
+// ONE code path — this page is the full queue (a long list has nowhere else to
+// live), and goal-inbox.js's attention-inbox slice is the capped summary. Both
+// render from blockers-lib.js's blockerFacts(), so the two cannot drift apart
+// the way ~10 hand-rolled pagers did before the kit (hall-ui/CLAUDE.md).
+//
+// Read-only: filing, resolving and linking a blocker to a task are task 1003456.
+// Deliberately UNGATED (tests/hall_page_gate_map.mjs) — its one data source is
+// public, the roster/drachmae precedent: a page must not be gated tighter than
+// the API it fronts.
+(function () {
+  'use strict';
+  var kit = window.OTBKit;
+  var lib = window.OTBBlockersLib;
+  var API = '/api/bongos';
+  var body = document.getElementById('blockers-body');
+  var countPill = document.getElementById('blockers-count');
+  var sub = document.getElementById('blockers-sub');
+
+  var taskHref = function (id) {
+    return window.OTBTaskDetail ? window.OTBTaskDetail.href(id) : ('/task/' + encodeURIComponent(id));
+  };
+  var blockerHref = function (id) { return '#/blocker/' + encodeURIComponent(id); };
+
+  var all = [];
+
+  function rowHtml(b) {
+    var facts = lib.blockerFacts(b, {
+      titleClass: 'ov-row__title',
+      noteClass: 'ov-row__sub',
+      whenClass: 'ov-row__when',
+      blockerHref: blockerHref,
+      taskHref: taskHref,
+    });
+    return '<li class="ov-row" data-id="' + lib.esc(String(b.id)) + '">'
+      + '<div class="ov-row__main">'
+      + facts.titleHtml
+      + facts.noteHtml
+      + '<div class="ov-row__facts">' + facts.factsHtml + '</div>'
+      + '</div>'
+      + '</li>';
+  }
+
+  var pager = kit.makePager('blockers', 'hall-blockers-per-page', { defaultPerPage: 25 });
+  var listEl = null;
+
+  function rerender() {
+    var slice = kit.paginate(all, pager);
+    listEl.innerHTML = slice.length
+      ? slice.map(rowHtml).join('')
+      : kit.emptyStateHtml('Nothing is stuck on the owner right now.');
+  }
+
+  function mountBlockers(rows) {
+    all = Array.isArray(rows) ? rows : [];
+    if (countPill) { countPill.textContent = String(all.length); countPill.hidden = all.length === 0; }
+    if (sub) {
+      sub.textContent = all.length
+        ? (all.length === 1 ? 'One thing' : all.length + ' things') + ' stuck on the owner — a credential, a '
+          + 'purchase, a product call only they can make. Resolving one un-sticks every task waiting on it automatically.'
+        : 'Nothing is stuck on the owner right now.';
+    }
+    body.innerHTML = '<ul class="ov-rows" id="blockers-list"></ul>' + kit.pagerBarHtml(pager.prefix, { label: 'blockers' });
+    listEl = document.getElementById('blockers-list');
+    kit.wirePager(pager, rerender);
+    rerender();
+  }
+
+  function notice(msg) {
+    body.innerHTML = '';
+    body.className = 'note';
+    body.textContent = msg;
+  }
+
+  fetch(API + '/blockers?limit=200', { headers: { Accept: 'application/json' } })
+    .then(function (r) {
+      if (!r.ok) throw new Error('http ' + r.status);
+      return r.json();
+    })
+    .then(function (data) { mountBlockers(data && data.blockers); })
+    .catch(function () { notice('Couldn’t load the blocker queue right now.'); });
+}());

package/modules/hall-ui/public/goal-inbox.js

@@ -384,6 +384,73 @@
       });
   }
 
+  // ---- open blockers (task 1003455, goal 1000089) ---------------------------
+  //
+  // GET /blockers is public and had ZERO hall consumers — the only blocker a
+  // builder could ever see was the #/blocker/N overlay task-detail.js already
+  // renders, reachable only by typing the id into the address bar. This slice
+  // + the /blockers page (blockers.js) are ONE code path: both render from
+  // blockers-lib.js's blockerFacts(), loaded before this file (index.html).
+  const MAX_BLOCKER_ROWS = 5;
+
+  function blockerRowHtml(b) {
+    const lib = window.OTBBlockersLib;
+    const facts = lib.blockerFacts(b, {
+      titleClass: 'ginbox__goal',
+      noteClass: 'ginbox__note',
+      whenClass: 'ginbox__sub',
+      // The SAME overlay task-detail.js has rendered since task 1003066's
+      // predecessor — this slice is what gives it its first door in.
+      blockerHref: (id) => `#/blocker/${encodeURIComponent(id)}`,
+      taskHref: (id) => (window.OTBTaskDetail ? window.OTBTaskDetail.href(id) : `/task/${encodeURIComponent(id)}`),
+    });
+    return `<li class="ginbox__item">
+        <div class="ginbox__body">
+          ${facts.titleHtml}
+          ${facts.factsHtml}
+          ${facts.noteHtml}
+        </div>
+      </li>`;
+  }
+
+  function renderBlockers(data) {
+    const box = host && host.querySelector('#attention-blockers');
+    if (!box) return;
+    const rows = (data && Array.isArray(data.blockers)) ? data.blockers : [];
+    if (!rows.length) {
+      box.innerHTML = '';
+      window.OTBAttention?.refresh();
+      return;
+    }
+    const total = (data && data.page && Number.isFinite(data.page.total)) ? data.page.total : rows.length;
+    const more = total > rows.length
+      ? `<p class="ginbox__pending">…${total - rows.length} more — <a href="/blockers">open the queue</a>.</p>`
+      : '';
+    box.innerHTML = '<h3 class="ginbox__sec-h">Stuck on the owner '
+      + `<span class="count-pill">${total}</span></h3>`
+      + `<ul class="ginbox">${rows.map(blockerRowHtml).join('')}</ul>${more}`;
+    window.OTBAttention?.refresh();
+  }
+
+  // task 1003448's "Home bounded reads" rule: ask the server for exactly the
+  // rows the card will show (limit=MAX_BLOCKER_ROWS) and read `page.total` back,
+  // rather than fetching every open blocker and slicing it client-side — the
+  // Next-up / triage-card bug this file's own CLAUDE.md names as the shape to
+  // avoid.
+  function loadBlockers() {
+    return getJSON(`${API}/blockers?limit=${MAX_BLOCKER_ROWS}`)
+      .then((data) => renderBlockers(data))
+      .catch((err) => {
+        const box = host && host.querySelector('#attention-blockers');
+        if (box) box.innerHTML = '';
+        window.OTBAttention?.refresh();
+        if (err.code !== 'auth-needed' && err.code !== 'not-found') {
+          console.warn('[hall] blockers feed unavailable — the "Stuck on the owner" section is empty '
+            + 'because the request failed, NOT because nothing is open:', err);
+        }
+      });
+  }
+
   // task 2169: this widget IS the "Needs your attention" card — ONE capped
   // summary hosting every actionable item class: goal invitations +
   // join-requests (this file) and ideas awaiting triage (builders.js renders
@@ -417,6 +484,12 @@
       // triage. Its rows carry the shared .ginbox__item class, so refresh()
       // counts them with no change to the selector below.
       '<div id="attention-nod"></div>' +
+      // task 1003455 (goal 1000089): open blockers — things stuck on the owner
+      // (modules/ideas/blockers.js). AFTER nod, BEFORE rot: like every slice
+      // above it, a blocker is genuinely waiting on a human, but unlike them it
+      // is project-wide rather than addressed to this viewer, so it sits with
+      // rot's standing-question tail rather than the personal asks at the top.
+      '<div id="attention-blockers"></div>' +
       // task 1003279 (goal 1000072): work going quiet — a goal or task untouched
       // past the project's rot timer, with the owner's four verbs on it. LAST in
       // the card on purpose: every slice above is somebody waiting on YOU right
@@ -426,6 +499,7 @@
     host.addEventListener('click', onClick);
     load();
     loadNodQueue();
+    loadBlockers();
     loadRot();
     // task 1002802 (P06): the profile slice lives in its own file (builders.js is
     // over the size budget); this card owns its div, so it boots it here.

package/modules/hall-ui/public/index.html

@@ -121,6 +121,10 @@
 <script src="/builders/hall-widgets.js?v=2026-06-27-r75" defer></script>
 <!-- BV1.R78 (task 1694): the Goals widget registers into the same registry. -->
 <script src="/builders/goals.js?v=2026-07-01-goals" defer></script>
+<!-- task 1003455: the shared blocker-row renderer (window.OTBBlockersLib), read by
+     both goal-inbox.js's attention-inbox slice below and the /blockers page.
+     Loaded BEFORE goal-inbox.js, which calls it while rendering. -->
+<script src="/builders/blockers-lib.js" defer></script>
 <!-- ADR 0112 (task 1954): the home-page goal-membership inbox — invitations to
      accept + join-requests to approve. Self-registers; hidden when empty. -->
 <script src="/builders/goal-inbox.js?v=2026-07-10-goal-inbox" defer></script>

package/modules/hall-ui/public/shell.js

@@ -165,6 +165,15 @@
       // active-nav detection (#nav-work), the 'work' gate case, and the server
       // page-gate all keep working — only the visible label and order change.
       { id: 'work', label: 'Tasks', icon: 'work', href: '/work', gate: 'signed' },
+      // task 1003455 (goal 1000089): the open-blocker queue — what's stuck on the
+      // owner. Lives with the project's own state (Roadmap/Goals/Tasks), not You
+      // or Community, because its subject is the project, not a person. Its one
+      // data source (GET /blockers) is deliberately public, like Roadmap's — but
+      // the NAV FLAG stays 'signed' on the roster/drachmae precedent: an ungated
+      // page can still gate cosmetically wider in the sidebar than the API it
+      // fronts, showing the link to signed-in builders while a stranger who
+      // already has the URL can still open it.
+      { id: 'blockers', label: 'Blockers', icon: 'admin', href: '/blockers', gate: 'signed' },
       // task 1003744 (goal 1000111): the Board Room lives HERE, in the project's
       // own group, and gates on the atom its page gates on.
       //

package/modules/platform-identity/routes/my-projects.js

@@ -6,7 +6,8 @@
 //                                    asked to join and when (ADR 0201 D1.3)
 //   POST /my-projects/join         — apply to a project: one click plus an optional
 //                                    note in the applicant's own words (task 1002330).
-//                                    Relayed; the project executes and decides.
+//                                    Relayed; the project executes and decides —
+//                                    unless the platform's record says it is unpublished.
 //   POST /my-projects/:clientId/leave — self-service offboard (reflected to the hub)
 //
 // All gated on a live HUB session (requireBuilder). Authority stays LOCAL: JOIN only
@@ -24,9 +25,30 @@ const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const projectStats = require('../project-stats');
 const applicationEcho = require('../application-echo');
+const { projectPublishability } = require('../publish-gate');
 
 const { pool, requireBuilder, validateOrRespond, userAgent } = api;
 
+// Dark matter, refused before the relay (task 1003578, ADR 0247 D4). The project's own
+// door cannot lock itself — its instance never holds its description — so the hub asks the
+// provisioning row, the one live copy, through a port resolved by name (ADR 0083; optional,
+// the `provisioning.projectOwnedBy` precedent). Only a POSITIVE verdict refuses. No port, no
+// row (a self-hosted or hand-seeded project) or a failed read is no verdict, and the request
+// is relayed as before: relaying grants nothing, and refusing on a guess would tell an
+// applicant something untrue about someone else's project.
+const PUBLISH_IDENTITY_PORT = 'provisioning.projectPublishIdentity';
+async function isDarkMatter(client) {
+  const identityOf = api.resolveOptional(PUBLISH_IDENTITY_PORT);
+  if (typeof identityOf !== 'function') return false;
+  try {
+    const identity = await identityOf({ slug: client.client_id, host: new URL(client.origin).hostname });
+    return !!identity && projectPublishability(identity).publishable === false;
+  } catch (e) {
+    api.logger('platform-identity').warn(`publish verdict read failed, relaying (non-fatal): ${e && e.message}`);
+    return false;
+  }
+}
+
 // joinRelayOutcome — what the project's own admission surface answered, said in
 // the HUB's words (task 1003044). The project decides; the hub relays and must
 // never paint a refusal as "requested" — nor as "unreachable". A 2xx is a filed
@@ -172,6 +194,10 @@ module.exports = function myProjectsRoutes() {
       if (!client || client.status !== 'active' || !client.origin) {
         return res.fail('unknown_project', 404);
       }
+      if (await isDarkMatter(client)) {
+        return res.json({ ok: true, status: 'not_published', project: { name: client.name, origin: client.origin },
+          message: RELAY_SENTENCE.not_published });
+      }
       // Relay an access request to the project's OWN (public) admission endpoint —
       // the project decides (open-join, or request/invite per ADR 0112). We post to
       // the registry-trusted origin, never the caller's raw input.

package/modules/provisioning/module.json

@@ -14,6 +14,6 @@
     "migrations": true,
     "pollers": ["liveness-sweep", "catalog-backfill"]
   },
-  "provides": ["provisioning.instanceState", "provisioning.projectPlanets", "provisioning.projectOwnedBy"],
+  "provides": ["provisioning.instanceState", "provisioning.projectPlanets", "provisioning.projectOwnedBy", "provisioning.projectPublishIdentity"],
   "consumes": []
 }

package/modules/provisioning/routes/provisioning.js

@@ -58,6 +58,8 @@ const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285,
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
 const { badProjectDetail, badModuleSelection, badProjectType } = require('./body-validators');
+// the kernel ports this module provides (moved out at the size ratchet, task 1003578)
+const { registerProvisioningSeams } = require('../seams');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
 
@@ -110,28 +112,6 @@ function ownerFromTargetRef(ref) {
   return m ? m[1] : null;
 }
 
-// Register this module's kernel seam (ADR 0083 / the registerBoxSeams precedent).
-// Idempotent — the loader calls this factory once at boot, but tests may
-// instantiate the router repeatedly; gating on hasProvider keeps the port
-// single-registered.
-//   • PROVIDES port `provisioning.instanceState` (slug) → { status, … } | null.
-//     Lets other code read an instance's provisioning status via
-//     resolveOptional without importing this module (box.hasEverConnected pattern).
-//   • PROVIDES port `provisioning.projectPlanets` (hosts[]) → { host: { planet_template,
-//     planet_accent } } — the owners' planet choices (task 1003347), so the hub's
-//     public featured feed can carry them without importing this module.
-//   • PROVIDES port `provisioning.projectOwnedBy` ({ slug, host, builderId }) → boolean —
-//     the OWNERSHIP fact behind a hub catalog row (task 1003580), so a hub surface can
-//     own-scope a project without importing this module and without treating the hub's
-//     `owner_github_id` columns as authority (ADR 0238). See projectOwnedBy for why the
-//     question names both halves of the ADR 0246 projection.
-function registerProvisioningSeams() {
-  if (api.hasProvider('provisioning.instanceState')) return;
-  api.registerProvider('provisioning.instanceState', (slug) => provisioning.instanceStateForSlug(pool, slug));
-  api.registerProvider('provisioning.projectPlanets', (hosts) => provisioning.planetChoicesForHosts(pool, hosts));
-  api.registerProvider('provisioning.projectOwnedBy', (target) => provisioning.projectOwnedBy(pool, target));
-}
-
 // Is this project on the public map, and if not, what is it still missing?
 // (R16, task 1002335 — the surface R15 pointed at by name.)
 //

package/modules/provisioning/seams.js

@@ -0,0 +1,54 @@
+// modules/provisioning/seams.js — the kernel ports this module provides (ADR 0083 / the
+// registerBoxSeams precedent). Moved out of routes/provisioning.js under task 1003578,
+// because that file sits at the 1500-line fitness ratchet and a new port needed a line.
+'use strict';
+
+const api = require('../../src/module-api');
+const { pool } = api;
+const provisioning = require('./provisioning');
+
+// The `provisioning.projectPublishIdentity` port (task 1003578, ADR 0247 D4): the name and
+// description the publish gate judges, for the control-plane project a hub catalog row was
+// projected from. This row is the one LIVE copy of a control-plane project's description;
+// the hub's catalog column is a cache (ADR 0182 D5), so the hub's join relay asks here.
+//
+// Keyed on BOTH halves of the ADR 0246 projection (`client_id = slug` at `https://<domain>`),
+// the `projectOwnedBy` rule: a hand-seeded catalog row's name is squattable in this table,
+// and a stranger's instance must not answer for it. The slug IS the name on this plane, so
+// the mapping stays here and the rule stays in the hub. `null` = no row = NO verdict.
+async function projectPublishIdentity(db, { slug, host } = {}) {
+  if (typeof slug !== 'string' || !slug) return null;
+  const { rows } = await db.query(
+    `SELECT slug, description FROM provisioning_instances
+      WHERE slug = $1 AND lower(domain) = $2
+      LIMIT 1`,
+    [slug, typeof host === 'string' ? host.toLowerCase() : ''],
+  );
+  return rows[0] ? { name: rows[0].slug, description: rows[0].description } : null;
+}
+
+// Idempotent — the loader calls the routes factory once at boot, but tests may
+// instantiate the router repeatedly; gating on hasProvider keeps each port
+// single-registered.
+//   • PROVIDES port `provisioning.instanceState` (slug) → { status, … } | null.
+//     Lets other code read an instance's provisioning status via
+//     resolveOptional without importing this module (box.hasEverConnected pattern).
+//   • PROVIDES port `provisioning.projectPlanets` (hosts[]) → { host: { planet_template,
+//     planet_accent } } — the owners' planet choices (task 1003347), so the hub's
+//     public featured feed can carry them without importing this module.
+//   • PROVIDES port `provisioning.projectOwnedBy` ({ slug, host, builderId }) → boolean —
+//     the OWNERSHIP fact behind a hub catalog row (task 1003580), so a hub surface can
+//     own-scope a project without importing this module and without treating the hub's
+//     `owner_github_id` columns as authority (ADR 0238). See projectOwnedBy for why the
+//     question names both halves of the ADR 0246 projection.
+//   • PROVIDES port `provisioning.projectPublishIdentity` ({ slug, host }) → { name,
+//     description } | null — see projectPublishIdentity above.
+function registerProvisioningSeams() {
+  if (api.hasProvider('provisioning.instanceState')) return;
+  api.registerProvider('provisioning.instanceState', (slug) => provisioning.instanceStateForSlug(pool, slug));
+  api.registerProvider('provisioning.projectPlanets', (hosts) => provisioning.planetChoicesForHosts(pool, hosts));
+  api.registerProvider('provisioning.projectOwnedBy', (target) => provisioning.projectOwnedBy(pool, target));
+  api.registerProvider('provisioning.projectPublishIdentity', (target) => projectPublishIdentity(pool, target));
+}
+
+module.exports = { registerProvisioningSeams, projectPublishIdentity };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.826",
+  "version": "1.19.828",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.826",
+      "version": "1.19.828",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.826",
+  "version": "1.19.828",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.826'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.828'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');