@bongos/core 1.21.5 → 1.21.7

package/tests/hub_craft_rollup.mjs

@@ -0,0 +1,350 @@
+// tests/hub_craft_rollup.mjs — task 1004440 (WA6.RP10, goal 1000095, criterion
+// wa6-roles-read-true-in-public): the hub profile shows each craft's own work.
+//
+// The cross-project rollup used to carry one ship count (with no status filter)
+// and "Roles" from the declared preference alone, so on the hub an artist with
+// forty approved pages, or an ideator the board ratified, read as an engineer
+// with nothing shipped. Three halves, each driven through its real code:
+//
+//   1. THE SENDER (core auth-admission.js reportActivityRollup) counts SHIPPED
+//      works only, sends each EARNED craft's counts (the ledger split decides,
+//      as on the local profile), derives `disciplines` from that evidence with
+//      the declared preference as the fallback, and — because the hub validates
+//      the body strictly — re-sends once without `crafts` when an older hub
+//      refuses the field, so the totals are never lost.
+//   2. THE HUB ROUTE + upsertActivity accept `crafts` and bind only the
+//      sanitised shape: three crafts, named counts, integers or null. Nothing a
+//      sender writes can carry text through it.
+//   3. getRollupForBuilder sums each craft over EVERY project row — named or
+//      not, exactly as the totals are (the aggregate is not the leak, the name
+//      is) — and the profile page draws a tile per craft from that sum.
+//
+// DB-free: the hub_recent_ships.mjs / activity_rollup_as_of.mjs idioms (pinned
+// require.cache, stubbed fetch, a recording fake pool).
+//
+// Run:  node tests/hub_craft_rollup.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+function mockPool(answer = () => ({ rows: [] })) {
+  const calls = [];
+  const query = async (text, params = []) => {
+    calls.push({ text: String(text), params });
+    return answer(String(text), params) || { rows: [] };
+  };
+  return {
+    calls, query,
+    connect: async () => ({ query, release: () => {} }),
+    find: (re) => calls.find((c) => re.test(c.text)),
+  };
+}
+const pin = (rel, exports) => {
+  const p = require.resolve(rel);
+  require.cache[p] = { id: p, filename: p, loaded: true, exports };
+};
+
+// ---- 1. the sender ----------------------------------------------------------
+
+console.log('\n1. the instance sends each earned craft, and shipped means shipped:');
+
+const seams = require('../src/module-seams.js');
+
+// One rollup through the real sender. `byCraft` is economy's ledger split for
+// builder 7 (null = no economy module); `ports` the craft stats; `statuses` the
+// HTTP status each successive send answers.
+async function sendRollup({ byCraft = null, preferred = ['engineer'], ports = {}, statuses = [200] } = {}) {
+  seams._reset();
+  if (byCraft) {
+    seams.registerProvider('reward', {
+      creditsByCraft: async (ids) => new Map(ids.map((id) => [String(id), byCraft])),
+      craftForPreference: (d) => (d === 'ui' ? 'artist' : ['engineer', 'artist', 'ideator'].includes(d) ? d : null),
+    });
+  }
+  for (const [k, fn] of Object.entries(ports)) seams.registerProvider(k, fn);
+  const senderPool = mockPool((sql) => {
+    if (/FROM builders WHERE id/.test(sql)) {
+      return { rows: [{ github_id: 42, total_credits: 900, karma: 2, rank: 'thetes', preferred_disciplines: preferred }] };
+    }
+    if (/count\(\*\)/.test(sql)) return { rows: [{ n: 5 }] };
+    return { rows: [] };
+  });
+  pin('../src/bongos/pool.js', { pool: senderPool });
+  pin('../src/bongos/auth-config.js', {
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'c1', clientSecret: 's' }),
+  });
+  delete require.cache[require.resolve('../src/bongos/auth-admission.js')];
+  const { reportActivityRollup } = require('../src/bongos/auth-admission.js');
+  const sent = [];
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async (url, opts) => {
+    sent.push(JSON.parse(opts.body));
+    const status = statuses[Math.min(sent.length - 1, statuses.length - 1)];
+    return { ok: status < 300, status, json: async () => ({}) };
+  };
+  try { await reportActivityRollup({ builderId: 7 }); } finally { globalThis.fetch = realFetch; seams._reset(); }
+  return { sent, senderPool };
+}
+
+const ARTIST_STATS = async () => ({ pages_approved: 42, pages: 30, surfaces_touched: 3, credits: 1100, this_week: 12, surfaces: [{ label: 'Landing', line: 'secret wording' }] });
+const IDEATOR_STATS = async () => ({ filed: 12, ignited: 4, full_ideas: 2, ratified: 1, size: { total: 9 }, alive: { share: 0.5 } });
+
+await t('the ship count asks for SHIPPED works only (the missing status filter)', async () => {
+  const { senderPool } = await sendRollup();
+  const q = senderPool.find(/count\(\*\)/);
+  assert.ok(q, 'the ship count ran');
+  assert.match(q.text, /shipped_by = \$1/);
+  assert.match(q.text, /status = 'shipped'/, 'a count without the status filter also counts work handed back after shipping');
+});
+
+await t('an artist who is also an ideator sends both crafts\' counts, and only counts', async () => {
+  const { sent } = await sendRollup({
+    byCraft: { engineer: 0, artist: 1100, ideator: 160, other: 0, total: 1260 },
+    preferred: ['ui'],
+    ports: { 'copy-desk.artistStats': ARTIST_STATS, 'ideas.ideatorStats': IDEATOR_STATS },
+  });
+  assert.equal(sent.length, 1);
+  const body = sent[0];
+  assert.deepEqual(body.crafts, {
+    artist: { pages_approved: 42, credits: 1100 },
+    ideator: { filed: 12, full_ideas: 2, ratified: 1, credits: 160 },
+  }, 'exactly the named counts — no surface line, no size, no wording');
+  assert.ok(!JSON.stringify(body).includes('secret wording'), 'no page wording leaves the instance');
+  assert.deepEqual(body.disciplines, ['artist', 'ideator'], 'crafts from evidence of work, in preferred order (ui → artist)');
+  assert.equal(body.tasks_shipped, 5, 'CONTROL: the totals still ride');
+});
+
+await t('an unearned craft sends nothing, and its stats port is never asked', async () => {
+  let asked = 0;
+  const { sent } = await sendRollup({
+    byCraft: { engineer: 900, artist: 0, ideator: 0, other: 0, total: 900 },
+    preferred: ['artist', 'engineer'],
+    ports: { 'copy-desk.artistStats': async () => { asked++; return {}; } },
+  });
+  assert.deepEqual(sent[0].crafts, { engineer: { shipped: 5, credits: 900 } });
+  assert.deepEqual(sent[0].disciplines, ['engineer'], 'a declared but unearned role is not shown once work exists elsewhere');
+  assert.equal(asked, 0, 'a craft that will not be sent is not read');
+});
+
+await t('nothing earned, or no economy to ask → the declared preference, and no crafts field', async () => {
+  const none = await sendRollup({ byCraft: { engineer: 0, artist: 0, ideator: 0, other: 0, total: 0 }, preferred: ['ideator'] });
+  assert.deepEqual(none.sent[0].disciplines, ['ideator'], 'the fallback is the preference');
+  assert.ok(!('crafts' in none.sent[0]), 'no crafts field, so an older hub never sees one');
+  const vanilla = await sendRollup({ byCraft: null, preferred: ['engineer', 'ui'] });
+  assert.deepEqual(vanilla.sent[0].disciplines, ['engineer', 'ui']);
+  assert.ok(!('crafts' in vanilla.sent[0]));
+});
+
+await t('a craft whose port cannot be asked sends null counts, never 0', async () => {
+  const { sent } = await sendRollup({ byCraft: { engineer: 0, artist: 50, ideator: 0, other: 0, total: 50 }, preferred: [] });
+  assert.deepEqual(sent[0].crafts, { artist: { pages_approved: null, credits: 50 } });
+});
+
+await t('an older hub refusing `crafts` (400) gets the report again without it — once', async () => {
+  const { sent } = await sendRollup({
+    byCraft: { engineer: 0, artist: 1100, ideator: 0, other: 0, total: 1100 },
+    ports: { 'copy-desk.artistStats': ARTIST_STATS },
+    statuses: [400, 200],
+  });
+  assert.equal(sent.length, 2, 'one retry');
+  assert.ok('crafts' in sent[0]);
+  assert.ok(!('crafts' in sent[1]), 'the retry drops only the new field');
+  assert.equal(sent[1].tasks_shipped, 5, 'the totals still land');
+  assert.deepEqual(sent[1].disciplines, ['artist'], 'the evidence-derived crafts ride the retry too');
+});
+
+await t('a 400 on a report WITHOUT crafts is not retried (nothing to drop)', async () => {
+  const { sent } = await sendRollup({ statuses: [400] });
+  assert.equal(sent.length, 1);
+});
+
+// ---- 2. the hub route + upsert ---------------------------------------------
+
+console.log('\n2. the hub accepts crafts and binds only the sanitised shape:');
+
+const SECRET = 'craft-secret';
+function hubRoute() {
+  const pi = require('../modules/platform-identity/platform-identity.js');
+  const rollupPool = mockPool((sql) => {
+    if (/FROM platform_identity_sso_clients/.test(sql)) {
+      return { rows: [{ client_id: 'c1', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: 'https://p.example' }] };
+    }
+    if (/FROM platform_identity_project_memberships/.test(sql)) {
+      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member', signin_verified_at: '2026-08-29T00:00:00.000Z' }] };
+    }
+    return { rows: [{ id: 1 }] };
+  });
+  const helpers = require('../src/bongos/routes/_helpers.js');
+  const realApi = require('../src/module-api.js');
+  pin('../src/module-api.js', {
+    pool: rollupPool,
+    validateOrRespond: helpers.validateOrRespond,
+    resolveSession: async () => null,
+    logger: () => ({ info() {}, warn() {}, error() {} }),
+    LIVE_RANK_LADDER: realApi.LIVE_RANK_LADDER,
+    withTx: realApi.withTx,
+    corsPublicGet: () => (_q, _s, next) => next(),
+    on: () => () => {},
+    hasProvider: () => false,
+    registerProvider: () => {},
+  });
+  delete require.cache[require.resolve('../modules/platform-identity/routes/sso.js')];
+  const router = require('../modules/platform-identity/routes/sso.js')();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/sso/activity/rollup');
+  return { handle: layer.route.stack[0].handle, rollupPool };
+}
+async function postRollup(extra) {
+  const { handle, rollupPool } = hubRoute();
+  const res = { body: null, failure: null };
+  res.json = (b) => { res.body = b; return res; };
+  res.fail = (code, ...rest) => { res.failure = { code, rest }; return res; };
+  const req = {
+    get: () => undefined,
+    body: { client_id: 'c1', client_secret: SECRET, github_id: 42, credits: 10, tasks_shipped: 2, karma: 1, ...extra },
+  };
+  await handle(req, res, () => {});
+  const insert = rollupPool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  return { res, insert };
+}
+
+await t('a report carrying crafts is accepted and binds the craft counts', async () => {
+  const { res, insert } = await postRollup({ crafts: { artist: { pages_approved: 42, credits: 1100 } } });
+  assert.equal(res.failure, null, JSON.stringify(res.failure));
+  assert.match(insert.text, /reported_as_of, crafts\)/, 'the upsert writes the crafts column');
+  assert.match(insert.text, /crafts = EXCLUDED\.crafts/, 'and a later report replaces it');
+  assert.deepEqual(JSON.parse(insert.params[9]), { artist: { pages_approved: 42, credits: 1100 } });
+});
+
+await t('the hub keeps only the three crafts and their named integer counts', async () => {
+  const { insert } = await postRollup({
+    crafts: {
+      artist: { pages_approved: 'forty', credits: -3, title: '<script>' },
+      ideator: { filed: 1.5, full_ideas: 99_000_000, ratified: 2, credits: 7, idea_title: 'A secret plan' },
+      governor: { laws: 4 },
+      engineer: 'lots',
+    },
+  });
+  const bound = JSON.parse(insert.params[9]);
+  assert.deepEqual(bound, {
+    artist: { pages_approved: null, credits: null },
+    ideator: { filed: null, full_ideas: null, ratified: 2, credits: 7 },
+  });
+  assert.ok(!insert.params[9].includes('secret') && !insert.params[9].includes('script'), 'no text survives');
+});
+
+await t('a report with no crafts (an older instance) binds the empty object', async () => {
+  const { res, insert } = await postRollup({});
+  assert.deepEqual(res.body, { ok: true });
+  assert.equal(insert.params[9], '{}');
+});
+
+await t('CONTROL: the body is still strict — an unknown field is refused', async () => {
+  const { res } = await postRollup({ rolez: {} });
+  assert.ok(res.failure, 'a strict body is what makes the sender\'s retry necessary');
+});
+
+// ---- 3. the aggregate + the page ----------------------------------------------
+
+console.log('\n3. the profile sums each craft over every project, and draws it:');
+
+await t('getRollupForBuilder sums each craft over EVERY project row, named or not', async () => {
+  // pin the doorway back to something with a pool the domain can take.
+  const pi = require('../modules/platform-identity/platform-identity.js');
+  const pool = mockPool((sql) => {
+    if (/WITH agg AS/.test(sql)) {
+      return { rows: [{ projects: 2, credits: 1300, works_shipped: 44, karma: 3, last_active: null, disciplines: ['artist'] }] };
+    }
+    if (/recent_ships/.test(sql)) {
+      return { rows: [
+        { name: 'Pub', origin: 'https://pub.example', rank_held: 'metic', recent_ships: [], is_public: true,
+          crafts: { artist: { pages_approved: 40, credits: 1000 } } },
+        { name: 'Hidden', origin: 'https://priv.example', rank_held: 'xenos', recent_ships: [], is_public: false,
+          crafts: { artist: { pages_approved: 2, credits: null }, ideator: { filed: 5, full_ideas: 1, ratified: null, credits: 60 } } },
+        { name: 'Old', origin: 'https://old.example', rank_held: null, recent_ships: [], is_public: true, crafts: {} },
+      ] };
+    }
+    return { rows: [] };
+  });
+  const r = await pi.getRollupForBuilder(42, { pool });
+  assert.match(pool.find(/recent_ships/).text, /a\.crafts/, 'the per-project read carries crafts');
+  assert.deepEqual(r.crafts, {
+    artist: { pages_approved: 42, credits: 1000 },
+    ideator: { filed: 5, full_ideas: 1, ratified: null, credits: 60 },
+  }, 'a private project is counted, as its totals are; a count nobody reported stays null');
+  assert.deepEqual(r.projects.map((p) => p.name), ['Pub', 'Old'], 'CONTROL: the private project is still not NAMED');
+  assert.ok(!JSON.stringify(r.projects).includes('pages_approved'), 'per-project numbers never cross, only the sum');
+});
+
+// The page: the real profile.js in the tests/profile_ui_cross_project.mjs stub.
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile.js'), 'utf8');
+const ROLES_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile-roles.js'), 'utf8');
+async function renderXp(crossProject) {
+  const els = new Map();
+  const makeEl = () => ({ hidden: false, textContent: '', _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } });
+  const $ = (sel) => { if (!els.has(sel)) els.set(sel, makeEl()); return els.get(sel); };
+  const escapeHtml = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  const profile = {
+    builder: { id: 7, github_login: 'b7', display_name: 'Builder 7', rank: 'thetes', total_credits: 1, karma: 0, created_at: '2026-01-01T00:00:00.000Z', preferred_disciplines: [] },
+    shipped_count: 0, recent_ships: [], achievements: [], cross_project: crossProject,
+  };
+  const api = { async request(_m, url) {
+    if (url === '/api/bongos/me') return { status: 200, ok: true, data: { builder: { id: 99 } } };
+    if (/\/builders\/[^/]+\/profile$/.test(url)) return { status: 200, ok: true, data: profile };
+    return { status: 404, ok: false, data: null };
+  } };
+  const sandbox = { location: { search: '?id=7' }, URLSearchParams, console, window: {
+    __BRANDING__: {}, BongosClient: { createClient: () => api },
+    OTB: { roleAxisLabel: () => 'Role', roleLabel: (d) => d.charAt(0).toUpperCase() + d.slice(1), roleOptions: () => [], roleIsUnset: (d) => !d,
+      ROLE_UNSET: 'unclassified', $, escapeHtml, fmtNum: (n) => String(Number(n) || 0), fmtDate: (d) => String(d).slice(0, 10), rankLabel: (r) => r, toast() {} },
+  } };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(ROLES_SRC, sandbox, { filename: 'profile-roles.js' });
+  vm.runInContext(SRC, sandbox, { filename: 'profile.js' });
+  for (let i = 0; i < 4; i++) await new Promise((r) => setImmediate(r));
+  return $('#xp-body').innerHTML;
+}
+const CP = (crafts) => ({ totals: { projects: 1, credits: 10, works_shipped: 0, karma: 0 }, disciplines: [], crafts, last_active: null, projects: [], more_projects: 0 });
+const tileOf = (html, label) => {
+  const m = html.match(new RegExp(`${label}</span>\\s*<span class="stat-tile__num">([^<]*)</span>`));
+  return m ? m[1] : null;
+};
+
+await t('an artist\'s and an ideator\'s tiles show their own craft\'s numbers', async () => {
+  const html = await renderXp(CP({ artist: { pages_approved: 42, credits: 1100 }, ideator: { filed: 12, full_ideas: 2, ratified: 1, credits: 160 } }));
+  assert.equal(tileOf(html, 'Pages approved'), '42');
+  assert.equal(tileOf(html, 'Thoughts filed'), '12');
+  assert.equal(tileOf(html, 'Full Ideas'), '2');
+  assert.match(html, /1 ratified by the board/);
+  assert.match(html, /stat-row--craft/);
+  assert.equal(tileOf(html, 'Works shipped'), '0', 'CONTROL: the totals band is unchanged');
+});
+
+await t('a count no project could report is a dash, never 0', async () => {
+  const html = await renderXp(CP({ artist: { pages_approved: null, credits: 50 } }));
+  assert.equal(tileOf(html, 'Pages approved'), '—');
+});
+
+await t('no crafts (an engineer, or an older hub) → no craft band at all', async () => {
+  for (const crafts of [undefined, {}, { engineer: { shipped: 3, credits: 9 } }]) {
+    const html = await renderXp(CP(crafts));
+    assert.ok(!html.includes('stat-row--craft'), `no craft band for ${JSON.stringify(crafts)}`);
+    assert.equal((html.match(/stat-tile__num/g) || []).length, 4);
+  }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/profile_rollup_consent.mjs

@@ -102,6 +102,8 @@ try {
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
   // upsertActivity also writes reported_as_of (026, task 1004268): 42703 without it.
   await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
+  // ...and crafts (029, task 1004440), which getRollupForBuilder also reads.
+  await q(migrationSql('platform_identity_029_activity_crafts.sql'));
   await cleanup();
 
   // CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state='active' AND

package/tests/profile_route.mjs

@@ -108,13 +108,22 @@ function stubPublicProfileExtras() {
   return {
     totals: { projects: 2, credits: 150, works_shipped: 7, karma: 4 },
     disciplines: ['engineer', 'ui'],
+    crafts: { artist: { pages_approved: 3, credits: 40 } },
     last_active: '2026-08-01T00:00:00.000Z',
     projects: named,
     more_projects: CROSS_PROJECT_ROWS.length - named.length,
   };
 }
 // The key contract for the cross_project object + its project rows.
-const CP_PUBLIC_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+// crafts (task 1004440) is each craft's summed counts — always present, {} when
+// no project reported any — so it belongs in the exact list too.
+const CP_PUBLIC_KEYS = ['totals', 'disciplines', 'crafts', 'last_active', 'projects', 'more_projects'];
+// The only shape crafts may take: the three crafts, each a block of counts.
+const CP_ROLE_FIELDS = {
+  engineer: ['credits', 'shipped'],
+  artist: ['credits', 'pages_approved'],
+  ideator: ['credits', 'filed', 'full_ideas', 'ratified'],
+};
 // recent_ships rides the project row (task 1002803) and is ALWAYS present —
 // getRollupForBuilder defaults it to [] — so it belongs in the exact key list.
 const CP_PROJECT_ROW_KEYS = ['name', 'origin', 'rank_held', 'recent_ships'];
@@ -129,6 +138,11 @@ const CP_SENTINELS = [SECRET_CLIENT_ID, SECRET_PROJECT_NAME, SECRET_EMAIL, SECRE
 function assertCrossProjectContract(cp, text) {
   assert.deepEqual(Object.keys(cp).sort(), [...CP_PUBLIC_KEYS].sort(), 'cross_project keys are exactly the contract');
   assert.deepEqual(Object.keys(cp.totals).sort(), ['credits', 'karma', 'projects', 'works_shipped']);
+  for (const [craft, block] of Object.entries(cp.crafts)) {
+    assert.ok(CP_ROLE_FIELDS[craft], `crafts carries only the three crafts — found "${craft}"`);
+    assert.deepEqual(Object.keys(block).sort(), CP_ROLE_FIELDS[craft], `${craft} carries only its named counts`);
+    for (const v of Object.values(block)) assert.ok(v === null || Number.isInteger(v), 'a craft count is a number or null, never text');
+  }
   for (const row of cp.projects) {
     assert.deepEqual(Object.keys(row).sort(), [...CP_PROJECT_ROW_KEYS].sort(), 'project rows carry only the whitelisted keys');
   }
@@ -619,7 +633,7 @@ await t('R06.5 no PARTIAL numbers survive the hide (a count beside a hidden tota
   await pi.setAccountHideStats({ githubId: HUB_GITHUB_ID, githubLogin: 'jaxri', hide: true }, { pool: engine });
   const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.json.cross_project, null);
-  for (const key of ['totals', 'works_shipped', 'more_projects', 'last_active', 'rank_held']) {
+  for (const key of ['totals', 'works_shipped', 'more_projects', 'last_active', 'rank_held', 'pages_approved']) {
     assert.ok(!r.text.includes(key), `nothing derived from the rollup may survive — found "${key}"`);
   }
   const digits = [sumOf('credits'), sumOf('tasks_shipped'), sumOf('karma'),

package/tests/project_invite_ui.mjs

@@ -474,11 +474,69 @@ test('the two mounts keep their own lines — an invite on one is not drawn on t
 // in" and "is this their project" — are answered by the caller, which hands over
 // a slug or nothing. So the pins are on the calls.
 
-test('the wizard opens the step only for a signed-in owner of a project that already exists', () => {
-  assert.match(SCRIPT, /setInviteSlug\('wizInvite', \(me && created && created\.id && created\.slug\) \? created\.slug : ''\);/,
-    'the created record IS the proof: no /me, no created id, no slug ⇒ no step');
-  assert.ok(SCRIPT.indexOf("setInviteSlug('wizInvite'") > SCRIPT.indexOf('function renderDone()'),
-    'and it is the done panel that opens it — the panel that only exists after Create');
+// The wizard's invite step waits for the hall (task 1004503): a second account cannot join a
+// project whose hall is not up, so the box opens only on the done panel's verified Live. The
+// gate is RUN here: demoTeam, paintInviteGate and paintDemoTeam sliced out of the script.
+const GATE_START = '    function demoTeam() {';
+function gateSlice() {
+  const a = SCRIPT.indexOf(GATE_START);
+  const b = SCRIPT.indexOf('\n    }\n', SCRIPT.indexOf('    function paintDemoTeam() {'));
+  return a > -1 && b > a ? SCRIPT.slice(a, b + 6) : '';
+}
+function bootGate({ me = { github_login: 'kestrel' }, created = { id: 7, slug: 'moonbase' }, demo = null } = {}) {
+  const els = {};
+  const $ = (id) => (els[id] = els[id] || { id, hidden: false, textContent: '', innerHTML: '', value: '' });
+  const calls = { slug: [], sugg: [] };
+  const sandbox = {
+    $, me, state: { demo },
+    createdRecord: () => created,
+    setInviteSlug: (id, slug) => calls.slug.push([id, slug]),
+    loadInviteSuggestions: (id, iid) => calls.sugg.push([id, iid]),
+    projectPageLink: (label) => '<a href="?view=manage">' + label + '</a>',
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(gateSlice(), sandbox);
+  return { run: (c) => vm.runInContext(c, sandbox), $, calls };
+}
+
+test('the wizard opens the invite step only once the hall is up, and only for a signed-in owner of a project that exists (tasks 1002346, 1004503)', () => {
+  assert.ok(gateSlice().includes('function paintInviteGate(live)'), 'the gate slice is found');
+  assert.match(SCRIPT, /function renderDone\(\) \{[\s\S]*?paintInviteGate\(false\);/, 'the done panel paints the gate shut');
+  assert.match(SCRIPT, /if \(inst\.last_verified_up\) \{[\s\S]{0,400}paintInviteGate\(true\);/, 'and opens it only on the verified Live');
+  assert.equal((SCRIPT.match(/setInviteSlug\('wizInvite'/g) || []).length, 2, 'the gate is the only caller: shut, or open on Live');
+
+  const before = bootGate();
+  before.run('paintInviteGate(false)');
+  assert.deepEqual(before.calls.slug, [['wizInvite', '']], 'before the hall is up: no invite control');
+  assert.deepEqual(before.calls.sugg, [], 'and no suggestions asked for');
+  assert.equal(before.$('wizInviteLater').textContent, 'You can invite builders once its hall is up.', 'one plain line says when');
+
+  const live = bootGate();
+  live.run('paintInviteGate(true)');
+  live.run('paintInviteGate(true)');
+  assert.deepEqual(live.calls.slug, [['wizInvite', 'moonbase']], 'on Live: the box opens on the created project, once');
+  assert.deepEqual(live.calls.sugg, [['wizInvite', 7]], 'and the suggestions are asked for once, not on every tick');
+  assert.match(live.$('wizInviteLater').innerHTML, /any time from <a href="\?view=manage">the project’s own page<\/a>/);
+
+  for (const [label, opts] of [['signed out', { me: null }], ['no created id', { created: { slug: 'moonbase' } }], ['no slug', { created: { id: 7 } }]]) {
+    const g = bootGate(opts);
+    g.run('paintInviteGate(true)');
+    assert.deepEqual(g.calls.slug, [['wizInvite', '']], label + ': the created record IS the proof — no step');
+  }
+});
+
+test('a demo\'s teammates are kept until the hall is up, then offered in the box (task 1004503)', () => {
+  const before = bootGate({ demo: { invites: ['ava', 'jo'] } });
+  before.run('paintInviteGate(false)');
+  assert.equal(before.$('wizInviteLater').textContent, 'You can invite @ava, @jo once its hall is up.', 'named while they wait');
+  assert.equal(before.$('wizDemoTeam').hidden, true, 'no invite prompt before the hall is up');
+  // a reload before the hall is up: the draft is gone, the created record still carries the names
+  const reloaded = bootGate({ created: { id: 7, slug: 'moonbase', demo_invites: ['ava'] } });
+  reloaded.run('paintInviteGate(true)');
+  assert.equal(reloaded.$('wizDemoTeam').hidden, false, 'on Live the teammates line shows');
+  assert.equal(reloaded.$('wizDemoTeam').textContent, 'Your demo teammates: @ava. Invite each one here.');
+  assert.equal(reloaded.$('wizInviteWho').value, 'ava', 'and the first is ready in the box');
+  assert.match(SCRIPT, /demo_invites: state\.demo && state\.demo\.invites && state\.demo\.invites\.length \? state\.demo\.invites\.slice\(\) : undefined/, 'the created record carries them');
 });
 
 test('the project page opens the step from its own manage read, which the API already own-scopes', () => {
@@ -643,8 +701,8 @@ test('a suggestion never renders a github_id, and its name goes through the esca
 test('the suggestion surface is mounted on BOTH the wizard and the project page', () => {
   assert.match(HUB, /<ul class="suggList" id="wizInviteSugg"><\/ul>/, 'the wizard mount');
   assert.match(HUB, /<ul class="suggList" id="mInviteSugg"><\/ul>/, 'and the project page mount');
-  assert.match(SCRIPT, /loadInviteSuggestions\('wizInvite', \(me && created && created\.slug\) \? created\.id : ''\)/,
-    'the wizard asks keyed on the SAME created record the slug comes from (ADR 0249 §1)');
+  assert.match(SCRIPT, /setInviteSlug\('wizInvite', created\.slug\);\n\s*paintDemoTeam\(\);\n\s*loadInviteSuggestions\('wizInvite', created\.id\);/,
+    'the wizard asks keyed on the SAME created record the slug comes from (ADR 0249 §1), and only once the gate opens (task 1004503)');
   assert.match(SCRIPT, /loadInviteSuggestions\('mInvite', inst\.slug \? inst\.id : ''\)/,
     'and the manage page asks with the id whose read already proved ownership');
   assert.match(COSMOS, /\.suggList\{/, 'styled in cosmos.css like its sibling list');

package/tests/projects_hub_dns_ready.mjs

@@ -48,9 +48,12 @@ function boot() {
   const liveProgress = { innerHTML: '' };
   // the done panel's heading (task 1004504): "Setting up <name>" until the project answers
   const doneH = { textContent: 'Setting up Lantern' };
+  // the invite step's gate (task 1004503): renderProgress opens it only on a verified answer
+  const gates = [];
   const sandbox = {
     $: (id) => (id === 'liveProgress' ? liveProgress : id === 'done-h' ? doneH : null),
     state: { name: 'Lantern', slug: 'lantern' },
+    paintInviteGate: (live) => gates.push(live),
     esc: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
       { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
     projectPageLink: (label) => '<a href="?view=manage&id=1">' + label + '</a>',
@@ -64,7 +67,7 @@ function boot() {
   };
   vm.createContext(sandbox);
   vm.runInContext(PROGRESS + '\n' + OVERLAY + '\n' + ADDRESS + '\n' + ORB, sandbox);
-  return { sandbox, progress: () => liveProgress.innerHTML, heading: () => doneH.textContent };
+  return { sandbox, progress: () => liveProgress.innerHTML, heading: () => doneH.textContent, gates };
 }
 
 const NOW = () => new Date().toISOString();
@@ -93,13 +96,16 @@ test('once the lookup answers, the done panel links the address', () => {
   assert.equal(terminal, false, 'resolving is not yet answering — the panel still waits for the probe');
   assert.match(h.progress(), ADDRESS_LINK);
   assert.equal(h.heading(), 'Setting up Lantern', 'and the heading claims nothing yet (task 1004504)');
+  assert.deepEqual(h.gates, [], 'and the invite box stays shut: the hall has not answered (task 1004503)');
   const live = boot();
   assert.equal(live.sandbox.renderProgress({ ...base, dns_resolves: true, last_verified_up: true, last_verified_at: NOW() }), true);
   assert.match(live.progress(), ADDRESS_LINK);
   assert.equal(live.heading(), 'Lantern is alive.', 'the alive moment, only on a verified answer');
+  assert.deepEqual(live.gates, [true], 'and the invite box opens with it (task 1004503)');
   const down = boot();
   down.sandbox.renderProgress({ ...base, dns_resolves: true, last_verified_up: false, last_verified_at: NOW() });
   assert.equal(down.heading(), 'Setting up Lantern', 'a down probe is never "alive"');
+  assert.deepEqual(down.gates, [], 'nor opens the invite box');
 });
 
 test('the card and the manage page: no link and no name before the lookup answers, in every pre-live state', () => {

package/tests/provision.mjs

@@ -1074,6 +1074,84 @@ await ta('scaffoldStandaloneRepo: a REGISTRY-pinned consumer control plane PACKS
   }
 });
 
+// ── new projects start on the RELEASED core, not the hall's candidate (task 1004299) ──
+// ADR 0361: merges publish as candidates and the platform hall runs them, so the core
+// this hall runs is routinely AHEAD of the registry's `latest` label. A new project —
+// and the pin refresh that runs in the same provisioning pass — must get the release.
+t('projectCoreDecision: the hall ahead of the release → the release; level or unreadable → the running core', () => {
+  assert.deepEqual(
+    (({ version, source }) => ({ version, source }))(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50' })),
+    { version: '1.19.50', source: 'released' });
+  assert.equal(RP.projectCoreDecision({ running: '1.19.50', released: '1.19.50' }).source, 'running', 'level → byte-exact running core, no registry pack');
+  assert.equal(RP.projectCoreDecision({ running: '1.19.40', released: '1.19.50' }).version, '1.19.40', 'never moves a project PAST what the hall has run');
+  assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: null }).version, '1.19.60', 'no label → fail-open to the running core');
+  assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50-rc.1' }).source, 'running', 'a prerelease label is not a release');
+  assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50;touch /tmp/x' }).source, 'running', 'a non-semver label never reaches a shell');
+});
+
+// A registry-installed control plane at 1.19.60 whose registry says `latest` = 1.19.50.
+function candidateHall({ latest }) {
+  const cp = mkdtempSync(join(tmpdir(), 'cpdir-cand-'));
+  mkdirSync(join(cp, 'node_modules', '@bongos', 'core'), { recursive: true });
+  writeFileSync(join(cp, 'node_modules', '@bongos', 'core', 'package.json'), JSON.stringify({ name: '@bongos/core', version: '1.19.60' }));
+  writeFileSync(join(cp, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': '1.19.60' } }));
+  const { deps, cmds } = recorder({ apply: true });
+  const exec = (cmd, o) => { cmds.push(cmd); return /^npm view @bongos\/core dist-tags\.latest$/.test(cmd) ? { ok: true, stdout: `${latest}\n` } : { ok: true, stdout: '' }; };
+  return { cp, cmds, deps: { ...deps, exec, instanceRoot: cp } };
+}
+
+await ta('scaffoldStandaloneRepo: a hall running an UNRELEASED candidate births the project on the released core (task 1004299)', async () => {
+  const { cp, cmds, deps } = candidateHall({ latest: '1.19.50' });
+  const base = mkdtempSync(join(tmpdir(), 'cpdir-standalone-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    await P.scaffoldStandaloneRepo({ slug: 'demo', hosting_shape: 'cloud-host', target_ref: 'example-owner/demo' }, deps);
+    const joined = cmds.join('\n');
+    assert.match(joined, /npm pack @bongos\/core@1\.19\.50 --pack-destination /, 'packs the RELEASED version from the registry');
+    assert.match(joined, /--vendor-core \S*bongos-core-1\.19\.50\.tgz/, 'the child is pinned to the release');
+    assert.ok(!/1\.19\.60\.tgz|bongos-core-pack-1\.19\.60/.test(joined), 'the candidate the hall runs is never vended');
+    assert.match(joined, /on a pinned @bongos\/core 1\.19\.50 /, 'the scaffold commit names the version it really pinned');
+    assert.ok(joined.indexOf('rm -rf') > joined.indexOf('--vendor-core'), 'the temp pack dir is cleaned after init');
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    [cp, base].forEach((d) => rmSync(d, { recursive: true, force: true }));
+  }
+});
+
+await ta('scaffoldStandaloneRepo: a hall running the release itself keeps the byte-exact running core (task 1004299)', async () => {
+  const { cp, cmds, deps } = candidateHall({ latest: '1.19.60' });
+  const base = mkdtempSync(join(tmpdir(), 'cpdir-standalone-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    await P.scaffoldStandaloneRepo({ slug: 'demo', hosting_shape: 'cloud-host', target_ref: 'example-owner/demo' }, deps);
+    const joined = cmds.join('\n');
+    assert.ok(!/npm pack @bongos\/core@/.test(joined), 'no registry pack when nothing is unreleased');
+    assert.match(joined, /--vendor-core \S*bongos-core-1\.19\.60\.tgz/);
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    [cp, base].forEach((d) => rmSync(d, { recursive: true, force: true }));
+  }
+});
+
+await ta('refreshStandaloneCorePin: a project pinned to the release is NOT bumped to the hall\'s candidate in the same run (task 1004299)', async () => {
+  const { cp, cmds, deps } = candidateHall({ latest: '1.19.50' });
+  const base = mkdtempSync(join(tmpdir(), 'cpdir-standalone-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    mkdirSync(join(base, 'demo'));
+    writeFileSync(join(base, 'demo', 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': 'file:vendor/bongos-core-1.19.50.tgz' } }));
+    const res = await P.refreshStandaloneCorePin({ slug: 'demo', hosting_shape: 'cloud-host', target_ref: 'example-owner/demo' }, deps);
+    assert.equal(res.action, 'current', 'the released pin is already the core this project is given');
+    assert.ok(!cmds.some((c) => /npm pack/.test(c)), 'nothing is packed or re-vendored');
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    [cp, base].forEach((d) => rmSync(d, { recursive: true, force: true }));
+  }
+});
+
 // ── scaffold push via the owner OAuth token (task 1002317) ────────────────────────
 // Deploy keys are per-repo; a shared key can't write to a NEW project repo. Push with the
 // owner's token (which created the repo) instead — WITHOUT leaking it into a logged command.