@bongos/core 1.20.26 → 1.20.27

package/modules/provisioning/planet-physics.js

@@ -0,0 +1,154 @@
+// modules/provisioning/planet-physics.js — the seven "planet physics" answers a new
+// project carries (BV2.PS02, task 1004416; goal 1000121, spec
+// docs/specs/bongos-v2-project-startup.md).
+//
+// WHAT. The questions the startup flow asks before any technical setup, as a closed
+// vocabulary the provisioning `detail` jsonb stores (the R15 dumb-store contract in
+// provisioning.js: a later question costs no migration). In the canvas's order:
+//
+//   1 state       project_state, existing_work (all that apply), main_work
+//   2 geography   home_country, home_region, builder_geography
+//   3 ages        minors_on_board
+//   4 entity      entity — a legal type (already formed) or an intent (not yet)
+//   5 builders    builders_at_start, builders_expected (the month-three estimate)
+//   6 rewards     reward_intents (all being considered — intent, never binding)
+//   7 framing     framing (A–D: managed, hybrid, local, open-source) and services
+//
+// THREE KINDS OF QUESTION. `one` takes a single member of its list, `many` takes an
+// array of members (stored de-duplicated, in the list's own order, so two spellings of
+// one answer store the same bytes), and `count` takes a whole number in a range.
+// Every kind has the same two rules as `team_shape`: an unknown value is REFUSED at the
+// boundary (badProjectDetail says which and why), and an explicit null un-answers.
+//
+// THESE ARE FACTS, NOT POLICY. Nothing here restricts what a project may do: the age
+// tiers and the payout geography are enforced by nobody yet (out of scope, spec "Out
+// of scope"). They are stored so the soft-limit table (soft-limits.js) can grey an
+// option with a reason, and so the later enforcement has the facts it will need.
+//
+// PURE, and requires nothing — provisioning.js composes these into
+// PROJECT_DETAIL_VOCAB, and soft-limits.js reads them, so a require of either from
+// here would be a cycle.
+
+'use strict';
+
+// ISO 3166-1 alpha-2, the officially assigned codes. A closed list rather than a
+// two-letter pattern, because "ZZ" is a typo the pattern would store as a country.
+const COUNTRY_CODES = Object.freeze((
+  'AD AE AF AG AI AL AM AO AQ AR AS AT AU AW AX AZ BA BB BD BE BF BG BH BI BJ BL BM BN BO BQ ' +
+  'BR BS BT BV BW BY BZ CA CC CD CF CG CH CI CK CL CM CN CO CR CU CV CW CX CY CZ DE DJ DK DM ' +
+  'DO DZ EC EE EG EH ER ES ET FI FJ FK FM FO FR GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS ' +
+  'GT GU GW GY HK HM HN HR HT HU ID IE IL IM IN IO IQ IR IS IT JE JM JO JP KE KG KH KI KM KN ' +
+  'KP KR KW KY KZ LA LB LC LI LK LR LS LT LU LV LY MA MC MD ME MF MG MH MK ML MM MN MO MP MQ ' +
+  'MR MS MT MU MV MW MX MY MZ NA NC NE NF NG NI NL NO NP NR NU NZ OM PA PE PF PG PH PK PL PM ' +
+  'PN PR PS PT PW PY QA RE RO RS RU RW SA SB SC SD SE SG SH SI SJ SK SL SM SN SO SR SS ST SV ' +
+  'SX SY SZ TC TD TF TG TH TJ TK TL TM TN TO TR TT TV TW TZ UA UG UM US UY UZ VA VC VE VG VI ' +
+  'VN VU WF WS YE YT ZA ZM ZW'
+).split(' '));
+
+// The sub-national level the canvas asks for ("your country · state"), ISO 3166-2
+// style. Only where the law that matters to a project — minors' work permits, what
+// kind of company you can form — is set at that level: the US states (with DC and the
+// territories) and the Canadian provinces and territories. Anywhere else the answer is
+// the country alone, and a region is refused rather than stored unread.
+const US_REGIONS = (
+  'AL AK AZ AR CA CO CT DE FL GA HI ID IL IN IA KS KY LA ME MD MA MI MN MS MO MT NE NV NH NJ ' +
+  'NM NY NC ND OH OK OR PA RI SC SD TN TX UT VT VA WA WV WI WY DC AS GU MP PR UM VI'
+).split(' ').map((s) => `US-${s}`);
+const CA_REGIONS = 'AB BC MB NB NL NS NT NU ON PE QC SK YT'.split(' ').map((s) => `CA-${s}`);
+const REGION_CODES = Object.freeze([...US_REGIONS, ...CA_REGIONS]);
+
+// The European Union's member states — what "EU builders" means to the soft limits.
+const EU_COUNTRIES = Object.freeze(
+  'AT BE BG CY CZ DE DK EE ES FI FR GR HR HU IE IT LT LU LV MT NL PL PT RO SE SI SK'.split(' ')
+);
+
+const WORK_KINDS = Object.freeze(['code', 'digital-files', 'physical-work']);
+
+// Question 4. A project that already exists picks its legal type; a new one says
+// roughly where it is heading (the canvas: "there's nothing to sign yet"). One key,
+// because they answer one question and a project holds exactly one of them.
+const ENTITY_INTENTS = Object.freeze(['intent-company', 'intent-nonprofit', 'intent-solo', 'intent-unsure']);
+const ENTITY_FORMS = Object.freeze([
+  'nonprofit', 'for-profit', 'corporate-division', 'research', // organization
+  'university-project', 'social-group',                        // group
+  'single-owner-llc', 'private-individual',                    // individual
+]);
+
+// Question 7's A–D, in that order (A = managed … D = open-source).
+const FRAMINGS = Object.freeze(['managed', 'hybrid', 'local', 'open-source']);
+
+// The suite a hybrid or local framing chooses from.
+const SERVICES = Object.freeze([
+  'hosting', 'labor-payment', 'starter-kit', 'marketplace-buy', 'marketplace-sell',
+  'guild-access', 'guild-create', 'company-creation', 'cbaas-consulting', 'public-marketing',
+]);
+
+// The ceiling on a builder count is a sanity bound, not a product limit.
+const BUILDER_COUNT = Object.freeze({ kind: 'count', min: 1, max: 100000 });
+
+const PLANET_PHYSICS_QUESTIONS = Object.freeze({
+  project_state: Object.freeze({ kind: 'one', values: Object.freeze(['new', 'existing']) }),
+  existing_work: Object.freeze({ kind: 'many', values: WORK_KINDS }),
+  main_work: Object.freeze({ kind: 'one', values: WORK_KINDS }),
+  home_country: Object.freeze({ kind: 'one', values: COUNTRY_CODES }),
+  home_region: Object.freeze({ kind: 'one', values: REGION_CODES }),
+  builder_geography: Object.freeze({ kind: 'one', values: Object.freeze(['us-only', 'us-eu', 'global', 'not-sure']) }),
+  minors_on_board: Object.freeze({ kind: 'one', values: Object.freeze([false, true]) }),
+  entity: Object.freeze({ kind: 'one', values: Object.freeze([...ENTITY_INTENTS, ...ENTITY_FORMS]) }),
+  builders_at_start: BUILDER_COUNT,
+  builders_expected: BUILDER_COUNT,
+  reward_intents: Object.freeze({ kind: 'many', values: Object.freeze(['non-monetary', 'cash', 'equity', 'future-payouts']) }),
+  framing: Object.freeze({ kind: 'one', values: FRAMINGS }),
+  services: Object.freeze({ kind: 'many', values: SERVICES }),
+});
+
+// The answer as it may be STORED, or undefined when it is not one. `many` answers come
+// back de-duplicated in the list's order; an empty array is a real answer ("none of
+// these"), distinct from never answering. PURE.
+function canonicalAnswer(question, value) {
+  if (!question) return undefined;
+  if (question.kind === 'one') return question.values.includes(value) ? value : undefined;
+  if (question.kind === 'many') {
+    if (!Array.isArray(value) || !value.every((v) => question.values.includes(v))) return undefined;
+    return question.values.filter((v) => value.includes(v));
+  }
+  if (question.kind === 'count') {
+    return Number.isInteger(value) && value >= question.min && value <= question.max ? value : undefined;
+  }
+  return undefined;
+}
+
+// Why a value is not an answer, in a sentence the caller can act on. Lists longer
+// than a dozen (the country and region codes) are named by their standard instead of
+// printed. PURE.
+function answerFaultMessage(key, question) {
+  const list = (values) => (values.length > 12
+    ? (key === 'home_country' ? 'an ISO 3166-1 alpha-2 country code, like US or DE' : 'a US state or Canadian province code, like US-CA or CA-ON')
+    : `one of: ${values.join(', ')}`);
+  if (question.kind === 'many') return `"${key}" must be a list, each item ${list(question.values)} — or null to un-answer it.`;
+  if (question.kind === 'count') return `"${key}" must be a whole number from ${question.min} to ${question.max} — or null to un-answer it.`;
+  return `"${key}" must be ${list(question.values)} — or null to un-answer it.`;
+}
+
+// Faults BETWEEN answers sent together in one body. Only within the body: a merge
+// patch may legitimately change one half now and the other later, and refusing a
+// write for disagreeing with a stored answer would make the order of edits matter.
+// Returns a message, or null. PURE.
+function crossAnswerFault(detail) {
+  if (Array.isArray(detail.existing_work) && typeof detail.main_work === 'string'
+      && !detail.existing_work.includes(detail.main_work)) {
+    return `"main_work" must be one of the kinds in "existing_work" (${detail.existing_work.join(', ') || 'none given'}).`;
+  }
+  if (typeof detail.home_region === 'string' && typeof detail.home_country === 'string'
+      && !detail.home_region.startsWith(`${detail.home_country}-`)) {
+    return `"home_region" ${detail.home_region} is not in "home_country" ${detail.home_country}.`;
+  }
+  return null;
+}
+
+module.exports = {
+  PLANET_PHYSICS_QUESTIONS,
+  COUNTRY_CODES, REGION_CODES, EU_COUNTRIES,
+  ENTITY_FORMS,
+  canonicalAnswer, answerFaultMessage, crossAnswerFault,
+};

package/modules/provisioning/provisioning.js

@@ -19,6 +19,11 @@
 // valued, and the value it resolves to when nobody answered is the type's starter
 // bundle — so storage and the read projection both have to read that declaration.
 const { normalizeModuleSelection, effectiveModules } = require('./starter-bundles');
+// The planet-physics answers and the soft limits over them (BV2.PS02, task 1004416) —
+// pure declarations beside this file, for the same reason: storage and the read
+// projection both have to read them.
+const { PLANET_PHYSICS_QUESTIONS, canonicalAnswer } = require('./planet-physics');
+const { softLimitsFor } = require('./soft-limits');
 
 // ---------------------------------------------------------------------------
 // Constants (mirror the CHECK constraints in provisioning_001_tables.sql)
@@ -253,9 +258,18 @@ const PLANET_VOCAB = Object.freeze({
 // obey, so an absent one has to resolve to today's behaviour; a detail answer is
 // something the owner SAID, and inventing one they never said would feed R17 a
 // recommendation nobody asked for. Absent stays absent, and skipped stays skipped.
-const PROJECT_DETAIL_VOCAB = Object.freeze({
-  team_shape: ['solo', 'small-team', 'community'],
+//
+// The seven planet-physics answers (BV2.PS02, task 1004416) ride the same column under
+// the same contract. They add two kinds of question beside the closed single answer:
+// a list of members (`many`) and a whole number (`count`) — see planet-physics.js.
+// PROJECT_DETAIL_QUESTIONS is the whole contract; PROJECT_DETAIL_VOCAB is its closed
+// answer lists, the shape every reader and the `options` reply already take.
+const PROJECT_DETAIL_QUESTIONS = Object.freeze({
+  team_shape: Object.freeze({ kind: 'one', values: Object.freeze(['solo', 'small-team', 'community']) }),
+  ...PLANET_PHYSICS_QUESTIONS,
 });
+const PROJECT_DETAIL_VOCAB = Object.freeze(Object.fromEntries(Object.entries(PROJECT_DETAIL_QUESTIONS)
+  .filter(([, question]) => question.values).map(([key, question]) => [key, question.values])));
 // The publish-gate half of the interview is prose, so it needs a ceiling. Long
 // enough for a real paragraph, short enough that the column is never a document —
 // the Explore card renders `tagline`, not this.
@@ -401,6 +415,7 @@ async function isProvisionedHostname(db, hostname) {
 // explicitly means a future sensitive column is never leaked by accident.
 function publicInstance(row) {
   if (!row) return { state: 'none' };
+  const detail = projectDetail(row);
   return {
     id: row.id,
     slug: row.slug,
@@ -431,7 +446,10 @@ function publicInstance(row) {
     // in (ADR 0182 D4). Surfaced so a form can render "here's what's still
     // missing" from a plain instance read, without a second endpoint.
     description: row.description || null,
-    detail: projectDetail(row),
+    detail,
+    // Which startup options those answers hide, grey or annotate, each with its reason
+    // (BV2.PS02, spec D6). Advice only — `enforced: false` says so on every read.
+    soft_limits: softLimitsFor(detail),
     // The creation picker's module set (task 1002339): the always-on core, what
     // the owner ends up with, and whether that came from their own toggles or
     // from the type's starter bundle because they never answered. Resolved, not
@@ -631,8 +649,9 @@ function normalizeDescription(input) {
 function normalizeProjectDetail(input) {
   const given = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
   const out = {};
-  for (const [key, vocab] of Object.entries(PROJECT_DETAIL_VOCAB)) {
-    if (vocab.includes(given[key])) out[key] = given[key];
+  for (const [key, question] of Object.entries(PROJECT_DETAIL_QUESTIONS)) {
+    const answer = canonicalAnswer(question, given[key]);
+    if (answer !== undefined) out[key] = answer;
   }
   return out;
 }
@@ -650,9 +669,10 @@ function projectDetailPatch(input) {
   const given = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
   const set = {};
   const clear = [];
-  for (const [key, vocab] of Object.entries(PROJECT_DETAIL_VOCAB)) {
+  for (const [key, question] of Object.entries(PROJECT_DETAIL_QUESTIONS)) {
+    const answer = canonicalAnswer(question, given[key]);
     if (given[key] === null) clear.push(key);
-    else if (vocab.includes(given[key])) set[key] = given[key];
+    else if (answer !== undefined) set[key] = answer;
   }
   return { set, clear };
 }
@@ -1445,7 +1465,7 @@ module.exports = {
   SETTINGS_APPLY_FROM, SETTINGS_APPLY_SHAPES,
   RESTART_FROM, RESTART_SHAPES,
   TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
-  SETTINGS_VOCAB, DEFAULT_SETTINGS, SETTINGS_COMPANION_ENV, PROJECT_DETAIL_VOCAB, DESCRIPTION_MAX,
+  SETTINGS_VOCAB, DEFAULT_SETTINGS, SETTINGS_COMPANION_ENV, PROJECT_DETAIL_VOCAB, PROJECT_DETAIL_QUESTIONS, DESCRIPTION_MAX,
   PLANET_TEMPLATES, PLANET_ACCENTS, PLANET_VOCAB,
   // pure
   isValidSlug, costEstimateUsd, DEFAULT_DEDICATED_TIER, publicInstance, normalizeHostname,
@@ -1453,7 +1473,7 @@ module.exports = {
   settingsPushOwed,
   // pure — the artist gate's non-retroactivity stamp (ADR 0241 §5, task 1003575)
   ARTIST_GATE_STRICT_SINCE_KEY, artistGateStrictSince, artistGateStamp,
-  normalizeDescription, normalizeProjectDetail, projectDetailPatch, projectDetail,
+  normalizeDescription, normalizeProjectDetail, projectDetailPatch, projectDetail, softLimitsFor,
   // pure — GitHub App Manifest flow (task 2080)
   githubAppName, buildGithubAppManifest, manifestPostUrl, publicGithubApp,
   // pure — the address race's database backstop (task 1002901, provisioning_015)

package/modules/provisioning/routes/body-validators.js

@@ -15,6 +15,8 @@
 
 const provisioning = require('../provisioning');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES } = require('../starter-bundles');
+const { canonicalAnswer, answerFaultMessage, crossAnswerFault } = require('../planet-physics');
+const { screenProject, STOP_MESSAGE } = require('../screening');
 
 // The project-detail answers, validated LOUDLY (task 1002334). `detail` arrives as
 // a nested object, and the strict body validator only reaches top-level fields — so
@@ -28,21 +30,37 @@ function badProjectDetail(detail) {
   if (typeof detail !== 'object' || Array.isArray(detail)) {
     return { code: 'bad_detail', message: 'detail must be an object of answers.' };
   }
-  const vocab = provisioning.PROJECT_DETAIL_VOCAB;
+  const questions = provisioning.PROJECT_DETAIL_QUESTIONS;
   for (const [key, value] of Object.entries(detail)) {
-    if (!Object.prototype.hasOwnProperty.call(vocab, key)) {
-      return { code: 'bad_detail', message: `Unknown detail answer "${key}" — the interview asks: ${Object.keys(vocab).join(', ')}.` };
+    if (!Object.prototype.hasOwnProperty.call(questions, key)) {
+      return { code: 'bad_detail', message: `Unknown detail answer "${key}" — the interview asks: ${Object.keys(questions).join(', ')}.` };
     }
     // An explicit null is the UN-ANSWER, not an off-vocabulary value (task 1003577):
     // the merge-patch way back to "never answered". Only null — an empty string or any
     // other sentinel stays a typo, so a caller trying to SET one is never silently
     // read as having erased their answer.
     if (value === null) continue;
-    if (!vocab[key].includes(value)) {
-      return { code: 'bad_detail', message: `"${key}" must be one of: ${vocab[key].join(', ')} — or null to un-answer it.` };
+    // Every kind of question (planet-physics.js, task 1004416) — a single answer, a
+    // list of members, or a whole number — refuses with a sentence naming its own shape.
+    if (canonicalAnswer(questions[key], value) === undefined) {
+      return { code: 'bad_detail', message: answerFaultMessage(key, questions[key]) };
     }
   }
-  return null;
+  const crossFault = crossAnswerFault(detail);
+  return crossFault ? { code: 'bad_detail', message: crossFault } : null;
+}
+
+// The screening hook (BV2.PS02, task 1004416) at the boundary: the project's own words,
+// screened BEFORE anything is created — the canvas's stop screen ("nothing has been set
+// up"). 422, because the body is well-formed and the refusal is about what it describes.
+// Neither the sentence nor `details` names the rule: a gate that says which rule it
+// tripped teaches a caller how to reword around it (the task 1004416 review).
+// Returns null when clean, or the res.fail options to stop with. The rules and the seam
+// a real classifier replaces are in ../screening.js.
+function screenedOut(description) {
+  const verdict = screenProject({ description });
+  if (!verdict.stop) return null;
+  return { status: 422, message: STOP_MESSAGE, details: { screened: true } };
 }
 
 // The creation picker's module selection, validated LOUDLY (BV1.R20, task
@@ -91,4 +109,4 @@ function badProjectType(type) {
   return null;
 }
 
-module.exports = { badProjectDetail, badModuleSelection, badProjectType };
+module.exports = { badProjectDetail, badModuleSelection, badProjectType, screenedOut };

package/modules/provisioning/routes/provisioning.js

@@ -61,7 +61,7 @@ const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
-const { badProjectDetail, badModuleSelection, badProjectType } = require('./body-validators');
+const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
 const { registerProvisioningSeams } = require('../seams');
@@ -330,6 +330,8 @@ module.exports = function provisioningRoutes() {
     if (detailFault) return res.fail(detailFault.code, { status: 400, message: detailFault.message });
     const modulesFault = badModuleSelection(body.modules);
     if (modulesFault) return res.fail(modulesFault.code, { status: 400, message: modulesFault.message });
+    const screened = screenedOut(body.description); // the stop screen (task 1004416): before anything exists
+    if (screened) return res.fail('screened_out', screened);
     const slug = String(body.slug || '').trim().toLowerCase();
     if (!provisioning.isValidSlug(slug)) {
       return res.fail('bad_slug', 400, { reason: 'lowercase, 2–40 chars of [a-z0-9-], no leading/trailing/double dash' });
@@ -698,6 +700,8 @@ module.exports = function provisioningRoutes() {
     if (detailFault) return res.fail(detailFault.code, { status: 400, message: detailFault.message });
     const modulesFault = badModuleSelection(body.modules);
     if (modulesFault) return res.fail(modulesFault.code, { status: 400, message: modulesFault.message });
+    const screened = screenedOut(body.description); // the stop screen (task 1004416): before anything exists
+    if (screened) return res.fail('screened_out', screened);
     // `type: null` reaches here because the kernel validator reads null as ABSENT —
     // which is exactly why the refusal has to be its own check and not an enum rule.
     const typeFault = badProjectType(Object.prototype.hasOwnProperty.call(body, 'type') ? body.type : undefined);
@@ -731,11 +735,12 @@ module.exports = function provisioningRoutes() {
       // one CLEARED here has to leave it, which is why the hub assigns `description`
       // rather than COALESCEing it.
       await catalogBridge.publishInstanceToCatalog(pool, updated).catch(() => {});
+      const detail = provisioning.projectDetail(updated);
       res.json({
         ok: true,
         description: updated.description || null,
-        detail: provisioning.projectDetail(updated),
-        options: provisioning.PROJECT_DETAIL_VOCAB,
+        detail, options: provisioning.PROJECT_DETAIL_VOCAB,
+        soft_limits: provisioning.softLimitsFor(detail), // advice, never enforced (task 1004416)
         // The whole point of the step, answered in the same breath (R16, task
         // 1002335): an owner who just wrote a description learns HERE that the
         // project is now on the map, and one who cleared it learns it just left.

package/modules/provisioning/screening.js

@@ -0,0 +1,62 @@
+// modules/provisioning/screening.js — the screening hook that can stop a project
+// before anything is created (BV2.PS02, task 1004416; the canvas's "this can't be
+// built on Cloud Bongos" stop screen).
+//
+// WHAT IT SCREENS. The words an owner uses to say what the project is: the idea text
+// for a new planet, and the description of the work that already exists for an
+// existing one. Both arrive as `description` today (the canvas asks one question, "what
+// is your project, and what do you want Bongos to do for you?"), so the hook takes an
+// object of named texts — a later field is one more key, not a new call site.
+//
+// THE SEAM. `screenProject(texts, rules)` is the whole contract: texts in, a verdict
+// out, `{ stop: false }` or `{ stop: true, rule }`. The real classifier is out of scope
+// (spec, PS02); when it exists it replaces SCREENING_RULES or this function's body, and
+// no caller changes.
+//
+// THE RULE SET IS DELIBERATELY SMALL. A keyword rule that stops an honest project is a
+// worse failure than one that misses a bad one — the classifier is the real answer, and
+// the stop screen always offers "contact us". So each rule names something no
+// legitimate project is built to BE, and a defensive project that merely talks about it
+// (a ransomware detector, a phishing-awareness course) carries an `unless` that lets it
+// through. When in doubt, a rule does not belong here.
+//
+// PURE — no I/O, no requires.
+
+'use strict';
+
+const SCREENING_RULES = Object.freeze([
+  Object.freeze({
+    id: 'child-sexual-abuse',
+    match: /\b(csam|child (sexual abuse|porn\w*)|(sexual|nude|explicit) (images?|photos?|videos?|content) of (children|minors|kids))\b/i,
+    unless: null,
+  }),
+  Object.freeze({
+    id: 'malware',
+    match: /\b(build|make|create|write|develop|sell|spread|distribute|deploy)\w*\b[^.!?\n]{0,40}\b(ransomware|keyloggers?|info-?stealers?|credential stealers?|botnets?)\b/i,
+    unless: /\b(detect\w*|defen[cs]\w*|protect\w*|prevent\w*|block\w*|remov\w*|scann\w*|research\w*|against|anti-?\w+)\b/i,
+  }),
+  Object.freeze({
+    id: 'phishing',
+    match: /\b(build|make|create|write|develop|sell|run|host|launch)\w*\b[^.!?\n]{0,40}\bphishing (kits?|pages?|sites?|campaigns?)\b/i,
+    unless: /\b(awareness|training|simulat\w*|detect\w*|report\w*|defen[cs]\w*|protect\w*|against)\b/i,
+  }),
+]);
+
+// The verdict for one project's texts. `texts` is `{ description, … }`; anything that is
+// not a string is skipped, so an unanswered field can never stop a project. PURE.
+function screenProject(texts, rules = SCREENING_RULES) {
+  const given = texts && typeof texts === 'object' ? texts : {};
+  const words = Object.values(given).filter((t) => typeof t === 'string' && t.trim()).join('\n');
+  if (!words) return { stop: false };
+  for (const rule of rules) {
+    if (rule.match.test(words) && !(rule.unless && rule.unless.test(words))) return { stop: true, rule: rule.id };
+  }
+  return { stop: false };
+}
+
+// The owner-facing sentence the stop screen shows — the canvas's own copy. It names no
+// rule, and nothing else in the reply does either: the person who answers "contact us"
+// reads the description itself.
+const STOP_MESSAGE = "What you described isn't something we can help create, so we've stopped here. Nothing has been set up. If you think we've read it wrong, contact us and a person will look at it.";
+
+module.exports = { SCREENING_RULES, STOP_MESSAGE, screenProject };

package/modules/provisioning/soft-limits.js

@@ -0,0 +1,146 @@
+// modules/provisioning/soft-limits.js — which startup options do not apply to a
+// project, and why (BV2.PS02, task 1004416; spec decision D6, "soft limits only").
+//
+// WHAT. One frozen table. Each rule says: WHEN these planet-physics answers hold, this
+// OPTION is hidden, greyed, or carries a note — and here is the REASON, in a line the
+// owner reads beside it. The recommendations.js pattern (ADR 0239): condition ->
+// effect -> reason, and a resolver over the table. Nothing else.
+//
+// SOFT MEANS NOBODY ENFORCES IT. No route refuses an answer for breaking one of these
+// rules, and none may: the server-side age and geography enforcement is a later goal.
+// So every resolution says `enforced: false`, and no reason in the table may word a
+// limit as though it were enforced (the integrity test reads every reason for that).
+// A screen that greys an option is giving advice with a reason, the same standing as
+// `governance.applied: false` in recommendations.js.
+//
+// DECLARATIVE ON PURPOSE. A condition is data — `{ key: { in: [...] } }` for a single
+// answer, `{ key: { has: value } }` or `{ key: { lacks: value } }` for a list answer —
+// never a function, so a rule can be checked against the vocabulary by a test and could
+// be sent to a browser as-is.
+// Every key in `when` must hold; an UNANSWERED key never matches, so no rule fires on
+// an answer nobody gave (the normalizeProjectDetail rule). An empty `when` always holds:
+// that is a fact about the platform, not about the project.
+//
+// EFFECTS, strongest first: `hide` (the option does not apply at all), `grey` (shown,
+// not offered, with the reason), `note` (offered, with the reason beside it — for an
+// option that applies only in part). An option names a whole question (`services`) or
+// one member of it (`reward_intents:equity`).
+//
+// PURE — requires only planet-physics.js.
+
+'use strict';
+
+const { EU_COUNTRIES, ENTITY_FORMS } = require('./planet-physics');
+
+const EFFECTS = Object.freeze(['hide', 'grey', 'note']);
+
+const SOFT_LIMIT_RULES = Object.freeze([
+  Object.freeze({
+    id: 'existing-work-needs-existing-project',
+    when: { project_state: { in: ['new'] } },
+    options: ['existing_work', 'main_work'],
+    effect: 'hide',
+    reason: 'Your planet is new, so there is nothing built yet to describe.',
+  }),
+  Object.freeze({
+    id: 'equity-needs-a-company',
+    when: { entity: { in: ['intent-company', 'intent-nonprofit', 'intent-solo', 'intent-unsure', 'university-project', 'social-group', 'private-individual'] } },
+    options: ['reward_intents:equity'],
+    effect: 'grey',
+    reason: 'Equity is off until you form a company — there are no shares to give yet.',
+  }),
+  Object.freeze({
+    id: 'equity-not-in-a-nonprofit',
+    when: { entity: { in: ['nonprofit'] } },
+    options: ['reward_intents:equity'],
+    effect: 'grey',
+    reason: 'A nonprofit has no owners, so it has no shares to give.',
+  }),
+  Object.freeze({
+    id: 'no-cash-payouts-to-eu-builders-yet',
+    when: { builder_geography: { in: ['us-eu', 'global'] } },
+    options: ['reward_intents:cash'],
+    effect: 'note',
+    reason: "Cash payouts to builders in the EU aren't available yet. Builders elsewhere can still be paid in cash.",
+  }),
+  Object.freeze({
+    id: 'no-cash-payouts-from-an-eu-home-yet',
+    when: { home_country: { in: [...EU_COUNTRIES] } },
+    options: ['reward_intents:cash'],
+    effect: 'grey',
+    reason: "Cash payouts from a project based in the EU aren't available yet.",
+  }),
+  Object.freeze({
+    id: 'young-builders-non-monetary',
+    when: { minors_on_board: { in: [true] } },
+    options: ['reward_intents:cash', 'reward_intents:equity', 'reward_intents:future-payouts'],
+    effect: 'note',
+    reason: 'Builders aged 13 to 15 join non-monetary tracks only. 16 and 17 year olds need a guardian to co-sign paid work.',
+  }),
+  Object.freeze({
+    id: 'managed-includes-every-service',
+    when: { framing: { in: ['managed'] } },
+    options: ['services'],
+    effect: 'hide',
+    reason: 'All managed includes the whole suite, so there is nothing to pick.',
+  }),
+  Object.freeze({
+    id: 'open-source-is-the-free-core',
+    when: { framing: { in: ['open-source'] } },
+    options: ['services'],
+    effect: 'hide',
+    reason: 'Open source, local is the free core on its own. You can add services later.',
+  }),
+  Object.freeze({
+    id: 'company-creation-needs-no-entity-yet',
+    when: { entity: { in: [...ENTITY_FORMS] } },
+    options: ['services:company-creation'],
+    effect: 'hide',
+    reason: 'You already have a legal entity.',
+  }),
+  Object.freeze({
+    id: 'labor-payment-follows-cash',
+    when: { reward_intents: { lacks: 'cash' } },
+    options: ['services:labor-payment'],
+    effect: 'grey',
+    reason: "You aren't considering cash for work, so there is no pay to run.",
+  }),
+  Object.freeze({
+    id: 'public-marketing-on-request',
+    when: {},
+    options: ['services:public-marketing'],
+    effect: 'grey',
+    reason: "A publicly marketed project is on request for now — contact us and we'll talk it through.",
+  }),
+]);
+
+// Does one condition hold against the answers? An absent answer never matches — not
+// even `lacks`, because "never said" is not "said no". PURE.
+function conditionHolds(answers, key, test) {
+  if (!Object.prototype.hasOwnProperty.call(answers, key) || answers[key] === null || answers[key] === undefined) return false;
+  const value = answers[key];
+  if (test.in) return test.in.includes(value);
+  if ('has' in test) return Array.isArray(value) && value.includes(test.has);
+  if ('lacks' in test) return Array.isArray(value) && !value.includes(test.lacks);
+  return false;
+}
+
+// The limits that apply to one project's answers:
+//
+//   { enforced: false, limits: [{ option, effect, reason, rule }] }
+//
+// one entry per (rule, option), in table order — several rules may name one option,
+// and a screen shows the strongest effect with every reason. `answers` is the stored
+// detail (projectDetail(row)), or the in-progress answers of a flow that has not
+// created anything yet. Never throws. PURE — the result is fresh, never the table.
+function softLimitsFor(answers) {
+  const given = answers && typeof answers === 'object' && !Array.isArray(answers) ? answers : {};
+  const limits = [];
+  for (const rule of SOFT_LIMIT_RULES) {
+    if (!Object.entries(rule.when).every(([key, test]) => conditionHolds(given, key, test))) continue;
+    for (const option of rule.options) limits.push({ option, effect: rule.effect, reason: rule.reason, rule: rule.id });
+  }
+  return { enforced: false, limits };
+}
+
+module.exports = { SOFT_LIMIT_RULES, EFFECTS, softLimitsFor };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.26",
+  "version": "1.20.27",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.26",
+      "version": "1.20.27",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.26",
+  "version": "1.20.27",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8216,5 +8216,19 @@
       "id": "1004429",
       "text": "A new project's founding stages are now decided by its own government. When a stage's work is finished, closing the stage goes to the Board Room like any other decision. A solo founder under the default one-leader government c"
     }
+  ],
+  "1.20.27": [
+    {
+      "id": "1004416",
+      "text": "A new project can now store the seven startup answers: new or existing, where everyone is, whether under-18s are building, what the entity is, how many builders, how they'll be rewarded, and how much Bongos should run. A wrong"
+    },
+    {
+      "id": "1004427",
+      "text": "A new project now chooses its government by the real names: Monarchy / BDFL, Timocratic Republic, Direct Democracy or Foundation, with Presidential, Cooperative and Federation shown as coming later. Every form and setting has"
+    },
+    {
+      "id": "1004408",
+      "text": "Old project invitations that led to a locked door are cleared from people's My Projects list."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -208,6 +208,10 @@ const INTEGRATION = new Set([
   // prove the CHECK actually refuses a stored fourth state, that the backfill lands on a
   // pre-migration row, and that publishableSql and projectPublishability agree.
   'project_visibility_db',
+  // task 1004408: migration platform_identity_028 deletes the old hub invite's
+  // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
+  // engine runs the DO block, the numeric version compare and the one-shot guard.
+  'pending_invite_purge_db',
   // task 1003956 (ADR 0294): that CLI sessions really never expire. The DB-free
   // sibling (auth_session_ttl) pins the constant, createSession's value against a
   // stub pool, and the TEXT of the refresh statement — but a regex over source

package/src/bongos/route-rank-check.js

@@ -271,6 +271,9 @@ const GOVERNMENT_PINS = {
   // task 1004429: the founding band — who each genesis stage is waiting on. A
   // read of the open ballot, so the same atom as the room.
   'GET /government/board/genesis-stages': 'perm:board.vote.cast',
+  // task 1004427: the genesis charter + legislation choice — an amendment by
+  // another door, so the same atom as proposing one.
+  'POST /government/board/charter': 'perm:board.item.open',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.26'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.27'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');