@bongos/core 1.19.1015 → 1.19.1017

package/tests/idea_filed_via.mjs

@@ -0,0 +1,185 @@
+// tests/idea_filed_via.mjs — WHERE AN IDEA WAS FILED FROM, and WHICH THOUGHTS
+// BECAME THE STRUCTURE (task 1004233 / sky part 5 of 5, goal 1000095; ADR 0331 §4).
+//
+// The sky's prototype guessed two things from text: whether a session or a
+// person filed a thought, and which thoughts became goals or rings. This suite
+// pins the two ledger facts that replaced those guesses:
+//   - the column: additive, nullable, no default, NO BACKFILL — a row older
+//     than the column stays NULL, because NULL is not 'cli';
+//   - the vocabulary: one closed set, spelled in projection.js and mirrored by
+//     the migration's CHECK, so a bad value is a named 400 and never a 500;
+//   - each writer's value: the route reads the door off the SESSION (web is the
+//     hall, cli is the CLI, anything else the API) and lets the body add only
+//     'planning'; capture.js names 'planning' and nothing else; the Discord
+//     paths and the agents' sink name their own on the port; a new row always
+//     records a door;
+//   - the born read: first ratification wins, ids as strings, through the
+//     ideas.bornOf port so lifecycle never reads an ideas table itself.
+//
+// DB-free: captureIdea runs against a recording pool (the idea_quick_guard
+// harness), readBornOf against a fake pool, the rest is pure or read from source.
+//
+// Run:  node tests/idea_filed_via.mjs
+process.env.NODE_ENV = 'test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8');
+const api = require(path.join(ROOT, 'src/module-api.js'));
+let queries = [];
+let nextRows = [];
+api.pool.query = async (sql, params = []) => { queries.push({ sql, params }); return { rows: nextRows }; };
+const inbox = require(path.join(ROOT, 'modules/ideas/inbox.js'));
+const projection = require(path.join(ROOT, 'modules/ideas/projection.js'));
+const { readBornOf } = require(path.join(ROOT, 'modules/ideas/born-of.js'));
+
+const { test, summary } = makeRunner();
+const reset = () => { queries = []; nextRows = [{ id: '41', title: 'an idea', status: 'open', grade: 'quick' }]; };
+const FIVE = ['hall', 'cli', 'discord', 'planning', 'api'];
+const migrationFile = fs.readdirSync(path.join(ROOT, 'migrations')).find((f) => /^core_\d+_idea_filed_via\.sql$/.test(f));
+
+// ═══ the migration ═══════════════════════════════════════════════════════════
+
+await test('the column is a CORE migration: additive, nullable, no default, and the CHECK names exactly the five doors', () => {
+  assert.ok(migrationFile, 'migrations/core_NNN_idea_filed_via.sql exists (idea_inbox is a core table — ADR 0083 §Decision #5)');
+  const sql = read(path.join('migrations', migrationFile));
+  assert.match(sql, /ALTER TABLE idea_inbox\s+ADD COLUMN IF NOT EXISTS filed_via text;/);
+  assert.equal(/filed_via text\s+(NOT NULL|DEFAULT)/i.test(sql), false, 'nullable, no default');
+  const check = /CHECK \(filed_via IS NULL OR filed_via IN \(([^)]*)\)\)/.exec(sql);
+  assert.ok(check, 'a CHECK closes the set');
+  assert.deepEqual(check[1].split(',').map((s) => s.trim().replace(/'/g, '')), FIVE);
+  assert.match(sql, /IF NOT EXISTS \(\s*SELECT 1 FROM pg_constraint/, 'the CHECK add is guarded — replay-safe');
+  assert.ok(sql.includes(`INSERT INTO schema_migrations (version) VALUES ('${migrationFile.replace(/\.sql$/, '')}')`), 'the stem is the version');
+});
+
+await test('NULL IS NOT \'cli\': the migration backfills nothing, and no writer guesses a door from text', () => {
+  const sql = read(path.join('migrations', migrationFile));
+  assert.equal(/UPDATE idea_inbox/i.test(sql), false, 'no backfill — a historic row stays NULL');
+  assert.equal(/title|body_md|ILIKE|~\*/.test(sql.replace(/^--.*$/gm, '')), false, 'nothing in the SQL reads the idea\'s words');
+  const src = read('modules/ideas/inbox.js') + read('modules/ideas/projection.js') + read('modules/ideas/routes/inbox.js');
+  assert.equal(/filed_via\s*=\s*CASE|classify\([^)]*\)\s*===?\s*'(cli|api)'/.test(src), false, 'no code derives a door from the text either');
+});
+
+// ═══ the vocabulary ══════════════════════════════════════════════════════════
+
+await test('ONE closed set, spelled in projection.js, carried by every read', () => {
+  assert.deepEqual([...projection.FILED_VIA_VALUES], FIVE);
+  assert.ok(Object.isFrozen(projection.FILED_VIA_VALUES));
+  assert.ok(projection.IDEA_COL_NAMES.includes('filed_via'), 'on the shared column list — so the trail (and GET /sky/mine, which is the trail) returns it');
+  assert.match(projection.IDEA_COLS_Q, /\bi\.filed_via\b/);
+  for (const v of FIVE) assert.equal(projection.isValidFiledVia(v), true);
+  for (const v of ['session', 'person', '', null, undefined, 'HALL']) assert.equal(projection.isValidFiledVia(v), false, `${v} is not a door`);
+  assert.deepEqual([inbox.FILED_VIA_VALUES, inbox.resolveFiledVia], [projection.FILED_VIA_VALUES, projection.resolveFiledVia], 'the facade re-exports the one declaration');
+});
+
+// ═══ the door is read off the session ════════════════════════════════════════
+
+await test('the session says which door: a web cookie is the hall, a device-flow token is the CLI, anything else is the API', () => {
+  const { filedViaForSource } = projection;
+  assert.equal(filedViaForSource('web'), 'hall');
+  assert.equal(filedViaForSource('cli'), 'cli');
+  assert.equal(filedViaForSource('box'), 'api');
+  assert.equal(filedViaForSource(null), 'api', 'a legacy sourceless session is the API, not a guess');
+  assert.equal(filedViaForSource(undefined), 'api');
+});
+
+await test('the body may ADD only \'planning\'; repeating the session\'s own door is harmless; any other claim is refused with the reason', () => {
+  const { resolveFiledVia } = projection;
+  assert.deepEqual(resolveFiledVia('cli', undefined), { ok: true, value: 'cli' });
+  assert.deepEqual(resolveFiledVia('web', null), { ok: true, value: 'hall' });
+  assert.deepEqual(resolveFiledVia('cli', 'planning'), { ok: true, value: 'planning' }, 'the planning session is a CLI filing no session can tell apart');
+  assert.deepEqual(resolveFiledVia('web', 'planning'), { ok: true, value: 'planning' });
+  assert.deepEqual(resolveFiledVia('web', 'hall'), { ok: true, value: 'hall' }, 'naming your own door changes nothing');
+  const spoof = resolveFiledVia('cli', 'hall');
+  assert.equal(spoof.ok, false, 'a CLI cannot say it came through the hall');
+  assert.deepEqual(spoof.detail.allowed, ['planning', 'cli']);
+  assert.match(spoof.detail.reason, /read off your session \(cli\)/);
+  const junk = resolveFiledVia('web', 'session');
+  assert.equal(junk.ok, false);
+  assert.match(junk.detail.reason, /must be one of hall, cli, discord, planning, api/);
+});
+
+await test('POST /inbox reads the door off req.gdsSession, refuses a bad claim as a named 400, and hands captureIdea the value', () => {
+  const src = read('modules/ideas/routes/inbox.js');
+  assert.match(src, /filed_via: \{ type: 'string', maxLength: 16 \}/, 'the body field is declared (strict validation would 400 it otherwise)');
+  assert.match(src, /inbox\.resolveFiledVia\(req\.gdsSession && req\.gdsSession\.source, body\.filed_via\)/, 'the SESSION source, never the body alone');
+  assert.match(src, /res\.fail\('bad_filed_via', 400, door\.detail\)/);
+  assert.match(src, /filedVia: door\.value,/);
+  assert.match(src, /err\.code === 'BAD_FILED_VIA' \? 400 :/, 'a value that slipped past the route is still a 400, never a constraint 500');
+});
+
+// ═══ every writer ════════════════════════════════════════════════════════════
+
+await test('captureIdea WRITES the door on the row, defaults a silent port caller to \'api\', and refuses a value outside the set', async () => {
+  reset();
+  await inbox.captureIdea({ title: 'from the bot', capturedBy: '7', filedVia: 'discord' });
+  assert.equal(queries.length, 1);
+  assert.match(queries[0].sql, /INSERT INTO idea_inbox[\s\S]*filed_via\)/, 'the column is in the INSERT');
+  assert.equal(queries[0].params.at(-1), 'discord', 'and the value is the last bind');
+  reset();
+  await inbox.captureIdea({ title: 'a program said nothing', capturedBy: null });
+  assert.equal(queries[0].params.at(-1), 'api', 'a NEW row always records a door — NULL is for rows older than the column');
+  reset();
+  await assert.rejects(inbox.captureIdea({ title: 'x', capturedBy: '7', filedVia: 'session' }), (e) => e.code === 'BAD_FILED_VIA' && e.filedVia === 'session' && Array.isArray(e.allowed));
+  assert.equal(queries.length, 0, 'refused before any write');
+});
+
+await test('the ROUTED insert (a filing that becomes a task in the same act) writes the door too', () => {
+  const src = read('modules/ideas/inbox.js');
+  const inserts = [...src.matchAll(/INSERT INTO idea_inbox[\s\S]*?RETURNING \$\{IDEA_COLS\}/g)].map((m) => m[0]);
+  assert.equal(inserts.length, 2, 'the inbox insert and the routed insert');
+  for (const ins of inserts) assert.match(ins, /filed_via/, 'both name the column');
+  assert.match(src, /capturedBy, goalId, landing, filerRank, touches, filedVia,\s*\}, activePool\)/, 'and the routed path is handed the value');
+});
+
+await test('capture.js names \'planning\' and nothing else — every other CLI filing\'s door is read off the session', () => {
+  const src = read('scripts/gds/capture.js');
+  assert.match(src, /const viaFromArg = arg\('--via', args\);/);
+  assert.match(src, /if \(viaFromArg !== null && viaFromArg !== 'planning'\)[\s\S]{0,400}process\.exit\(2\)/, 'a door the CLI may not name is refused before the request');
+  assert.match(src, /if \(viaFromArg\) payload\.filed_via = viaFromArg;/, 'sent only when given — a pinned core that predates the field never sees it');
+  assert.equal(/filed_via: 'cli'/.test(src), false, 'never claims cli — the session already says so');
+  assert.equal(/postInbox\(/.test(read('scripts/gds/spark.js')), false, 'spark.js files no idea row of its own (a spark is made from an existing idea), so its door is the row\'s');
+  assert.match(read('.claude/skills/planning-session/SKILL.md'), /--via planning/, 'the planning session is told to name its door');
+});
+
+await test('the Discord doors and the agents\' sink name their own door on the port', () => {
+  assert.match(read('modules/discord/discord-inbound.js'), /filedVia: 'discord',/);
+  assert.match(read('modules/discord/discord-bugs.js'), /filedVia: 'discord',/);
+  assert.match(read('modules/agents/pollers/event-router.js'), /filedVia: 'api',/);
+});
+
+// ═══ born of a thought ═══════════════════════════════════════════════════════
+
+function bornPool({ goals = [], criteria = [] } = {}) {
+  const calls = [];
+  return { calls, async query(sql) { calls.push(sql); return { rows: /ideas_goal_ratifications/.test(sql) ? goals : criteria }; } };
+}
+
+await test('readBornOf: goals from the goal ratifications, criteria from the proposal audit, the FIRST ratification wins, ids as strings', async () => {
+  const pool = bornPool({
+    goals: [{ goal_id: '7', idea_id: '10' }, { goal_id: '7', idea_id: '99' }, { goal_id: 8, idea_id: 11 }],
+    criteria: [{ criterion_id: '70', idea_id: '12' }, { criterion_id: '71', idea_id: null }],
+  });
+  const born = await readBornOf({ pool });
+  assert.deepEqual(born, { goals: { 7: '10', 8: '11' }, criteria: { 70: '12' } });
+  assert.equal(pool.calls.length, 2);
+  assert.match(pool.calls[0], /FROM ideas_goal_ratifications\s+ORDER BY ratified_at, id/);
+  assert.match(pool.calls[1], /FROM criterion_proposal_audit\s+ORDER BY ratified_at, id/);
+  assert.deepEqual(await readBornOf({ pool: bornPool() }), { goals: {}, criteria: {} }, 'nothing ratified is an empty map');
+});
+
+await test('the read is served through the ideas.bornOf port, beside ideas.capture, so lifecycle\'s GET /sky never reads an ideas table', () => {
+  assert.match(read('modules/ideas/routes/inbox.js'), /api\.registerProvider\('ideas\.bornOf', bornOf\.readBornOf\)/);
+  const sky = read('modules/lifecycle/sky.js');
+  assert.match(sky, /resolveOptional\('ideas\.bornOf'\)/);
+  assert.equal(/ideas_goal_ratifications|criterion_proposal_audit|require\(['"][^'"]*ideas/.test(sky), false);
+});
+
+console.log('');
+summary();

package/tests/landing_page.mjs

@@ -600,3 +600,11 @@ test('the chip is the profile trigger, built with createElement; Sign out is the
   assert.match(CODE, /var signout = document\.querySelector\('#menuProfile a\.signout'\);\s*if \(signout\) signout\.addEventListener\('click', function \(e\) \{ e\.preventDefault\(\); doLogout\(\); \}\);/, 'the honest href, upgraded to the POST');
   assert.doesNotMatch(CODE, /className = 'pill signout'/, 'no sign-out pill in the bar any more');
 });
+
+test('the retired gate assets (world/assets/clouds|creatures|plates) are gone — the chrome landing ships its plates from assets/world/ instead (task 1003650)', () => {
+  assert.ok(!fs.existsSync(path.join(LANDING, 'world')), 'modules/public-landing/public/world/ no longer exists');
+  assert.doesNotMatch(HTML, /\bworld\/assets\//, 'the page links no path under the retired world/assets/ folder');
+  assert.doesNotMatch(WORLD, /\bworld\/assets\//, 'world.css references no path under the retired folder');
+  // the chrome landing's own plates (task 1003298) live at assets/world/ and are untouched by this cleanup
+  assert.ok(fs.existsSync(path.join(LANDING, 'assets', 'world', 'r2-bongos-chrome-b.jpg')), 'the chrome plate at assets/world/ is untouched (task 1003649 converts it separately)');
+});

package/tests/people_name_only.mjs

@@ -0,0 +1,262 @@
+// tests/people_name_only.mjs — the People directory lists a hidden builder by
+// name alone (task 1002291 / R15, ADR 0334; privacy spec D2's recruiter column:
+// "listed name-only (if not opted out)").
+//
+// GET /scouting now answers two tiers: `builders`, ranked on the cross-project
+// record, and `name_only`, the builders who hid that record but are still open
+// to recruiting. The server decides who is in each (tests/scouting_owner_access_-
+// and_reach.mjs); this file holds the PAGE to the rules that keep the second
+// tier honest on screen:
+//   - it is its own panel, revealed only when the server sends a row
+//   - a row is the identity cell and nothing else — no figure, no role, no date
+//   - it is never ranked: alphabetical whatever the sort lens says
+//   - search reads a name; a role filter never matches (the role is part of the
+//     record the builder hid)
+//   - the page still makes ONE read
+//
+// It runs the REAL people.js and the REAL kit in a vm, over a DOM fake one step
+// deeper than tests/people_directory_clip.mjs's: an element keeps the node it
+// hands out for a selector, so the <tbody> the kit fills is the one read back.
+//
+// Run:  node tests/people_name_only.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const KIT_JS = read('modules/hall-ui/public/hall-kit.js');
+const PEOPLE_JS = read('modules/hall-ui/public/people.js');
+const PEOPLE_HTML = read('modules/hall-ui/public/people.html');
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+function makeEl(id) {
+  const kids = new Map();
+  const listeners = {};
+  return {
+    id,
+    innerHTML: '', textContent: '', value: '',
+    hidden: false, disabled: false, className: '',
+    options: [], style: {}, dataset: {},
+    classList: { add() {}, remove() {}, toggle() {}, contains: () => false },
+    appendChild() {}, setAttribute() {}, removeAttribute() {},
+    addEventListener(type, fn) { (listeners[type] ||= []).push(fn); },
+    fire(type) { (listeners[type] || []).forEach((fn) => fn({ target: { matches: () => true } })); },
+    querySelector(sel) {
+      if (!kids.has(sel)) kids.set(sel, makeEl(sel));
+      return kids.get(sel);
+    },
+    querySelectorAll() { return []; },
+  };
+}
+
+function realRoleLabel() {
+  const src = read('modules/hall-ui/public/dom-utils.js');
+  const win = { location: { search: '', hash: '', pathname: '/' }, addEventListener() {}, localStorage: null };
+  const doc = { addEventListener() {}, querySelector: () => null, querySelectorAll: () => [], documentElement: { dataset: {} } };
+  new Function('window', 'document', src)(win, doc);
+  return win.OTB.roleLabel;
+}
+
+// Ranked rows carry a record; the sentinels are what a name-only row must never show.
+const RANKED = [
+  { github_id: 1, github_login: 'zed-ranked', display_name: 'Zed', avatar_url: null, project_count: 2,
+    total_credits: 900, total_tasks_shipped: 9, total_karma: 4, last_active: '2026-09-01T00:00:00Z', disciplines: ['engineer'] },
+  { github_id: 2, github_login: 'amy-ranked', display_name: 'Amy', avatar_url: null, project_count: 1,
+    total_credits: 100, total_tasks_shipped: 1, total_karma: 1, last_active: '2026-09-02T00:00:00Z', disciplines: ['artist'] },
+];
+// Alphabetical by login, as the server sends them.
+const NAMED = [
+  { github_login: 'bea-hidden', display_name: 'Bea', avatar_url: null },
+  { github_login: 'cal-hidden', display_name: null, avatar_url: 'https://avatars.githubusercontent.com/u/7?v=4' },
+];
+
+function harness(payload) {
+  const els = new Map();
+  const getEl = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+  const documentObj = {
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    getElementById: getEl,
+    querySelector(sel) { return getEl(String(sel).replace(/^#/, '')); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+  const requests = [];
+  const store = new Map();
+  const windowObj = {
+    location: { assign() {}, href: '/people', search: '' },
+    localStorage: {
+      getItem: (k) => (store.has(k) ? store.get(k) : null),
+      setItem: (k, v) => store.set(k, String(v)),
+      removeItem: (k) => store.delete(k),
+    },
+    addEventListener() {},
+    OTBBranding: { currencyLabel: () => 'Credits' },
+    OTB: {
+      roleAxisLabel: () => 'Role',
+      roleLabel: realRoleLabel(),
+      fmtInt: (n) => String(Number(n) || 0),
+      rankLabel: (r) => String(r ?? ''),
+    },
+  };
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console: { error() {}, warn() {}, log() {} },
+    CSS: { escape: (s) => String(s) },
+    setTimeout, clearTimeout, URLSearchParams, encodeURIComponent, Date, Math, JSON,
+    fetch: (url) => {
+      requests.push(String(url));
+      return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(payload) });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
+  vm.runInContext(PEOPLE_JS, sandbox, { filename: 'people.js' });
+
+  const filters = () => getEl('people-filters');
+  return {
+    getEl,
+    requests,
+    rankedRows: () => getEl('people-body').querySelector('tbody').innerHTML,
+    namedRows: () => getEl('people-named-body').querySelector('tbody').innerHTML,
+    // Drive the kit's filter bar the way a reader does: set the control, fire.
+    setFilter(id, value) {
+      filters().querySelector(`#${id}`).value = value;
+      filters().fire(id === 'people-q' ? 'input' : 'change');
+    },
+  };
+}
+
+const loginsIn = (html) => [...html.matchAll(/class="dir-login">@([^<]+)</g)].map((m) => m[1]);
+
+// ---------------------------------------------------------------------------
+
+await test('the page carries the name-only panel, hidden until the server sends a row', () => {
+  const tag = PEOPLE_HTML.match(/<section[^>]*id="people-named-scroll"[^>]*>/);
+  assert.ok(tag, 'a panel of its own — a hidden builder is not a row in the ranked ledger');
+  assert.match(tag[0], /class="scroll"/, "the shell's panel, not a fourth card level");
+  assert.match(tag[0], /\bhidden\b/, 'it ships hidden: an instance with no such builder shows nothing');
+  assert.match(PEOPLE_HTML, /id="people-named-h"[^>]*>[^<]+<span class="count-pill" id="people-named-count" hidden>/,
+    'a heading with its own count');
+  const lede = (PEOPLE_HTML.match(/<p class="scroll__lede" id="people-named-lede">([^<]+)<\/p>/) || [])[1] || '';
+  assert.match(lede, /private/i, 'the lede says why these builders show no record');
+  assert.match(lede, /ranked/i, 'and that they are never ranked');
+  assert.match(lede, /filter/i, 'and that a role filter never finds them');
+  assert.match(PEOPLE_HTML, /id="people-named-body"/, 'and a mount for the ledger');
+});
+
+await test('name-only rows render the identity cell and nothing else', async () => {
+  const h = harness({ builders: RANKED, name_only: NAMED });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-named-scroll').hidden, false, 'revealed once a row arrives');
+  assert.equal(h.getEl('people-named-count').textContent, '2');
+  assert.equal(h.getEl('people-named-count').hidden, false);
+  const rows = h.namedRows();
+  assert.deepEqual(loginsIn(rows), ['bea-hidden', 'cal-hidden'], 'each builder, by login');
+  assert.match(rows, /<a class="lb-name dir-name" href="https:\/\/github\.com\/bea-hidden"/,
+    'the same door the ranked row has — the one page every listed builder has');
+  assert.match(rows, /<img class="dir-avatar" src="https:\/\/avatars\.githubusercontent\.com\/u\/7\?v=4"/, 'and the picture');
+  assert.match(rows, />cal-hidden</, 'a builder with no display name reads as their login');
+  assert.doesNotMatch(rows, /ledger__num|ledger__date|fact-chip/,
+    'no figure, no date and no role cell: every one of those is the record the builder hid');
+});
+
+await test('the ranked ledger is untouched by the second tier', async () => {
+  const h = harness({ builders: RANKED, name_only: NAMED });
+  await tick(); await tick();
+  assert.deepEqual(loginsIn(h.rankedRows()), ['zed-ranked', 'amy-ranked'],
+    'ranked in the server order, as before — and no hidden builder among them');
+  assert.equal(h.getEl('people-count').textContent, '2', 'its count is the ranked count');
+  assert.match(h.getEl('people-sub').textContent, /2 more .*by name only/,
+    'the subtitle counts both tiers, so it does not claim the ranked list is everyone');
+});
+
+await test('a sort lens never re-orders the name-only list — it is not ranked', async () => {
+  const h = harness({ builders: RANKED, name_only: [...NAMED].reverse() });
+  await tick(); await tick();
+  const before = loginsIn(h.namedRows());
+  for (const lens of ['ships', 'credits', 'karma', 'projects', 'recent']) {
+    h.setFilter('people-sort', lens);
+    assert.deepEqual(loginsIn(h.namedRows()), before, `the ${lens} lens has nothing to sort a hidden record by`);
+  }
+  assert.deepEqual(loginsIn(h.rankedRows()), ['amy-ranked', 'zed-ranked'],
+    'CONTROL: the ranked list DID re-order — the last lens, most recently active, puts Amy first');
+});
+
+await test('search reads a name; a role filter never matches a hidden builder', async () => {
+  const h = harness({ builders: RANKED, name_only: NAMED });
+  await tick(); await tick();
+  h.setFilter('people-q', 'bea');
+  assert.deepEqual(loginsIn(h.namedRows()), ['bea-hidden'], 'a hidden builder is findable by name');
+  assert.deepEqual(loginsIn(h.rankedRows()), [], 'and the ranked list filters the same search');
+  h.setFilter('people-q', '');
+  h.setFilter('people-craft', 'engineer');
+  assert.deepEqual(loginsIn(h.namedRows()), [], 'the role is part of the hidden record, so a role filter finds no one here');
+  assert.match(h.namedRows(), /ledger__empty/, 'and says so in the panel rather than leaving it blank');
+  assert.deepEqual(loginsIn(h.rankedRows()), ['zed-ranked'], 'CONTROL: the role filter does apply to the ranked list');
+});
+
+await test('no name-only rows — or an older server that sends no such key — leaves the panel hidden', async () => {
+  for (const payload of [{ builders: RANKED, name_only: [] }, { builders: RANKED }]) {
+    const h = harness(payload);
+    await tick(); await tick();
+    assert.equal(h.getEl('people-named-scroll').hidden, true, 'never revealed');
+    assert.deepEqual(loginsIn(h.rankedRows()), ['zed-ranked', 'amy-ranked'], 'and the directory renders as before');
+  }
+});
+
+await test('only hidden builders listed: the page renders them rather than the empty-directory notice', async () => {
+  const h = harness({ builders: [], name_only: NAMED });
+  await tick(); await tick();
+  assert.doesNotMatch(h.getEl('people-body').textContent, /Nobody is publicly listed/,
+    'the directory is not empty — two builders are listed by name');
+  assert.deepEqual(loginsIn(h.namedRows()), ['bea-hidden', 'cal-hidden']);
+  assert.match(h.rankedRows(), /ledger__empty/, 'the ranked ledger states its own empty case');
+  const sub = h.getEl('people-sub').textContent;
+  assert.match(sub, /^2 builders listed across hosted projects by name only\./,
+    'the subtitle counts who IS listed');
+  assert.doesNotMatch(sub, /\b0 builders|more by name only/, 'not "0 builders … 2 more" — a count of nothing');
+});
+
+await test('a FULL name-only response is hedged, and says a search cannot reach past it', async () => {
+  const CEILING = 500;
+  const full = Array.from({ length: CEILING }, (_, i) => ({ github_login: `h${String(i).padStart(3, '0')}`, display_name: null, avatar_url: null }));
+  let h = harness({ builders: RANKED, name_only: full });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-named-count').textContent, `${CEILING}+`, 'the pill may not state a total the page cannot know');
+  const foot = h.getEl('people-named-foot');
+  assert.equal(foot.hidden, false, 'the footnote shows on a clipped list');
+  assert.match(foot.textContent, /clipped at the first 500 by login/);
+  assert.match(foot.textContent, /Search only reads what this page loaded/, 'naming the one lens that reads this list');
+  assert.match(PEOPLE_HTML, /<p class="ledger__note" id="people-named-foot" hidden><\/p>/, 'the slot ships hidden');
+  h = harness({ builders: RANKED, name_only: full.slice(0, CEILING - 1) });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-named-foot').hidden, true, 'one short of the ceiling is a complete list');
+  assert.equal(h.getEl('people-named-count').textContent, String(CEILING - 1));
+});
+
+await test('both tiers empty: the consent-boundary notice still explains the empty page', async () => {
+  const h = harness({ builders: [], name_only: [] });
+  await tick(); await tick();
+  assert.match(h.getEl('people-body').textContent, /Nobody is publicly listed/);
+  assert.equal(h.getEl('people-named-scroll').hidden, true, 'and the second panel stays hidden');
+});
+
+await test('the page still makes ONE read for both tiers', async () => {
+  const h = harness({ builders: RANKED, name_only: NAMED });
+  await tick(); await tick();
+  assert.equal(h.requests.length, 1);
+  assert.match(h.requests[0], /^\/api\/bongos\/scouting\?limit=/);
+});
+
+summary();

package/tests/profile_rollup_consent.mjs

@@ -62,6 +62,7 @@ const ALL_ORIGINS = [PUB_ORIGIN, PRIV_ORIGIN, STEALTH_ORIGIN, UNREAD_ORIGIN];
 const q = (sql, params) => pool.query(sql, params);
 
 async function cleanup() {
+  await q(`DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM platform_identity_project_memberships WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
@@ -81,7 +82,9 @@ try {
   // error dressed up as a boundary failure — instead of a clean assertion.
   // 011 and 020 carry the columns the naming rule reads (description, visibility,
   // the door-known pair); 012_recent_ships the column the rollup SELECTs; 008 and
-  // 009 the handle and display_name_source columns upsertAccount writes.
+  // 009 the handle and display_name_source columns upsertAccount writes; 022 is
+  // the table upsertActivity now also writes on every call (task 1002977) — step
+  // 5 below issues that INSERT, and a fresh database without it fails 42P01.
   await q(migrationSql('platform_identity_001_tables.sql'));
   await q(migrationSql('platform_identity_004_projects.sql'));
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
@@ -93,6 +96,7 @@ try {
   await q(migrationSql('platform_identity_012_recent_ships.sql'));
   await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
   await q(migrationSql('platform_identity_020_visibility_pull.sql'));
+  await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
   await cleanup();
 
   // CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state='active' AND

package/tests/profile_route.mjs

@@ -420,6 +420,17 @@ const engine = {
       if (/NOT pa\.hide_stats/.test(sql)) rows = rows.filter((r) => !r.hide_stats);
       return { rows: rows.map((r) => ({ ...r.row })) };
     }
+    // listScoutingNameOnly — the directory's name-only tier (task 1002291). The
+    // same literal-minded rule: only the predicates it declares. Each row comes
+    // back WHOLE, numbers included, so the route's projection has to drop them.
+    if (/^\s*SELECT github_login, display_name, avatar_url\s+FROM platform_identity_accounts/.test(sql)) {
+      let rows = SCOUTING_TABLE;
+      if (/profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
+      if (/terms_accepted_at IS NOT NULL/.test(sql)) rows = rows.filter((r) => r.terms_accepted_at != null);
+      if (/account_visibility = 'public'/.test(sql)) rows = rows.filter((r) => r.account_visibility === 'public');
+      if (/AND hide_stats\)/.test(sql)) rows = rows.filter((r) => r.hide_stats);
+      return { rows: rows.map((r) => ({ ...r, ...r.row })) };
+    }
     // setAccountHideStats — the own-scoped write behind PATCH /me/cross-project.
     if (/INSERT INTO platform_identity_accounts/.test(sql)) {
       hubAccount.hide_stats = !!params[4];
@@ -635,16 +646,23 @@ scoutApp.use(attachFail);
 scoutApp.use('/api/bongos', buildScoutingRoutes());
 const scout = await listen(scoutApp);
 
-await t('R06.3 GET /scouting drops the hidden, the provisional AND the private builder', async () => {
+await t('R06.3 GET /scouting ranks the visible builder, lists the HIDDEN one by name alone, and drops the provisional AND the private', async () => {
   engine.calls.length = 0;
   const r = await get(scout.port, '/api/bongos/scouting');
   assert.equal(r.status, 200);
   const logins = r.json.builders.map((b) => b.github_login);
   assert.deepEqual(logins, ['r06-visible'],
-    'only the consented, publicly-visible, non-hidden builder is listed (task 1002967 added the visibility axis)');
-  assert.equal(engine.calls.length, 1, 'exactly ONE read — nothing can re-enter via a second, unfiltered query');
-  for (const s of [HIDDEN_LOGIN, PROV_LOGIN, PRIVATE_LOGIN, '88817', '6613', '5519', '71713', '63127', '4409', '2287']) {
-    assert.ok(!r.text.includes(s), `the excluded builder leaks nothing — found "${s}"`);
+    'only the consented, publicly-visible, non-hidden builder is RANKED (task 1002967 added the visibility axis)');
+  // Task 1002291 (privacy spec D2): a hidden builder is "listed name-only", not
+  // dropped. Hide takes the record away; the name stays findable.
+  assert.deepEqual(r.json.name_only, [{ github_login: HIDDEN_LOGIN, display_name: 'Hidden', avatar_url: null }],
+    'the hidden builder is listed by login, name and avatar — and nothing else');
+  assert.equal(engine.calls.length, 2, 'exactly TWO reads — the ranked tier and the name-only tier');
+  for (const c of engine.calls) {
+    assert.match(c.sql, /profile_state = 'active'/, 'and each carries the consent predicate — nothing re-enters unfiltered');
+  }
+  for (const s of [PROV_LOGIN, PRIVATE_LOGIN, '88817', '6613', '5519', '71713', '63127', '4409', '2287']) {
+    assert.ok(!r.text.includes(s), `the excluded builder, and the hidden builder's record, leak nothing — found "${s}"`);
   }
 });
 

package/tests/project_admin_console_model.mjs

@@ -0,0 +1,105 @@
+// tests/project_admin_console_model.mjs — the project admin console model holds
+// (task 1002813, R1 of the console wave; the ADR whose filename ends in ADR_SLUG).
+//
+// The ADR decides three things and then tells three build tasks what to build on
+// them. Its decisions rest on facts about live code, and a decision whose premises
+// drift quietly is worse than none, so the load-bearing ones are pinned here:
+//
+//   D1  the hub relays and notifies; it never writes a project's admission row
+//   D2  an invite is a row the existing gate already reads — `kind` and
+//       `created_by` are descriptive and never enter the admission read
+//   D3  the admission verdict stays `access_request.review` at the archon floor,
+//       and `project.recruit`, once minted, takes exactly the shape the ADR fixes
+//
+// The ADR is found by its slug, not its number, because a parallel ADR can take
+// the number first and force a renumber (tests/adr_renumber_integrity.mjs).
+//
+// Run:  node --test --test-reporter=tap tests/project_admin_console_model.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ADR_DIR = path.join(ROOT, 'docs', 'adr');
+const ADR_SLUG = 'an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md';
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const { stripComments } = require(path.join(ROOT, 'scripts', 'gds', 'category-advisory-guard.js'));
+
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+
+function findAdr() {
+  const hits = fs.readdirSync(ADR_DIR).filter((f) => /^\d{4}-/.test(f) && f.endsWith(ADR_SLUG));
+  assert.equal(hits.length, 1, `exactly one ADR ends in ${ADR_SLUG}; found ${hits.length}`);
+  return hits[0];
+}
+
+function jsFilesUnder(dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules' || entry.name === 'tests') continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...jsFilesUnder(full));
+    else if (entry.name.endsWith('.js')) out.push(full);
+  }
+  return out;
+}
+
+test('the ADR exists, is indexed, and ADR 0141 names it as superseding its §5 invitations note', () => {
+  const file = findAdr();
+  const index = read('docs', 'adr', 'README.md');
+  assert.ok(index.includes(`](${file})`), 'docs/adr/README.md carries an index row linking the ADR');
+
+  const status = read('docs', 'adr', '0141-cross-site-identity-federated-hub-idp.md')
+    .split(/\r?\n/)
+    .find((l) => l.startsWith('- **Status:**'));
+  assert.ok(status, 'ADR 0141 keeps a Status line');
+  assert.ok(status.includes(file), 'ADR 0141 Status line links the superseding ADR');
+  assert.match(status, /§5/, 'the supersession is partial — it names §5, not the whole of ADR 0141');
+
+  const specHead = read('docs', 'specs', 'bongos-v1-project-admin-console.md').split(/\r?\n/)[0];
+  assert.ok(specHead.includes(file), 'the spike spec sends its reader to the ADR that narrowed it');
+});
+
+// Both admission reads: the gate's own (hasInvitedAccessRequest) and the state the
+// "confirming access" waiting page polls (accessStateByLogin), which must agree with it.
+test('D2: both admission reads look at status alone — an invite and an approved application admit identically', () => {
+  const src = read('src', 'bongos', 'db-kernel.js');
+  for (const fn of ['hasInvitedAccessRequest', 'accessStateByLogin']) {
+    const m = new RegExp(`async function ${fn}\\([^)]*\\)\\s*\\{([\\s\\S]*?)\\n\\}`).exec(src);
+    assert.ok(m, `${fn} is still an admission read in db-kernel.js`);
+    const body = m[1];
+    assert.match(body, /status\s*=\s*'invited'/, `${fn}: admission is status = invited`);
+    assert.doesNotMatch(body, /\bkind\b/, `${fn}: kind is descriptive; it must never decide admission`);
+    assert.doesNotMatch(body, /\bcreated_by\b/, `${fn}: created_by is audit data; it must never decide admission`);
+  }
+});
+
+test('D1: no hub (platform-identity) source writes access_requests — the hub relays, it never admits', () => {
+  const writers = [];
+  for (const f of jsFilesUnder(path.join(ROOT, 'modules', 'platform-identity'))) {
+    const code = stripComments(fs.readFileSync(f, 'utf8'));
+    if (/\b(?:INSERT\s+INTO|UPDATE|DELETE\s+FROM)\s+access_requests\b/i.test(code)) {
+      writers.push(path.relative(ROOT, f));
+    }
+  }
+  assert.deepEqual(writers, [], 'a project admits on its own instance; the hub reaches it only through a relay');
+});
+
+test('D3: the verdict stays access_request.review at archon, and project.recruit takes the fixed shape', () => {
+  const review = catalog.byKey('access_request.review');
+  assert.ok(review, 'access_request.review exists');
+  assert.equal(review.floor, 'archon', 'the admission verdict stays at the archon floor');
+
+  // R3 (task 1002815) mints the atom. Until then there is nothing to check; once
+  // it lands, this is the shape the ADR fixed, so a drifted mint reds here.
+  const recruit = catalog.byKey('project.recruit');
+  if (!recruit) return;
+  assert.equal(recruit.floor, 'archon', 'the per-project invite floor defaults to archon (ADR 0217 D1)');
+  assert.equal(recruit.system, false, 'grantable, and composable into a custom rank');
+  assert.ok(!recruit.substrate, 'enforced in the app, so a grant is never inert');
+  assert.ok(recruit.principal == null, 'held by ranks, never by a machine principal');
+});