@bongos/core 1.19.1016 → 1.19.1017

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2035 strings** across 3 surfaces · 1736 distinct pieces of copy · 2035 certain, 0 heuristic · 212 shown in more than one place.
+**2037 strings** across 3 surfaces · 1738 distinct pieces of copy · 2037 certain, 0 heuristic · 212 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 102 | 1544 |
+| `builders-hall` | `modules/hall-ui/public` | 102 | 1546 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 391 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7926e30955d2` | 3x | ← Back to goal | modules/hall-ui/public/goals.html:199, modules/hall-ui/public/goals.html:210, modules/hall-ui/public/goals.html:222 |
 | … | | _172 more in the JSON registry_ | |
 
-## `builders-hall` — 1544 strings
+## `builders-hall` — 1546 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -618,6 +618,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a53e0cde7ff7` | certain | Link first — your rank role is set the moment you join. | `modules/hall-ui/public/settings.js:840` |
 | `64e85f1691f9` | certain | Link your Discord account and you're added to the {{worldName}} server with your rank role already set — no in | `modules/hall-ui/public/settings.html:61` |
 | `9a31cf5fe05b` | certain | Linking opens Discord's consent screen; unlinking applies at once. | `modules/hall-ui/public/settings.html:66` |
+| `8e067a257eed` | certain | Listed by name only | `modules/hall-ui/public/people.html:53` |
 | `daf84bba41b1` | certain | Loading goals… | `modules/hall-ui/public/goals.html:44` |
 | `93ceeaa4e226` | certain | Loading idea | `modules/hall-ui/public/idea.html:32` |
 | `2b5826012538` | certain | Loading profile… | `modules/hall-ui/public/profile.html:34` |
@@ -1114,6 +1115,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bcdbded93d4e` | certain | The work board failed to load. Reload to try again. | `modules/hall-ui/public/work.js:1492` |
 | `25794c439321` | certain | Then copy the project onto your machine and run the one-shot bootstrap (it checks your setup, installs depende | `modules/hall-ui/public/hall-render.js:890` |
 | `df316c3484de` | certain | Then drive it however you like: | `modules/hall-ui/public/hall-render.js:825` |
+| `48ace42c55ef` | certain | These builders are open to recruiting but keep their cross-project record private, so only who they are is sho | `modules/hall-ui/public/people.html:54` |
 | `a0140098c0e0` | certain | They already have an invitation or a join-request pending on this goal. | `modules/hall-ui/public/goals-render.js:1303` |
 | `5151cf635644` | certain | They have asked to connect. | `modules/hall-ui/public/profile-connections.js:203` |
 | `10219b02433e` | certain | They join as a member once they accept — you can change that afterwards. Nobody is added until they do. | `modules/hall-ui/public/goals-render.js:1235` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2035,
-    "unique_ids": 1736,
-    "certain": 2035,
+    "strings": 2037,
+    "unique_ids": 1738,
+    "certain": 2037,
     "heuristic": 0,
     "duplicate_ids": 212
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 102,
-      "strings": 1544
+      "strings": 1546
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -7071,6 +7071,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "8e067a257eed",
+      "surface": "builders-hall",
+      "text": "Listed by name only",
+      "file": "modules/hall-ui/public/people.html",
+      "line": 53,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "daf84bba41b1",
       "surface": "builders-hall",
@@ -11535,6 +11544,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "48ace42c55ef",
+      "surface": "builders-hall",
+      "text": "These builders are open to recruiting but keep their cross-project record private, so only who they are is shown. They are never ranked, and a role filter never finds them.",
+      "file": "modules/hall-ui/public/people.html",
+      "line": 54,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "a0140098c0e0",
       "surface": "builders-hall",

package/docs/file-map.md

@@ -375,7 +375,7 @@ tests/
 ├── canonical_profile_url.mjs      ← (task 1002804, goal 1000045 criterion C1, ADR 0214): the P08 proof — the canonical profile URL is resolved in ONE place, `handle` reaches `GET /builders/:id/profile` under the EXISTENCE predicate (so a hidden builder keeps their address), absent/provisional/private are BYTE-IDENTICAL so the numeric-id redirect cannot become an existence oracle, and the widened response still leaks no private column. Real core router over a WHERE-derived fake pool on a real socket; the real browser script in a vm above a stub DOM, run twice — as shipped (every surface dark, because `/u/<handle>` still 404s) and with the liveness constant flipped, so the three live behaviours are proved rather than deferred. Asserts its own DB-free lane membership. DB-free `unit` lane.
 ├── application_lifecycle.mjs     ← (task 1002284, goal 1000045, ADR 0201 D1/D3.2/D4 + ADR 0208): the application lifecycle EXECUTED — apply, list-pending, approve, decline, RESCIND (`invited → dismissed`), idempotency on the state already held, and the two things that must never happen: a builder without `access_request.review` moving the queue, and a VOUCH buying admission. Real router, REAL `requirePermission` resolving against the real government catalog's rank seed, and the REAL `hasInvitedAccessRequest` from `src/bongos/db-kernel.js` pointed at the same in-memory `access_requests` table (a stubbed `./pool`), whose filter is built from each statement's own WHERE clause and which refuses a predicate it cannot read. The no-authority proof seeds a vouched row and asserts the approve path and the admission read are byte-identical to the unvouched twin, and that no statement on either path names `applicant_github_id`/`vouched_at`. DB-free `unit` lane.
 ├── application_echo.mjs          ← (task 1002284, goal 1000045, ADR 0201 D1.3/D1.4): the hub's STATUSLESS echo of an application. Part A pins the domain functions — the read binds `APPLICATION_ECHO_WINDOW_DAYS` itself (one 30, not three), the write is an upsert on the pair, neither statement mentions a status, and a non-numeric principal is refused before any query (ADR 0171 D2). Part B runs the real `POST /my-projects/join` and `GET /my-projects` over an in-memory `platform_identity_application_echoes` table with the relay's answer scripted: only an accepted application leaves a trace — a standing membership, either door refusal, a members-only project and an unreachable project leave none — and best-effort is asserted in both directions (a failed echo write still reports the filed application; a failed echo read still lands the memberships listing). DB-free `unit` lane.
-├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked three ways. DB-free `unit` lane.
+├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Since task 1002291 (R15, ADR 0334) it also proves the directory's NAME-ONLY tier: a hidden, reachable builder is listed by login, name and avatar alone, never ranked, and none of their record reaches the body. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked five ways. DB-free `unit` lane. The page half is `people_name_only.mjs` (the real people.js + kit in a vm).
 ├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
 ├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
 ├── applicant_profile_boundary.mjs ← (task 1002972, goal 1000045 C4, privacy spec D7, ADR 0241): THE D7 BOUNDARY proof for the applicant view a reviewer sees. Whitelists read from the MODULES’ own exports — the private branch against `recruiter-sliver`’s `SLIVER_KEYS`/`SLIVER_KEYS_HIDDEN`, the public branch against the public-page payload’s key list — so a third shape (the “new disclosure class” D7 forbids) reds this file. Pins THE CONSENT SWAP in both directions on the same account: a private builder who never opted into recruiting gets an applicant view and gets `null` from `getRecruiterSliver`, so a refactor routing the port through the recruiter sliver cannot pass quietly. `hide_stats` beats the application in both branches; provisional and terms-never-accepted disclose nothing; planted sentinels asserted absent from the whole body with the avatar-embedded `github_id` pinned as the one honest exception. Plus the federated gate (ADR 0205): no echo → 404 and NO account row read (asserted on the statement log), the witness matched against the AUTHENTICATED client, an out-of-window echo stops working, and `Cache-Control: no-store`. Real router + real HTTP over in-memory tables filtered by each statement’s own WHERE clause. DB-free `unit` lane, asserted in the file itself.

package/docs/module-api-changelog.md

@@ -2506,5 +2506,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1014 with no explicit bump. run 36078624472. (task 1002620)
   1.19.1016 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1015 with no explicit bump. run 36080388706. (task 1002620)
+  1.19.1017 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1016 with no explicit bump. run 36081753087. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/people.html

@@ -44,6 +44,17 @@
                rollup offers; people.js writes it. -->
           <p class="ledger__note" id="people-foot" hidden></p>
         </section>
+
+        <!-- task 1002291 (ADR 0334): builders who hid their cross-project record
+             but are still open to recruiting, listed by name alone (privacy spec
+             D2). Its own panel because they are never ranked; hidden unless the
+             response carries a row, and people.js writes it. -->
+        <section class="scroll" id="people-named-scroll" aria-labelledby="people-named-h" hidden>
+          <h2 id="people-named-h" class="scroll__h">Listed by name only<span class="count-pill" id="people-named-count" hidden></span></h2>
+          <p class="scroll__lede" id="people-named-lede">These builders are open to recruiting but keep their cross-project record private, so only who they are is shown. They are never ranked, and a role filter never finds them.</p>
+          <div id="people-named-body"></div>
+          <p class="ledger__note" id="people-named-foot" hidden></p>
+        </section>
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>

package/modules/hall-ui/public/people.js

@@ -16,6 +16,13 @@
 // exists); then the four figures in tabular columns, the crafts as chips, and
 // when they were last seen. Search, a sort and a craft lens are the kit's
 // filter bar; the rows page through the kit's pager.
+//
+// THE SECOND TIER (task 1002291, ADR 0334). The response also carries
+// `name_only`: builders who hid their cross-project record but are still open to
+// recruiting, which privacy spec D2 lists "name-only". They get their own panel
+// of identity cells because they have no record to rank, sort or filter by role:
+// the lenses below leave them alphabetical, a search reads their name, and a
+// role filter never matches them.
 // All network values render through OTBKit.esc — never raw innerHTML.
 (function () {
   'use strict';
@@ -26,6 +33,10 @@
   var sub = document.getElementById('people-sub');
   var countPill = document.getElementById('people-count');
   var foot = document.getElementById('people-foot');
+  var namedScroll = document.getElementById('people-named-scroll');
+  var namedCount = document.getElementById('people-named-count');
+  var namedBody = document.getElementById('people-named-body');
+  var namedFoot = document.getElementById('people-named-foot');
 
   function fmtRecency(iso) {
     if (!iso) return '—';
@@ -97,6 +108,7 @@
   var DIRECTORY_LIMIT = 500;
 
   var all = [];
+  var named = [];
   var query = '';
   var craft = '';
   var sortBy = '';
@@ -108,6 +120,17 @@
       (Array.isArray(b.disciplines) ? b.disciplines.join(' ') : '')).toLowerCase();
     return hay.indexOf(query) !== -1;
   }
+  // A name-only row carries no roles (they are part of the hidden record), so a
+  // role filter never matches it; a search reads the name.
+  function matchesNamed(b) {
+    if (craft) return false;
+    if (!query) return true;
+    return ((b.github_login || '') + ' ' + (b.display_name || '')).toLowerCase().indexOf(query) !== -1;
+  }
+  // A count that cannot overstate a clipped read: a full response means "at least".
+  function countText(n) {
+    return n >= DIRECTORY_LIMIT ? fmtInt(DIRECTORY_LIMIT) + '+' : fmtInt(n);
+  }
   // The server's order IS "track record" (ADR 0141 §4 ranks the rollup); the
   // other lenses re-order the loaded set client-side, ties keeping that order.
   var SORTS = {
@@ -128,6 +151,8 @@
 
   var pager = kit.makePager('people', 'hall-people-per-page');
   var ledger = null;
+  var namedPager = kit.makePager('people-named', 'hall-people-named-per-page');
+  var namedLedger = null;
 
   function rowHtml(b) {
     return '<tr>' +
@@ -141,12 +166,45 @@
       '</tr>';
   }
 
+  // The identity cell and nothing else: every other column is the record hidden.
+  function namedRowHtml(b) {
+    return '<tr><td>' + whoHtml(b) + '</td></tr>';
+  }
+
   function rerender() {
     if (ledger) ledger.render(ordered(all.filter(matches)));
+    if (namedLedger) namedLedger.render(named.filter(matchesNamed));
+  }
+
+  function mountNamed() {
+    if (!namedScroll || !named.length) return;
+    namedScroll.hidden = false;
+    if (namedCount) {
+      namedCount.textContent = countText(named.length);
+      namedCount.hidden = false;
+    }
+    // The ranked footnote's rule, for the one lens that reads this list: a full
+    // response is clipped, and a search cannot find a builder it never loaded.
+    var namedClipped = named.length >= DIRECTORY_LIMIT;
+    if (namedFoot) {
+      namedFoot.textContent = namedClipped
+        ? 'This list is clipped at the first ' + fmtInt(DIRECTORY_LIMIT) + ' by login. Search only reads what this page loaded, so a builder past that ' + fmtInt(DIRECTORY_LIMIT) + ' will not appear in it.'
+        : '';
+      namedFoot.hidden = !namedClipped;
+    }
+    namedLedger = kit.makeLedger({
+      mount: namedBody,
+      columns: ['Builder'],
+      rowHtml: namedRowHtml,
+      emptyMsg: 'No builder listed by name only matches these filters.',
+      pager: namedPager,
+    });
   }
 
-  function mountDirectory(builders) {
+  function mountDirectory(builders, nameOnly) {
     all = Array.isArray(builders) ? builders : [];
+    named = Array.isArray(nameOnly) ? nameOnly : [];
+    if (namedScroll) namedScroll.hidden = true;
     // An EMPTY directory is almost never missing data — it is ADR 0171's
     // fail-closed consent boundary doing exactly what it was ratified to do.
     // `listScoutingRollup` filters on `profile_state = 'active'`, every account
@@ -160,7 +218,7 @@
     // leaderboard; the accounts simply are not publicly listed — and that wrong
     // explanation is why an empty directory got filed as a bug (task 1002937).
     // Say which of the two it is, so the page is never mistaken for broken.
-    if (!all.length) {
+    if (!all.length && !named.length) {
       notice('Nobody is publicly listed here yet. A builder joins this directory once they have '
         + 'signed in on the main platform site at least once — accounts stay unlisted until then, '
         + 'and none are listed without it. Their work still shows on each project’s own ledger.');
@@ -169,16 +227,21 @@
     // A FULL PAGE IS A CLIPPED PAGE. Every sentence below has to hedge when this
     // is true, because each of them otherwise states a total the page cannot know.
     var clipped = all.length >= DIRECTORY_LIMIT;
+    // The second tier, named in the same sentence so the ranked count is never
+    // read as everyone the directory lists.
+    var namedPart = named.length ? '; ' + countText(named.length) + ' more by name only' : '';
     if (countPill) {
       countPill.textContent = clipped ? fmtInt(DIRECTORY_LIMIT) + '+' : String(all.length);
       countPill.hidden = false;
     }
     if (sub) {
-      sub.textContent = clipped
-        ? 'Showing the first ' + fmtInt(DIRECTORY_LIMIT) + ' builders across hosted projects, ranked by track record — there are more than this page can load. '
-          + 'Descriptive only — cross-project numbers never carry authority here.'
-        : fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's') + ' listed across hosted projects, ranked by track record. '
-          + 'Descriptive only — cross-project numbers never carry authority here.';
+      var listed = clipped
+        ? 'Showing the first ' + fmtInt(DIRECTORY_LIMIT) + ' builders across hosted projects, ranked by track record — there are more than this page can load' + namedPart
+        : all.length
+          ? fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's') + ' listed across hosted projects, ranked by track record' + namedPart
+          // Nobody ranked yet: "0 builders ranked; 2 more by name only" would read as a count of nothing.
+          : countText(named.length) + ' builder' + (named.length === 1 ? '' : 's') + ' listed across hosted projects by name only';
+      sub.textContent = listed + '. Descriptive only — cross-project numbers never carry authority here.';
     }
     // THE LENSES LIE HARDER THAN THE COUNT DOES, and that is worth its own
     // sentence. Search, sort and the craft filter all re-order the set this page
@@ -214,6 +277,7 @@
         craft = String(vals['people-craft'] || '');
         sortBy = String(vals['people-sort'] || '');
         pager.page = 1;
+        namedPager.page = 1;
         rerender();
       },
     });
@@ -224,11 +288,13 @@
       columns: ['Builder', { label: 'Projects', class: 'ledger__num' }, { label: 'Ships', class: 'ledger__num' },
         { label: currencyLabel(), class: 'ledger__num' }, { label: 'Karma', class: 'ledger__num' }, `${window.OTB.roleAxisLabel()}s`, 'Last active'],
       rowHtml: rowHtml,
-      // Reached only when the directory HAS builders and the lenses excluded them
-      // all — the empty-API case returns above with its own explanation.
-      emptyMsg: 'No listed builder matches that search.',
+      // With ranked builders, reached only when the lenses excluded them all;
+      // without, the directory lists hidden builders alone (the panel below) —
+      // the fully empty case returns above with its own explanation.
+      emptyMsg: all.length ? 'No listed builder matches that search.' : 'No builder with a public track record is listed yet.',
       pager: pager,
     });
+    mountNamed();
     rerender();
   }
 
@@ -244,7 +310,7 @@
       if (!r.ok) throw new Error('http ' + r.status);
       return r.json();
     })
-    .then(function (data) { mountDirectory(data && data.builders); })
+    .then(function (data) { mountDirectory(data && data.builders, data && data.name_only); })
     .catch(function (e) {
       // The floor is the pack's label for metic, never a hardcoded rank name —
       // and the page used to say "Archon-only", which was wrong since ADR 0210.

package/modules/hall-ui/public/people.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "People — the cross-project directory behind requireProjectCuratePage (metic+ via project.curate, or a project owner). Descriptive only; it grants no authority, and the page says so above the fold. Written with the re-skin (task 1003307); the redesign (task 1003470) added the identity cell, the sort and craft lenses, and the `search` state. Its legacy door /scouting was deleted in task 1003440; the URL 301s here. Populated look: the hall-preview harness (scripts/hall-preview/fixtures/scouting.json carries five builders, three with avatars).",
+  "_": "People — the cross-project directory behind requireProjectCuratePage (metic+ via project.curate, or a project owner). Descriptive only; it grants no authority, and the page says so above the fold. Written with the re-skin (task 1003307); the redesign (task 1003470) added the identity cell, the sort and craft lenses, and the `search` state. Its legacy door /scouting was deleted in task 1003440; the URL 301s here. Populated look: the hall-preview harness (scripts/hall-preview/fixtures/scouting.json carries five builders, three with avatars, plus two listed by name only — task 1002291 added that second panel; the `search` state shows its empty case).",
   "page": "/builders/people",
   "surface": "hall-ui",
   "stub": {

package/modules/platform-identity/account-visibility.js

@@ -32,8 +32,13 @@
 //   recruiterReachSql / isRecruiterDiscoverable  REACH — the COALESCE, privacy
 //       spec D1. A reach predicate only: it never buys addressability.
 //   scoutingListableSql                    THE DIRECTORY — numbers AND reach,
-//       the ONE predicate the recruiting directory joins (ADR 0210, task
-//       1002290). Composed, never restated.
+//       the predicate the recruiting directory's ranked tier joins (ADR 0210,
+//       task 1002290). Composed, never restated.
+//   scoutingNameOnlySql                    THE DIRECTORY'S NAME-ONLY TIER —
+//       existence AND hidden AND reach (ADR 0334, task 1002291; privacy spec D2:
+//       a hidden builder is "listed name-only (if not opted out)"). The same
+//       predicate as the one above with the hide term flipped, so the two tiers
+//       partition the directory: hide decides a row's SHAPE, reach its presence.
 //   recruiterSliverVisibleSql / isRecruiterSliverVisible  THE PRE-ACCEPT
 //       SLIVER — consent AND reach, WITHOUT the existence axis (ADR 0215, task
 //       1002968; privacy spec D3). The one predicate that deliberately does not
@@ -205,6 +210,31 @@ function scoutingListableSql(alias) {
   return `(${rollupVisibleSql(alias)} AND ${recruiterReachSql(alias)})`;
 }
 
+// scoutingNameOnlySql — WHO the recruiting directory lists by NAME ALONE: a
+// publicly visible, reachable account that hid its cross-project record (ADR
+// 0334, task 1002291). Privacy spec D2's recruiter column lists that account
+// "name-only (if not opted out)"; before this the directory dropped it outright,
+// reading hide as a second opt-out while Settings told the builder recruiters
+// would see their name and picture.
+//
+// It is scoutingListableSql with the hide term FLIPPED and nothing else, shaped
+// identically so the two tiers cannot overlap or leave a gap
+// (tests/effective_visibility_predicate.mjs holds that). It keeps the EXISTENCE
+// floor, so a private account is never listed even by name — that is the D3
+// sliver's subject, at the archon floor (ADR 0215/0217).
+//
+// DANGEROUS OUTSIDE ITS ONE READER. It admits hidden accounts by design, so a
+// read that joined it and returned a number would hand out exactly the record
+// hide_stats withholds. scouting-name-only.js is its only reader and selects
+// three identity columns; the guard pins both.
+function scoutingNameOnlySql(alias) {
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('scoutingNameOnlySql: alias must be a bare SQL identifier');
+  }
+  const q = alias ? `${alias}.` : '';
+  return `((${accountVisibleSql(alias)} AND ${q}hide_stats) AND ${recruiterReachSql(alias)})`;
+}
+
 // recruiterSliverVisibleSql — THE predicate the PRE-ACCEPT recruiter sliver
 // joins: the CONSENT floor AND the reach axis (ADR 0215, privacy spec D3; task
 // 1002968). modules/platform-identity/recruiter-sliver.js is its one reader.
@@ -256,6 +286,7 @@ module.exports = {
   isRecruiterDiscoverable,
   recruiterReachSql,
   scoutingListableSql,
+  scoutingNameOnlySql,
   recruiterSliverVisibleSql,
   isRecruiterSliverVisible,
 };

package/modules/platform-identity/builder-search.js

@@ -0,0 +1,153 @@
+// modules/platform-identity/builder-search.js — the PUBLIC builder search (D4,
+// docs/specs/bongos-v1-community-tab.md; task 1002979, goal 1000110 CT3). Answers
+// "find a builder by name, optionally narrowed to a discipline" for the future
+// /community page (tasks 1002980 / 1003363) — NOT the recruiting directory
+// (routes/scouting.js), which stays a separate, project.curate/owner-gated
+// surface with its own consent predicate, and NOT its archon-floor pre-accept
+// sliver (recruiter-sliver.js). This surface reveals nothing beyond the same
+// public-profile rules /profiles/:handle already applies (D8: no new disclosure
+// class).
+//
+// TWO PREDICATES FROM account-visibility.js, ONE PER AXIS D4 NAMES:
+//   NAME MATCH        — accountVisibleSql (existence: active + public). A
+//     hide_stats account is still findable BY NAME — hiding removes the
+//     rollup, not the page (the same rule /profiles/:handle already honors).
+//   DISCIPLINE MATCH   — rollupVisibleSql (existence AND NOT hide_stats),
+//     because a discipline is ROLLUP-DERIVED
+//     (platform_identity_builder_project_activity.disciplines) and the rollup
+//     is exactly what hide_stats suppresses. A hidden account's disciplines are
+//     therefore never attached and never filterable — which is what keeps a
+//     discipline facet from re-exposing a hidden account's rollup by a side
+//     door. Private and provisional accounts never reach either predicate, so
+//     they are absent from every result regardless of query or filter.
+// Both predicates are IMPORTED, never re-derived — the sole-owner rule
+// tests/effective_visibility_predicate.mjs enforces.
+//
+// Matching: handle / display_name PREFIX (escaped LIKE) OR pg_trgm fuzzy (the
+// `%` similarity operator) — the two legs D4 asks for. BOTH legs compare
+// lower(column) against lower($1)/lower($2) — the `%` operator is
+// case-SENSITIVE (unlike ILIKE, pg_trgm has no case-insensitive variant), so
+// without the explicit lower() a query differing only in case would silently
+// miss the fuzzy leg while the `sim` column (already lower()-folded) still
+// scored it. Indexed by migration platform_identity_023_builder_search_trgm.sql
+// — a GIN gin_trgm_ops index on lower(handle) and lower(display_name), which
+// accelerates both legs since both now query that same expression.
+// github_id never crosses the projection — handle is the address, exactly as
+// every sibling public read in this module already treats it.
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { accountVisibleSql, rollupVisibleSql } = require('./account-visibility');
+
+const DEFAULT_LIMIT = 20;
+const MAX_LIMIT = 50;
+// Deep OFFSET pagination on an unauthenticated route is a free scan-and-discard
+// knob (?offset=999999999 still walks and throws away every matched row before
+// the LIMIT) — capped so a caller can page a reasonable distance and no further.
+const MAX_OFFSET = 1000;
+// A 1-character query has no usable trigram and a near-unselective LIKE
+// prefix, so it would materialize and sort a large share of the table before
+// LIMIT on every anonymous request. 2 chars is the floor at which a trigram
+// exists at all.
+const MIN_QUERY_CHARS = 2;
+const MAX_QUERY_CHARS = 100;
+const MAX_DISCIPLINE_CHARS = 32; // mirrors upsertActivity's per-discipline cap
+
+function clampLimit(limit) {
+  const n = parseInt(limit, 10);
+  if (!Number.isFinite(n) || n <= 0) return DEFAULT_LIMIT;
+  return Math.min(n, MAX_LIMIT);
+}
+
+function clampOffset(offset) {
+  const n = parseInt(offset, 10);
+  if (!Number.isFinite(n) || n < 0) return 0;
+  return Math.min(n, MAX_OFFSET);
+}
+
+// Escape LIKE's own wildcard characters so a searcher's literal % or _ can't
+// turn a prefix match into an unbounded pattern.
+function escapeLikePrefix(s) {
+  return s.replace(/[\\%_]/g, (c) => `\\${c}`);
+}
+
+// searchBuilders — the one read behind GET /community/search. `q` is required
+// (too short/empty/oversized → no results, never a throw — the route
+// validates and 400s before calling this; this stays defensive on its own).
+// `discipline` is optional; '' means no filter. Returns
+// { results, limit, offset } — `limit`/`offset` are the CLAMPED values
+// actually used, so a caller (the route) never re-derives them to echo back.
+// A result's `disciplines` is null for a hidden account or one with no
+// rollup activity.
+async function searchBuilders({ q, discipline, limit, offset, pool = defaultPool } = {}) {
+  const query = typeof q === 'string' ? q.trim() : '';
+  const lim = clampLimit(limit);
+  const off = clampOffset(offset);
+  if (query.length < MIN_QUERY_CHARS || query.length > MAX_QUERY_CHARS) {
+    return { results: [], limit: lim, offset: off };
+  }
+  const disc = typeof discipline === 'string' ? discipline.trim().slice(0, MAX_DISCIPLINE_CHARS) : '';
+
+  const { rows } = await pool.query(
+    `WITH matches AS (
+       SELECT pa.github_id, pa.handle, pa.github_login, pa.display_name, pa.avatar_url,
+              (lower(pa.handle) = lower($1)) AS exact_handle,
+              GREATEST(similarity(lower(pa.handle), lower($1)),
+                       similarity(lower(COALESCE(pa.display_name, '')), lower($1))) AS sim
+         FROM platform_identity_accounts pa
+        WHERE ${accountVisibleSql('pa')}
+          AND (
+            lower(pa.handle) LIKE lower($2) ESCAPE '\\'
+            OR lower(pa.display_name) LIKE lower($2) ESCAPE '\\'
+            OR lower(pa.handle) % lower($1)
+            OR lower(pa.display_name) % lower($1)
+          )
+     ), disc AS (
+       -- Scoped to the name matches only (never the whole activity table),
+       -- which is strictly smaller — though 'matches' itself is bounded only
+       -- by MIN_QUERY_CHARS' selectivity, not by a hard cap, since the
+       -- discipline filter (below) needs every match's disciplines before
+       -- LIMIT can apply.
+       SELECT x.github_id, array_agg(DISTINCT x.d) AS disciplines
+         FROM (SELECT a.github_id, unnest(a.disciplines) AS d
+                 FROM platform_identity_builder_project_activity a
+                WHERE a.github_id IN (SELECT github_id FROM matches)
+                  AND EXISTS (
+                        SELECT 1 FROM platform_identity_accounts pa2
+                         WHERE pa2.github_id = a.github_id AND ${rollupVisibleSql('pa2')})) x
+        WHERE x.d IS NOT NULL
+        GROUP BY x.github_id
+     )
+     SELECT m.handle, m.github_login, m.display_name, m.avatar_url, d.disciplines
+       FROM matches m
+       LEFT JOIN disc d ON d.github_id = m.github_id
+      WHERE ($3::text = '' OR d.disciplines @> ARRAY[$3]::text[])
+      ORDER BY m.exact_handle DESC, m.sim DESC, m.handle
+      LIMIT $4 OFFSET $5`,
+    [query, `${escapeLikePrefix(query)}%`, disc, lim, off],
+  );
+  return {
+    results: rows.map((r) => ({
+      handle: r.handle,
+      github_login: r.github_login,
+      display_name: r.display_name,
+      avatar_url: r.avatar_url,
+      disciplines: Array.isArray(r.disciplines) ? r.disciplines : null,
+    })),
+    limit: lim,
+    offset: off,
+  };
+}
+
+module.exports = {
+  searchBuilders,
+  clampLimit,
+  clampOffset,
+  escapeLikePrefix,
+  DEFAULT_LIMIT,
+  MAX_LIMIT,
+  MAX_OFFSET,
+  MIN_QUERY_CHARS,
+  MAX_QUERY_CHARS,
+  MAX_DISCIPLINE_CHARS,
+};

package/modules/platform-identity/migrations/platform_identity_023_builder_search_trgm.sql

@@ -0,0 +1,40 @@
+-- platform_identity_023_builder_search_trgm.sql — GIN trigram indexes for the
+-- public builder search (D4, docs/specs/bongos-v1-community-tab.md; task
+-- 1002979). builder-search.js's searchBuilders() queries
+-- lower(handle) LIKE lower($2) OR lower(handle) % lower($1) (and the same
+-- pair for display_name) against platform_identity_accounts on EVERY request
+-- to an UNAUTHENTICATED, rate-limited-but-public route — an unindexed
+-- sequential scan there is a cost every anonymous caller can trigger.
+--
+-- INDEXED ON THE EXPRESSION, NOT THE BARE COLUMN. Both query legs compare
+-- lower(handle)/lower(display_name), so a plain gin_trgm_ops index on the raw
+-- column would never be used — Postgres only matches a functional index
+-- against the identical expression. One index per column then serves BOTH
+-- legs (prefix LIKE and % fuzzy), because pg_trgm's GIN opclass supports LIKE
+-- as well as the trigram similarity operators.
+--
+-- pg_trgm itself is already enabled repo-wide by migrations/103_search_chunks.sql
+-- (a core migration, so it runs before any module migration) — nothing to
+-- create here.
+--
+-- WHY NOT CONCURRENTLY. Same reasoning core_222 and modules/ideas/migrations/-
+-- ideas_004_lineage_route_index.sql recorded for their own indexes: CREATE
+-- INDEX CONCURRENTLY cannot run inside a transaction block, and this file is
+-- wrapped BEGIN/COMMIT so it lands atomically. Acceptable here specifically
+-- because platform_identity_accounts is a hub-only, human-signup-paced table
+-- (one row per platform account) — the build is a light, one-time lock against
+-- a small table, not a write-hot one.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Forward-safe: index
+-- creation only, no column/type change, so the previous release runs
+-- unmodified against this schema. Idempotent (IF NOT EXISTS).
+
+BEGIN;
+
+CREATE INDEX IF NOT EXISTS platform_identity_accounts_handle_trgm
+  ON platform_identity_accounts USING gin (lower(handle) gin_trgm_ops);
+
+CREATE INDEX IF NOT EXISTS platform_identity_accounts_display_name_trgm
+  ON platform_identity_accounts USING gin (lower(display_name) gin_trgm_ops);
+
+COMMIT;

package/modules/platform-identity/module.json

@@ -10,7 +10,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile", "connections"],
+    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile", "connections", "community-search"],
     "migrations": true,
     "pollers": ["code-sweep", "visibility-pull"]
   },