@bongos/core 1.19.980 → 1.19.982

package/docs/module-api-changelog.md

@@ -2434,5 +2434,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.978 with no explicit bump. run 35887876013. (task 1002620)
   1.19.980 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.979 with no explicit bump. run 35889261972. (task 1002620)
+  1.19.981 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.980 with no explicit bump. run 35891635199. (task 1002620)
+  1.19.982 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.981 with no explicit bump. run 35894422097. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/blockers-lib.js

@@ -28,25 +28,12 @@
 }(typeof self !== 'undefined' ? self : this, function () {
   'use strict';
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
-
-  function fmtDate(iso) {
-    if (!iso) return '';
-    var d = new Date(iso);
-    if (isNaN(d.getTime())) return '';
-    return d.toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' });
-  }
-
   // A blocker's body_md is the owner's own words, quoted the way goal-inbox.js's
   // invitation/join rows already quote a note (the SAME convention, not a new
   // one). It can run to a paragraph, and the row is a summary, so it is clipped —
   // CSS line-clamp handles visual overflow on both surfaces, this just keeps one
   // enormous blocker from making the row's own text node absurd.
-  function noteHtml(bodyMd, noteClass) {
+  function noteHtml(bodyMd, noteClass, esc) {
     var t = String(bodyMd || '').trim();
     if (!t) return '';
     var clipped = t.length > 240 ? t.slice(0, 239).replace(/\s+$/, '') + '…' : t;
@@ -55,8 +42,9 @@
 
   // `taskHref(id)` is the caller's own link builder (window.OTBTaskDetail.href on
   // a live page) — kept OUT of this pure module the way hall-kit.js stays
-  // date-agnostic: the lib never learns what a task URL looks like.
-  function blockingLine(b, taskHref) {
+  // date-agnostic: the lib never learns what a task URL looks like. `esc` is the
+  // caller's too (OTBKit.esc): the lib owns no formatter of its own (task 1003984).
+  function blockingLine(b, taskHref, esc) {
     var ids = Array.isArray(b.blocking_task_ids) ? b.blocking_task_ids : [];
     if (!ids.length) return 'Blocking nothing yet';
     var links = ids.map(function (id) {
@@ -76,11 +64,18 @@
   //                      the "reachable only by typing the URL" bug this task
   //                      fixes is exactly that overlay having no door INTO it).
   //   taskHref(id)     — see blockingLine above.
+  //   esc(s), fmtDate(iso) — REQUIRED; callers pass OTBKit.esc / OTBKit.fmtAbsDate
+  //                      so the hall keeps ONE definition of each (task 1003984).
   // Returns { titleHtml, noteHtml, factsHtml } — fragments, not a wrapped row;
   // each caller nests them in its OWN <li> (goal-inbox.js's .ginbox__item,
   // blockers.js's .ov-row), the goalRenderFacts idiom.
   function blockerFacts(b, opts) {
     opts = opts || {};
+    var esc = opts.esc;
+    var fmtDate = opts.fmtDate;
+    if (typeof esc !== 'function' || typeof fmtDate !== 'function') {
+      throw new TypeError('blockerFacts: opts.esc and opts.fmtDate are required (pass OTBKit.esc / OTBKit.fmtAbsDate)');
+    }
     var titleClass = opts.titleClass || 'ov-row__title';
     var noteClass = opts.noteClass || 'ov-row__sub';
     var whenClass = opts.whenClass || 'ov-row__when';
@@ -96,15 +91,15 @@
     // join multiple facts into a single .ov-row__when span the same way) rather
     // than several sibling spans, which need a flex-gapped parent to space
     // themselves and the attention-inbox context (.ginbox__sub) is not one.
-    var facts = 'Filed ' + esc(fmtDate(b.created_at)) + ' · ' + blockingLine(b, taskHref);
+    var facts = 'Filed ' + esc(fmtDate(b.created_at)) + ' · ' + blockingLine(b, taskHref, esc);
     var factsHtml = '<span class="' + esc(whenClass) + '">' + facts + '</span>';
 
     return {
       titleHtml: titleHtml,
-      noteHtml: noteHtml(b.body_md, noteClass),
+      noteHtml: noteHtml(b.body_md, noteClass, esc),
       factsHtml: factsHtml,
     };
   }
 
-  return { esc: esc, fmtDate: fmtDate, blockingLine: blockingLine, blockerFacts: blockerFacts };
+  return { blockingLine: blockingLine, blockerFacts: blockerFacts };
 }));

package/modules/hall-ui/public/blockers.js

@@ -120,12 +120,14 @@
       whenClass: 'ov-row__when',
       blockerHref: blockerHref,
       taskHref: taskHref,
+      esc: kit.esc,
+      fmtDate: kit.fmtAbsDate,
     });
     var right = '';
     if (isReviewer()) {
       var id = String(b.id);
       if (openRow && String(openRow.id) === id && openRow.mode === 'resolve') {
-        right = '<div class="ov-row__right"><form class="td-form" data-resolve-form="' + lib.esc(id) + '">'
+        right = '<div class="ov-row__right"><form class="td-form" data-resolve-form="' + kit.esc(id) + '">'
           + '<label class="td-field td-field--wide"><span>Resolution note (optional)</span>'
           + '<input type="text" name="note" maxlength="1000" placeholder="what got un-stuck"></label>'
           + '<div class="td-actions">'
@@ -133,7 +135,7 @@
           + '<button type="button" class="td-btn" data-row-cancel>Cancel</button>'
           + '</div><p class="td-action-note" data-err></p></form></div>';
       } else if (openRow && String(openRow.id) === id && openRow.mode === 'link') {
-        right = '<div class="ov-row__right"><form class="td-form" data-link-form="' + lib.esc(id) + '">'
+        right = '<div class="ov-row__right"><form class="td-form" data-link-form="' + kit.esc(id) + '">'
           + '<label class="td-field td-field--wide"><span>Task #</span>'
           + '<input type="number" name="taskId" min="1" required placeholder="e.g. 1002980"></label>'
           + '<div class="td-actions">'
@@ -142,8 +144,8 @@
           + '</div><p class="td-action-note" data-err></p></form></div>';
       } else {
         right = '<div class="ov-row__right"><div class="ov-row__actions">'
-          + '<button type="button" class="btn-ghost" data-resolve-open="' + lib.esc(id) + '">Resolve</button>'
-          + '<button type="button" class="btn-ghost" data-link-open="' + lib.esc(id) + '">Link a task</button>'
+          + '<button type="button" class="btn-ghost" data-resolve-open="' + kit.esc(id) + '">Resolve</button>'
+          + '<button type="button" class="btn-ghost" data-link-open="' + kit.esc(id) + '">Link a task</button>'
           + '</div></div>';
       }
     }
@@ -154,7 +156,7 @@
     // three-column grid (auto minmax(0,1fr) auto) would misread the actions
     // column as the row's middle content and pin it beside the text on a
     // phone instead of dropping it beneath.
-    return '<li class="ov-row" data-id="' + lib.esc(String(b.id)) + '">'
+    return '<li class="ov-row" data-id="' + kit.esc(String(b.id)) + '">'
       + '<div class="ov-row__main">'
       + facts.titleHtml
       + facts.noteHtml

package/modules/hall-ui/public/goal-inbox.js

@@ -495,6 +495,8 @@
       whenClass: 'ginbox__sub',
       // The SAME overlay task-detail.js has rendered since task 1003066's
       // predecessor — this slice is what gives it its first door in.
+      esc: window.OTBKit.esc,
+      fmtDate: window.OTBKit.fmtAbsDate,
       blockerHref: (id) => `#/blocker/${encodeURIComponent(id)}`,
       taskHref: (id) => (window.OTBTaskDetail ? window.OTBTaskDetail.href(id) : `/task/${encodeURIComponent(id)}`),
     });

package/modules/provisioning/module.json

@@ -16,7 +16,8 @@
       "provisioning",
       "disconnect",
       "core-upgrade",
-      "env-manifest"
+      "env-manifest",
+      "repo-private"
     ],
     "migrations": true,
     "pollers": [

package/modules/provisioning/routes/repo-private.js

@@ -0,0 +1,82 @@
+// modules/provisioning/routes/repo-private.js — POST /provisioning/instances/:id/repo-private
+// (split (c) of task 1003078; ADR 0176).
+//
+// WHY. A project stood up while its repository was public reads its code with the shared key,
+// which cannot read a private repository, so a plain flip would break its next deploy. This
+// route only ENQUEUES the `repo-private` intent; the runner (scripts/gds/provision-repo-private.js)
+// wires the project's own read-only deploy key FIRST and flips SECOND. Going public stays the
+// direct core call (POST /github/repo/visibility) — it needs no wiring.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at the
+// size ratchet — the routes/disconnect.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const repoPrivate = require('../repo-private');
+
+const log = api.logger('provisioning');
+
+// What the runner leg would refuse, answered here so the owner hears it at once instead of
+// as an error note once its retries are spent. The runner keeps its own checks — the row can
+// change between this read and the drain.
+function unavailableReason(inst) {
+  if (inst.hosting_shape === 'byo-host') {
+    return 'This project runs on your own host, so the platform never reads its code — you can make the repository private on GitHub directly.';
+  }
+  if (inst.hosting_shape !== 'standalone') {
+    return 'Only a project on a Cloud host can have its repository made private from here.';
+  }
+  if (inst.status !== 'active') {
+    return 'This project isn’t running right now, so its repository can’t be made private from here. Try again once it’s live.';
+  }
+  if (!inst.target_ref) return 'This project has no GitHub repository linked, so there is nothing to make private.';
+  return null;
+}
+
+module.exports = function buildRepoPrivateRouter() {
+  const router = express.Router();
+
+  // POST /provisioning/instances/:id/repo-private — rank: any authenticated builder, and
+  // OWNER ONLY: no archon override, because the runner flips with the owner's stored GitHub
+  // token whoever asked (owner decision, task 1004194). 404 for everyone else, so another
+  // owner's id is never confirmed. Takes no body. The reply is a receipt — the repository is
+  // still public when it is sent; the manage page re-reads GitHub once the intent settles.
+  router.post('/provisioning/instances/:id/repo-private', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true }); // 400 bad_id + null on failure; positiveInt so id 0 is answered, not dropped
+    if (!id) return;
+    if (validateOrRespond(req, res, {})) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) return res.fail('instance_not_found', 404);
+      const why = unavailableReason(inst);
+      if (why) {
+        return res.fail('repo_private_unavailable', { status: 409, message: why,
+          details: { status: inst.status, hosting_shape: inst.hosting_shape } });
+      }
+      const r = await repoPrivate.enqueueRepoPrivate(pool, id, 'api:self');
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is currently ${r.intent.state} for this project — making the repository private waits for it to finish. Try again once it has.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'repo-private',
+          detail: 'making the repository private requested by owner', actor: 'api:self',
+        }).catch(() => {});
+      }
+      res.json({ ok: true, queued: r.created, action: 'repo-private', status: inst.status,
+        message: r.created
+          ? 'Queued. The platform first gives this project its own read-only deploy key, then makes the repository private. This page updates when it’s done.'
+          : 'Making the repository private is already under way for this project.' });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/repo-private', err);
+      res.fail('repo_private_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/public-landing/public/projects.html

@@ -762,20 +762,16 @@ summary{min-height:24px;padding:3px 0;}
       </div>
 
       <!-- live since task 1003045: reads the repo's real visibility from GitHub
-           with the owner's own repository credential. Flip-to-PUBLIC only — the
-           private direction is refused (server + copy) until the private-repo
-           deploy fix lands, because the deploy pull cannot read a private repo
-           (walk finding N4). -->
+           with the owner's own repository credential. Going public is a direct
+           call; going private (task 1003078) is QUEUED, because the project's own
+           deploy key must be wired before the flip or its next deploy breaks
+           (walk finding N4, ADR 0176). -->
       <div class="card mSec" id="mRepoVisibility">
         <h2>Repository visibility</h2>
         <div id="mRepoVis"><p class="finePrint">Checking the repository on GitHub…</p></div>
-        <!-- the limitation itself, one click away (grade follow-up task 1003077):
-             the refusal above states it; this fold explains it and links the
-             tracked fix. The hall link is apex-only — a child instance keeps the
-             explanation, not another platform's task tracker. -->
         <details class="finePrint" id="mRepoVisWhy">
-          <summary>Why can’t it be private yet?</summary>
-          <p>This project’s deploys read its code from GitHub with an older key that only works on public repositories — so making the repository private would break the next deploy. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically<!--apex-only:start--> — shipped as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall<!--apex-only:end-->. A project set up before that still reads with the older key, so the switch stays off until existing projects are re-wired.</p>
+          <summary>What making it private does</summary>
+          <p>The platform first gives this project its own read-only deploy key and switches its deploys over to it, and only then makes the repository private — in that order, so no deploy ever tries to read a private repository with a key that can’t. The change is made with your connected GitHub account, so that account needs admin rights on the repository. It works for a project on a Cloud host; a project on your own host is yours to change on GitHub directly. You can make it public again from here at any time.</p>
         </details>
       </div>
 
@@ -5149,7 +5145,8 @@ summary{min-height:24px;padding:3px 0;}
     teardown: { names: ['Teardown queued', 'Winding down', 'Torn down'], cls: 'flowDown' },
     address: { names: ['Address queued', 'Wiring the address', 'Answering there'], cls: '' },
     settings: { names: ['Change saved', 'Restarting to apply it', 'Applied'], cls: '' },
-    restart: { names: ['Restart queued', 'Restarting', 'Answering again'], cls: '' }
+    restart: { names: ['Restart queued', 'Restarting', 'Answering again'], cls: '' },
+    repo: { names: ['Change queued', 'Setting up its deploy key', 'Private'], cls: '' }
   };
   function stripMarkup(flow, stageNow, stagesDone, note, extraCls) {
     var f = FLOWS[flow];
@@ -5191,6 +5188,10 @@ summary{min-height:24px;padding:3px 0;}
       if (a === 'restart') return inst.open_intent.state === 'running'
         ? stripMarkup('restart', 1, 1, 'Restarting the project — it goes down and comes back up.')
         : stripMarkup('restart', 0, 0, 'A restart is queued — this card updates when it starts.');
+      /* task 1003078: the deploy key is wired BEFORE the flip — the strip says which half is running */
+      if (a === 'repo-private') return inst.open_intent.state === 'running'
+        ? stripMarkup('repo', 1, 1, 'Making the repository private — setting up the project’s own deploy key first.')
+        : stripMarkup('repo', 0, 0, 'Making the repository private is queued — this card updates when it starts.');
       if (a === 'provision') return stripMarkup(s === 'torn_down' ? 'revive' : 'standup', 0, 0, (s === 'torn_down' ? 'A revive is queued' : 'A standup is queued') + ' — this card updates when it starts.');
       return stripMarkup('standup', 2, 2, 'A ' + esc(a) + ' run is queued — this card updates when it lands.');
     }
@@ -5215,6 +5216,10 @@ summary{min-height:24px;padding:3px 0;}
     var n = String(note || '');
     if (/^repository not found:/i.test(n)) return 'We couldn’t find the project’s repository on GitHub even with the access you granted — it may have been renamed or deleted, or the access was lost.';
     if (/^repository access is not admin:/i.test(n)) return 'Your GitHub access can read the repository but can’t manage its deploy keys — a repository admin needs to raise your access (or make the repository public).';
+    /* the repo-private runner leg's own sentences (task 1003078) — the project is live */
+    if (/made private[\s\S]*credential/i.test(n)) return 'Making the repository private didn’t finish — the project’s GitHub access needs reconnecting first. Its repository is still public.';
+    if (/is still public|made private|left public/i.test(n)) return 'Making the repository private didn’t finish — it’s still public.';
+    if (/^deploy-key setup failed/i.test(n)) return 'Setting up the project’s own read-only deploy key on GitHub didn’t finish.';
     if (/repository not found/i.test(n)) return 'We couldn’t push the starter code to the repository — it wasn’t found on GitHub. A private repository looks “not found” too — if yours is private, sign in again to re-grant repository access, then retry.';
     if (/mkdir|no such file or directory|read-only file system/i.test(n)) return 'The server couldn’t prepare a workspace for the project.';
     if (/(push|clone|github).*permission|permission.*(push|clone|repo)/i.test(n)) return 'We couldn’t reach the repository — the account that set it up doesn’t have permission.';
@@ -5617,6 +5622,7 @@ summary{min-height:24px;padding:3px 0;}
        only, so a queued settings push shows up on the tick without a reload */
     renderVisState(inst);
     renderJoinState(inst);
+    renderRepoVisState(inst);
     /* its planet (task 1003347) reads off the row — fetch-free too; a pick in
        progress survives the tick because only a different project re-renders it */
     renderPick(inst);
@@ -5853,6 +5859,7 @@ summary{min-height:24px;padding:3px 0;}
       $('mChip').innerHTML = '';
       $('mOrb').innerHTML = '';
     }
+    if (!keepRepo) { mRepoPrivSeen = false; mRepoPrivState = ''; }
     var asked = manageId; /* a stale answer must never paint a newer project */
     fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId), { credentials: 'same-origin' })
       .then(function (res) {
@@ -5922,14 +5929,16 @@ summary{min-height:24px;padding:3px 0;}
   setInterval(manageChipTick, REFRESH_MS);
 
   /* ── repo visibility (task 1003045): read live from GitHub with the owner's
-     own repository credential; flip-to-PUBLIC only. The private direction is
-     refused by the server — and unbuilt here — until the private-repo deploy
-     fix lands: the deploy pull runs as the shared deploy key, which cannot
-     read a private repo (walk finding N4), so flipping private would break
-     the project's next deploy. Every claim below is what GitHub answered for
-     THIS account — never a cached or guessed state. ── */
+     own repository credential. Going public is a direct call. Going private
+     (task 1003078) is QUEUED on the provisioning route: the runner wires the
+     project's own deploy key first, because a project stood up public reads
+     with the shared key, which cannot read a private repo (walk finding N4).
+     Every claim below is what GitHub answered for THIS account — never a
+     cached or guessed state; the queue's receipt is not a new visibility. ── */
 
   var manageRepo = null; /* GitHub's last answer for the manage view's repo */
+  var mRepoPrivSeen = false; /* a make-private run was open — ask GitHub again once it settles */
+  var mRepoPrivState = '';   /* the in-flight line last painted: '', 'pending' or 'running' */
 
   function repoVisReconnect() {
     return API + '/auth/web/start?repos=1&return=' +
@@ -5947,14 +5956,67 @@ summary{min-height:24px;padding:3px 0;}
         '<div class="addr">This repository is <b>private</b> — only accounts it’s shared with can read its code.</div>' +
         (snagged
           ? '<div class="projMsg err">A private repository deploys through the project’s own read-only deploy key, wired at standup. If the standup couldn’t read it, retry it from the card above — or make the repository public.</div>'
-          : '<p class="finePrint">The platform reads it through this project’s own read-only deploy key, set up at standup. Nothing to do here.</p>') +
+          : '<p class="finePrint">The platform reads it through this project’s own read-only deploy key. Nothing to do here.</p>') +
         (repo.admin
           ? '<div class="actions"><button type="button" class="btn small ghost" data-repo-public>Make it public</button></div>'
           : '<p class="finePrint">Your GitHub account can’t change this repository’s settings.</p>'));
     } else {
-      repoVisMsg(
-        '<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
-        '<p class="finePrint">Making it private isn’t possible from here yet — see below for why.</p>');
+      repoVisMsg('<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
+        (repoPrivOpen(manageInst)
+          ? '<p class="finePrint">' + (manageInst.open_intent.state === 'running'
+              ? 'Making it private — the platform is giving this project its own deploy key first.'
+              : 'Making it private is queued — the platform gives this project its own deploy key first. Until then it stays public.') + '</p>'
+          : repoPrivDoor(manageInst, repo)) +
+        /* the make-private receipt's slot, painted WITH the state (the #mVisMsg idiom) —
+           a sibling div would land on this one: every .mSec>div takes the same grid cell */
+        '<div class="projMsg" id="mRepoVisMsg" role="status" aria-live="polite"></div>');
+    }
+  }
+
+  /* fetch-free, from open_intent only (renderManage calls it on every repaint) */
+  function repoPrivOpen(inst) {
+    return !!(inst && inst.open_intent && inst.open_intent.action === 'repo-private');
+  }
+
+  /* the one door to private, or the sentence saying why there is none here — the
+     route refuses the same cases; this only keeps a button off a dead end */
+  function repoPrivDoor(inst, repo) {
+    if (!inst) return '';
+    var why = inst.hosting_shape === 'byo-host' ? 'This project runs on your own host, so the platform never reads its code — you can make the repository private on GitHub directly.'
+      : inst.hosting_shape !== 'standalone' ? 'Only a project on a Cloud host can have its repository made private from here.'
+      : inst.status !== 'active' ? 'You can make it private once the project is running.'
+      : !repo.admin ? 'Your GitHub account can’t change this repository’s settings.'
+      : '';
+    if (why) return '<p class="finePrint">' + why + '</p>';
+    return '<p class="finePrint">Making it private gives this project its own deploy key first, so its deploys keep working.</p>' +
+      '<div class="actions"><button type="button" class="btn small ghost" data-repo-private>Make it private</button></div>';
+  }
+
+  function repoVisNote(cls, html) {
+    var box = $('mRepoVisMsg');
+    if (!box) {
+      if (!html) return;
+      $('mRepoVis').insertAdjacentHTML('beforeend', '<div class="projMsg" id="mRepoVisMsg" role="status" aria-live="polite"></div>');
+      box = $('mRepoVisMsg');
+    }
+    box.className = 'projMsg' + (cls ? ' ' + cls : '');
+    box.innerHTML = html;
+  }
+
+  /* the in-flight line is repainted only when the run's state MOVES, so the tick
+     never flickers it; once the run settles, GitHub is asked again — the only
+     source that can say the flip took (the renderVisState contract) */
+  function renderRepoVisState(inst) {
+    var now = repoPrivOpen(inst) ? inst.open_intent.state : '';
+    if (now) mRepoPrivSeen = true;
+    if (now !== mRepoPrivState) {
+      mRepoPrivState = now;
+      if (manageRepo && !manageRepo.private) renderRepoVis(manageRepo);
+    }
+    if (!now && mRepoPrivSeen) {
+      mRepoPrivSeen = false;
+      repoVisNote('', '');
+      loadRepoVisibility(inst);
     }
   }
 
@@ -6034,12 +6096,58 @@ summary{min-height:24px;padding:3px 0;}
     });
   }
 
+  function askRepoPrivate() {
+    var act = document.querySelector('#mRepoVis .actions');
+    if (!act) return;
+    act.innerHTML = '<div class="confirmRow">' +
+      '<span class="plain">Make it private? Only accounts it’s shared with will be able to read the code.</span>' +
+      '<button type="button" class="btn small" data-repo-private-yes>Yes, make it private</button>' +
+      '<button type="button" class="linklike" data-repo-private-no>Keep it public</button></div>';
+  }
+
+  /* the reply is a RECEIPT — the repository is still public when it lands. The
+     in-flight line reads open_intent, so the manage row is re-read, never patched */
+  function doRepoPrivate() {
+    if (!manageInst) return;
+    var btn = document.querySelector('#mRepoVis [data-repo-private-yes]');
+    if (btn) btn.disabled = true;
+    repoVisNote('', 'Queueing…');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/repo-private', {
+      method: 'POST', credentials: 'same-origin'
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the receipt proves a run is OPEN — never that the repository changed. Record
+             that much, so the 5s watch follows it and a repaint from the stale row cannot
+             drop it; the re-read below swaps in the server's own open_intent */
+          if (!repoPrivOpen(manageInst)) manageInst.open_intent = { action: 'repo-private', state: 'pending' };
+          renderRepoVisState(manageInst);
+          repoVisNote('ok', esc(data.message || 'Queued.'));
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (manageRepo) renderRepoVis(manageRepo);
+        repoVisNote('err', res.status === 401 ? signInAgain()
+          : res.status === 404 ? 'Only the project’s owner can make its repository private.'
+          : esc(e.message || 'The change could not be queued — try again in a moment.'));
+      });
+    }).catch(function () {
+      if (manageRepo) renderRepoVis(manageRepo);
+      repoVisNote('err', 'Couldn’t reach the platform — check your connection and try again.');
+    }).then(function () {
+      loadManage(true, true);
+    });
+  }
+
   $('mRepoVis').addEventListener('click', function (ev) {
     var t = ev.target.closest && ev.target.closest('button');
     if (!t) return;
     if (t.hasAttribute('data-repo-public')) return askRepoPublic();
     if (t.hasAttribute('data-repo-public-yes')) return doRepoPublic();
     if (t.hasAttribute('data-repo-public-no')) { if (manageRepo) renderRepoVis(manageRepo); }
+    if (t.hasAttribute('data-repo-private')) return askRepoPrivate();
+    if (t.hasAttribute('data-repo-private-yes')) return doRepoPrivate();
+    if (t.hasAttribute('data-repo-private-no')) { if (manageRepo) renderRepoVis(manageRepo); }
   });
 
   /* ── on the public map (task 1002335, BV1.R16): the publish gate ──────────

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.980",
+  "version": "1.19.982",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.980",
+      "version": "1.19.982",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.980",
+  "version": "1.19.982",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/github.js

@@ -1,7 +1,7 @@
 // src/bongos/routes/github.js — GitHub repo list/create for the signed-in user, the
 // server half of the onboarding wizard's repo picker (adopt) + auto-create (fresh),
 // plus the manage page's repo-visibility read/flip (task 1003045 — public only; the
-// private direction is refused until the private-repo deploy fix lands).
+// private direction is the provisioning module's queued route, task 1003078).
 // Task 1002099 / ADR 0143.
 //
 // These act on the user's OWN GitHub identity, so they live in core auth alongside
@@ -127,9 +127,9 @@ module.exports = function buildGithubRouter() {
     if (!token) return;
     try {
       const repo = await githubRepos.getUserRepo(token, ref);
-      // private_deployable is the platform truth the UI copy leans on: the deploy
-      // pull runs as the shared deploy key, which cannot read a private repo (N4).
-      res.json({ ok: true, repo, private_deployable: false });
+      // private_deployable: a private repo deploys through the project's own read-only
+      // deploy key (ADR 0176), which the manage page's make-private route wires first.
+      res.json({ ok: true, repo, private_deployable: true });
     } catch (err) {
       if (err && err.status === 401) {
         await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
@@ -145,9 +145,10 @@ module.exports = function buildGithubRouter() {
 
   // rank: any-builder — flips one of the caller's repos PUBLIC, with their own
   // credential. The private direction is REFUSED here, before GitHub is ever
-  // called: the deploy pull still runs as the shared deploy key that cannot read
-  // a private repo (walk finding N4), so flipping private would break the
-  // project's next deploy — the refusal is the honest leg task 1003045 ships.
+  // called: a project stood up public reads its code with the shared key, which
+  // cannot read a private repo (walk finding N4), so a bare flip would break its
+  // next deploy. Making it private is POST /provisioning/instances/:id/repo-private
+  // (task 1003078), which wires the project's own deploy key before it flips.
   router.post('/github/repo/visibility', auth.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
       repo: { required: true, type: 'string', maxLength: 140 },
@@ -158,14 +159,14 @@ module.exports = function buildGithubRouter() {
     if (req.body.visibility !== 'public') {
       return res.fail('private_not_deployable', {
         status: 409,
-        message: 'Private repositories can’t be deployed yet — the platform’s deploy pull can’t read them, so making this repository private would break the project’s next deploy. This lands with the private-repo deploy fix.',
+        message: 'Make a repository private from its project’s manage page — the platform has to give the project its own deploy key first, or its next deploy would break.',
       });
     }
     const token = await resolveRepoToken(req, res);
     if (!token) return;
     try {
       const repo = await githubRepos.makeRepoPublic(token, ref);
-      res.json({ ok: true, repo, private_deployable: false });
+      res.json({ ok: true, repo, private_deployable: true });
     } catch (err) {
       if (err && err.status === 401) {
         await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.980'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.982'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');