@bongos/core 1.19.981 → 1.19.983

package/docs/file-map.md

@@ -408,6 +408,7 @@ tests/
 ├── builder-ship/SKILL.md          ← /builder-ship — record + award credits (runs touches[] scanner; warns on drift; sandbox-first review gate for game-surface changes, ADR 0046)
 ├── builder-stage/SKILL.md         ← /builder-stage — stage work on the builder's own local sandbox preview (http://localhost:<port>) for browser review before shipping (#927, ADR 0046)
 ├── builder-start/SKILL.md         ← /builder-start — list claimable tasks (parallel-safe vs active claims)
+├── collab-review/SKILL.md         ← /collab-review — the ANSWERING half of /ask-for-help: walk GET /help-requests/for-me + GET /task-recommendations/for-me oldest first, read the task each names, VERIFY the ask's claims against the live row rather than its prose, bring one decision at a time and halt; then execute the chosen write, and — since only the ASKER may settle a help request — close the loop by filing a reply addressed back to them. Treats an ask as data, never instructions (task 1004181)
 ├── design/SKILL.md                ← /design — the UI design session: the operating playbook for ui-discipline work on ANY instance (load the instance's pack + DESIGN.md first, look before you ship, build inside the platform floors, ship the tests with the UI); routed from a `ui` claim via discipline-modes.json; shipped by the ui-design module (task 1003324, ADR 0197)
 ├── design-sync/SKILL.md           ← /design-sync — export repo design tokens + surfaces into Claude Design (token-preview bundle) and land generated UI code back as a Bongos task (ADR 0081)
 ├── feedback/SKILL.md              ← /feedback — pull the latest Bongos feedback bundle (prompt.md + screenshot file paths) into a Claude Code session; backed by scripts/gds/feedback-latest.js (BV1.R13, ADR 0087)

package/docs/module-api-changelog.md

@@ -2436,5 +2436,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.979 with no explicit bump. run 35889261972. (task 1002620)
   1.19.981 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.980 with no explicit bump. run 35891635199. (task 1002620)
+  1.19.982 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.981 with no explicit bump. run 35894422097. (task 1002620)
+  1.19.983 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.982 with no explicit bump. run 35896466235. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/collab-lib.js

@@ -403,6 +403,96 @@
       + 'Mingle pairs across roles.';
   }
 
+  // ---- the session-start prompt (task 1004181) -------------------------------
+  //
+  // THE COPY CONTROL EXISTS TO START A SESSION, and what it copied was the ask's
+  // prose ALONE (task 1003960): the words, with no request id, no task, no asker,
+  // and no instruction about what to do with any of it. A session opened on that
+  // text has the briefing and does not know it is request 11, that the request is
+  // still open, that only the ASKER may settle it, or that the reader wanted the
+  // ask's claims checked before anything was decided — so it reads five hundred
+  // words of someone else's certainty and acts on them.
+  //
+  // So the clipboard now carries the SKILL INVOCATION and the few facts the skill
+  // cannot rediscover from the text, with the ask verbatim underneath. The ask is
+  // untouched: same words, same line breaks, no trim beyond the outer whitespace.
+  // Adding a frame around it is the whole change.
+  //
+  // PURE, which is why `hallBase` is a parameter. The hall answers on two shapes
+  // (a /builders path on the site, or builders.<domain> as its own host) and a lib
+  // that read location to tell them apart could not be executed by a test.
+  var SKILL_COMMAND = '/collab-review';
+
+  // The one line that says what this ask is attached to, with an ABSOLUTE url —
+  // the prompt is pasted into a terminal, not clicked in this page, so a
+  // site-relative href would resolve against nothing.
+  function contextSentence(req, hallBase) {
+    var ctx = contextOf(req);
+    if (!ctx) return 'It names no task and no goal.';
+    var base = String(hallBase == null ? '' : hallBase).replace(/\/$/, '');
+    var href = ctx.kind === 'task'
+      ? base + '/task/' + ctx.id
+      : base + '/goals#/goal/' + ctx.id;
+    return 'It is about ' + ctx.kind + ' ' + ctx.id + ' — ' + href;
+  }
+
+  function askedOnLine(req) {
+    var who = askerOf(req) || 'another builder';
+    var when = req && req.created_at ? String(req.created_at).slice(0, 10) : '';
+    return when ? who + ' asked it on ' + when + '.' : who + ' asked it.';
+  }
+
+  // sessionStartPrompt(req, hallBase) -> the text the per-row control copies.
+  // Empty string for no request, so a caller can refuse to copy nothing rather
+  // than put an empty clipboard up as a success.
+  function sessionStartPrompt(req, hallBase) {
+    if (!req) return '';
+    var ask = String(req.what_is_stuck == null ? '' : req.what_is_stuck).trim();
+    return [
+      SKILL_COMMAND + ' ' + req.id,
+      '',
+      'Work help request ' + req.id + ', which is addressed to me. ' + askedOnLine(req),
+      contextSentence(req, hallBase),
+      '',
+      'Check what the ask claims against the live database and the repo before you act on'
+        + ' any of it, then bring me ONE decision. Do not decide it yourself, and do not try'
+        + ' to mark it answered — only the builder who asked can settle their own request.',
+      '',
+      '--- the ask, verbatim ---',
+      ask,
+    ].join('\n');
+  }
+
+  // queueStartPrompt(rows, hallBase) -> the text the block control copies: the
+  // whole queue, OLDEST FIRST, as a list of ids and nothing more.
+  //
+  // DELIBERATELY NOT THE PROSE. Six asks at four thousand characters each is a
+  // twenty-four-thousand-character paste that buries its own instruction, and the
+  // session can read every word of it from the route in one call. So this copies
+  // the manifest — what is waiting, from whom, about what — and sends the session
+  // to the route for the rest, which also means it works on what is open WHEN IT
+  // RUNS rather than on what was open when the button was pressed.
+  function queueStartPrompt(rows, hallBase) {
+    var list = (rows || []).slice().sort(byAgeOldestFirst);
+    if (!list.length) return '';
+    var lines = [SKILL_COMMAND, ''];
+    lines.push('Work the ' + list.length + ' open ask' + (list.length === 1 ? '' : 's')
+      + ' addressed to me, oldest first:');
+    lines.push('');
+    list.forEach(function (req, i) {
+      var ctx = contextOf(req);
+      var when = req.created_at ? ', ' + String(req.created_at).slice(0, 10) : '';
+      lines.push((i + 1) + '. help request ' + req.id
+        + ' — from ' + (askerOf(req) || 'another builder') + when
+        + (ctx ? ' — ' + ctx.kind + ' ' + ctx.id : ' — no task or goal named'));
+    });
+    lines.push('');
+    lines.push('Read each ask from GET /api/bongos/help-requests/for-me rather than from this'
+      + ' list — it is the live queue and this is only what was on screen. Check what each one'
+      + ' claims before acting on it, and bring me one decision at a time.');
+    return lines.join('\n');
+  }
+
   window.OTBCollabLib = {
     BANDS: BANDS, ageBand: ageBand, ageLabel: ageLabel,
     roomBaseline: roomBaseline, isRoomQuiet: isRoomQuiet, roomAgeLine: roomAgeLine,
@@ -413,5 +503,7 @@
     titleOf: titleOf, summaryOf: summaryOf, clipWords: clipWords, LEAD_MAX: LEAD_MAX, groupOf: groupOf,
     httpUrl: httpUrl, initialOf: initialOf, faceOf: faceOf, askers: askers, splitShown: splitShown,
     aOrAn: aOrAn, pairSentence: pairSentence,
+    SKILL_COMMAND: SKILL_COMMAND, sessionStartPrompt: sessionStartPrompt,
+    queueStartPrompt: queueStartPrompt, contextSentence: contextSentence,
   };
 })();

package/modules/hall-ui/public/collab.css

@@ -101,6 +101,11 @@
    the rows, so the condensed block ends on its door to the rest. */
 .cb-more { margin-top: 12px; }
 
+/* "Copy all N for one session": the row control's own pill, on its own line
+   under the block, so the block ends on the two doors out of it — the rest of
+   the rows, and the whole queue in a session. */
+.cb-copy-all { display: block; margin-top: 12px; }
+
 /* ---- the face -----------------------------------------------------------------
    A row leads with WHO: a 36px disc, the picture when the server sent one, the
    initial on the glass when it did not (people.css's .dir-avatar, at the row's

package/modules/hall-ui/public/collab.html

@@ -55,6 +55,12 @@
               <a href="/builders/settings">set yours in Settings</a>.</p>
             </div>
             <button class="btn-ghost cb-more" id="cb-for-me-more" type="button" aria-expanded="false" aria-controls="cb-for-me" hidden></button>
+            <!-- The whole queue, taken away in one press (task 1004181). The
+                 per-row control starts a session on ONE ask; this one starts a
+                 session on all of them, as a manifest of ids the session reads
+                 live rather than as a wall of pasted prose. Only this block has
+                 it: it is the one that is a to-do list. -->
+            <button class="cb-ask__copy cb-copy-all" id="cb-for-me-copy" type="button" hidden></button>
           </section>
 
           <section class="scroll cb-block" aria-labelledby="cb-mine-h">
@@ -108,7 +114,7 @@
 <script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
-<script src="/builders/collab-lib.js?v=2026-09-19-agewords"></script>
-<script src="/builders/collab.js?v=2026-09-19-agewords"></script>
+<script src="/builders/collab-lib.js?v=2026-09-23-sessionstart"></script>
+<script src="/builders/collab.js?v=2026-09-23-sessionstart"></script>
 </body>
 </html>

package/modules/hall-ui/public/collab.js

@@ -47,6 +47,24 @@
 
   let settling = false;
 
+  // THE COPY CONTROL READS THE REQUEST, NOT THE PAGE (task 1004181). It used to
+  // lift its text out of the hidden <p> holding the full ask, which tied the
+  // control to the door: an ask short enough to fit on the face had no <p>, so it
+  // had no copy either — and those are exactly the asks a session can act on
+  // fastest. The rows are indexed by id as they load and the prompt is built from
+  // the request itself, so every row can be taken away whether or not it has more
+  // to show. Keyed by String(id) because the same request appears in up to three
+  // blocks and the API sends ids as strings.
+  const askById = new Map();
+  let forMeRows = [];
+
+  // The hall answers on two shapes — /builders on the site, or builders.<domain>
+  // as its own host. A pasted prompt is opened somewhere that is not this page,
+  // so the links in it are absolute; same rule work.js follows.
+  function hallBase() {
+    return location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
+  }
+
   // The age pill: the band picks the colour (collab.css .cb-age--*), the LABEL
   // carries the real age, so fourteen old rows read as fourteen different ages
   // instead of fourteen copies of one alarm (artist verdict, task 1004041). The
@@ -93,13 +111,18 @@
     const s = L.summaryOf(req.what_is_stuck);
     let html = `<span class="ov-row__title">${escapeHtml(s.title)}</span>`;
     if (s.lead) html += `<p class="ov-row__sub">${escapeHtml(s.lead)}</p>`;
-    if (!s.more) return html;
     const fid = askId(key, req.id);
-    return html + `<div class="cb-ask">
-        <button class="cb-ask__door" type="button" data-ask-toggle aria-expanded="false" aria-controls="${fid}">Read the full ask</button>
-        <button class="cb-ask__copy" type="button" data-ask-copy="${fid}">Copy for Session Start</button>
-      </div>
-      <p class="cb-ask__full" id="${fid}" hidden>${escapeHtml(s.more)}</p>`;
+    // The door appears only over words the reader cannot see; the copy control
+    // appears always, because what it hands over is no longer the visible text
+    // (task 1004181) — it is the request's id, its asker, its task and the
+    // instruction, which are absent from the face however short the ask is.
+    const door = s.more
+      ? `<button class="cb-ask__door" type="button" data-ask-toggle aria-expanded="false" aria-controls="${fid}">Read the full ask</button>`
+      : '';
+    const full = s.more ? `<p class="cb-ask__full" id="${fid}" hidden>${escapeHtml(s.more)}</p>` : '';
+    return html + `<div class="cb-ask">${door}
+        <button class="cb-ask__copy" type="button" data-ask-copy="${escapeHtml(String(req.id))}">Copy for Session Start</button>
+      </div>${full}`;
   }
 
   function contextChip(req) {
@@ -304,6 +327,23 @@
     </div>`;
   }
 
+  // The block control: present only when there is a QUEUE to take away, and it
+  // says the number, so a reader knows what they are about to hand over.
+  //
+  // ONE ASK IS NOT A QUEUE, so at one row the control is absent rather than
+  // reworded. Its first draft said "Copy this ask for a session" in that case,
+  // which put two different phrasings of one action on one screen — the row's
+  // own control, six centimetres above, does exactly this and calls it "Copy for
+  // Session Start". Whichever words won, the duplicate control was the real
+  // problem: at one row it takes away precisely what the row control takes away.
+  // Above one, the words are the row's own, so the page names the act once.
+  function paintQueueCopy() {
+    const btn = $('#cb-for-me-copy');
+    if (!btn) return;
+    btn.hidden = forMeRows.length < 2;
+    btn.textContent = `Copy all ${forMeRows.length} for Session Start`;
+  }
+
   function paintFigures(forMe, mine, crafts) {
     const host = $('#cb-figs');
     if (!host) return;
@@ -357,16 +397,28 @@
     } catch (_) { return false; }
   }
 
-  // textContent, not innerText: the hidden <p> holds the ask verbatim including
-  // its line breaks, and innerText on a hidden element is not guaranteed to
-  // return them. What lands on the clipboard is exactly what the asker wrote.
+  // What lands on the clipboard is the SESSION START (L.sessionStartPrompt): the
+  // skill to run, the request id, who asked and about what, the instruction to
+  // check the ask before acting on it — and then the ask itself verbatim, line
+  // breaks and all, exactly as its author wrote it.
   function copyAsk(btn) {
-    const full = document.getElementById(btn.getAttribute('data-ask-copy'));
-    if (!full) return;
-    const text = full.textContent || '';
+    const req = askById.get(String(btn.getAttribute('data-ask-copy')));
+    if (!req) return;
+    const text = L.sessionStartPrompt(req, hallBase());
     if (!text) return;
     writeClipboard(text).then((ok) => {
-      toast(ok ? 'Copied — paste it in to start a session on this.' : 'Could not copy — open the full ask and copy it by hand.');
+      toast(ok ? 'Copied — paste it in to start a session on this ask.' : 'Could not copy — open the full ask and copy it by hand.');
+    });
+  }
+
+  // The whole queue in one go. Only "Asked of you" carries this: it is the block
+  // that is a to-do list, and copying the board of everyone else's asks would be
+  // handing a session work nobody asked this reader for.
+  function copyQueue() {
+    const text = L.queueStartPrompt(forMeRows, hallBase());
+    if (!text) return;
+    writeClipboard(text).then((ok) => {
+      toast(ok ? `Copied — paste it in to work all ${forMeRows.length} in one session.` : 'Could not copy — copy the asks one at a time instead.');
     });
   }
 
@@ -393,6 +445,16 @@
     const rowsOf = (r) => ((r && r.ok && r.data && r.data.help_requests) || []);
     const crafts = (forMe.ok && forMe.data && forMe.data.crafts) || [];
 
+    // Re-indexed on every load, not merged into: a request settled elsewhere
+    // must disappear from the copy path at the same moment it disappears from
+    // the rows, or a stale entry would keep handing a session work that is done.
+    askById.clear();
+    forMeRows = rowsOf(forMe);
+    [forMeRows, rowsOf(mine), rowsOf(all)].forEach((list) => {
+      list.forEach((req) => { askById.set(String(req.id), req); });
+    });
+    paintQueueCopy();
+
     paintFigures(rowsOf(forMe), rowsOf(mine), crafts);
     paintBlock('for-me', rowsOf(forMe), forMeRow, nowMs, true);
     paintBlock('mine', rowsOf(mine), mineRow, nowMs, false);
@@ -533,6 +595,8 @@
     if (door) { ev.preventDefault(); toggleAsk(door); return; }
     const copyBtn = closest('[data-ask-copy]');
     if (copyBtn) { ev.preventDefault(); copyAsk(copyBtn); return; }
+    const copyAll = closest('#cb-for-me-copy');
+    if (copyAll) { ev.preventDefault(); copyQueue(); return; }
     const mingleBtn = closest('[data-mingle]');
     if (mingleBtn) {
       ev.preventDefault();

package/modules/provisioning/module.json

@@ -16,7 +16,8 @@
       "provisioning",
       "disconnect",
       "core-upgrade",
-      "env-manifest"
+      "env-manifest",
+      "repo-private"
     ],
     "migrations": true,
     "pollers": [

package/modules/provisioning/routes/repo-private.js

@@ -0,0 +1,82 @@
+// modules/provisioning/routes/repo-private.js — POST /provisioning/instances/:id/repo-private
+// (split (c) of task 1003078; ADR 0176).
+//
+// WHY. A project stood up while its repository was public reads its code with the shared key,
+// which cannot read a private repository, so a plain flip would break its next deploy. This
+// route only ENQUEUES the `repo-private` intent; the runner (scripts/gds/provision-repo-private.js)
+// wires the project's own read-only deploy key FIRST and flips SECOND. Going public stays the
+// direct core call (POST /github/repo/visibility) — it needs no wiring.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at the
+// size ratchet — the routes/disconnect.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const repoPrivate = require('../repo-private');
+
+const log = api.logger('provisioning');
+
+// What the runner leg would refuse, answered here so the owner hears it at once instead of
+// as an error note once its retries are spent. The runner keeps its own checks — the row can
+// change between this read and the drain.
+function unavailableReason(inst) {
+  if (inst.hosting_shape === 'byo-host') {
+    return 'This project runs on your own host, so the platform never reads its code — you can make the repository private on GitHub directly.';
+  }
+  if (inst.hosting_shape !== 'standalone') {
+    return 'Only a project on a Cloud host can have its repository made private from here.';
+  }
+  if (inst.status !== 'active') {
+    return 'This project isn’t running right now, so its repository can’t be made private from here. Try again once it’s live.';
+  }
+  if (!inst.target_ref) return 'This project has no GitHub repository linked, so there is nothing to make private.';
+  return null;
+}
+
+module.exports = function buildRepoPrivateRouter() {
+  const router = express.Router();
+
+  // POST /provisioning/instances/:id/repo-private — rank: any authenticated builder, and
+  // OWNER ONLY: no archon override, because the runner flips with the owner's stored GitHub
+  // token whoever asked (owner decision, task 1004194). 404 for everyone else, so another
+  // owner's id is never confirmed. Takes no body. The reply is a receipt — the repository is
+  // still public when it is sent; the manage page re-reads GitHub once the intent settles.
+  router.post('/provisioning/instances/:id/repo-private', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true }); // 400 bad_id + null on failure; positiveInt so id 0 is answered, not dropped
+    if (!id) return;
+    if (validateOrRespond(req, res, {})) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) return res.fail('instance_not_found', 404);
+      const why = unavailableReason(inst);
+      if (why) {
+        return res.fail('repo_private_unavailable', { status: 409, message: why,
+          details: { status: inst.status, hosting_shape: inst.hosting_shape } });
+      }
+      const r = await repoPrivate.enqueueRepoPrivate(pool, id, 'api:self');
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is currently ${r.intent.state} for this project — making the repository private waits for it to finish. Try again once it has.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      if (r.created) {
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'repo-private',
+          detail: 'making the repository private requested by owner', actor: 'api:self',
+        }).catch(() => {});
+      }
+      res.json({ ok: true, queued: r.created, action: 'repo-private', status: inst.status,
+        message: r.created
+          ? 'Queued. The platform first gives this project its own read-only deploy key, then makes the repository private. This page updates when it’s done.'
+          : 'Making the repository private is already under way for this project.' });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/repo-private', err);
+      res.fail('repo_private_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/public-landing/public/projects.html

@@ -762,20 +762,16 @@ summary{min-height:24px;padding:3px 0;}
       </div>
 
       <!-- live since task 1003045: reads the repo's real visibility from GitHub
-           with the owner's own repository credential. Flip-to-PUBLIC only — the
-           private direction is refused (server + copy) until the private-repo
-           deploy fix lands, because the deploy pull cannot read a private repo
-           (walk finding N4). -->
+           with the owner's own repository credential. Going public is a direct
+           call; going private (task 1003078) is QUEUED, because the project's own
+           deploy key must be wired before the flip or its next deploy breaks
+           (walk finding N4, ADR 0176). -->
       <div class="card mSec" id="mRepoVisibility">
         <h2>Repository visibility</h2>
         <div id="mRepoVis"><p class="finePrint">Checking the repository on GitHub…</p></div>
-        <!-- the limitation itself, one click away (grade follow-up task 1003077):
-             the refusal above states it; this fold explains it and links the
-             tracked fix. The hall link is apex-only — a child instance keeps the
-             explanation, not another platform's task tracker. -->
         <details class="finePrint" id="mRepoVisWhy">
-          <summary>Why can’t it be private yet?</summary>
-          <p>This project’s deploys read its code from GitHub with an older key that only works on public repositories — so making the repository private would break the next deploy. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically<!--apex-only:start--> — shipped as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall<!--apex-only:end-->. A project set up before that still reads with the older key, so the switch stays off until existing projects are re-wired.</p>
+          <summary>What making it private does</summary>
+          <p>The platform first gives this project its own read-only deploy key and switches its deploys over to it, and only then makes the repository private — in that order, so no deploy ever tries to read a private repository with a key that can’t. The change is made with your connected GitHub account, so that account needs admin rights on the repository. It works for a project on a Cloud host; a project on your own host is yours to change on GitHub directly. You can make it public again from here at any time.</p>
         </details>
       </div>
 
@@ -5149,7 +5145,8 @@ summary{min-height:24px;padding:3px 0;}
     teardown: { names: ['Teardown queued', 'Winding down', 'Torn down'], cls: 'flowDown' },
     address: { names: ['Address queued', 'Wiring the address', 'Answering there'], cls: '' },
     settings: { names: ['Change saved', 'Restarting to apply it', 'Applied'], cls: '' },
-    restart: { names: ['Restart queued', 'Restarting', 'Answering again'], cls: '' }
+    restart: { names: ['Restart queued', 'Restarting', 'Answering again'], cls: '' },
+    repo: { names: ['Change queued', 'Setting up its deploy key', 'Private'], cls: '' }
   };
   function stripMarkup(flow, stageNow, stagesDone, note, extraCls) {
     var f = FLOWS[flow];
@@ -5191,6 +5188,10 @@ summary{min-height:24px;padding:3px 0;}
       if (a === 'restart') return inst.open_intent.state === 'running'
         ? stripMarkup('restart', 1, 1, 'Restarting the project — it goes down and comes back up.')
         : stripMarkup('restart', 0, 0, 'A restart is queued — this card updates when it starts.');
+      /* task 1003078: the deploy key is wired BEFORE the flip — the strip says which half is running */
+      if (a === 'repo-private') return inst.open_intent.state === 'running'
+        ? stripMarkup('repo', 1, 1, 'Making the repository private — setting up the project’s own deploy key first.')
+        : stripMarkup('repo', 0, 0, 'Making the repository private is queued — this card updates when it starts.');
       if (a === 'provision') return stripMarkup(s === 'torn_down' ? 'revive' : 'standup', 0, 0, (s === 'torn_down' ? 'A revive is queued' : 'A standup is queued') + ' — this card updates when it starts.');
       return stripMarkup('standup', 2, 2, 'A ' + esc(a) + ' run is queued — this card updates when it lands.');
     }
@@ -5215,6 +5216,10 @@ summary{min-height:24px;padding:3px 0;}
     var n = String(note || '');
     if (/^repository not found:/i.test(n)) return 'We couldn’t find the project’s repository on GitHub even with the access you granted — it may have been renamed or deleted, or the access was lost.';
     if (/^repository access is not admin:/i.test(n)) return 'Your GitHub access can read the repository but can’t manage its deploy keys — a repository admin needs to raise your access (or make the repository public).';
+    /* the repo-private runner leg's own sentences (task 1003078) — the project is live */
+    if (/made private[\s\S]*credential/i.test(n)) return 'Making the repository private didn’t finish — the project’s GitHub access needs reconnecting first. Its repository is still public.';
+    if (/is still public|made private|left public/i.test(n)) return 'Making the repository private didn’t finish — it’s still public.';
+    if (/^deploy-key setup failed/i.test(n)) return 'Setting up the project’s own read-only deploy key on GitHub didn’t finish.';
     if (/repository not found/i.test(n)) return 'We couldn’t push the starter code to the repository — it wasn’t found on GitHub. A private repository looks “not found” too — if yours is private, sign in again to re-grant repository access, then retry.';
     if (/mkdir|no such file or directory|read-only file system/i.test(n)) return 'The server couldn’t prepare a workspace for the project.';
     if (/(push|clone|github).*permission|permission.*(push|clone|repo)/i.test(n)) return 'We couldn’t reach the repository — the account that set it up doesn’t have permission.';
@@ -5617,6 +5622,7 @@ summary{min-height:24px;padding:3px 0;}
        only, so a queued settings push shows up on the tick without a reload */
     renderVisState(inst);
     renderJoinState(inst);
+    renderRepoVisState(inst);
     /* its planet (task 1003347) reads off the row — fetch-free too; a pick in
        progress survives the tick because only a different project re-renders it */
     renderPick(inst);
@@ -5853,6 +5859,7 @@ summary{min-height:24px;padding:3px 0;}
       $('mChip').innerHTML = '';
       $('mOrb').innerHTML = '';
     }
+    if (!keepRepo) { mRepoPrivSeen = false; mRepoPrivState = ''; }
     var asked = manageId; /* a stale answer must never paint a newer project */
     fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId), { credentials: 'same-origin' })
       .then(function (res) {
@@ -5922,14 +5929,16 @@ summary{min-height:24px;padding:3px 0;}
   setInterval(manageChipTick, REFRESH_MS);
 
   /* ── repo visibility (task 1003045): read live from GitHub with the owner's
-     own repository credential; flip-to-PUBLIC only. The private direction is
-     refused by the server — and unbuilt here — until the private-repo deploy
-     fix lands: the deploy pull runs as the shared deploy key, which cannot
-     read a private repo (walk finding N4), so flipping private would break
-     the project's next deploy. Every claim below is what GitHub answered for
-     THIS account — never a cached or guessed state. ── */
+     own repository credential. Going public is a direct call. Going private
+     (task 1003078) is QUEUED on the provisioning route: the runner wires the
+     project's own deploy key first, because a project stood up public reads
+     with the shared key, which cannot read a private repo (walk finding N4).
+     Every claim below is what GitHub answered for THIS account — never a
+     cached or guessed state; the queue's receipt is not a new visibility. ── */
 
   var manageRepo = null; /* GitHub's last answer for the manage view's repo */
+  var mRepoPrivSeen = false; /* a make-private run was open — ask GitHub again once it settles */
+  var mRepoPrivState = '';   /* the in-flight line last painted: '', 'pending' or 'running' */
 
   function repoVisReconnect() {
     return API + '/auth/web/start?repos=1&return=' +
@@ -5947,14 +5956,67 @@ summary{min-height:24px;padding:3px 0;}
         '<div class="addr">This repository is <b>private</b> — only accounts it’s shared with can read its code.</div>' +
         (snagged
           ? '<div class="projMsg err">A private repository deploys through the project’s own read-only deploy key, wired at standup. If the standup couldn’t read it, retry it from the card above — or make the repository public.</div>'
-          : '<p class="finePrint">The platform reads it through this project’s own read-only deploy key, set up at standup. Nothing to do here.</p>') +
+          : '<p class="finePrint">The platform reads it through this project’s own read-only deploy key. Nothing to do here.</p>') +
         (repo.admin
           ? '<div class="actions"><button type="button" class="btn small ghost" data-repo-public>Make it public</button></div>'
           : '<p class="finePrint">Your GitHub account can’t change this repository’s settings.</p>'));
     } else {
-      repoVisMsg(
-        '<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
-        '<p class="finePrint">Making it private isn’t possible from here yet — see below for why.</p>');
+      repoVisMsg('<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
+        (repoPrivOpen(manageInst)
+          ? '<p class="finePrint">' + (manageInst.open_intent.state === 'running'
+              ? 'Making it private — the platform is giving this project its own deploy key first.'
+              : 'Making it private is queued — the platform gives this project its own deploy key first. Until then it stays public.') + '</p>'
+          : repoPrivDoor(manageInst, repo)) +
+        /* the make-private receipt's slot, painted WITH the state (the #mVisMsg idiom) —
+           a sibling div would land on this one: every .mSec>div takes the same grid cell */
+        '<div class="projMsg" id="mRepoVisMsg" role="status" aria-live="polite"></div>');
+    }
+  }
+
+  /* fetch-free, from open_intent only (renderManage calls it on every repaint) */
+  function repoPrivOpen(inst) {
+    return !!(inst && inst.open_intent && inst.open_intent.action === 'repo-private');
+  }
+
+  /* the one door to private, or the sentence saying why there is none here — the
+     route refuses the same cases; this only keeps a button off a dead end */
+  function repoPrivDoor(inst, repo) {
+    if (!inst) return '';
+    var why = inst.hosting_shape === 'byo-host' ? 'This project runs on your own host, so the platform never reads its code — you can make the repository private on GitHub directly.'
+      : inst.hosting_shape !== 'standalone' ? 'Only a project on a Cloud host can have its repository made private from here.'
+      : inst.status !== 'active' ? 'You can make it private once the project is running.'
+      : !repo.admin ? 'Your GitHub account can’t change this repository’s settings.'
+      : '';
+    if (why) return '<p class="finePrint">' + why + '</p>';
+    return '<p class="finePrint">Making it private gives this project its own deploy key first, so its deploys keep working.</p>' +
+      '<div class="actions"><button type="button" class="btn small ghost" data-repo-private>Make it private</button></div>';
+  }
+
+  function repoVisNote(cls, html) {
+    var box = $('mRepoVisMsg');
+    if (!box) {
+      if (!html) return;
+      $('mRepoVis').insertAdjacentHTML('beforeend', '<div class="projMsg" id="mRepoVisMsg" role="status" aria-live="polite"></div>');
+      box = $('mRepoVisMsg');
+    }
+    box.className = 'projMsg' + (cls ? ' ' + cls : '');
+    box.innerHTML = html;
+  }
+
+  /* the in-flight line is repainted only when the run's state MOVES, so the tick
+     never flickers it; once the run settles, GitHub is asked again — the only
+     source that can say the flip took (the renderVisState contract) */
+  function renderRepoVisState(inst) {
+    var now = repoPrivOpen(inst) ? inst.open_intent.state : '';
+    if (now) mRepoPrivSeen = true;
+    if (now !== mRepoPrivState) {
+      mRepoPrivState = now;
+      if (manageRepo && !manageRepo.private) renderRepoVis(manageRepo);
+    }
+    if (!now && mRepoPrivSeen) {
+      mRepoPrivSeen = false;
+      repoVisNote('', '');
+      loadRepoVisibility(inst);
     }
   }
 
@@ -6034,12 +6096,58 @@ summary{min-height:24px;padding:3px 0;}
     });
   }
 
+  function askRepoPrivate() {
+    var act = document.querySelector('#mRepoVis .actions');
+    if (!act) return;
+    act.innerHTML = '<div class="confirmRow">' +
+      '<span class="plain">Make it private? Only accounts it’s shared with will be able to read the code.</span>' +
+      '<button type="button" class="btn small" data-repo-private-yes>Yes, make it private</button>' +
+      '<button type="button" class="linklike" data-repo-private-no>Keep it public</button></div>';
+  }
+
+  /* the reply is a RECEIPT — the repository is still public when it lands. The
+     in-flight line reads open_intent, so the manage row is re-read, never patched */
+  function doRepoPrivate() {
+    if (!manageInst) return;
+    var btn = document.querySelector('#mRepoVis [data-repo-private-yes]');
+    if (btn) btn.disabled = true;
+    repoVisNote('', 'Queueing…');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/repo-private', {
+      method: 'POST', credentials: 'same-origin'
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the receipt proves a run is OPEN — never that the repository changed. Record
+             that much, so the 5s watch follows it and a repaint from the stale row cannot
+             drop it; the re-read below swaps in the server's own open_intent */
+          if (!repoPrivOpen(manageInst)) manageInst.open_intent = { action: 'repo-private', state: 'pending' };
+          renderRepoVisState(manageInst);
+          repoVisNote('ok', esc(data.message || 'Queued.'));
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (manageRepo) renderRepoVis(manageRepo);
+        repoVisNote('err', res.status === 401 ? signInAgain()
+          : res.status === 404 ? 'Only the project’s owner can make its repository private.'
+          : esc(e.message || 'The change could not be queued — try again in a moment.'));
+      });
+    }).catch(function () {
+      if (manageRepo) renderRepoVis(manageRepo);
+      repoVisNote('err', 'Couldn’t reach the platform — check your connection and try again.');
+    }).then(function () {
+      loadManage(true, true);
+    });
+  }
+
   $('mRepoVis').addEventListener('click', function (ev) {
     var t = ev.target.closest && ev.target.closest('button');
     if (!t) return;
     if (t.hasAttribute('data-repo-public')) return askRepoPublic();
     if (t.hasAttribute('data-repo-public-yes')) return doRepoPublic();
     if (t.hasAttribute('data-repo-public-no')) { if (manageRepo) renderRepoVis(manageRepo); }
+    if (t.hasAttribute('data-repo-private')) return askRepoPrivate();
+    if (t.hasAttribute('data-repo-private-yes')) return doRepoPrivate();
+    if (t.hasAttribute('data-repo-private-no')) { if (manageRepo) renderRepoVis(manageRepo); }
   });
 
   /* ── on the public map (task 1002335, BV1.R16): the publish gate ──────────