Merge pull request '§22 Plan B write path (propose): project-scoped propose (v0.38.0)' (#16) from feat/m3-planb-write into main

A new entry can be proposed into a specific project; it lands in that project's
content repo and shows under that project's proposals. A non-default project is
no longer read-only.

- api.py: POST /api/projects/{pid}/rfcs/propose (propose body extracted into a
  project-parameterized helper; unscoped /api/rfcs/propose kept as default
  compat). Slug uniqueness, idea-PR reservation, landing state, and the
  proposed_use_cases row scoped to the target project. GET
  /api/projects/{pid}/proposals.
- cache.py: refresh_meta_pulls loops every project's content_repo, stamping
  cached_prs.project_id; projects.content_repo(pid) helper.
- frontend: proposeRFC(projectId,…)/listProposals(projectId); ProposeModal
  takes projectId; App resolves current project from the /p/<id>/ URL; Catalog
  lists that project's proposals.
- tests: test_project_scoped_propose.py (lands scoped + gated 404). 447 backend
  + 11 Vitest green; clean build.

Known limitation: branch/PR/graduation edit flows + default-id re-stamp not yet
scoped (next slice). Per docs/superpowers/specs/2026-06-04-m3-backend-planb-design.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -23,6 +23,81 @@ skip versions are the composition of each intervening adjacent
 release's steps in order — no A-to-B path is pre-computed beyond
 that.
 
+## 0.38.0 — 2026-06-04
+
+**Minor — §22 M3-backend Plan B (write path, propose): a new entry can be
+proposed *into a specific project*, landing in that project's content repo and
+surfacing under that project's proposals. A non-default project is no longer
+read-only. No upgrade steps; single-project deployments are unaffected.**
+
+Added:
+
+- **`POST /api/projects/{pid}/rfcs/propose`** — propose into a chosen project
+  (read-gated, then project-level contribute-gated, §22.6/§22.7). The propose
+  body is now a project-parameterized helper; the unscoped `/api/rfcs/propose`
+  stays as the default-project compat path. Slug uniqueness, the idea-PR
+  reservation, the landing state (§22.4b), and the `proposed_use_cases` row are
+  all scoped to the target project.
+- **`GET /api/projects/{pid}/proposals`** — pending idea-PRs scoped to one
+  project.
+- **Per-project PR mirror** (`app/cache.py`): `refresh_meta_pulls` iterates
+  every project's `content_repo`, stamping `cached_prs.project_id` (was: the
+  default project only). `projects.content_repo(pid)` helper added.
+- **Tests:** `test_project_scoped_propose.py` — propose into a second project
+  lands in its content repo + shows only under its proposals (not the
+  default's); gated-project propose 404s a non-member. 447 backend green.
+
+Changed:
+
+- **Frontend:** `api.proposeRFC(projectId, …)` / `listProposals(projectId)`;
+  `ProposeModal` takes a `projectId`; `App` resolves the current project from
+  the `/p/<id>/` URL so the propose modal targets it; `Catalog` lists that
+  project's proposals.
+
+Known limitation (next slice): the **edit** write flows — branch / PR /
+graduation — and the **default-project-id re-stamp** (§22.13 step 1) are not
+yet project-scoped (they still target the default project's content repo). Per
+`docs/superpowers/specs/2026-06-04-m3-backend-planb-design.md` §1 + §3.
+
+## 0.37.0 — 2026-06-04
+
+**Minor — §22 M3-backend Plan B (2/2, read path): per-project RFC serving. A
+second project's corpus now renders under `/p/<id>/`, isolated by its own slug
+namespace. No upgrade steps; single-project deployments are unaffected.**
+
+This is the slice that makes "multiple projects" *observable*: M3-frontend
+(v0.35.0) shipped the shell with a "not served" guard for any non-default
+project; v0.36.0 rebuilt the keys so project #2 can exist; this serves project
+#2's corpus.
+
+Added:
+
+- **Per-project read endpoints** (`app/api.py`): `GET /api/projects/{pid}/rfcs`
+  (catalog scoped to one project) and `GET /api/projects/{pid}/rfcs/{slug}`
+  (entry by `(project_id, slug)`), both behind the §22.5 read gate
+  (gated project 404s a non-member). The unscoped `/api/rfcs[/{slug}]` remain as
+  the default-project compat path.
+- **Per-project corpus mirror** (`app/cache.py`): `refresh_meta_repo` now
+  iterates every `projects` row and mirrors each project's `content_repo` into
+  `cached_rfcs` stamped with that `project_id` (was: the default project only).
+- **Tests:** `test_project_scoped_serving.py` — catalog scoping, entry
+  isolation (same slug under two projects resolves distinctly; a slug present
+  only in one 404s under the other), gated-project 404. 445 backend green.
+
+Changed:
+
+- **Frontend** reads the scoped routes: `api.listRFCs(projectId)` /
+  `getRFC(projectId, slug)`; `Catalog` + `RFCView` pass `useProjectId()`. The
+  **M3-frontend `NotServedPlaceholder` guard is removed** — every registry
+  project renders its corpus. `ProjectLayout` keeps the 404/not-readable branch.
+
+Known limitation (next slice): the **write** path (propose / branch / PR /
+graduate) and the **default-project-id re-stamp** (§22.13 step 1) are not yet
+project-scoped — write affordances still target the default project, so a
+non-default project is effectively read-only until Plan B's write slice. (No
+live impact: no deployment runs a second project yet.) Per
+`docs/superpowers/specs/2026-06-04-m3-backend-planb-design.md` §1 + §3 (write).
+
 ## 0.36.0 — 2026-06-04
 
 **Minor — §22 M3-backend Plan B (1/2): the slug-keyed PK/UNIQUE rebuild that

VERSION

@@ -1 +1 @@
-0.36.0
+0.38.0

backend/app/api.py

@@ -708,6 +708,88 @@ def make_router(
         payload["proposed_use_case"] = uc["use_case"] if uc else None
         return payload
 
+    # ---------------------------------------------------------------
+    # §22.4 (Plan B): per-project RFC serving — the catalog + entry view
+    # scoped to one project, identified by its own slug namespace
+    # (project_id, slug). The unscoped /api/rfcs[/{slug}] above stay as the
+    # default-project compat path; the frontend reads these scoped routes so a
+    # second project's corpus renders under /p/<id>/.
+    # ---------------------------------------------------------------
+
+    @router.get("/api/projects/{project_id}/rfcs")
+    async def list_project_rfcs(
+        project_id: str, request: Request, unreviewed: str | None = None
+    ) -> dict[str, Any]:
+        viewer = auth.current_user(request)
+        # §22.5 read gate: a gated project's catalog 404s to a non-member.
+        auth.require_project_readable(viewer, project_id)
+        viewer_id = viewer.user_id if viewer else None
+        unreviewed_clause = ""
+        if unreviewed is not None and unreviewed.lower() in ("1", "true", "yes"):
+            unreviewed_clause = " AND unreviewed = 1 AND state = 'active'"
+        rows = db.conn().execute(
+            f"""
+            SELECT slug, title, state, rfc_id, repo,
+                   owners_json, arbiters_json, tags_json,
+                   last_main_commit_at, last_entry_commit_at, updated_at
+              FROM cached_rfcs
+             WHERE state IN ('super-draft', 'active')
+               AND project_id = ?{unreviewed_clause}
+             ORDER BY COALESCE(last_main_commit_at, last_entry_commit_at) DESC
+            """,
+            (project_id,),
+        ).fetchall()
+        starred = set()
+        if viewer_id is not None:
+            starred = {
+                r["rfc_slug"]
+                for r in db.conn().execute(
+                    "SELECT rfc_slug FROM stars WHERE user_id = ? AND project_id = ?",
+                    (viewer_id, project_id),
+                )
+            }
+        items = [
+            {
+                "slug": r["slug"],
+                "title": r["title"],
+                "state": r["state"],
+                "id": r["rfc_id"],
+                "repo": r["repo"],
+                "owners": json.loads(r["owners_json"] or "[]"),
+                "arbiters": json.loads(r["arbiters_json"] or "[]"),
+                "tags": json.loads(r["tags_json"] or "[]"),
+                "last_active_at": r["last_main_commit_at"] or r["last_entry_commit_at"] or r["updated_at"],
+                "starred_by_me": r["slug"] in starred,
+                "has_open_prs": False,
+            }
+            for r in rows
+        ]
+        return {"items": items}
+
+    @router.get("/api/projects/{project_id}/rfcs/{slug}")
+    async def get_project_rfc(project_id: str, slug: str, request: Request) -> dict[str, Any]:
+        viewer = auth.current_user(request)
+        auth.require_project_readable(viewer, project_id)
+        row = db.conn().execute(
+            "SELECT * FROM cached_rfcs WHERE project_id = ? AND slug = ?",
+            (project_id, slug),
+        ).fetchone()
+        if row is None:
+            raise HTTPException(404, "Not found")
+        if row["state"] == "retired" and (viewer is None or viewer.role != "owner"):
+            raise HTTPException(404, "Not found")
+        payload = _serialize_rfc(row)
+        uc = db.conn().execute(
+            """
+            SELECT use_case FROM proposed_use_cases
+             WHERE scope = 'rfc' AND rfc_slug = ? AND project_id = ?
+             ORDER BY id DESC LIMIT 1
+            """,
+            (slug, project_id),
+        ).fetchone()
+        payload["proposed_use_case"] = uc["use_case"] if uc else None
+        return payload
+
     # ---------------------------------------------------------------
     # §22.4c: mark-reviewed — clear an active entry's `unreviewed` flag
     # ---------------------------------------------------------------
@@ -788,6 +870,35 @@ def make_router(
             ]
         }
 
+    @router.get("/api/projects/{project_id}/proposals")
+    async def list_project_proposals(project_id: str, request: Request) -> dict[str, Any]:
+        # §22.4/§22.5: the pending idea-PRs scoped to one project.
+        viewer = auth.current_user(request)
+        auth.require_project_readable(viewer, project_id)
+        rows = db.conn().execute(
+            """
+            SELECT rfc_slug, pr_number, title, description, opened_by, opened_at, state
+              FROM cached_prs
+             WHERE pr_kind = 'idea' AND state = 'open' AND project_id = ?
+             ORDER BY opened_at DESC
+            """,
+            (project_id,),
+        ).fetchall()
+        return {
+            "items": [
+                {
+                    "slug": r["rfc_slug"],
+                    "pr_number": r["pr_number"],
+                    "title": r["title"],
+                    "description": r["description"],
+                    "opened_by": r["opened_by"],
+                    "opened_at": r["opened_at"],
+                    "proposed_use_case": _proposal_use_case(r["pr_number"]),
+                }
+                for r in rows
+            ]
+        }
+
     @router.get("/api/proposals/{pr_number}")
     async def get_proposal(pr_number: int, request: Request) -> dict[str, Any]:
         """§9.3 pending-idea view data.
@@ -840,14 +951,11 @@ def make_router(
     # §9.1: propose a new RFC
     # ---------------------------------------------------------------
 
-    @router.post("/api/rfcs/propose")
-    async def propose_rfc(payload: ProposeBody, request: Request) -> dict[str, Any]:
-        user = auth.require_contributor(request)
+    async def _propose_into_project(project_id: str, payload: ProposeBody, user) -> dict[str, Any]:
         # §22.6/§22.7: proposing a new entry requires project-level contribute
-        # standing. Through M2 every entry lands in the default project; M3's
-        # routing carries the target project. On the public default project the
+        # standing in the *target* project. On the public default project the
         # implicit-public baseline preserves the pre-multi-project flow.
-        if not auth.can_contribute_in_project(user, auth.DEFAULT_PROJECT_ID):
+        if not auth.can_contribute_in_project(user, project_id):
             raise HTTPException(403, "You do not have contribute access to this project")
         slug = payload.slug.strip().lower()
         if not entry_mod.is_valid_slug(slug):
@@ -858,13 +966,14 @@ def make_router(
         # on every keystroke, since a concurrent submission could land
         # between dialog-open and submit.
         clash = db.conn().execute(
-            "SELECT 1 FROM cached_rfcs WHERE slug = ?", (slug,)
+            "SELECT 1 FROM cached_rfcs WHERE slug = ? AND project_id = ?", (slug, project_id)
         ).fetchone()
         if clash:
             raise HTTPException(409, f"Slug `{slug}` is already taken")
         idea_clash = db.conn().execute(
-            "SELECT 1 FROM cached_prs WHERE pr_kind = 'idea' AND state = 'open' AND rfc_slug = ?",
-            (slug,),
+            "SELECT 1 FROM cached_prs WHERE pr_kind = 'idea' AND state = 'open' "
+            "AND rfc_slug = ? AND project_id = ?",
+            (slug, project_id),
         ).fetchone()
         if idea_clash:
             raise HTTPException(409, f"Slug `{slug}` is already reserved by an open proposal")
@@ -872,7 +981,7 @@ def make_router(
         # §22.4b: the target project's landing state. Through Plan A every
         # entry lands in the default project; M3-frontend routing carries a
         # non-default target later.
-        target_project = projects_mod.resolved_default_id(config)
+        target_project = project_id
         landing_state = "active" if projects_mod.project_initial_state(target_project) == "active" else "super-draft"
 
         entry = entry_mod.Entry(
@@ -908,7 +1017,7 @@ def make_router(
             pr = await bot.open_idea_pr(
                 user.as_actor(),
                 org=config.gitea_org,
-                meta_repo=(projects_mod.default_content_repo(config) or ""),
+                meta_repo=(projects_mod.content_repo(project_id) or ""),
                 slug=slug,
                 file_contents=contents,
                 pr_title=pr_title,
@@ -932,19 +1041,35 @@ def make_router(
         if use_case:
             db.conn().execute(
                 """
-                INSERT INTO proposed_use_cases (scope, rfc_slug, pr_number, use_case)
-                VALUES ('rfc', ?, ?, ?)
+                INSERT INTO proposed_use_cases (scope, rfc_slug, pr_number, use_case, project_id)
+                VALUES ('rfc', ?, ?, ?, ?)
                 ON CONFLICT(project_id, scope, pr_number) DO UPDATE SET use_case = excluded.use_case
                 """,
-                (slug, pr["number"], use_case),
+                (slug, pr["number"], use_case, project_id),
             )
             db.conn().execute(
-                "UPDATE cached_prs SET proposed_use_case = ? WHERE pr_kind = 'idea' AND pr_number = ?",
-                (use_case, pr["number"]),
+                "UPDATE cached_prs SET proposed_use_case = ? WHERE pr_kind = 'idea' AND pr_number = ? AND project_id = ?",
+                (use_case, pr["number"], project_id),
             )
 
         return {"pr_number": pr["number"], "slug": slug}
 
+    @router.post("/api/rfcs/propose")
+    async def propose_rfc(payload: ProposeBody, request: Request) -> dict[str, Any]:
+        # Default-project compat path (pre-multi-project clients).
+        user = auth.require_contributor(request)
+        return await _propose_into_project(projects_mod.resolved_default_id(config), payload, user)
+
+    @router.post("/api/projects/{project_id}/rfcs/propose")
+    async def propose_project_rfc(
+        project_id: str, payload: ProposeBody, request: Request
+    ) -> dict[str, Any]:
+        # §22.4: propose a new entry into a specific project (read-gated first
+        # so a gated project 404s a non-member before the contribute check).
+        user = auth.require_contributor(request)
+        auth.require_project_readable(user, project_id)
+        return await _propose_into_project(project_id, payload, user)
+
     # ---------------------------------------------------------------
     # §9.1 Slice 2 (roadmap #27): Claude Haiku tag suggestions as the
     # propose-RFC fields fill in. The modal debounce-posts the partial

backend/app/cache.py

@@ -35,20 +35,29 @@ log = logging.getLogger(__name__)
 
 
 async def refresh_meta_repo(config: Config, gitea: Gitea) -> None:
-    """Re-read rfcs/ on the meta repo and reconcile cached_rfcs.
+    """Re-read rfcs/ on every project's content repo and reconcile cached_rfcs.
 
-    Idempotent. Safe to call on every meta-repo webhook and on every
-    reconciler sweep.
+    §22 (Plan B): a deployment has N projects (§22.1), each with its own
+    content_repo (§22.3). Mirror each into cached_rfcs stamped with that
+    project's id, so a second project's corpus renders under /p/<id>/. Idempotent;
+    safe on every content-repo webhook and reconciler sweep.
     """
     org = config.gitea_org
-    repo = projects_mod.default_content_repo(config)
-    if not repo:
-        log.warning("refresh_meta_repo: default project has no content_repo yet; skipping")
+    rows = db.conn().execute(
+        "SELECT id, content_repo FROM projects WHERE content_repo IS NOT NULL AND content_repo != ''"
+    ).fetchall()
+    if not rows:
+        log.warning("refresh_meta_repo: no projects with a content_repo yet; skipping")
         return
+    for prow in rows:
+        await _refresh_project_corpus(org, prow["id"], prow["content_repo"], gitea)
+
+
+async def _refresh_project_corpus(org: str, project_id: str, repo: str, gitea: Gitea) -> None:
     try:
         files = await gitea.list_dir(org, repo, "rfcs", ref="main")
     except GiteaError as e:
-        log.warning("refresh_meta_repo: cannot list rfcs/: %s", e)
+        log.warning("refresh_meta_repo: project %s: cannot list rfcs/: %s", project_id, e)
         return
 
     seen_slugs: set[str] = set()
@@ -62,24 +71,28 @@ async def refresh_meta_repo(config: Config, gitea: Gitea) -> None:
         try:
             entry = entry_mod.parse(text)
         except Exception as parse_err:
-            log.warning("refresh_meta_repo: skipping %s: %s", f["path"], parse_err)
+            log.warning("refresh_meta_repo: %s: skipping %s: %s", project_id, f["path"], parse_err)
             continue
         if not entry.slug:
-            log.warning("refresh_meta_repo: skipping %s: missing slug", f["path"])
+            log.warning("refresh_meta_repo: %s: skipping %s: missing slug", project_id, f["path"])
             continue
         seen_slugs.add(entry.slug)
-        _upsert_cached_rfc(entry, body_sha=sha)
+        _upsert_cached_rfc(entry, body_sha=sha, project_id=project_id)
 
-    # Mark entries removed from the meta repo as withdrawn-without-trace.
-    # In practice the spec keeps withdrawn entries in rfcs/ as historical
-    # record (§3), so this branch fires only for entries deleted out of
-    # band. We leave the row but flag it for reconciler attention.
-    existing = {row["slug"] for row in db.conn().execute("SELECT slug FROM cached_rfcs")}
+    # Entries removed from a project's rfcs/ — the spec keeps withdrawn entries
+    # as historical record (§3), so this fires only for out-of-band deletes;
+    # leave the row, scoped to this project, for reconciler attention.
+    existing = {
+        row["slug"]
+        for row in db.conn().execute(
+            "SELECT slug FROM cached_rfcs WHERE project_id = ?", (project_id,)
+        )
+    }
     for missing in existing - seen_slugs:
-        log.info("refresh_meta_repo: %s no longer in rfcs/ — leaving cache row in place", missing)
+        log.info("refresh_meta_repo: %s/%s no longer in rfcs/ — leaving cache row", project_id, missing)
 
 
-def _upsert_cached_rfc(entry: entry_mod.Entry, body_sha: str) -> None:
+def _upsert_cached_rfc(entry: entry_mod.Entry, body_sha: str, project_id: str = "default") -> None:
     # §6.6: models_json stays NULL when the frontmatter key is absent
     # (inherit operator universe) and '[]' for the explicit opt-out.
     models_json = json.dumps(entry.models) if entry.models is not None else None
@@ -92,9 +105,9 @@ def _upsert_cached_rfc(entry: entry_mod.Entry, body_sha: str) -> None:
             (slug, title, state, rfc_id, repo, proposed_by, proposed_at,
              graduated_at, graduated_by, owners_json, arbiters_json, tags_json,
              models_json, funder_login, body, body_sha,
-             unreviewed, reviewed_at, reviewed_by,
+             unreviewed, reviewed_at, reviewed_by, project_id,
              last_entry_commit_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, datetime('now'), datetime('now'))
         ON CONFLICT(project_id, slug) DO UPDATE SET
             title = excluded.title,
             state = excluded.state,
@@ -137,6 +150,7 @@ def _upsert_cached_rfc(entry: entry_mod.Entry, body_sha: str) -> None:
             1 if entry.unreviewed else 0,
             entry.reviewed_at,
             entry.reviewed_by,
+            project_id,
         ),
     )
 
@@ -454,20 +468,28 @@ async def refresh_meta_pulls(config: Config, gitea: Gitea) -> None:
     login as last resort.
     """
     org = config.gitea_org
-    repo = projects_mod.default_content_repo(config)
-    if not repo:
-        log.warning("refresh_meta_pulls: default project has no content_repo yet; skipping")
+    bot_login = config.gitea_bot_user
+    rows = db.conn().execute(
+        "SELECT id, content_repo FROM projects WHERE content_repo IS NOT NULL AND content_repo != ''"
+    ).fetchall()
+    if not rows:
+        log.warning("refresh_meta_pulls: no projects with a content_repo yet; skipping")
         return
+    for prow in rows:
+        await _refresh_project_pulls(org, prow["id"], prow["content_repo"], gitea, bot_login)
+
+
+async def _refresh_project_pulls(
+    org: str, project_id: str, repo: str, gitea: Gitea, bot_login: str
+) -> None:
     repo_full = f"{org}/{repo}"
     try:
         open_pulls = await gitea.list_pulls(org, repo, state="open")
         closed_pulls = await gitea.list_pulls(org, repo, state="closed")
     except GiteaError as e:
-        log.warning("refresh_meta_pulls: %s", e)
+        log.warning("refresh_meta_pulls: project %s: %s", project_id, e)
         return
 
-    bot_login = config.gitea_bot_user
-
     for pull in open_pulls + closed_pulls:
         head_branch = pull.get("head", {}).get("ref", "")
         # A merged-and-deleted PR's branch is no longer reported by Gitea
@@ -522,8 +544,8 @@ async def refresh_meta_pulls(config: Config, gitea: Gitea) -> None:
             INSERT INTO cached_prs
                 (rfc_slug, pr_kind, repo, pr_number, title, description, state,
                  opened_by, opened_at, merged_at, closed_at,
-                 head_branch, base_branch, head_sha, merge_commit_sha)
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                 head_branch, base_branch, head_sha, merge_commit_sha, project_id)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
             ON CONFLICT(repo, pr_number) DO UPDATE SET
                 title = excluded.title,
                 description = excluded.description,
@@ -550,6 +572,7 @@ async def refresh_meta_pulls(config: Config, gitea: Gitea) -> None:
                 (pull.get("base") or {}).get("ref") or "main",
                 (pull.get("head") or {}).get("sha"),
                 merge_commit_sha,
+                project_id,
             ),
         )
 

backend/app/projects.py

@@ -31,6 +31,15 @@ def default_content_repo(config: Config) -> str | None:
     return row["content_repo"] if row and row["content_repo"] else None
 
 
+def content_repo(project_id: str) -> str | None:
+    """The content repo for a specific project (§22.3). None if unknown/unset.
+    The per-project successor to `default_content_repo` for the write path."""
+    row = db.conn().execute(
+        "SELECT content_repo FROM projects WHERE id = ?", (project_id,)
+    ).fetchone()
+    return row["content_repo"] if row and row["content_repo"] else None
+
+
 def project_initial_state(project_id: str) -> str:
     """§22.4b landing state for new entries in a project. Defaults to
     'super-draft' for an unknown/unset row (the safe, today's-flow default)."""

backend/tests/test_project_scoped_propose.py

@@ -0,0 +1,64 @@
+"""§22.4 (Plan B write): proposing a new entry into a *specific* project lands
+it in that project's content repo and surfaces under that project's proposals,
+isolated from the default project."""
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+
+from test_propose_vertical import (  # noqa: F401
+    app_with_fake_gitea, tmp_env, provision_user_row, sign_in_as,
+)
+
+
+def _register_ecomm(fake):
+    from app import db
+    db.conn().execute(
+        "INSERT OR IGNORE INTO projects (id, name, type, content_repo, visibility, initial_state) "
+        "VALUES ('ecomm', 'Ecomm', 'document', 'ecomm-content', 'public', 'super-draft')"
+    )
+    fake._seed_repo("wiggleverse", "ecomm-content")
+
+
+def test_propose_into_second_project_lands_scoped(app_with_fake_gitea):
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _register_ecomm(fake)
+        provision_user_row(user_id=3, login="alice", role="contributor")
+        sign_in_as(client, user_id=3, gitea_login="alice", display_name="Alice",
+                   role="contributor", email="alice@test")
+        r = client.post("/api/projects/ecomm/rfcs/propose", json={
+            "title": "Cart", "slug": "cart", "pitch": "why a cart", "tags": [],
+        })
+        assert r.status_code == 200, r.text
+
+        # The idea PR shows under ecomm's proposals, not the default's.
+        e = {i["slug"] for i in client.get("/api/projects/ecomm/proposals").json()["items"]}
+        d = {i["slug"] for i in client.get("/api/projects/default/proposals").json()["items"]}
+        assert "cart" in e
+        assert "cart" not in d
+
+        # It landed in ecomm's content repo, not the default 'meta' repo.
+        assert ("wiggleverse", "ecomm-content") in {
+            (o, rp) for (o, rp) in fake.branches if rp == "ecomm-content"
+        }
+        assert any(
+            br.startswith("propose/cart")
+            for br in fake.branches.get(("wiggleverse", "ecomm-content"), {})
+        )
+
+
+def test_propose_into_gated_project_404s_for_non_member(app_with_fake_gitea):
+    app, _ = app_with_fake_gitea
+    from app import db
+    with TestClient(app) as client:
+        db.conn().execute(
+            "INSERT OR IGNORE INTO projects (id, name, type, content_repo, visibility, initial_state) "
+            "VALUES ('secret', 'Secret', 'document', 'secret-content', 'gated', 'super-draft')"
+        )
+        provision_user_row(user_id=4, login="bob", role="contributor")
+        sign_in_as(client, user_id=4, gitea_login="bob", display_name="Bob",
+                   role="contributor", email="bob@test")
+        r = client.post("/api/projects/secret/rfcs/propose", json={
+            "title": "X", "slug": "x", "pitch": "p", "tags": [],
+        })
+        assert r.status_code == 404

backend/tests/test_project_scoped_serving.py

@@ -0,0 +1,67 @@
+"""§22.4 (Plan B) — per-project RFC serving. A second project's corpus renders
+under its own slug namespace via /api/projects/{pid}/rfcs[/{slug}], isolated
+from the default project and gated by §22.5 visibility."""
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+
+from test_propose_vertical import (  # noqa: F401
+    app_with_fake_gitea, tmp_env, provision_user_row, sign_in_as,
+)
+
+
+def _add_project(pid, name, vis="public"):
+    from app import db
+    db.conn().execute(
+        "INSERT OR IGNORE INTO projects (id, name, type, content_repo, visibility, initial_state) "
+        "VALUES (?, ?, 'document', ?, ?, 'super-draft')",
+        (pid, name, pid + "-content", vis),
+    )
+
+
+def _add_rfc(slug, title, pid, state="active"):
+    from app import db
+    db.conn().execute(
+        "INSERT INTO cached_rfcs (slug, title, state, project_id) VALUES (?, ?, ?, ?)",
+        (slug, title, state, pid),
+    )
+
+
+def test_catalog_scoped_to_one_project(app_with_fake_gitea):
+    app, _ = app_with_fake_gitea
+    with TestClient(app) as client:
+        _add_project("ecomm", "Ecomm")
+        _add_rfc("intro", "Default Intro", "default")
+        _add_rfc("intro", "Ecomm Intro", "ecomm")
+        _add_rfc("only-ecomm", "Ecomm Only", "ecomm")
+
+        d = client.get("/api/projects/default/rfcs").json()["items"]
+        e = client.get("/api/projects/ecomm/rfcs").json()["items"]
+        d_slugs = {i["slug"] for i in d}
+        e_slugs = {i["slug"] for i in e}
+        assert "intro" in d_slugs and "only-ecomm" not in d_slugs
+        assert {"intro", "only-ecomm"} <= e_slugs
+
+
+def test_entry_is_isolated_by_project(app_with_fake_gitea):
+    app, _ = app_with_fake_gitea
+    with TestClient(app) as client:
+        _add_project("ecomm", "Ecomm")
+        _add_rfc("intro", "Default Intro", "default")
+        _add_rfc("intro", "Ecomm Intro", "ecomm")
+        _add_rfc("only-ecomm", "Ecomm Only", "ecomm")
+
+        assert client.get("/api/projects/default/rfcs/intro").json()["title"] == "Default Intro"
+        assert client.get("/api/projects/ecomm/rfcs/intro").json()["title"] == "Ecomm Intro"
+        # a slug that exists only in ecomm 404s under default
+        assert client.get("/api/projects/ecomm/rfcs/only-ecomm").status_code == 200
+        assert client.get("/api/projects/default/rfcs/only-ecomm").status_code == 404
+
+
+def test_gated_project_catalog_404s_for_anon(app_with_fake_gitea):
+    app, _ = app_with_fake_gitea
+    with TestClient(app) as client:
+        _add_project("secret", "Secret", vis="gated")
+        _add_rfc("hush", "Hush", "secret")
+        assert client.get("/api/projects/secret/rfcs").status_code == 404
+        assert client.get("/api/projects/secret/rfcs/hush").status_code == 404

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "rfc-app-frontend",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "rfc-app-frontend",
-      "version": "0.34.0",
+      "version": "0.36.0",
       "dependencies": {
         "@amplitude/unified": "^1.1.9",
         "@codemirror/commands": "^6.10.3",

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rfc-app-frontend",
   "private": true,
-  "version": "0.36.0",
+  "version": "0.38.0",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/App.jsx

@@ -61,6 +61,11 @@ export default function App() {
   // §22.9 — runtime deployment config (name for the brand, default project id
   // for building corpus links this slice; see DeploymentProvider).
   const deployment = useDeployment()
+  // §22.4 — the project the viewer is currently in (from the /p/<id>/ URL),
+  // so the propose modal (App-level chrome, above the route tree) targets the
+  // right project. Falls back to the deployment default off a project route.
+  const _projMatch = location.pathname.match(/^\/p\/([^/]+)/)
+  const currentProjectId = (_projMatch && _projMatch[1]) || deployment.defaultProjectId
   // #28 Parts 2–3: the LinkedText create/contribute affordances route via
   // query params so they need no prop-threading from deep in a comment
   // list. `?propose=<term>` opens the propose modal pre-filled;
@@ -372,12 +377,13 @@ export default function App() {
         <ProposeModal
           viewer={viewer}
           initialTitle={proposeParam || ''}
+          projectId={currentProjectId}
           onClose={() => { setProposeOpen(false); clearParams('propose') }}
           onSubmitted={({ pr_number }) => {
             setProposeOpen(false)
             clearParams('propose')
             setCatalogVersion(v => v + 1)
-            navigate(proposalPath(deployment.defaultProjectId, pr_number))
+            navigate(proposalPath(currentProjectId, pr_number))
           }}
         />
       )}

frontend/src/api.js

@@ -182,24 +182,36 @@ export async function getProject(projectId) {
   return jsonOrThrow(await fetch(`/api/projects/${projectId}`))
 }
 
-export async function listRFCs() {
-  return jsonOrThrow(await fetch('/api/rfcs'))
+// §22.4 (Plan B): per-project serving. Given a projectId, read the
+// project-scoped routes so a non-default project's corpus renders; without
+// one, fall back to the default-project compat path.
+export async function listRFCs(projectId) {
+  const url = projectId ? `/api/projects/${projectId}/rfcs` : '/api/rfcs'
+  return jsonOrThrow(await fetch(url))
 }
 
-export async function getRFC(slug) {
-  return jsonOrThrow(await fetch(`/api/rfcs/${slug}`))
+export async function getRFC(projectId, slug) {
+  // Back-compat: getRFC(slug) (one arg) still hits the unscoped default path.
+  if (slug === undefined) {
+    return jsonOrThrow(await fetch(`/api/rfcs/${projectId}`))
+  }
+  return jsonOrThrow(await fetch(`/api/projects/${projectId}/rfcs/${slug}`))
 }
 
-export async function listProposals() {
-  return jsonOrThrow(await fetch('/api/proposals'))
+export async function listProposals(projectId) {
+  const url = projectId ? `/api/projects/${projectId}/proposals` : '/api/proposals'
+  return jsonOrThrow(await fetch(url))
 }
 
 export async function getProposal(prNumber) {
   return jsonOrThrow(await fetch(`/api/proposals/${prNumber}`))
 }
 
-export async function proposeRFC({ title, slug, pitch, tags, proposedUseCase }) {
-  const res = await fetch('/api/rfcs/propose', {
+// §22.4 (Plan B write): propose into a specific project when projectId is
+// given; else the default-project compat path.
+export async function proposeRFC(projectId, { title, slug, pitch, tags, proposedUseCase }) {
+  const url = projectId ? `/api/projects/${projectId}/rfcs/propose` : '/api/rfcs/propose'
+  const res = await fetch(url, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     // #26: proposed_use_case is optional; send null when blank so the

frontend/src/components/Catalog.jsx

@@ -34,9 +34,9 @@ export default function Catalog({ viewer, onProposeRFC, version }) {
   const pid = useProjectId()
 
   useEffect(() => {
-    listRFCs().then(d => setRfcs(d.items)).catch(() => setRfcs([]))
-    listProposals().then(d => setProposals(d.items)).catch(() => setProposals([]))
-  }, [version])
+    listRFCs(pid).then(d => setRfcs(d.items)).catch(() => setRfcs([]))
+    listProposals(pid).then(d => setProposals(d.items)).catch(() => setProposals([]))
+  }, [version, pid])
 
   const filtered = useMemo(() => {
     const needle = search.trim().toLowerCase()

frontend/src/components/NotServedPlaceholder.jsx

@@ -1,18 +0,0 @@
-// §22.10 (M3) — the guard placeholder. A project that exists in the registry
-// but whose corpus the backend does not yet serve (everything except the
-// corpus-served default, until Plan B lands per-project RFC serving) renders
-// this instead of mislabeled default-project content.
-export default function NotServedPlaceholder({ project }) {
-  const name = project?.name || 'This project'
-  return (
-    <main className="chrome-pane">
-      <div className="welcome">
-        <h1>{name}</h1>
-        <p>
-          This project is registered, but its content isn&apos;t being served
-          here yet. Per-project content arrives in a later release.
-        </p>
-      </div>
-    </main>
-  )
-}

frontend/src/components/ProjectLayout.jsx

@@ -16,8 +16,6 @@ import { createContext, useContext, useEffect, useState } from 'react'
 import { useParams } from 'react-router-dom'
 import { getProject } from '../api'
 import { brandTitle } from '../lib/brand'
-import { useDeployment } from '../context/DeploymentProvider'
-import NotServedPlaceholder from './NotServedPlaceholder.jsx'
 
 const ProjectContext = createContext(null)
 
@@ -42,7 +40,6 @@ const THEME_TOKENS = {
 
 export default function ProjectLayout({ children }) {
   const { projectId } = useParams()
-  const deployment = useDeployment()
   const [project, setProject] = useState(null)
   const [status, setStatus] = useState('loading') // loading | ready | notfound
 
@@ -90,10 +87,11 @@ export default function ProjectLayout({ children }) {
     )
   }
 
-  const served = projectId === deployment.defaultProjectId
+  // §22.4 (Plan B): every registry project now serves its own corpus, so
+  // there is no "not served" guard — a readable project renders its children.
   return (
-    <ProjectContext.Provider value={{ project, projectId, served, noun: entryNoun(project?.type) }}>
-      {served ? children : <NotServedPlaceholder project={project} />}
+    <ProjectContext.Provider value={{ project, projectId, noun: entryNoun(project?.type) }}>
+      {children}
     </ProjectContext.Provider>
   )
 }

frontend/src/components/ProjectLayout.test.jsx

@@ -43,11 +43,10 @@ describe('ProjectLayout', () => {
     expect(document.documentElement.style.getPropertyValue('--c-accent')).toBe('')
   })
 
-  it('shows the not-served placeholder for a non-default (Plan-B) project', async () => {
+  it('renders the corpus for a non-default project too (Plan B: every project serves)', async () => {
     getProject.mockResolvedValue({ id: 'other', name: 'Ecomm', type: 'bdd', theme: {} })
     renderAt('/p/other/')
-    expect(await screen.findByText(/isn.t being served here yet/i)).toBeInTheDocument()
-    expect(screen.queryByTestId('corpus')).not.toBeInTheDocument()
+    expect(await screen.findByTestId('corpus')).toBeInTheDocument()
   })
 
   it('shows a not-found message when the project 404s', async () => {

frontend/src/components/ProposeModal.jsx

@@ -28,7 +28,7 @@ function slugify(title) {
     .replace(/^-+|-+$/g, '')
 }
 
-export default function ProposeModal({ viewer, onClose, onSubmitted, initialTitle = '' }) {
+export default function ProposeModal({ viewer, onClose, onSubmitted, initialTitle = '', projectId }) {
   // #28 Part 2: a "create RFC for '<term>'" affordance pre-fills the title
   // (App passes the `?propose=<term>` value here); the slug derives from it
   // via the same effect that drives manual typing.
@@ -92,7 +92,7 @@ export default function ProposeModal({ viewer, onClose, onSubmitted, initialTitl
     setSubmitting(true)
     setError(null)
     try {
-      const result = await proposeRFC({
+      const result = await proposeRFC(projectId, {
         title: title.trim(),
         slug,
         pitch: pitch.trim(),

frontend/src/components/RFCView.jsx

@@ -125,7 +125,7 @@ export default function RFCView({ viewer }) {
   const [drawerOpen, setDrawerOpen] = useState(false)
 
   useEffect(() => {
-    getRFC(slug).then(entry => {
+    getRFC(pid, slug).then(entry => {
       setEntry(entry)
       // v0.15.0 — analytics: fire RFC Viewed once per slug load.
       // We key on the slug param rather than the loaded entry so a
@@ -140,7 +140,7 @@ export default function RFCView({ viewer }) {
         setSelectedModel(def || models?.[0]?.id || '')
       })
       .catch(() => {})
-  }, [slug])
+  }, [slug, pid])
 
   // Per §9.4 / §17's routing-collapse rule, super-drafts render through
   // the same surface as active RFCs — the bot, the chat, the change
@@ -179,7 +179,7 @@ export default function RFCView({ viewer }) {
     setActionError(null)
     try {
       const res = await unretireRFC(slug)
-      getRFC(slug).then(setEntry).catch(() => {})
+      getRFC(pid, slug).then(setEntry).catch(() => {})
       if (res?.state) navigate(entryPath(pid, slug))
     } catch (err) {
       setActionError(err.message)
@@ -957,7 +957,7 @@ export default function RFCView({ viewer }) {
           onCompleted={() => {
             setShowGraduateDialog(false)
             // The catalog row and the RFC view now reflect `active`.
-            getRFC(slug).then(setEntry).catch(() => {})
+            getRFC(pid, slug).then(setEntry).catch(() => {})
             getRFCMain(slug).then(setMainView).catch(() => {})
           }}
         />