@bongos/core 1.19.981 → 1.19.982

package/docs/module-api-changelog.md

@@ -2436,5 +2436,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.979 with no explicit bump. run 35889261972. (task 1002620)
   1.19.981 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.980 with no explicit bump. run 35891635199. (task 1002620)
+  1.19.982 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.981 with no explicit bump. run 35894422097. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/module.json

@@ -16,7 +16,8 @@
       "provisioning",
       "disconnect",
       "core-upgrade",
-      "env-manifest"
+      "env-manifest",
+      "repo-private"
     ],
     "migrations": true,
     "pollers": [

package/modules/provisioning/routes/repo-private.js

@@ -0,0 +1,82 @@
+// modules/provisioning/routes/repo-private.js — POST /provisioning/instances/:id/repo-private
+// (split (c) of task 1003078; ADR 0176).
+//
+// WHY. A project stood up while its repository was public reads its code with the shared key,
+// which cannot read a private repository, so a plain flip would break its next deploy. This
+// route only ENQUEUES the `repo-private` intent; the runner (scripts/gds/provision-repo-private.js)
+// wires the project's own read-only deploy key FIRST and flips SECOND. Going public stays the
+// direct core call (POST /github/repo/visibility) — it needs no wiring.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at the
+// size ratchet — the routes/disconnect.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const repoPrivate = require('../repo-private');
+
+const log = api.logger('provisioning');
+
+// What the runner leg would refuse, answered here so the owner hears it at once instead of
+// as an error note once its retries are spent. The runner keeps its own checks — the row can
+// change between this read and the drain.
+function unavailableReason(inst) {
+  if (inst.hosting_shape === 'byo-host') {
+    return 'This project runs on your own host, so the platform never reads its code — you can make the repository private on GitHub directly.';
+  }
+  if (inst.hosting_shape !== 'standalone') {
+    return 'Only a project on a Cloud host can have its repository made private from here.';
+  }
+  if (inst.status !== 'active') {
+    return 'This project isn’t running right now, so its repository can’t be made private from here. Try again once it’s live.';
+  }
+  if (!inst.target_ref) return 'This project has no GitHub repository linked, so there is nothing to make private.';
+  return null;
+}
+
+module.exports = function buildRepoPrivateRouter() {
+  const router = express.Router();
+
+  // POST /provisioning/instances/:id/repo-private — rank: any authenticated builder, and
+  // OWNER ONLY: no archon override, because the runner flips with the owner's stored GitHub
+  // token whoever asked (owner decision, task 1004194). 404 for everyone else, so another
+  // owner's id is never confirmed. Takes no body. The reply is a receipt — the repository is
+  // still public when it is sent; the manage page re-reads GitHub once the intent settles.
+  router.post('/provisioning/instances/:id/repo-private', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true }); // 400 bad_id + null on failure; positiveInt so id 0 is answered, not dropped
+    if (!id) return;
+    if (validateOrRespond(req, res, {})) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) return res.fail('instance_not_found', 404);
+      const why = unavailableReason(inst);
+      if (why) {
+        return res.fail('repo_private_unavailable', { status: 409, message: why,
+          details: { status: inst.status, hosting_shape: inst.hosting_shape } });
+      }
+      const r = await repoPrivate.enqueueRepoPrivate(pool, id, 'api:self');
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is currently ${r.intent.state} for this project — making the repository private waits for it to finish. Try again once it has.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'repo-private',
+          detail: 'making the repository private requested by owner', actor: 'api:self',
+        }).catch(() => {});
+      }
+      res.json({ ok: true, queued: r.created, action: 'repo-private', status: inst.status,
+        message: r.created
+          ? 'Queued. The platform first gives this project its own read-only deploy key, then makes the repository private. This page updates when it’s done.'
+          : 'Making the repository private is already under way for this project.' });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/repo-private', err);
+      res.fail('repo_private_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/public-landing/public/projects.html

@@ -762,20 +762,16 @@ summary{min-height:24px;padding:3px 0;}
       </div>
 
       <!-- live since task 1003045: reads the repo's real visibility from GitHub
-           with the owner's own repository credential. Flip-to-PUBLIC only — the
-           private direction is refused (server + copy) until the private-repo
-           deploy fix lands, because the deploy pull cannot read a private repo
-           (walk finding N4). -->
+           with the owner's own repository credential. Going public is a direct
+           call; going private (task 1003078) is QUEUED, because the project's own
+           deploy key must be wired before the flip or its next deploy breaks
+           (walk finding N4, ADR 0176). -->
       <div class="card mSec" id="mRepoVisibility">
         <h2>Repository visibility</h2>
         <div id="mRepoVis"><p class="finePrint">Checking the repository on GitHub…</p></div>
-        <!-- the limitation itself, one click away (grade follow-up task 1003077):
-             the refusal above states it; this fold explains it and links the
-             tracked fix. The hall link is apex-only — a child instance keeps the
-             explanation, not another platform's task tracker. -->
         <details class="finePrint" id="mRepoVisWhy">
-          <summary>Why can’t it be private yet?</summary>
-          <p>This project’s deploys read its code from GitHub with an older key that only works on public repositories — so making the repository private would break the next deploy. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically<!--apex-only:start--> — shipped as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall<!--apex-only:end-->. A project set up before that still reads with the older key, so the switch stays off until existing projects are re-wired.</p>
+          <summary>What making it private does</summary>
+          <p>The platform first gives this project its own read-only deploy key and switches its deploys over to it, and only then makes the repository private — in that order, so no deploy ever tries to read a private repository with a key that can’t. The change is made with your connected GitHub account, so that account needs admin rights on the repository. It works for a project on a Cloud host; a project on your own host is yours to change on GitHub directly. You can make it public again from here at any time.</p>
         </details>
       </div>
 
@@ -5149,7 +5145,8 @@ summary{min-height:24px;padding:3px 0;}
     teardown: { names: ['Teardown queued', 'Winding down', 'Torn down'], cls: 'flowDown' },
     address: { names: ['Address queued', 'Wiring the address', 'Answering there'], cls: '' },
     settings: { names: ['Change saved', 'Restarting to apply it', 'Applied'], cls: '' },
-    restart: { names: ['Restart queued', 'Restarting', 'Answering again'], cls: '' }
+    restart: { names: ['Restart queued', 'Restarting', 'Answering again'], cls: '' },
+    repo: { names: ['Change queued', 'Setting up its deploy key', 'Private'], cls: '' }
   };
   function stripMarkup(flow, stageNow, stagesDone, note, extraCls) {
     var f = FLOWS[flow];
@@ -5191,6 +5188,10 @@ summary{min-height:24px;padding:3px 0;}
       if (a === 'restart') return inst.open_intent.state === 'running'
         ? stripMarkup('restart', 1, 1, 'Restarting the project — it goes down and comes back up.')
         : stripMarkup('restart', 0, 0, 'A restart is queued — this card updates when it starts.');
+      /* task 1003078: the deploy key is wired BEFORE the flip — the strip says which half is running */
+      if (a === 'repo-private') return inst.open_intent.state === 'running'
+        ? stripMarkup('repo', 1, 1, 'Making the repository private — setting up the project’s own deploy key first.')
+        : stripMarkup('repo', 0, 0, 'Making the repository private is queued — this card updates when it starts.');
       if (a === 'provision') return stripMarkup(s === 'torn_down' ? 'revive' : 'standup', 0, 0, (s === 'torn_down' ? 'A revive is queued' : 'A standup is queued') + ' — this card updates when it starts.');
       return stripMarkup('standup', 2, 2, 'A ' + esc(a) + ' run is queued — this card updates when it lands.');
     }
@@ -5215,6 +5216,10 @@ summary{min-height:24px;padding:3px 0;}
     var n = String(note || '');
     if (/^repository not found:/i.test(n)) return 'We couldn’t find the project’s repository on GitHub even with the access you granted — it may have been renamed or deleted, or the access was lost.';
     if (/^repository access is not admin:/i.test(n)) return 'Your GitHub access can read the repository but can’t manage its deploy keys — a repository admin needs to raise your access (or make the repository public).';
+    /* the repo-private runner leg's own sentences (task 1003078) — the project is live */
+    if (/made private[\s\S]*credential/i.test(n)) return 'Making the repository private didn’t finish — the project’s GitHub access needs reconnecting first. Its repository is still public.';
+    if (/is still public|made private|left public/i.test(n)) return 'Making the repository private didn’t finish — it’s still public.';
+    if (/^deploy-key setup failed/i.test(n)) return 'Setting up the project’s own read-only deploy key on GitHub didn’t finish.';
     if (/repository not found/i.test(n)) return 'We couldn’t push the starter code to the repository — it wasn’t found on GitHub. A private repository looks “not found” too — if yours is private, sign in again to re-grant repository access, then retry.';
     if (/mkdir|no such file or directory|read-only file system/i.test(n)) return 'The server couldn’t prepare a workspace for the project.';
     if (/(push|clone|github).*permission|permission.*(push|clone|repo)/i.test(n)) return 'We couldn’t reach the repository — the account that set it up doesn’t have permission.';
@@ -5617,6 +5622,7 @@ summary{min-height:24px;padding:3px 0;}
        only, so a queued settings push shows up on the tick without a reload */
     renderVisState(inst);
     renderJoinState(inst);
+    renderRepoVisState(inst);
     /* its planet (task 1003347) reads off the row — fetch-free too; a pick in
        progress survives the tick because only a different project re-renders it */
     renderPick(inst);
@@ -5853,6 +5859,7 @@ summary{min-height:24px;padding:3px 0;}
       $('mChip').innerHTML = '';
       $('mOrb').innerHTML = '';
     }
+    if (!keepRepo) { mRepoPrivSeen = false; mRepoPrivState = ''; }
     var asked = manageId; /* a stale answer must never paint a newer project */
     fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId), { credentials: 'same-origin' })
       .then(function (res) {
@@ -5922,14 +5929,16 @@ summary{min-height:24px;padding:3px 0;}
   setInterval(manageChipTick, REFRESH_MS);
 
   /* ── repo visibility (task 1003045): read live from GitHub with the owner's
-     own repository credential; flip-to-PUBLIC only. The private direction is
-     refused by the server — and unbuilt here — until the private-repo deploy
-     fix lands: the deploy pull runs as the shared deploy key, which cannot
-     read a private repo (walk finding N4), so flipping private would break
-     the project's next deploy. Every claim below is what GitHub answered for
-     THIS account — never a cached or guessed state. ── */
+     own repository credential. Going public is a direct call. Going private
+     (task 1003078) is QUEUED on the provisioning route: the runner wires the
+     project's own deploy key first, because a project stood up public reads
+     with the shared key, which cannot read a private repo (walk finding N4).
+     Every claim below is what GitHub answered for THIS account — never a
+     cached or guessed state; the queue's receipt is not a new visibility. ── */
 
   var manageRepo = null; /* GitHub's last answer for the manage view's repo */
+  var mRepoPrivSeen = false; /* a make-private run was open — ask GitHub again once it settles */
+  var mRepoPrivState = '';   /* the in-flight line last painted: '', 'pending' or 'running' */
 
   function repoVisReconnect() {
     return API + '/auth/web/start?repos=1&return=' +
@@ -5947,14 +5956,67 @@ summary{min-height:24px;padding:3px 0;}
         '<div class="addr">This repository is <b>private</b> — only accounts it’s shared with can read its code.</div>' +
         (snagged
           ? '<div class="projMsg err">A private repository deploys through the project’s own read-only deploy key, wired at standup. If the standup couldn’t read it, retry it from the card above — or make the repository public.</div>'
-          : '<p class="finePrint">The platform reads it through this project’s own read-only deploy key, set up at standup. Nothing to do here.</p>') +
+          : '<p class="finePrint">The platform reads it through this project’s own read-only deploy key. Nothing to do here.</p>') +
         (repo.admin
           ? '<div class="actions"><button type="button" class="btn small ghost" data-repo-public>Make it public</button></div>'
           : '<p class="finePrint">Your GitHub account can’t change this repository’s settings.</p>'));
     } else {
-      repoVisMsg(
-        '<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
-        '<p class="finePrint">Making it private isn’t possible from here yet — see below for why.</p>');
+      repoVisMsg('<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
+        (repoPrivOpen(manageInst)
+          ? '<p class="finePrint">' + (manageInst.open_intent.state === 'running'
+              ? 'Making it private — the platform is giving this project its own deploy key first.'
+              : 'Making it private is queued — the platform gives this project its own deploy key first. Until then it stays public.') + '</p>'
+          : repoPrivDoor(manageInst, repo)) +
+        /* the make-private receipt's slot, painted WITH the state (the #mVisMsg idiom) —
+           a sibling div would land on this one: every .mSec>div takes the same grid cell */
+        '<div class="projMsg" id="mRepoVisMsg" role="status" aria-live="polite"></div>');
+    }
+  }
+
+  /* fetch-free, from open_intent only (renderManage calls it on every repaint) */
+  function repoPrivOpen(inst) {
+    return !!(inst && inst.open_intent && inst.open_intent.action === 'repo-private');
+  }
+
+  /* the one door to private, or the sentence saying why there is none here — the
+     route refuses the same cases; this only keeps a button off a dead end */
+  function repoPrivDoor(inst, repo) {
+    if (!inst) return '';
+    var why = inst.hosting_shape === 'byo-host' ? 'This project runs on your own host, so the platform never reads its code — you can make the repository private on GitHub directly.'
+      : inst.hosting_shape !== 'standalone' ? 'Only a project on a Cloud host can have its repository made private from here.'
+      : inst.status !== 'active' ? 'You can make it private once the project is running.'
+      : !repo.admin ? 'Your GitHub account can’t change this repository’s settings.'
+      : '';
+    if (why) return '<p class="finePrint">' + why + '</p>';
+    return '<p class="finePrint">Making it private gives this project its own deploy key first, so its deploys keep working.</p>' +
+      '<div class="actions"><button type="button" class="btn small ghost" data-repo-private>Make it private</button></div>';
+  }
+
+  function repoVisNote(cls, html) {
+    var box = $('mRepoVisMsg');
+    if (!box) {
+      if (!html) return;
+      $('mRepoVis').insertAdjacentHTML('beforeend', '<div class="projMsg" id="mRepoVisMsg" role="status" aria-live="polite"></div>');
+      box = $('mRepoVisMsg');
+    }
+    box.className = 'projMsg' + (cls ? ' ' + cls : '');
+    box.innerHTML = html;
+  }
+
+  /* the in-flight line is repainted only when the run's state MOVES, so the tick
+     never flickers it; once the run settles, GitHub is asked again — the only
+     source that can say the flip took (the renderVisState contract) */
+  function renderRepoVisState(inst) {
+    var now = repoPrivOpen(inst) ? inst.open_intent.state : '';
+    if (now) mRepoPrivSeen = true;
+    if (now !== mRepoPrivState) {
+      mRepoPrivState = now;
+      if (manageRepo && !manageRepo.private) renderRepoVis(manageRepo);
+    }
+    if (!now && mRepoPrivSeen) {
+      mRepoPrivSeen = false;
+      repoVisNote('', '');
+      loadRepoVisibility(inst);
     }
   }
 
@@ -6034,12 +6096,58 @@ summary{min-height:24px;padding:3px 0;}
     });
   }
 
+  function askRepoPrivate() {
+    var act = document.querySelector('#mRepoVis .actions');
+    if (!act) return;
+    act.innerHTML = '<div class="confirmRow">' +
+      '<span class="plain">Make it private? Only accounts it’s shared with will be able to read the code.</span>' +
+      '<button type="button" class="btn small" data-repo-private-yes>Yes, make it private</button>' +
+      '<button type="button" class="linklike" data-repo-private-no>Keep it public</button></div>';
+  }
+
+  /* the reply is a RECEIPT — the repository is still public when it lands. The
+     in-flight line reads open_intent, so the manage row is re-read, never patched */
+  function doRepoPrivate() {
+    if (!manageInst) return;
+    var btn = document.querySelector('#mRepoVis [data-repo-private-yes]');
+    if (btn) btn.disabled = true;
+    repoVisNote('', 'Queueing…');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/repo-private', {
+      method: 'POST', credentials: 'same-origin'
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the receipt proves a run is OPEN — never that the repository changed. Record
+             that much, so the 5s watch follows it and a repaint from the stale row cannot
+             drop it; the re-read below swaps in the server's own open_intent */
+          if (!repoPrivOpen(manageInst)) manageInst.open_intent = { action: 'repo-private', state: 'pending' };
+          renderRepoVisState(manageInst);
+          repoVisNote('ok', esc(data.message || 'Queued.'));
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (manageRepo) renderRepoVis(manageRepo);
+        repoVisNote('err', res.status === 401 ? signInAgain()
+          : res.status === 404 ? 'Only the project’s owner can make its repository private.'
+          : esc(e.message || 'The change could not be queued — try again in a moment.'));
+      });
+    }).catch(function () {
+      if (manageRepo) renderRepoVis(manageRepo);
+      repoVisNote('err', 'Couldn’t reach the platform — check your connection and try again.');
+    }).then(function () {
+      loadManage(true, true);
+    });
+  }
+
   $('mRepoVis').addEventListener('click', function (ev) {
     var t = ev.target.closest && ev.target.closest('button');
     if (!t) return;
     if (t.hasAttribute('data-repo-public')) return askRepoPublic();
     if (t.hasAttribute('data-repo-public-yes')) return doRepoPublic();
     if (t.hasAttribute('data-repo-public-no')) { if (manageRepo) renderRepoVis(manageRepo); }
+    if (t.hasAttribute('data-repo-private')) return askRepoPrivate();
+    if (t.hasAttribute('data-repo-private-yes')) return doRepoPrivate();
+    if (t.hasAttribute('data-repo-private-no')) { if (manageRepo) renderRepoVis(manageRepo); }
   });
 
   /* ── on the public map (task 1002335, BV1.R16): the publish gate ──────────

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.981",
+  "version": "1.19.982",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.981",
+      "version": "1.19.982",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.981",
+  "version": "1.19.982",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/github.js

@@ -1,7 +1,7 @@
 // src/bongos/routes/github.js — GitHub repo list/create for the signed-in user, the
 // server half of the onboarding wizard's repo picker (adopt) + auto-create (fresh),
 // plus the manage page's repo-visibility read/flip (task 1003045 — public only; the
-// private direction is refused until the private-repo deploy fix lands).
+// private direction is the provisioning module's queued route, task 1003078).
 // Task 1002099 / ADR 0143.
 //
 // These act on the user's OWN GitHub identity, so they live in core auth alongside
@@ -127,9 +127,9 @@ module.exports = function buildGithubRouter() {
     if (!token) return;
     try {
       const repo = await githubRepos.getUserRepo(token, ref);
-      // private_deployable is the platform truth the UI copy leans on: the deploy
-      // pull runs as the shared deploy key, which cannot read a private repo (N4).
-      res.json({ ok: true, repo, private_deployable: false });
+      // private_deployable: a private repo deploys through the project's own read-only
+      // deploy key (ADR 0176), which the manage page's make-private route wires first.
+      res.json({ ok: true, repo, private_deployable: true });
     } catch (err) {
       if (err && err.status === 401) {
         await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
@@ -145,9 +145,10 @@ module.exports = function buildGithubRouter() {
 
   // rank: any-builder — flips one of the caller's repos PUBLIC, with their own
   // credential. The private direction is REFUSED here, before GitHub is ever
-  // called: the deploy pull still runs as the shared deploy key that cannot read
-  // a private repo (walk finding N4), so flipping private would break the
-  // project's next deploy — the refusal is the honest leg task 1003045 ships.
+  // called: a project stood up public reads its code with the shared key, which
+  // cannot read a private repo (walk finding N4), so a bare flip would break its
+  // next deploy. Making it private is POST /provisioning/instances/:id/repo-private
+  // (task 1003078), which wires the project's own deploy key before it flips.
   router.post('/github/repo/visibility', auth.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
       repo: { required: true, type: 'string', maxLength: 140 },
@@ -158,14 +159,14 @@ module.exports = function buildGithubRouter() {
     if (req.body.visibility !== 'public') {
       return res.fail('private_not_deployable', {
         status: 409,
-        message: 'Private repositories can’t be deployed yet — the platform’s deploy pull can’t read them, so making this repository private would break the project’s next deploy. This lands with the private-repo deploy fix.',
+        message: 'Make a repository private from its project’s manage page — the platform has to give the project its own deploy key first, or its next deploy would break.',
       });
     }
     const token = await resolveRepoToken(req, res);
     if (!token) return;
     try {
       const repo = await githubRepos.makeRepoPublic(token, ref);
-      res.json({ ok: true, repo, private_deployable: false });
+      res.json({ ok: true, repo, private_deployable: true });
     } catch (err) {
       if (err && err.status === 401) {
         await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.981'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.982'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/github_repo_visibility.mjs

@@ -3,10 +3,11 @@
 //
 // The load-bearing assertions:
 //   • the PRIVATE direction is refused BEFORE GitHub is ever called (409
-//     private_not_deployable): the deploy pull runs as the shared deploy key,
-//     which cannot read a private repo (walk finding N4), so flipping private
-//     would break the project's next deploy — the honest-refusal leg this task
-//     ships. The refusal must not even consult the stored token.
+//     private_not_deployable): a project stood up public reads with the shared
+//     key, which cannot read a private repo (walk finding N4), so a bare flip
+//     would break its next deploy. The refusal points at the manage page, whose
+//     queued route wires the project's own deploy key first (task 1003078). It
+//     must not even consult the stored token.
 //   • flip-to-public calls makeRepoPublic with the parsed owner/name and
 //     forwards GitHub's own answer — the new state is never assumed
 //   • a GitHub 401 drops the stored token and re-prompts (the /github/repos
@@ -80,7 +81,7 @@ test('GET /github/repo: forwards GitHub\'s answer for the caller\'s own credenti
     assert.equal(res._status, 200);
     assert.equal(res._body.repo.private, true);
     assert.equal(res._body.repo.admin, true);
-    assert.equal(res._body.private_deployable, false, 'the platform truth rides every answer');
+    assert.equal(res._body.private_deployable, true, 'a private repo deploys through its own key (ADR 0176)');
     assert.deepEqual(s.calls.read, [{ owner: 'jaxri', name: 'mercury' }]);
   } finally { s.restore(); }
 });
@@ -129,7 +130,9 @@ test('POST visibility=private: refused 409 private_not_deployable — GitHub and
     await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'private' } }, res);
     assert.equal(res._status, 409);
     assert.equal(res._body.error.code, 'private_not_deployable');
-    assert.match(res._body.error.message, /deploy/i, 'the refusal says WHY in plain words');
+    assert.match(res._body.error.message, /deploy key/i, 'the refusal says WHY in plain words');
+    assert.match(res._body.error.message, /manage page/, 'and names the door that CAN do it');
+    assert.doesNotMatch(res._body.error.message, /can’t be deployed yet/, 'the old platform-wide refusal is gone');
     assert.equal(s.calls.flip.length, 0, 'no GitHub call for a refused direction');
     assert.equal(tokenReads, 0, 'the refusal happens before the credential is even read');
   } finally { db.getGithubToken = origGet; s.restore(); }

package/tests/projects_hub.mjs

@@ -1210,10 +1210,10 @@ test('every owned card carries its Manage door, and a modified click keeps its m
 
 /* ── Repo visibility on the manage page (task 1003045) ──────────────────────
    The section reads the repo's REAL visibility from GitHub with the owner's
-   own repository credential and offers exactly one direction: private→public.
-   The private direction is refused — server-side and here — until the
-   private-repo deploy fix lands, because the deploy pull runs as the shared
-   deploy key that cannot read a private repo (walk finding N4). ── */
+   own repository credential. Going public is the direct core call; going
+   private (task 1003078) is QUEUED on the provisioning route, because the
+   project's own deploy key must be wired before the flip — a project stood up
+   public reads with the shared key, which cannot read a private repo (N4). ── */
 
 test('the repo-visibility section is live markup with its body slot (C7)', () => {
   assert.match(HUB, /id="mRepoVis"/, 'the section body must be real markup');
@@ -1221,16 +1221,14 @@ test('the repo-visibility section is live markup with its body slot (C7)', () =>
     'the pre-answer state is honest waiting copy, not a fake answer');
 });
 
-test('flip-to-private cannot travel from this page — only the public direction exists', () => {
-  assert.match(SCRIPT, /visibility: 'public'/, 'the one POST body pins the public direction');
+test('flip-to-private travels ONLY through the queued provisioning route, never the core flip', () => {
+  assert.match(SCRIPT, /visibility: 'public'/, 'the core POST body still pins the public direction');
   assert.doesNotMatch(SCRIPT, /visibility:\s*'private'/,
-    'no code path may send the private direction');
-  // the refusal is SAID, with its reason, not silently missing — post-ADR-0176 the
-  // reason is THIS project's shared-credential wiring, not a platform-wide inability
-  assert.match(SCRIPT, /Making it private isn’t possible from here yet — see below for why\./,
-    'the refusal is SAID inline, and points at the fold that carries the reason');
-  assert.match(HUB, /would break the next deploy/,
-    'the flip-to-private limitation is stated in plain words, in the fold');
+    'the core flip is never asked for private — it cannot wire the deploy key');
+  assert.match(SCRIPT, /'\/provisioning\/instances\/' \+ encodeURIComponent\(manageId\) \+ '\/repo-private'/,
+    'the private direction is the provisioning route, keyed on the project');
+  assert.doesNotMatch(HUB, /isn’t possible from here yet/, 'the refusal copy is gone');
+  assert.doesNotMatch(HUB, /Why can’t it be private yet\?/, 'and so is its fold');
 });
 
 test('the visibility shown is GitHub\'s answer, never an assumption', () => {
@@ -1261,19 +1259,15 @@ test('the reconnect door asks for repository access and returns to this project'
     'and returns to the exact project being managed');
 });
 
-test('the refusal carries a LINK to the limitation, never prose alone (task 1003077)', () => {
-  assert.match(HUB, /id="mRepoVisWhy"/, 'the why-fold is real markup beside the section body');
+test('the fold says what making it private does, in the order it happens (task 1003078)', () => {
+  assert.match(HUB, /id="mRepoVisWhy"/, 'the fold is real markup beside the section body');
   const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
   assert.ok(fold, 'the fold must be extractable');
-  assert.match(fold, /an older key that only works on public repositories/, 'the WHY is stated in plain words');
-  assert.match(fold, /\{\{buildersOrigin\}\}#\/task\/1002735/,
-    'the tracked fix is a real link, hall-origin server-stamped (never client-filled)');
-  // apex-only: a child instance keeps the explanation, not another platform's tracker
-  const at = HUB.indexOf('{{buildersOrigin}}#/task/1002735');
-  const before = HUB.slice(0, at);
-  const opens = (before.match(/<!--apex-only:start-->/g) || []).length;
-  const closes = (before.match(/<!--apex-only:end-->/g) || []).length;
-  assert.equal(opens - closes, 1, 'the task link sits inside an apex-only sentinel pair');
+  assert.match(fold, /What making it private does/);
+  assert.match(fold, /its own read-only deploy key[\s\S]*only then makes the repository private/,
+    'the key comes first, the flip second — the safety property, in plain words');
+  assert.match(fold, /needs admin rights on the repository/, 'the one thing the owner must bring');
+  assert.doesNotMatch(fold, /an older key that only works on public repositories/, 'the old limitation is gone');
 });
 
 test('making a repo public asks first — exposure is never one accidental click', () => {

package/tests/projects_hub_pre_uat.mjs

@@ -585,15 +585,16 @@ test('founder voice on the Device Flow step and the manual OAuth fallback', () =
   assert.doesNotMatch(manual, /auth_configured|healthz/, 'no JSON health check for a founder to perform');
 });
 
-test('repo visibility: the refusal is one line, the mechanism lives in the fold', () => {
+test('repo visibility: the public line stays one line, then the door or the reason — the mechanism lives in the fold', () => {
   const rv = fn('renderRepoVis');
   assert.match(rv, /This repository is <b>public<\/b> — anyone can read its code\./, 'line one stays');
-  assert.match(rv, /Making it private isn’t possible from here yet — see below for why\./);
+  assert.match(rv, /repoPrivDoor\(manageInst, repo\)/, 'the public branch offers the door, or says why there is none');
+  assert.doesNotMatch(rv, /isn’t possible from here yet/, 'the old refusal is gone');
   assert.doesNotMatch(rv, /shared credential/);
   const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
-  assert.match(fold, /an older key that only works on public repositories/);
+  assert.match(fold, /What making it private does/);
   assert.doesNotMatch(fold, /shared read-only credential/);
-  assert.match(fold, /<!--apex-only:start--> — shipped as <a href="\{\{buildersOrigin\}\}#\/task\/1002735"/, 'the hall task link stays inside its apex-only sentinel');
+  assert.doesNotMatch(fold, /#\/task\//, 'the fold explains; it no longer points at a tracked fix');
 });
 
 test('a failed manage read offers a retry; the no-address sentence offers a door', () => {