@bongos/core 1.19.1016 → 1.19.1017

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1016",
-  "core_contract": "1.19.1016",
-  "source_commit": "b851150b854b6cb84117b7844e8790a7abb302ab",
+  "core_version": "1.19.1017",
+  "core_contract": "1.19.1017",
+  "source_commit": "9a573618264550e005f12355e27d3a7b181a3baf",
   "source_ref": "HEAD",
-  "built_at": "2026-09-25T01:04:44.947Z",
+  "built_at": "2026-09-25T01:23:29.511Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 525,
+    "docs_redacted": 526,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2432,
+    "functional_verbatim": 2439,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2983,
-  "tree_sha256": "8dde43afac6292dd0280de03c46e9f393fddaab6c42bbbee84ac05784ce96a52",
+  "file_count": 2991,
+  "tree_sha256": "0df28ef9d48e95b2b0701f4c132182d88e6e5e5995bf19569136cfedb92f1299",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "26e3e9bd1e4dc4e7715eaabfdc155b98da64eefc2c002a18f4c5da0b5b288baa"
+      "sha256": "1d0f3cc30c66a4eb757e297d95406a42c55cedc073ee29671827926f06c0d260"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "6684688f85798c74d0c58853fa54c90e30a69c442708e191a3ef15b8f06ca0fb"
+      "sha256": "c913bb0302165f718776d8f5f6f5d3bdde73ee152a9eabbe3fc4f92d23e6b0e3"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "5b844bbe07c67c1ac42f46d8a065d59039a447ca38ca6ae9f3422c081038cd8a"
+      "sha256": "48051577351ecb7f13d874668d2ed3171b1cad370969ba5e8b4124b20584c839"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "68f3117d69e1bb2d68c398aab75cc302b833404d37a13f1297f5c68f03f7a1aa"
+      "sha256": "ffbc111669a6fb27297d1819c35d02f732c3d69b87411613a88b348b0fa897c6"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "24cf3312198537eb92a5c2f247faa826f596fae91a44705905bd80a5cdc8c7b0"
+      "sha256": "81da43a07fc9e2c89899334f58440d07c8f36df0efc5a1f3a9512a20f2a90047"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2154,6 +2154,11 @@
       "mode": "0000644",
       "sha256": "659b73c16da06bb150434de1eae1bcc1dfe4f6acf61ac0b2d787f3b52f617187"
     },
+    {
+      "path": "docs/adr/0334-the-recruiting-directory-lists-a-hidden-builder-by-name.md",
+      "mode": "0000644",
+      "sha256": "60b5794466cfbdd544c19119d6e6e18ae264782b90b0d3a1d96d4a178619e62c"
+    },
     {
       "path": "docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md",
       "mode": "0000644",
@@ -2167,17 +2172,17 @@
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "737e64b05ae9128a7320d5d142278a6fb8f28187f8036649d6b4752576726949"
+      "sha256": "83fa5a319b2680beec179cf4f9dc5a1b630699aa2cfa7443300694b724215e8f"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "9d41ac5a4a8e13d03487068f43de42fbd0d58d4ab66f7599e2a05b7f929c1fc9"
+      "sha256": "89d96b4b83075fea2954bbbfda5d815a74f12a06f46cb11da3d83c3d7951d65b"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "5aa56fcfb0a0fb6f7af0e96ed6b48848cf50657854ff57a7e8bea5177c0b3f89"
+      "sha256": "0e679eec9a95a36a04a91c2d37a34dcba1dec397b0eff30eff6b0b1c5e267627"
     },
     {
       "path": "docs/architecture.md",
@@ -2202,12 +2207,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "94ef983fbe12b8d7d3314a7ebe74486ba419b382e9ae449ebdf5e5aafc56f16a"
+      "sha256": "7824524ca9e6c4eed55c42542e5bca4904650f4476218a22012bf8e13d1e9ac3"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d39ca24221a9eec0ede5cd4dd594dc9558337999e5ace5c3145a5c462da1f39b"
+      "sha256": "72b54a0726ff452ddc7c1e6938b6274c1251e2a471592d8083e2530aeef10778"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2727,7 +2732,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "90e0058ee679d9dc8c9fd5bad7dad2fd05cb22dd4d5fc4831827ec42f51207d2"
+      "sha256": "569c8541506b9f7669dfda06ab3768be173e7d2091d8ff591c07fa67c0fda0eb"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2737,7 +2742,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ea0498c65e3167f316d25a081ba9e74b410e9012daf478c42b2c43b0cca6201e"
+      "sha256": "67d5afba0afa656dbf2f89d7591cc91af04a97492c85959ef6dd41ccc764e12a"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5182,17 +5187,17 @@
     {
       "path": "modules/hall-ui/public/people.html",
       "mode": "0000644",
-      "sha256": "d94e1d3bf0a0f819469b995b4723f756d301fffcc6f42fb132bdaa82815f7011"
+      "sha256": "4da8ca7dc9321f3d7303332e78ec9caeb6ea65a71fa670b20f593874514585ac"
     },
     {
       "path": "modules/hall-ui/public/people.js",
       "mode": "0000644",
-      "sha256": "37d7c9b14bb42a473ef7caf45f138cd87b01b976bb593d1fd2a0c82c94208539"
+      "sha256": "4f5ececf426b07f6df121c857f15c436e1ae4c1269c7352104f258a21589eca1"
     },
     {
       "path": "modules/hall-ui/public/people.states.json",
       "mode": "0000644",
-      "sha256": "6f7612bf9ef7da53e2f66337921ee30a13f8a28bde61044f9263bc45a8074edc"
+      "sha256": "5db6df77fb3ea39e03de3489178ab2bf3e978fdd7f67b795ce0da207c71e3eb9"
     },
     {
       "path": "modules/hall-ui/public/primer.css",
@@ -6417,7 +6422,7 @@
     {
       "path": "modules/platform-identity/account-visibility.js",
       "mode": "0000644",
-      "sha256": "020279ae50f2f9e7a004fe571e5ca14493ad26bd22c395cc4805f759f5560b72"
+      "sha256": "59275121f2a8c6a044659ca94c7f7671f65be27bfc4a6759ec94afc962fc01cd"
     },
     {
       "path": "modules/platform-identity/activity-snapshots.js",
@@ -6434,6 +6439,11 @@
       "mode": "0000644",
       "sha256": "8217660dc23b57ba0fb54d6375aca9aec190c7abb1d70f9d44d4e290da272c64"
     },
+    {
+      "path": "modules/platform-identity/builder-search.js",
+      "mode": "0000644",
+      "sha256": "69e85980a3cb693fa3d39f05b6fadee34799e27c66a2e63fe86ca461f2cfa394"
+    },
     {
       "path": "modules/platform-identity/canonical-profile.js",
       "mode": "0000644",
@@ -6574,10 +6584,15 @@
       "mode": "0000644",
       "sha256": "b9b4ca90e638af35682b04d311b2ed42f4630a41e003ee329648374fe74fef09"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_023_builder_search_trgm.sql",
+      "mode": "0000644",
+      "sha256": "f119d0d4f8775e2ec1e0e30702ba9564d7f4f712853751e2e66bb3c103cf1da4"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "cc6f7ab084ee74715241220339411d1a10c8d6697af143df452278ea2c634f79"
+      "sha256": "a0f4d7143929eee513926111a314c5687005c95ebff998d0d59dd498bb5c62f2"
     },
     {
       "path": "modules/platform-identity/origin-containment.js",
@@ -6624,6 +6639,11 @@
       "mode": "0000644",
       "sha256": "4f6854050e3c7459f698c550577fa97958a573d7f1981c9de4d29417af2669c0"
     },
+    {
+      "path": "modules/platform-identity/routes/community-search.js",
+      "mode": "0000644",
+      "sha256": "f2f8f4f7a94b7f3a917b583a71fcaf482d110ed06e22a1c1aaad6d9a71a34cad"
+    },
     {
       "path": "modules/platform-identity/routes/connections.js",
       "mode": "0000644",
@@ -6652,7 +6672,7 @@
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
-      "sha256": "0f898c038abc6c0aceb2f5649008cdc7fc66bc1b7f83129aae3da65f1eb33c15"
+      "sha256": "fbd1f8679be51718131d3d95d6ed7d8dcd1ebe091df6cfc190b69fd62c00013c"
     },
     {
       "path": "modules/platform-identity/routes/sso.js",
@@ -6664,6 +6684,11 @@
       "mode": "0000644",
       "sha256": "b4da61899339ac5e9fac517efa4b3d98e39a8e7d38fd8b0cffbd8464ba85e902"
     },
+    {
+      "path": "modules/platform-identity/scouting-name-only.js",
+      "mode": "0000644",
+      "sha256": "cfffe99b93ad044a115f322eec909983b0e12428975d7cf1e0f2bd9060f922ce"
+    },
     {
       "path": "modules/platform-identity/terms-acceptance.js",
       "mode": "0000644",
@@ -7487,12 +7512,12 @@
     {
       "path": "modules/public-landing/public/projects-floor.states.json",
       "mode": "0000644",
-      "sha256": "b02464625daff141f318ae902151b914661236bb369147507f5920dd0cd9665d"
+      "sha256": "598d3d330ec8f054a8af2ca0b354e7f3a604c6335a34607dd6bcd4cd2dae4584"
     },
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "60439c0cfe1c6ac00bc2054342f9065f03e0a2a7cc8f8fb6ba4c7ba8f754661f"
+      "sha256": "5239de18d6e58de7e8e22f4666965afe956f567b3f31304a206feb9f476258cc"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -8207,7 +8232,7 @@
     {
       "path": "modules/ui-design/styles/expedition/mock.html",
       "mode": "0000644",
-      "sha256": "baeccde1879cfb781ddf8da40f0080352fe6a2c1f015b1c8bbfe8fad49f1b6d0"
+      "sha256": "3596b070d8ece6f93894257fd9d8ae5c6a4a12690302c13e6eafa971161b102d"
     },
     {
       "path": "modules/ui-design/styles/expedition/mock.states.json",
@@ -8262,12 +8287,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c40b22193411a5ab4aeb39970ddc87ab3cc170bc0bc31648ee97abca8ce4fcea"
+      "sha256": "95953cc5ca598a00deaa5aeb7f508b6b80c161f90fa7d3fd801f3d86b23bad7d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "14e4e326449774e1d15023eb3ff52f1bf147b710ae6be8e83b422f05c69e0abe"
+      "sha256": "3b1e756b16420ac260634273c6b00ab0e08e5c81ebe9df3496ec1b5b60bde3ae"
     },
     {
       "path": "public-docs/index.html",
@@ -10312,7 +10337,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d156fd5b889037c1ff215c0d48ceadb9cf07717bda0b547a77a5eccf3d0835bf"
+      "sha256": "45613a020e18c5494e4b2664f97274a34f225e2d2c35ecd38b2926528b150a8a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10407,7 +10432,7 @@
     {
       "path": "tests/account_privacy_flags.mjs",
       "mode": "0000644",
-      "sha256": "8318379f7c012dbd56ac983649da92182d4a1b7178833285b6cd7fd75d46fa13"
+      "sha256": "1b49da051770c8bcce351c5d6dd96070962913bb63c687a7b5ae0cc0248ad1e6"
     },
     {
       "path": "tests/achievements_reconcile.mjs",
@@ -11029,6 +11054,11 @@
       "mode": "0000644",
       "sha256": "2ddceb37d46eda5c3ab2a56b54c86f3cf55596479b5fe7f30646f45b1ac11ac2"
     },
+    {
+      "path": "tests/card_apply_ui.mjs",
+      "mode": "0000644",
+      "sha256": "998dcc1ca4ff0dfc2368fe4237a5b00bc98fbf7824cd1992f1f7e90bb01c1c56"
+    },
     {
       "path": "tests/cascade-dispatch.mjs",
       "mode": "0000644",
@@ -11169,6 +11199,11 @@
       "mode": "0000644",
       "sha256": "654e70af16092ed0dc76c058b245863c8470b8c3441c39e4c4f5bfd40f60c138"
     },
+    {
+      "path": "tests/community_search_route.mjs",
+      "mode": "0000644",
+      "sha256": "4562631deca93ab222d9ead95c31cbc0964f30194dd59e025bfee35c4d18bb80"
+    },
     {
       "path": "tests/compose_demo_credentials.mjs",
       "mode": "0000644",
@@ -11542,7 +11577,7 @@
     {
       "path": "tests/effective_visibility_predicate.mjs",
       "mode": "0000644",
-      "sha256": "17b7292dba01d25f160d2dd292661e5c236b3f390399e66bfab09124b551eb8f"
+      "sha256": "385ffb03ca61b6422f521dfefa4ab584af1fe87cd8bd4c6fb4cf3a5d631acc28"
     },
     {
       "path": "tests/est_advisory.mjs",
@@ -13254,6 +13289,11 @@
       "mode": "0000644",
       "sha256": "e3b2f36780b35fd66690b1c426832322b2781c5386cf7fd50e995a7c2cc089bb"
     },
+    {
+      "path": "tests/people_name_only.mjs",
+      "mode": "0000644",
+      "sha256": "a94562e7680e7153b065fa5b152e13d9880de477e7e9f2a4c9b8de0224266ead"
+    },
     {
       "path": "tests/permission_path.mjs",
       "mode": "0000644",
@@ -13357,7 +13397,7 @@
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "b0ce292dc642be5100cce00c199ef3dc253098ddd952eb7618c6ca6ff3fc54e5"
+      "sha256": "2e23ed585a9cc31bc3627c284ba7fd1e9234ef746d050d79fa771e8029eaf1e8"
     },
     {
       "path": "tests/profile_ui_cross_project.mjs",
@@ -13797,7 +13837,7 @@
     {
       "path": "tests/recruiter_sliver_boundary.mjs",
       "mode": "0000644",
-      "sha256": "a9ad552e7060898e5c94db8af29e63d7cad568294c240c48bef78859a0558ec6"
+      "sha256": "522df6e7930347ff312ef5b2cb98cfde3c53f7465a133618dd970872241bc2b3"
     },
     {
       "path": "tests/redteam_followup_kind.mjs",
@@ -13962,7 +14002,7 @@
     {
       "path": "tests/scouting_owner_access_and_reach.mjs",
       "mode": "0000644",
-      "sha256": "d5ba589fac458e51cf16ed25d01744c3bb020d607d13b85b23d780a655f30261"
+      "sha256": "bbaff2a089e24b294961d8be52714be3704b81b934457a0872e32bdf3b330a96"
     },
     {
       "path": "tests/scouting_page_gate.mjs",
@@ -14732,7 +14772,7 @@
     {
       "path": "tests/ui_design_styles.mjs",
       "mode": "0000644",
-      "sha256": "a2ab80b7fb38695bb65c617eff1c39cfbe17403b1586cb1b20e3dee50e5a23fa"
+      "sha256": "e10c29d3cf8ad7b617276c1af424a6f7c84b6b5b2c20c0284f229a0f0077c678"
     },
     {
       "path": "tests/unit_report_status.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 416 operations across 62 resource groups
+- 417 operations across 63 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -308,6 +308,10 @@ function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "community": {
+      // GET /community/search — rank: public — GET /community/search
+      getCommunitySearch: (args) => request("GET", "/community/search", { hasBody: false }, args),
+    },
     "connections": {
       // GET /connections — rank: any-builder — GET /connections
       getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -307,6 +307,10 @@ function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "community": {
+      // GET /community/search — rank: public — GET /community/search
+      getCommunitySearch: (args) => request("GET", "/community/search", { hasBody: false }, args),
+    },
     "connections": {
       // GET /connections — rank: any-builder — GET /connections
       getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -49,6 +49,7 @@ export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unk
 export interface GetClosenessForMeResponse { closeness: unknown; count: unknown; returned: unknown }
 export interface GetClosenessWeightsResponse { weights: unknown; window_days: unknown; note: unknown }
 export interface GetClosenessWithBuilderIdResponse { closeness: unknown; why: unknown }
+export interface GetCommunitySearchResponse { query: unknown; discipline: unknown; count: unknown; results: unknown; page: unknown }
 export interface GetConnectionsDegreeHandleResponse { handle: unknown; degree: unknown; mutuals: unknown; mutual_count: unknown; truncated: unknown }
 export interface GetConnectionsRequestsResponse { incoming: unknown; outgoing: unknown; incoming_count: unknown; outgoing_count: unknown }
 export interface GetConnectionsResponse { connections: unknown; count: unknown }
@@ -134,7 +135,7 @@ export interface GetPublicUptimeResponse { services: unknown }
 export interface GetPublicVersionsResponse { versions: unknown; page: PageInfo }
 export interface GetRemovalProposalsResponse { pending: unknown; count: unknown }
 export interface GetScoutingHandleResponse { sliver: unknown }
-export interface GetScoutingResponse { builders: unknown }
+export interface GetScoutingResponse { builders: unknown; name_only: unknown }
 export interface GetSecurityDocsResponse { docs: unknown }
 export interface GetSecurityDocsSlugResponse { doc: unknown }
 export interface GetSecurityReportsResponse { reports: unknown; bounty_table: unknown; statuses: unknown }
@@ -694,6 +695,10 @@ export interface BongosClient {
     /** GET /closeness/with/{builderId} — rank: any-builder */
     getClosenessWithBuilderId(args?: RequestArgs): Promise<GetClosenessWithBuilderIdResponse>;
   };
+  "community": {
+    /** GET /community/search — rank: public */
+    getCommunitySearch(args?: RequestArgs): Promise<GetCommunitySearchResponse>;
+  };
   "connections": {
     /** GET /connections — rank: any-builder */
     getConnections(args?: RequestArgs): Promise<GetConnectionsResponse>;

package/clients/bongos-client/index.mjs

@@ -304,6 +304,10 @@ export function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "community": {
+      // GET /community/search — rank: public — GET /community/search
+      getCommunitySearch: (args) => request("GET", "/community/search", { hasBody: false }, args),
+    },
     "connections": {
       // GET /connections — rank: any-builder — GET /connections
       getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),

package/docs/adr/0334-the-recruiting-directory-lists-a-hidden-builder-by-name.md

@@ -0,0 +1,47 @@
+# 0334 — The recruiting directory lists a hidden builder by name, and hide changes a row's shape, not whether it exists
+
+- **Status:** Accepted
+- **Date:** 2026-09-24
+- **Task:** [#1002291](https://cloudbongos.com/builders#/task/1002291) (R15, owner recruiting UI; goal 1000045 C5, now folded into goal 1000110)
+- **Relates to:** `docs/specs/<redacted>.md` D2 (owner-signed 2026-08-16), [ADR 0171](0171-profile-rollup-join-and-consent.md) D2, [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) D4, [ADR 0215](0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md), [ADR 0217](0217-rank-gates-inviting-not-viewing.md) D1/D2
+
+## Context
+
+R15 asks for an owner recruiting surface with search, a role filter and a sort by track record, and says it must honour the hide flag and the recruiting opt-out. Most of that already existed when the task was picked up. The hall's `/people` page (tasks 1002577, 1003470, 1003110) searches, filters by role and sorts. R14 (task 1002290, ADR 0210) opened it to project owners and made the opt-out remove a builder. The one thing that did not match the owner-signed spec was what "honour hide" does.
+
+The privacy spec's D2 matrix has a row for an account that is active, public and has hidden its cross-project stats. In the recruiter column it says **"listed name-only (if not opted out)"**. The directory did something else: `listScoutingRollup` joins `rollupVisibleSql`, which excludes `hide_stats`, so a hidden builder was dropped completely. In practice hide worked as a second opt-out.
+
+Two things made that a bug and not a harmless extra caution:
+
+- **The Settings copy said the opposite.** A hidden builder's "Discoverable by recruiters" row says *"Because your cross-project record is hidden, they will see your name and your picture, and nothing else"*, and that turning the switch off *"removes you from … the People directory"*. For that builder the second sentence was false, because they were never in the directory.
+- **Absence came from ADR 0171 D2, which predates the spec.** ADR 0171 dropped hidden builders from `/people` and `/scouting` before a privacy model existed, and it said *"if 1002785 lands a different privacy rule, its model wins"*. Spike 1002785 then produced the D2 matrix.
+
+## Decision
+
+**The directory answers in two tiers, and the hide flag decides a builder's tier, not whether they are listed.**
+
+| | Who | Carries |
+|---|---|---|
+| `builders`, the ranked tier | visible AND NOT hidden AND reachable (`scoutingListableSql`, unchanged) | the full rollup row, ranked on track record |
+| `name_only` | visible AND hidden AND reachable (`scoutingNameOnlySql`, new) | `github_login`, `display_name`, `avatar_url` and nothing else |
+
+1. **One predicate, flipped.** `scoutingNameOnlySql` is `scoutingListableSql` with the hide term reversed, built the same way. A test proves the two predicates differ only in that term, so no builder can be in both tiers or in neither. Only the recruiting opt-out removes a builder from the directory. It lives in `account-visibility.js` like every other visibility rule.
+2. **The existence floor stays.** A private account is never listed, even by name, and even when it opted in to recruiting. That account is the D3 sliver's subject, and the sliver is gated at the archon floor, which the owner kept (ADR 0215 D4, ADR 0217 D2). This ADR does not move that gate.
+3. **Presence must not depend on activity.** The ranked tier is built from the activity table, so only builders with a record appear in it. The name-only tier reads the accounts table alone. If it listed only hidden builders who had shipped something, appearing in the list would reveal that fact, and that fact comes from the hidden record.
+4. **The only sort key is the login.** The ranked tier is sorted by the record itself, so a hidden row placed among ranked rows would reveal roughly where its record would rank. Name-only rows sit in their own panel in alphabetical order. No sort lens reorders them, a search matches their name, and a role filter never matches them because the role list is part of the hidden record.
+5. **The row is a literal whitelist, and the predicate has exactly one reader.** `scouting-name-only.js` builds each row key by key from a statement that selects three identity columns. `scoutingNameOnlySql` admits hidden accounts by design, so a read that joined it and returned a number would leak the very record hide withholds. `tests/effective_visibility_predicate.mjs` therefore pins the predicate to that one file, that file to that one statement, and the statement to those three columns and no rollup table.
+
+These three fields are already public. A hidden builder's public profile page (`GET /profiles/:handle`) shows their handle, login, display name and avatar to anyone. The directory's audience is `project.curate` or a project owner, which is narrower. The only new fact the directory reveals is that the builder has not opted out of recruiting, and recruiters are the audience that setting exists for.
+
+## Consequences
+
+- A hidden builder who is still discoverable now appears on `/people` by name and picture. Recruiters were already promised this, and the Settings copy is now true without any wording change. Turning off "Discoverable by recruiters" removes them from both tiers. `tests/account_privacy_flags.mjs` now requires all three recruiting predicates to include the reach term.
+- `GET /scouting` gains a response key and changes nothing that already existed. `builders` still has the same rows and the same shape, and an older client that ignores `name_only` behaves as before. Under the hood the route now runs two reads instead of one. The page still makes a single request.
+- Tests that asserted a hidden builder was *absent* from the directory now assert that the builder is *listed by name only*, and that none of their numbers appear anywhere in the response (`tests/profile_route.mjs` R06.3). The real-database proof `tests/profile_rollup_consent.mjs` calls `listScoutingRollup` directly, which is the ranked tier, and is unchanged.
+- The creation wizard's invite suggestions (`invite-suggestions.js`, ADR 0251) still read the ranked tier only. A hidden builder has no record to rank, and adding them there would be a new decision, which this ADR does not make.
+
+## Rejected alternatives
+
+- **Keep the exclusion and just fix the copy.** This contradicts the owner-signed matrix row, and it keeps two switches doing the same job. Whether a builder can be found is the reach setting's decision alone.
+- **Mix hidden builders into the ranked ledger as trailing rows.** Their position below everyone else would read as a ranking, a role filter would need special cases, and the count, pager and clipping logic would all have to account for two kinds of row.
+- **Also list private, discoverable accounts by name.** That is the D3 sliver, held at the archon floor by an owner decision. The directory's door is wider than that, and widening it is exactly what ADR 0217 D2 declined to do.

package/docs/adr/README.md

@@ -423,5 +423,6 @@ This keeps the decision history honest and traceable.
 | 0329 | [**The rendered fit check is a kit floor and an advisory ship-check row, not a grader worker** ([task 1004203](https://cloudbongos.com/builders#/task/1004203), goal 1000095 — UI quality). Nothing in the pipeline rendered a page, so titles clipped by character count ran past their cards (task 1003480, task 1004204) and a second `.mSec` child would have landed on the first (task 1003078), each found only in a browser. Two new kit floors, `text-fit` (text measured word by word past its box; SVG text past its card rect) and `sibling-overlap` (in-flow, block-level, text-bearing siblings), run in every `render.js` render; `scripts/gds/render-check.js` renders the pages a branch changed at 1280 + 390 and `/ship-check` shows them as an ADVISORY row that never flips its exit (ADR 0162). Not a grader worker: that would put a browser, fixtures and a harness on the grader host for signal the builder already saw; the artist gate (ADR 0241) stays the human look before deploy.](0329-the-rendered-fit-check-is-a-kit-floor-and-an-advisory-ship-check-row.md) | ui-design / kit + ship-check |
 | 0330 | [**An ask is answered where it was asked** ([task 1004216](https://cloudbongos.com/builders#/task/1004216), goal 1000095 — BONGOS-V2), amending [ADR 0187](0187-collab-four-decisions.md) §4a. `lifecycle_004` let a builder ASK for help and let the **asker** mark their own row answered; the person being **asked** had no write at all, so the answer happened somewhere Bongos cannot see and the row sat open until its author remembered it — six asks addressed to the owner had been open between four and thirteen days on 2026-09-23, every one of them answerable. That was not an oversight: §4a deferred conversation to the Agora and a test named *"there is deliberately NO reply thread"* enforced it. **The deferral lost its addressee** — task 1002946 is ABANDONED and goal 1000064 ARCHIVED (verified against the live DB), so the rule had stopped meaning "wait for the Agora" and started meaning "an ask stays unanswerable forever to keep a promise to something that does not exist". **Decisions:** (1) an ask carries a thread of replies, APPEND-ONLY in the SCHEMA rather than by convention — no `updated_at`, `edited_by`, `deleted_at` or `parent_reply_id`, no reactions, no mentions, and a trigger that refuses UPDATE and DELETE outright, because a thing you can edit, nest, react to and address at people is a chat and that is what §4a declined; any builder may reply, since the board read is already project-wide and the good case is somebody you did not ask knowing the answer; (2) the **ADDRESSEE** may close an ask (`answered`), widening an asker-only UPDATE that was coherent only while nothing could be said on the row — but `withdrawn` does NOT widen, since "I no longer need this" is the asker's sentence alone and widening it would be a way to make an ask vanish unanswered; `settled_by` records which of the two closed it, and ADR 0187 §3's consent posture is untouched — closing ends a question, it does not accept work; (3) `/collab-review` posts the reply and **leaves the ask open** (owner decision), since an answer the reader has not read is exactly what an unattended run must halt on. **Consequences:** a reply cannot be taken back, by design; the FK **RESTRICTS rather than cascades** — the first draft cascaded, which reads right and was wrong, because a cascade is a plain DELETE the trigger refuses, so deleting an answered ask failed outright (caught by applying the migration to a real Postgres, not by reading it); the old test was REPLACED, not deleted, so the record that the restraint was deliberate survives; and replies inherit the pull-not-push posture, so nothing still tells an asker they were answered. Rejected: a single `answer` column (cheapest and unambiguously not a chat, but a follow-up would have nowhere to go except a second ask, splitting one conversation across two rows); waiting for the Agora (abandoned — waiting means forever); letting anyone close any ask (an open question is somebody's, and a stranger ending it should not be one click away).](0330-an-ask-is-answered-where-it-was-asked.md) | collab / lifecycle / schema |
 | 0331 | [**The sky is the ideator's home, and the project sky takes the goal map's page** ([task 1004229](https://cloudbongos.com/builders#/task/1004229), goal 1000095 — BONGOS-V2), amending [ADR 0227](0227-a-task-network-map-is-refused-the-goal-graph-is-the-map.md) and decision 11 of `docs/specs/<redacted>.md`. The owner reviewed an interactive prototype of the ideator sky and the project sky over five rounds on 2026-09-24 and adopted it AS IS — copy, layout, colours, tour text, toggles, interactions — which contradicts two things already written down, so they are rewritten rather than leaving the build graded against a contract nobody means any more. **Decisions:** (1) the sky is the ideator's HOME surface — it replaces *Your thinking*, and the project sky replaces the goal map page — so "never load-bearing" and "arrives last" are DROPPED as a sequencing hedge from before there was a design to look at; the rule that survives at full force is the accessibility half, that the sky is never the ONLY path to anything it shows (the list drawer — the room — is one key away, and every drawn thing is a row in it); (2) ADR 0227 is AMENDED, not reversed — its measured refusal of a whole-corpus task map stands, and the project sky is §1's own prescription rather than its refusal: the goal graph is the entry point, tasks are drawn only INSIDE one goal past a zoom threshold (the per-goal drill-down §10.5 measured readable at 85.2px pitch worst case), below that they are dust density on the rings with NO identities, and the goal map's table survives as the sky's ledger drawer (§6's table equivalent kept); the nav slot the goal map was deliberately denied is GRANTED to the project sky, under Goals (owner, 2026-09-24), so part 4 changes the page and the test asserting no slot together; (3) the five states and the two channels are UNTOUCHED — criterion `ideator-sky-tells-the-truth` names a model, not a picture, and this amendment changes the picture's standing only; (4) the two HEURISTICS in the prototype — an idea's origin guessed from its text, and "born of a thought" found by scanning text for idea ids — must not ship as ledger facts: parts 3 and 4 hide both layers, part 5 replaces them with a `filed_via` column and a real born-of read. **Consequences:** `docs/design/mocks/sky/sky.template.html` is the PIXEL CONTRACT for parts 2–5, and every deviation a gate or the file ratchet forces is listed in that part's ship notes; no snapshot JSON or built page is ever committed (it carries real task and idea titles and this repo is public); ADR 0264's deleted goal "Living project sky" is superseded by this work under Working area 3. Rejected: shipping the sky as an extra and keeping "never load-bearing" (makes the adopted home surface unroutable); reversing ADR 0227 (its refusal is measured and still correct — the sky needs its drill-down shape, not its repeal); shipping the heuristics behind a disclaimer (a labelled guess is still a guess in a picture whose promise is that it cannot be faked).](0331-the-sky-is-the-ideators-home.md) | design / ideator / sky |
+| 0334 | [**The recruiting directory lists a hidden builder by name, and hide changes a row's shape, not whether it exists** ([task 1002291](https://cloudbongos.com/builders#/task/1002291), R15 — goal 1000110). Privacy spec D2 (owner-signed) lists an active, public, hidden account on the recruiter surface "name-only (if not opted out)"; the directory dropped it outright, making hide a second opt-out while Settings told that builder recruiters would see their name and picture. `GET /scouting` now answers two tiers: `builders` (ranked, `scoutingListableSql`, unchanged) and `name_only` (`scoutingNameOnlySql` = the same predicate with the hide term flipped, so the tiers partition the directory and only the opt-out removes anyone), projected to `github_login`, `display_name`, `avatar_url` by `scouting-name-only.js`. The existence floor stays (a private account is the archon-floor D3 sliver's, never the directory's); presence never depends on activity; the only order is the login; the predicate is pinned to that one reader and its three columns. The hall's `/people` renders the tier as its own panel, never ranked, found by name, never by a role filter. Rejected: fixing only the copy; trailing rows in the ranked ledger; listing private discoverable accounts by name.](0334-the-recruiting-directory-lists-a-hidden-builder-by-name.md) | privacy / recruiting / hall |
 | 0335 | [**An invite is a pre-approved row on the project's own instance, and `project.recruit` says who may send one** ([task 1002813](https://cloudbongos.com/builders#/task/1002813), R1 of the project admin console wave, goal 1000110 — BONGOS-V2). Supersedes ADR 0141 §5's "Invitations (deferred slice)" paragraph only. Formalises spike task 1002786's three decisions and reconciles them with six weeks of shipping: the instance invite route (task 1003044), the PATCH rescind (ADR 0201 D4.2) and the composed join door (ADR 0247) already exist, and the hub invite's dead end is now reachable from the creation wizard. **Decisions:** (D1) authority lives on the project's own instance, and the instance IS the project; the hub is identity, relay, echo, notification and links, and never writes a project's admission row; (D2) a recruit invite is an `access_requests` row with `status='invited'`, so signing in is the acceptance act and the gate is untouched; the row gains `kind ∈ (application, invite)` and `created_by` (the inviter, which a rescind would otherwise overwrite), reuses `note`, backfills exactly (`created_at = resolved_at`), and neither column ever enters an admission read; (D3) one new grantable atom, `project.recruit` (`system:false`, floor archon, widened per instance through the existing governance tab), guards the invite, the outstanding list, the invite rescind and the queue read, while `access_request.review` keeps the verdict; because inviting is admitting, a recruiter without the review atom may not approve or re-admit an APPLICANT through the invite route (409 to the queue); the hub sliver moves onto the atom, and the hub directory and hub invite KEEP `project.curate`, revising ADR 0210/0215/0248, since swapping the directory would raise a gate on a viewing surface (ADR 0217). **Task map:** R2 (task 1002814) = the migration, the invite writes and the sender list, still on `access_request.review`; R3 (task 1002815) = mint the atom, move the gates, the 409 clause, the sliver swap and the pins, and it lands after R2; R5 (task 1002817) is already delivered, so close it into task 1002331; task 1003362 folds into R3. Rejected: a new invitations table; the hub pending row as the invite; widening `access_request.review` instead of minting an atom; a per-project settings row for the floor; letting a recruiter's invite approve applications; `system:true`; swapping `project.curate` on the hub directory.](0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md) | governance / onboarding / platform-identity |
 | 0336 | [**A guild is a hub-side group whose members each consent twice, and its collective record is only ever the sum of what those members already show** ([task 1002299](https://cloudbongos.com/builders#/task/1002299), goal 1000110 — the R23 design spike for goal 1000045's C7/C8/C9). No platform guild existed (every "guild" in the tree is Discord's). Decisions: (1) three hub tables in `platform-identity`, in their own `guilds.js` (the 1,500-line ratchet), distinct from instance-local `goal_members`: guilds (slug, name, `visibility ∈ public|unlisted` with **no default**), members (`membership_kind ∈ owner|member`, never `role` per ADR 0174; a partial unique index holds exactly one owner; a per-member `shown_publicly`), and requests; (2) two consents to join, no self-join, through ADR 0202's connections lifecycle verbatim (silent decline, 90-day swallowed re-ask, 30-day read-time expiry); `accountActiveSql` floors the feature; an **unlisted guild 404s to everyone on the public read, members included**, and takes invites only, because a slug is guessable; (3) the public roster is `shown_publicly AND accountVisibleSql`, and widening a guild to public changes no member's flag but the flipping owner's, so consent given to a small audience is never reused for a large one; (4) **the privacy resolution, pending the owner's ratification:** a member is counted iff shown AND `rollupVisibleSql`, read-time, `no-store`, never stored, and N and M are both lengths of lists the reader can see. The guild record is therefore always a sum of numbers already on members' own public profiles, so nothing can be subtracted out. All-or-nothing is rejected (one member blanks everyone and hiding becomes costly), as is per-member consent to count hidden numbers (it breaks "hide_stats beats everything"). The trade-off: guilds of privacy-minded builders look smaller and rank lower. A union count of all members' projects is refused because it reveals shared private projects; (5) the namespace is `/g/<slug>`, `g` is reserved in the SEO spec's project-slug list, the slug is fixed in V1, and `tests/guild_namespace_reserved.mjs` pins the two documents together; (6) a guild engages a project only through the individual door: a guild application is each member's own vouched application, labelled through ADR 0260's live applicant-profile read (no new instance field); inviting a guild fans out ordinary individual invites to its public roster at that moment, **never a guild-level pre-approval** (that would let a guild owner decide admission to someone else's project); (7) the map ranks public guilds by size and counted works shipped, read-time, with a slug tiebreak, and R29 narrows to the visual. Scope changes for R24–R37 are tabled in the ADR, including R28's dependency on the abandoned R11 and R29/R31's archived orb goals.](0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md) | platform identity / privacy / social graph |

package/docs/api/openapi.json

@@ -89,6 +89,10 @@
       "name": "closeness",
       "description": "Endpoints under `/api/bongos/closeness`."
     },
+    {
+      "name": "community",
+      "description": "Endpoints under `/api/bongos/community`."
+    },
     {
       "name": "connections",
       "description": "Endpoints under `/api/bongos/connections`."
@@ -4391,6 +4395,34 @@
         ]
       }
     },
+    "/community/search": {
+      "get": {
+        "operationId": "get_community_search",
+        "tags": [
+          "community"
+        ],
+        "summary": "GET /community/search",
+        "description": "a name/discipline search under EXACTLY the public-profile visibility rules (D4): a hide_stats account is findable by name but drops out of a discipline-filtered result (disciplines are rollup-derived, and the rollup is what hide_stats suppresses); private and provisional accounts never appear. no-store: the same hide-must-beat-the-cache posture as /profiles/:handle (ADR 0171 D5) — this reads the identical predicate and a flip must be reflected on the very next request.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/community-search.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetCommunitySearchResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/connections": {
       "get": {
         "operationId": "get_connections",
@@ -19808,6 +19840,23 @@
           "why"
         ]
       },
+      "GetCommunitySearchResponse": {
+        "type": "object",
+        "properties": {
+          "query": {},
+          "discipline": {},
+          "count": {},
+          "results": {},
+          "page": {}
+        },
+        "required": [
+          "query",
+          "discipline",
+          "count",
+          "results",
+          "page"
+        ]
+      },
       "GetConnectionsDegreeHandleResponse": {
         "type": "object",
         "properties": {
@@ -20934,10 +20983,12 @@
       "GetScoutingResponse": {
         "type": "object",
         "properties": {
-          "builders": {}
+          "builders": {},
+          "name_only": {}
         },
         "required": [
-          "builders"
+          "builders",
+          "name_only"
         ]
       },
       "GetSecurityDocsResponse": {
@@ -26418,9 +26469,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 416,
-  "x-schema-count": 453,
+  "x-endpoint-count": 417,
+  "x-schema-count": 454,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 308,
+  "x-response-schemas": 309,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 416 endpoints across 70 route files.
+> **Generated from the live route files** — the route file is authoritative. 417 endpoints across 71 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -187,6 +187,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/closeness/weights` | `any-builder` | — | the MODEL is not private, and publishing it is the whole point of the weights being data. |
 | GET | `/api/bongos/closeness/with/:builderId` | `any-builder` | — | One pair — "why am I close to THEM", asked directly rather than by paging the graph. |
 
+## `community` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/community/search` | `public` | — | a name/discipline search under EXACTLY the public-profile visibility rules (D4): a hide_stats account is findable by name but drops out o… |
+
 ## `connections` (7)
 
 | Method | Path | Rank | Body | Description |