@bongos/core 1.19.981 → 1.19.983

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.981",
+  "version": "1.19.983",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.981",
+      "version": "1.19.983",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.981",
+  "version": "1.19.983",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/github.js

@@ -1,7 +1,7 @@
 // src/bongos/routes/github.js — GitHub repo list/create for the signed-in user, the
 // server half of the onboarding wizard's repo picker (adopt) + auto-create (fresh),
 // plus the manage page's repo-visibility read/flip (task 1003045 — public only; the
-// private direction is refused until the private-repo deploy fix lands).
+// private direction is the provisioning module's queued route, task 1003078).
 // Task 1002099 / ADR 0143.
 //
 // These act on the user's OWN GitHub identity, so they live in core auth alongside
@@ -127,9 +127,9 @@ module.exports = function buildGithubRouter() {
     if (!token) return;
     try {
       const repo = await githubRepos.getUserRepo(token, ref);
-      // private_deployable is the platform truth the UI copy leans on: the deploy
-      // pull runs as the shared deploy key, which cannot read a private repo (N4).
-      res.json({ ok: true, repo, private_deployable: false });
+      // private_deployable: a private repo deploys through the project's own read-only
+      // deploy key (ADR 0176), which the manage page's make-private route wires first.
+      res.json({ ok: true, repo, private_deployable: true });
     } catch (err) {
       if (err && err.status === 401) {
         await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
@@ -145,9 +145,10 @@ module.exports = function buildGithubRouter() {
 
   // rank: any-builder — flips one of the caller's repos PUBLIC, with their own
   // credential. The private direction is REFUSED here, before GitHub is ever
-  // called: the deploy pull still runs as the shared deploy key that cannot read
-  // a private repo (walk finding N4), so flipping private would break the
-  // project's next deploy — the refusal is the honest leg task 1003045 ships.
+  // called: a project stood up public reads its code with the shared key, which
+  // cannot read a private repo (walk finding N4), so a bare flip would break its
+  // next deploy. Making it private is POST /provisioning/instances/:id/repo-private
+  // (task 1003078), which wires the project's own deploy key before it flips.
   router.post('/github/repo/visibility', auth.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
       repo: { required: true, type: 'string', maxLength: 140 },
@@ -158,14 +159,14 @@ module.exports = function buildGithubRouter() {
     if (req.body.visibility !== 'public') {
       return res.fail('private_not_deployable', {
         status: 409,
-        message: 'Private repositories can’t be deployed yet — the platform’s deploy pull can’t read them, so making this repository private would break the project’s next deploy. This lands with the private-repo deploy fix.',
+        message: 'Make a repository private from its project’s manage page — the platform has to give the project its own deploy key first, or its next deploy would break.',
       });
     }
     const token = await resolveRepoToken(req, res);
     if (!token) return;
     try {
       const repo = await githubRepos.makeRepoPublic(token, ref);
-      res.json({ ok: true, repo, private_deployable: false });
+      res.json({ ok: true, repo, private_deployable: true });
     } catch (err) {
       if (err && err.status === 401) {
         await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.981'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.983'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/collab_page.mjs

@@ -623,3 +623,108 @@ test('the client is not configured to send API calls to the site root', () => {
     + 'resolve against /api/bongos/v1, or switch every call to api.request() with a full path',
   );
 });
+
+// ---- THE SESSION START (task 1004181) -------------------------------------
+// The copy control's job is to START A SESSION on an ask, and what it copied was
+// the ask's prose alone: no request id, no task, no asker, no instruction. These
+// run the prompt builders rather than grepping them, because every clause here is
+// a fact a session acts on and a grep would agree with a prompt that was wrong.
+const ASK = {
+  id: '11',
+  requested_by: '1000025',
+  requested_by_name: 'IAMMASTERQUA',
+  created_at: '2026-09-19T21:38:27.389Z',
+  task_id: '1001948',
+  what_is_stuck: 'Task 1001948 should not be built. ADR 0100 §2 decided against it.\n\nSecond paragraph, kept.',
+};
+const BASE = 'https://cloudbongos.com/builders';
+
+test('the copied prompt INVOKES the skill, and names the request it is about', () => {
+  const p = lib().sessionStartPrompt(ASK, BASE);
+  assert.ok(p.startsWith('/collab-review 11\n'), 'first line is the invocation + the id');
+  assert.match(p, /help request 11/);
+  assert.match(p, /IAMMASTERQUA asked it on 2026-09-19\./, 'who asked, and when');
+});
+
+test('the ask travels VERBATIM, opening included, line breaks kept', () => {
+  const p = lib().sessionStartPrompt(ASK, BASE);
+  assert.ok(p.includes(ASK.what_is_stuck), 'the asker\'s own text, untrimmed of its first sentence');
+  assert.ok(p.includes('\n\nSecond paragraph, kept.'), 'its paragraphs survive');
+});
+
+test('the link is ABSOLUTE — the prompt is opened somewhere that is not this page', () => {
+  const L = lib();
+  assert.match(L.sessionStartPrompt(ASK, BASE), /https:\/\/cloudbongos\.com\/builders\/task\/1001948/);
+  // The hall also answers as its own host, where there is no /builders segment.
+  assert.match(L.sessionStartPrompt(ASK, 'https://builders.cloudbongos.com'),
+    /https:\/\/builders\.cloudbongos\.com\/task\/1001948/);
+  // A goal context resolves to the goals page's own route, not a task url.
+  const g = L.sessionStartPrompt({ ...ASK, task_id: null, goal_id: '1000095' }, BASE);
+  assert.match(g, /goal 1000095 — https:\/\/cloudbongos\.com\/builders\/goals#\/goal\/1000095/);
+  // An ask attached to nothing says so rather than linking somewhere wrong.
+  assert.match(L.sessionStartPrompt({ ...ASK, task_id: null }, BASE), /names no task and no goal/);
+});
+
+test('the prompt carries the two rules a session would otherwise break', () => {
+  const p = lib().sessionStartPrompt(ASK, BASE);
+  assert.match(p, /[Cc]heck what the ask claims/, 'verify before acting on someone else\'s certainty');
+  assert.match(p, /only the builder who asked can settle/, 'the recipient cannot settle it');
+});
+
+test('nothing to copy copies nothing — an empty clipboard is not a success', () => {
+  const L = lib();
+  assert.equal(L.sessionStartPrompt(null, BASE), '');
+  assert.equal(L.queueStartPrompt([], BASE), '');
+  assert.equal(L.queueStartPrompt(null, BASE), '');
+});
+
+test('the QUEUE prompt is a manifest, oldest first — not six asks of pasted prose', () => {
+  const L = lib();
+  const older = { ...ASK, id: '4', created_at: '2026-09-10T00:00:00Z', task_id: '1002068' };
+  const p = L.queueStartPrompt([ASK, older], BASE);
+  assert.ok(p.startsWith('/collab-review\n'), 'the whole-queue form takes no id');
+  assert.match(p, /Work the 2 open asks/);
+  assert.ok(p.indexOf('help request 4') < p.indexOf('help request 11'), 'oldest first — age is the point');
+  assert.ok(!p.includes(ASK.what_is_stuck), 'the prose stays on the server; the session reads it live');
+  assert.match(p, /GET \/api\/bongos\/help-requests\/for-me/, 'and is told where to read it');
+  assert.match(L.queueStartPrompt([ASK], BASE), /Work the 1 open ask addressed/, 'one ask is not "1 asks"');
+});
+
+test('the copy control is on EVERY row, keyed by the request, not by the door', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  // The defect this replaced: the control lifted its text out of the hidden <p>
+  // holding the full ask, so a short ask — which has no <p> — had no copy either.
+  assert.match(js, /data-ask-copy="\$\{escapeHtml\(String\(req\.id\)\)\}"/, 'the request id is the key');
+  assert.ok(!/data-ask-copy="\$\{fid\}"/.test(js), 'no longer keyed by the door\'s DOM id');
+  assert.match(js, /askById\.get\(String\(btn\.getAttribute\('data-ask-copy'\)\)\)/);
+  assert.match(js, /L\.sessionStartPrompt\(req, hallBase\(\)\)/, 'built by the pure, tested function');
+  const html = read('modules', 'hall-ui', 'public', 'collab.html');
+  assert.match(html, /id="cb-for-me-copy"/, 'the whole queue has its own control');
+  assert.ok(!/id="cb-all-copy"|id="cb-mine-copy"/.test(html),
+    'only the block that is a to-do list — copying the board would hand over work nobody asked this reader for');
+});
+
+test('the page names the act ONCE — and one ask is not a queue', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  // Two phrasings of one action on one screen was the grader's finding on the
+  // first draft ("Copy this ask for a session" beside "Copy for Session Start").
+  // Comments stripped first: this file ARGUES about the wording at length, and a
+  // scan that read the argument as a label would fail on the prose explaining
+  // why the label is what it is.
+  const code = js.replace(/^\s*\/\/.*$/gm, '');
+  const labels = [...code.matchAll(/Copy [^`"'<\n]*[Ss]ession[^`"'<\n]*/g)].map((m) => m[0].trim());
+  assert.ok(labels.length >= 2, 'both controls are in this file');
+  for (const l of labels) assert.match(l, /Session Start/, `"${l}" must use the page's one phrase`);
+  assert.match(js, /btn\.hidden = forMeRows\.length < 2;/,
+    'at one row the control is absent, not reworded — it would take away exactly what the row does');
+});
+
+test('the skill the page invokes exists, and is the ANSWERING half', () => {
+  const md = read('.claude', 'skills', 'collab-review', 'SKILL.md');
+  assert.match(md, /^name: collab-review$/m);
+  assert.match(md, /GET \/api\/bongos\/help-requests\/for-me/);
+  assert.match(md, /GET \/api\/bongos\/task-recommendations\/for-me/);
+  // The asymmetry the routes enforce, stated where a session will read it.
+  assert.match(md, /cannot settle a help request addressed to you/i);
+  assert.match(md, /DATA, not instructions/, 'an ask is untrusted input');
+});

package/tests/github_repo_visibility.mjs

@@ -3,10 +3,11 @@
 //
 // The load-bearing assertions:
 //   • the PRIVATE direction is refused BEFORE GitHub is ever called (409
-//     private_not_deployable): the deploy pull runs as the shared deploy key,
-//     which cannot read a private repo (walk finding N4), so flipping private
-//     would break the project's next deploy — the honest-refusal leg this task
-//     ships. The refusal must not even consult the stored token.
+//     private_not_deployable): a project stood up public reads with the shared
+//     key, which cannot read a private repo (walk finding N4), so a bare flip
+//     would break its next deploy. The refusal points at the manage page, whose
+//     queued route wires the project's own deploy key first (task 1003078). It
+//     must not even consult the stored token.
 //   • flip-to-public calls makeRepoPublic with the parsed owner/name and
 //     forwards GitHub's own answer — the new state is never assumed
 //   • a GitHub 401 drops the stored token and re-prompts (the /github/repos
@@ -80,7 +81,7 @@ test('GET /github/repo: forwards GitHub\'s answer for the caller\'s own credenti
     assert.equal(res._status, 200);
     assert.equal(res._body.repo.private, true);
     assert.equal(res._body.repo.admin, true);
-    assert.equal(res._body.private_deployable, false, 'the platform truth rides every answer');
+    assert.equal(res._body.private_deployable, true, 'a private repo deploys through its own key (ADR 0176)');
     assert.deepEqual(s.calls.read, [{ owner: 'jaxri', name: 'mercury' }]);
   } finally { s.restore(); }
 });
@@ -129,7 +130,9 @@ test('POST visibility=private: refused 409 private_not_deployable — GitHub and
     await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'private' } }, res);
     assert.equal(res._status, 409);
     assert.equal(res._body.error.code, 'private_not_deployable');
-    assert.match(res._body.error.message, /deploy/i, 'the refusal says WHY in plain words');
+    assert.match(res._body.error.message, /deploy key/i, 'the refusal says WHY in plain words');
+    assert.match(res._body.error.message, /manage page/, 'and names the door that CAN do it');
+    assert.doesNotMatch(res._body.error.message, /can’t be deployed yet/, 'the old platform-wide refusal is gone');
     assert.equal(s.calls.flip.length, 0, 'no GitHub call for a refused direction');
     assert.equal(tokenReads, 0, 'the refusal happens before the credential is even read');
   } finally { db.getGithubToken = origGet; s.restore(); }

package/tests/hall_collab_world.mjs

@@ -203,7 +203,11 @@ test('the door and the copy control are on the row, and the copy control is reac
   assert.match(js, /L\.summaryOf\(req\.what_is_stuck\)/, 'the face is built from summaryOf');
   assert.match(js, /class="ov-row__title">\$\{escapeHtml\(s\.title\)\}/);
   assert.match(js, /class="ov-row__sub">\$\{escapeHtml\(s\.lead\)\}/);
-  assert.match(js, /if \(!s\.more\) return html;/, 'no door when the ask already fits');
+  // No door when the ask already fits — since task 1004181 that is a gate on the
+  // door alone rather than an early return, because the COPY control below it is
+  // now rendered either way.
+  assert.match(js, /const door = s\.more/, 'no door when the ask already fits');
+  assert.match(js, /const full = s\.more \?/, 'and nothing hidden behind it to open');
 
   // The door announces its state and names what it controls, so it works from
   // the keyboard and reads correctly to a screen reader.
@@ -216,15 +220,24 @@ test('the door and the copy control are on the row, and the copy control is reac
   // whether or not the ask is open — the owner asked for it "in the closed
   // version next to the link", and a control only reachable after expanding
   // would make a reader open four thousand characters to take them away.
+  //
+  // AND SINCE TASK 1004181 IT IS RENDERED EVEN WHEN THERE IS NO DOOR. What the
+  // control hands over stopped being the visible text and became the request —
+  // its id, its asker, its task and the instruction — none of which is on the
+  // face however short the ask is. So the shortest asks, the ones a session can
+  // act on fastest, stopped being the only ones you could not take away.
   const bar = js.slice(js.indexOf('<div class="cb-ask">'), js.indexOf('</div>', js.indexOf('<div class="cb-ask">')));
-  assert.match(bar, /data-ask-toggle/, 'the door is in the bar');
+  assert.match(bar, /\$\{door\}/, 'the door is in the bar');
   assert.match(bar, /Copy for Session Start/, 'and so is the copy control, in the owner\'s words');
   assert.ok(!/hidden/.test(bar), 'the bar itself is never hidden');
+  assert.ok(!/s\.more/.test(bar), 'and the copy control is not gated on there being more to read');
   assert.match(js, /<p class="cb-ask__full" id="\$\{fid\}" hidden>/, 'only the ask is hidden');
 
-  // What lands on the clipboard is the ask verbatim, line breaks and all.
-  assert.match(js, /full\.textContent/, 'copied from textContent, so the line breaks survive');
-  assert.ok(!/full\.innerText/.test(js), 'innerText on a hidden element is not guaranteed to keep them');
+  // What lands on the clipboard is the SESSION START — the skill, the id, the
+  // context, then the ask verbatim. The prompt itself is EXECUTED in
+  // tests/collab_page.mjs; this only checks the page reaches for it.
+  assert.match(js, /L\.sessionStartPrompt\(req, hallBase\(\)\)/, 'through the pure, tested builder');
+  assert.ok(!/full\.innerText/.test(js), 'no innerText — on a hidden element it need not keep the line breaks');
   assert.match(js, /document\.execCommand\('copy'\)/, 'with the hall\'s fallback for an insecure context');
 
   // One request can appear in three blocks at once, so the id is block-scoped.

package/tests/projects_hub.mjs

@@ -1210,10 +1210,10 @@ test('every owned card carries its Manage door, and a modified click keeps its m
 
 /* ── Repo visibility on the manage page (task 1003045) ──────────────────────
    The section reads the repo's REAL visibility from GitHub with the owner's
-   own repository credential and offers exactly one direction: private→public.
-   The private direction is refused — server-side and here — until the
-   private-repo deploy fix lands, because the deploy pull runs as the shared
-   deploy key that cannot read a private repo (walk finding N4). ── */
+   own repository credential. Going public is the direct core call; going
+   private (task 1003078) is QUEUED on the provisioning route, because the
+   project's own deploy key must be wired before the flip — a project stood up
+   public reads with the shared key, which cannot read a private repo (N4). ── */
 
 test('the repo-visibility section is live markup with its body slot (C7)', () => {
   assert.match(HUB, /id="mRepoVis"/, 'the section body must be real markup');
@@ -1221,16 +1221,14 @@ test('the repo-visibility section is live markup with its body slot (C7)', () =>
     'the pre-answer state is honest waiting copy, not a fake answer');
 });
 
-test('flip-to-private cannot travel from this page — only the public direction exists', () => {
-  assert.match(SCRIPT, /visibility: 'public'/, 'the one POST body pins the public direction');
+test('flip-to-private travels ONLY through the queued provisioning route, never the core flip', () => {
+  assert.match(SCRIPT, /visibility: 'public'/, 'the core POST body still pins the public direction');
   assert.doesNotMatch(SCRIPT, /visibility:\s*'private'/,
-    'no code path may send the private direction');
-  // the refusal is SAID, with its reason, not silently missing — post-ADR-0176 the
-  // reason is THIS project's shared-credential wiring, not a platform-wide inability
-  assert.match(SCRIPT, /Making it private isn’t possible from here yet — see below for why\./,
-    'the refusal is SAID inline, and points at the fold that carries the reason');
-  assert.match(HUB, /would break the next deploy/,
-    'the flip-to-private limitation is stated in plain words, in the fold');
+    'the core flip is never asked for private — it cannot wire the deploy key');
+  assert.match(SCRIPT, /'\/provisioning\/instances\/' \+ encodeURIComponent\(manageId\) \+ '\/repo-private'/,
+    'the private direction is the provisioning route, keyed on the project');
+  assert.doesNotMatch(HUB, /isn’t possible from here yet/, 'the refusal copy is gone');
+  assert.doesNotMatch(HUB, /Why can’t it be private yet\?/, 'and so is its fold');
 });
 
 test('the visibility shown is GitHub\'s answer, never an assumption', () => {
@@ -1261,19 +1259,15 @@ test('the reconnect door asks for repository access and returns to this project'
     'and returns to the exact project being managed');
 });
 
-test('the refusal carries a LINK to the limitation, never prose alone (task 1003077)', () => {
-  assert.match(HUB, /id="mRepoVisWhy"/, 'the why-fold is real markup beside the section body');
+test('the fold says what making it private does, in the order it happens (task 1003078)', () => {
+  assert.match(HUB, /id="mRepoVisWhy"/, 'the fold is real markup beside the section body');
   const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
   assert.ok(fold, 'the fold must be extractable');
-  assert.match(fold, /an older key that only works on public repositories/, 'the WHY is stated in plain words');
-  assert.match(fold, /\{\{buildersOrigin\}\}#\/task\/1002735/,
-    'the tracked fix is a real link, hall-origin server-stamped (never client-filled)');
-  // apex-only: a child instance keeps the explanation, not another platform's tracker
-  const at = HUB.indexOf('{{buildersOrigin}}#/task/1002735');
-  const before = HUB.slice(0, at);
-  const opens = (before.match(/<!--apex-only:start-->/g) || []).length;
-  const closes = (before.match(/<!--apex-only:end-->/g) || []).length;
-  assert.equal(opens - closes, 1, 'the task link sits inside an apex-only sentinel pair');
+  assert.match(fold, /What making it private does/);
+  assert.match(fold, /its own read-only deploy key[\s\S]*only then makes the repository private/,
+    'the key comes first, the flip second — the safety property, in plain words');
+  assert.match(fold, /needs admin rights on the repository/, 'the one thing the owner must bring');
+  assert.doesNotMatch(fold, /an older key that only works on public repositories/, 'the old limitation is gone');
 });
 
 test('making a repo public asks first — exposure is never one accidental click', () => {

package/tests/projects_hub_pre_uat.mjs

@@ -585,15 +585,16 @@ test('founder voice on the Device Flow step and the manual OAuth fallback', () =
   assert.doesNotMatch(manual, /auth_configured|healthz/, 'no JSON health check for a founder to perform');
 });
 
-test('repo visibility: the refusal is one line, the mechanism lives in the fold', () => {
+test('repo visibility: the public line stays one line, then the door or the reason — the mechanism lives in the fold', () => {
   const rv = fn('renderRepoVis');
   assert.match(rv, /This repository is <b>public<\/b> — anyone can read its code\./, 'line one stays');
-  assert.match(rv, /Making it private isn’t possible from here yet — see below for why\./);
+  assert.match(rv, /repoPrivDoor\(manageInst, repo\)/, 'the public branch offers the door, or says why there is none');
+  assert.doesNotMatch(rv, /isn’t possible from here yet/, 'the old refusal is gone');
   assert.doesNotMatch(rv, /shared credential/);
   const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
-  assert.match(fold, /an older key that only works on public repositories/);
+  assert.match(fold, /What making it private does/);
   assert.doesNotMatch(fold, /shared read-only credential/);
-  assert.match(fold, /<!--apex-only:start--> — shipped as <a href="\{\{buildersOrigin\}\}#\/task\/1002735"/, 'the hall task link stays inside its apex-only sentinel');
+  assert.doesNotMatch(fold, /#\/task\//, 'the fold explains; it no longer points at a tracked fix');
 });
 
 test('a failed manage read offers a retry; the no-address sentence offers a door', () => {

package/tests/projects_hub_repo_private.mjs

@@ -0,0 +1,238 @@
+// tests/projects_hub_repo_private.mjs
+//
+// The manage page's "Make it private" (split (c) of task 1003078): the page's OWN functions,
+// lifted out of projects.html and run in a sandbox with a fake DOM and fetch — so what is
+// proved is behaviour, not the shape of the source.
+//
+// The load-bearing assertions:
+//   • the door shows only where the route would accept it, and every other case says why
+//   • the POST reply is a RECEIPT: it lands in the stable slot, and nothing claims the
+//     repository is private until GitHub is asked again after the run settles
+//   • the in-flight line is fetch-free, repaints only when the run's state MOVES (the
+//     minute tick never flickers it), and the settle triggers exactly ONE GitHub re-read
+//   • a failed make-private reads as a failed make-private on the card, not a failed standup
+//
+// Run:  node tests/projects_hub_repo_private.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import vm from 'node:vm';
+
+const HUB = readFileSync(new URL('../modules/public-landing/public/projects.html', import.meta.url), 'utf8').replace(/\r\n/g, '\n');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// A top-level (2-space) declaration, up to its own closing brace at that indent.
+function grab(head) {
+  const at = HUB.indexOf(`\n  ${head}`);
+  assert.ok(at >= 0, `${head} must exist`);
+  const end = HUB.indexOf('\n  }', at + 1);
+  const close = HUB.slice(end, end + 5) === '\n  };' ? end + 5 : end + 4;
+  return HUB.slice(at, close);
+}
+const SOURCES = [
+  'function esc(', 'var FLOWS = {', 'function stripMarkup(', 'function stripFor(', 'function errCategory(',
+  'function repoPrivOpen(', 'function repoPrivDoor(', 'function repoVisNote(', 'function renderRepoVis(',
+  'function renderRepoVisState(', 'function askRepoPrivate(', 'function doRepoPrivate(',
+].map(grab).join('\n') + "\nfunction repoVisMsg(html) { $('mRepoVis').innerHTML = html; }\n";
+
+const RECEIPT = { status: 200, body: { ok: true, queued: true, message: 'Queued <b>ok</b>.' } };
+function world({ reply = RECEIPT } = {}) {
+  const els = { mRepoVis: { innerHTML: '' }, mRepoVisMsg: { className: 'projMsg', innerHTML: '' } };
+  const calls = { fetch: [], loadManage: [], reread: 0 };
+  let settle;
+  const done = new Promise((r) => { settle = r; });
+  const ctx = {
+    API: '/api/bongos', manageId: '18', manageInst: null, manageRepo: null,
+    mRepoPrivSeen: false, mRepoPrivState: '',
+    $: (id) => els[id],
+    document: { querySelector: () => null },
+    jsonOrEmpty: (res) => res.json(),
+    apiError: (data) => (data && data.error) || {},
+    signInAgain: () => 'SIGN-IN',
+    justLive: () => false,
+    loadRepoVisibility: () => { calls.reread++; },
+    loadManage: (...a) => { calls.loadManage.push(a); settle(); },
+    fetch: (url, opts) => {
+      calls.fetch.push({ url, opts });
+      return Promise.resolve({ ok: reply.status < 300, status: reply.status, json: async () => reply.body });
+    },
+  };
+  vm.createContext(ctx);
+  vm.runInContext(SOURCES, ctx, { filename: 'projects.html#repo-private' });
+  return { ctx, els, calls, done };
+}
+
+const LIVE = { id: 18, status: 'active', hosting_shape: 'standalone', target_ref: 'o/demo', open_intent: null };
+const PUBLIC = { private: false, admin: true };
+
+console.log('the door:');
+
+await ta('a live Cloud-host project whose owner is a repo admin gets the button', async () => {
+  const { ctx } = world();
+  assert.match(ctx.repoPrivDoor(LIVE, PUBLIC), /data-repo-private>Make it private</);
+});
+
+for (const [label, inst, repo, why] of [
+  ['own host', { ...LIVE, hosting_shape: 'byo-host' }, PUBLIC, /on GitHub directly/],
+  ['another shape', { ...LIVE, hosting_shape: 'dedicated' }, PUBLIC, /Cloud host/],
+  ['not running', { ...LIVE, status: 'error' }, PUBLIC, /once the project is running/],
+  ['no admin rights', LIVE, { private: false, admin: false }, /can’t change this repository’s settings/],
+]) {
+  await ta(`${label}: no button, and a sentence saying why`, async () => {
+    const { ctx } = world();
+    const html = ctx.repoPrivDoor(inst, repo);
+    assert.doesNotMatch(html, /data-repo-private/);
+    assert.match(html, why);
+  });
+}
+
+console.log('\nthe request — a receipt, never a new state:');
+
+await ta('Yes POSTs to the project’s repo-private route with NO body', async () => {
+  const w = world();
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  assert.equal(w.calls.fetch.length, 1);
+  assert.equal(w.calls.fetch[0].url, '/api/bongos/provisioning/instances/18/repo-private');
+  assert.equal(w.calls.fetch[0].opts.method, 'POST');
+  assert.equal(w.calls.fetch[0].opts.body, undefined, 'the route takes no fields');
+});
+
+await ta('a 200 puts the server’s sentence (escaped) in the stable slot, arms the re-read, and re-reads the row', async () => {
+  const w = world();
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  assert.equal(w.els.mRepoVisMsg.className, 'projMsg ok');
+  assert.equal(w.els.mRepoVisMsg.innerHTML, 'Queued &lt;b&gt;ok&lt;/b&gt;.');
+  assert.equal(w.ctx.mRepoPrivSeen, true, 'a run that settles before the re-read lands is still followed up');
+  assert.equal(JSON.stringify(w.ctx.manageInst.open_intent), JSON.stringify({ action: 'repo-private', state: 'pending' }),
+    'the receipt proves a run is open, so the row says so — and the 5s watch follows it');
+  assert.match(w.els.mRepoVis.innerHTML, /Making it private is queued/, 'the door gives way to the in-flight line at once');
+  assert.deepEqual(w.calls.loadManage, [[true, true]], 'quiet, keep the repo read');
+  assert.doesNotMatch(w.els.mRepoVis.innerHTML, /<b>private<\/b>/, 'nothing claims the flip happened');
+});
+
+await ta('a repaint from the row right after the click (the minute tick) keeps the run and its receipt', async () => {
+  const w = world();
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.equal(w.calls.reread, 0, 'no settle is read into a run that has not been re-read yet');
+  assert.match(w.els.mRepoVisMsg.innerHTML, /Queued/);
+  assert.doesNotMatch(w.els.mRepoVis.innerHTML, /data-repo-private/, 'the button does not come back');
+});
+
+await ta('a 404 (an archon on someone else’s project) says the rule plainly', async () => {
+  const w = world({ reply: { status: 404, body: { error: { code: 'instance_not_found' } } } });
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  assert.equal(w.els.mRepoVisMsg.className, 'projMsg err');
+  assert.match(w.els.mRepoVisMsg.innerHTML, /Only the project’s owner can make its repository private/);
+  assert.equal(w.ctx.mRepoPrivSeen, false);
+});
+
+await ta('a 409 shows the server’s own sentence, escaped', async () => {
+  const w = world({ reply: { status: 409, body: { error: { code: 'intent_conflict', message: "A 'restart' run is <i>running</i>" } } } });
+  w.ctx.manageInst = { ...LIVE }; w.ctx.manageRepo = PUBLIC;
+  w.ctx.doRepoPrivate();
+  await w.done;
+  assert.equal(w.els.mRepoVisMsg.className, 'projMsg err');
+  assert.match(w.els.mRepoVisMsg.innerHTML, /restart.* run is &lt;i&gt;running&lt;\/i&gt;/);
+  assert.doesNotMatch(w.els.mRepoVisMsg.innerHTML, /<i>/);
+});
+
+console.log('\nthe in-flight line and the settle:');
+
+await ta('the receipt slot is painted INSIDE #mRepoVis, never a sibling of it', async () => {
+  // every .mSec>div takes the same grid cell (cosmos.css), so a sibling would sit on top
+  const card = (HUB.match(/<div class="card mSec" id="mRepoVisibility">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, 'the card markup is extractable');
+  assert.doesNotMatch(card, /id="mRepoVisMsg"/, 'no second grid child in the card markup');
+  const w = world();
+  w.ctx.manageInst = { ...LIVE };
+  w.ctx.renderRepoVis(PUBLIC);
+  assert.match(w.els.mRepoVis.innerHTML, /<div class="projMsg" id="mRepoVisMsg" role="status" aria-live="polite"><\/div>$/);
+});
+
+await ta('an open run replaces the door with the in-flight line, worded by its state', async () => {
+  const w = world();
+  w.ctx.manageRepo = PUBLIC;
+  w.ctx.manageInst = { ...LIVE, open_intent: { action: 'repo-private', state: 'pending' } };
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.match(w.els.mRepoVis.innerHTML, /Making it private is queued/);
+  assert.doesNotMatch(w.els.mRepoVis.innerHTML, /data-repo-private/);
+  w.ctx.manageInst = { ...LIVE, open_intent: { action: 'repo-private', state: 'running' } };
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.match(w.els.mRepoVis.innerHTML, /the platform is giving this project its own deploy key first/);
+});
+
+await ta('the minute tick with an unchanged state does not repaint', async () => {
+  const w = world();
+  w.ctx.manageRepo = PUBLIC;
+  w.ctx.manageInst = { ...LIVE, open_intent: { action: 'repo-private', state: 'running' } };
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  w.els.mRepoVis.innerHTML = 'SENTINEL';
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.equal(w.els.mRepoVis.innerHTML, 'SENTINEL');
+  assert.equal(w.calls.reread, 0, 'and asks GitHub nothing while it runs');
+});
+
+await ta('the settle asks GitHub exactly once and clears the receipt', async () => {
+  const w = world();
+  w.ctx.manageRepo = PUBLIC;
+  w.ctx.renderRepoVisState({ ...LIVE, open_intent: { action: 'repo-private', state: 'running' } });
+  w.els.mRepoVisMsg.innerHTML = 'Queued.';
+  w.ctx.renderRepoVisState({ ...LIVE, open_intent: null });
+  w.ctx.renderRepoVisState({ ...LIVE, open_intent: null });
+  assert.equal(w.calls.reread, 1, 'only GitHub can say the flip took — asked once');
+  assert.equal(w.els.mRepoVisMsg.innerHTML, '');
+});
+
+await ta('another intent (a restart) is not mistaken for a make-private run', async () => {
+  const w = world();
+  w.ctx.manageRepo = PUBLIC;
+  w.ctx.manageInst = { ...LIVE, open_intent: { action: 'restart', state: 'running' } };
+  w.ctx.renderRepoVis(PUBLIC);
+  assert.match(w.els.mRepoVis.innerHTML, /data-repo-private/);
+  w.ctx.renderRepoVisState(w.ctx.manageInst);
+  assert.equal(w.ctx.mRepoPrivSeen, false);
+});
+
+console.log('\nthe card:');
+
+await ta('the mine-card strip names the make-private flow and its running half', async () => {
+  const { ctx } = world();
+  const run = ctx.stripFor({ ...LIVE, open_intent: { action: 'repo-private', state: 'running' } });
+  assert.match(run, /Setting up its deploy key/);
+  assert.match(run, /setting up the project’s own deploy key first/);
+  const queued = ctx.stripFor({ ...LIVE, open_intent: { action: 'repo-private', state: 'pending' } });
+  assert.match(queued, /Making the repository private is queued/);
+  assert.doesNotMatch(queued, /repo-private run is queued/, 'not the generic fallback');
+});
+
+await ta('a retired make-private reads as that, not as a standup that stopped', async () => {
+  const { ctx } = world();
+  for (const note of [
+    'o/demo is still public: its deploy key could not be set up on the server. Nothing on your side caused this, and trying again is safe.',
+    'o/demo cannot be made private right now: GitHub could not be reached to set up its deploy key (fetch failed). Nothing has been changed — try again.',
+    'The deploy key for o/demo could not be set up, so the repository was left public.',
+  ]) assert.match(ctx.errCategory(note), /Making the repository private didn’t finish/, note);
+  for (const note of [
+    "o/demo cannot be made private: there is no usable GitHub credential stored for this project, and without one its deploy key cannot be registered. Reconnect the project's GitHub access, then try again.",
+    "o/demo was not made private: the project's GitHub credential could not be read. Its deploy key is already in place, so reconnect GitHub and try again.",
+  ]) assert.match(ctx.errCategory(note), /needs reconnecting/, 'the one fix the owner can make is not folded away');
+  assert.match(ctx.errCategory('deploy-key setup failed for o/demo: GitHub deploy-key add failed (500).'), /deploy key on GitHub didn’t finish/);
+  assert.match(ctx.errCategory('repository not found: GitHub answered 404'), /couldn’t find the project’s repository/, 'the older categories are untouched');
+});
+
+console.log(`\nprojects_hub_repo_private: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);