@bongos/core 1.19.1016 → 1.19.1018

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1016",
-  "core_contract": "1.19.1016",
-  "source_commit": "b851150b854b6cb84117b7844e8790a7abb302ab",
+  "core_version": "1.19.1018",
+  "core_contract": "1.19.1018",
+  "source_commit": "49eb795ed8e84657315241e6cfa652f3491e6edc",
   "source_ref": "HEAD",
-  "built_at": "2026-09-25T01:04:44.947Z",
+  "built_at": "2026-09-25T01:46:13.363Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 525,
+    "docs_redacted": 527,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2432,
+    "functional_verbatim": 2440,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2983,
-  "tree_sha256": "8dde43afac6292dd0280de03c46e9f393fddaab6c42bbbee84ac05784ce96a52",
+  "file_count": 2993,
+  "tree_sha256": "ed9091f7fa992b1a3cb4b1d473869986f200827a94ca69cc0a8c86770b571b71",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "26e3e9bd1e4dc4e7715eaabfdc155b98da64eefc2c002a18f4c5da0b5b288baa"
+      "sha256": "1d0f3cc30c66a4eb757e297d95406a42c55cedc073ee29671827926f06c0d260"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "6684688f85798c74d0c58853fa54c90e30a69c442708e191a3ef15b8f06ca0fb"
+      "sha256": "c913bb0302165f718776d8f5f6f5d3bdde73ee152a9eabbe3fc4f92d23e6b0e3"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "5b844bbe07c67c1ac42f46d8a065d59039a447ca38ca6ae9f3422c081038cd8a"
+      "sha256": "48051577351ecb7f13d874668d2ed3171b1cad370969ba5e8b4124b20584c839"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "68f3117d69e1bb2d68c398aab75cc302b833404d37a13f1297f5c68f03f7a1aa"
+      "sha256": "ffbc111669a6fb27297d1819c35d02f732c3d69b87411613a88b348b0fa897c6"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "24cf3312198537eb92a5c2f247faa826f596fae91a44705905bd80a5cdc8c7b0"
+      "sha256": "81da43a07fc9e2c89899334f58440d07c8f36df0efc5a1f3a9512a20f2a90047"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1542,7 +1542,7 @@
     {
       "path": "docs/adr/0208-application-lifecycle-the-handle-waits-and-the-vouch-has-no-minter.md",
       "mode": "0000644",
-      "sha256": "8164be7327574eb29b5c1bd76c6d2b8892cb26ed2c7d07cb59f08182ae6b4f42"
+      "sha256": "84f46e47b23542bf6d4fb78c7e1914f1ebbbf9548e40159814c41bb4003f827e"
     },
     {
       "path": "docs/adr/0209-one-budget-for-the-account-existence-oracle.md",
@@ -2154,6 +2154,16 @@
       "mode": "0000644",
       "sha256": "659b73c16da06bb150434de1eae1bcc1dfe4f6acf61ac0b2d787f3b52f617187"
     },
+    {
+      "path": "docs/adr/0333-the-application-vouch-is-a-third-token-spent-once-and-bound-to-its-login.md",
+      "mode": "0000644",
+      "sha256": "b89c4d4bd55e2fe48686cdeabe5bd7eb08c41d195e4d06ea422096d1b7466e0b"
+    },
+    {
+      "path": "docs/adr/0334-the-recruiting-directory-lists-a-hidden-builder-by-name.md",
+      "mode": "0000644",
+      "sha256": "60b5794466cfbdd544c19119d6e6e18ae264782b90b0d3a1d96d4a178619e62c"
+    },
     {
       "path": "docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md",
       "mode": "0000644",
@@ -2167,17 +2177,17 @@
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "737e64b05ae9128a7320d5d142278a6fb8f28187f8036649d6b4752576726949"
+      "sha256": "8227e2293df9bc8364bc66ecd8890341e7a1410b9edc7906c38abae37ce7eccd"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "9d41ac5a4a8e13d03487068f43de42fbd0d58d4ab66f7599e2a05b7f929c1fc9"
+      "sha256": "89d96b4b83075fea2954bbbfda5d815a74f12a06f46cb11da3d83c3d7951d65b"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "5aa56fcfb0a0fb6f7af0e96ed6b48848cf50657854ff57a7e8bea5177c0b3f89"
+      "sha256": "0e679eec9a95a36a04a91c2d37a34dcba1dec397b0eff30eff6b0b1c5e267627"
     },
     {
       "path": "docs/architecture.md",
@@ -2202,12 +2212,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "94ef983fbe12b8d7d3314a7ebe74486ba419b382e9ae449ebdf5e5aafc56f16a"
+      "sha256": "7824524ca9e6c4eed55c42542e5bca4904650f4476218a22012bf8e13d1e9ac3"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d39ca24221a9eec0ede5cd4dd594dc9558337999e5ace5c3145a5c462da1f39b"
+      "sha256": "72b54a0726ff452ddc7c1e6938b6274c1251e2a471592d8083e2530aeef10778"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2727,7 +2737,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "90e0058ee679d9dc8c9fd5bad7dad2fd05cb22dd4d5fc4831827ec42f51207d2"
+      "sha256": "569c8541506b9f7669dfda06ab3768be173e7d2091d8ff591c07fa67c0fda0eb"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2737,7 +2747,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ea0498c65e3167f316d25a081ba9e74b410e9012daf478c42b2c43b0cca6201e"
+      "sha256": "a0b015494e2c8eaf772b17de3bd6c38737a4ad939921a395021172271b445e3f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3859,6 +3869,11 @@
       "mode": "0000644",
       "sha256": "968b1f4b893c9368da682fae0845b69ec367aa465ae608f60644c266818b874e"
     },
+    {
+      "path": "migrations/core_254_access_requests_applicant_handle.sql",
+      "mode": "0000644",
+      "sha256": "040de8cddf1a8740ac7e97fb35572e56494a5a3b51ce8873887f71759f6a3b9d"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5182,17 +5197,17 @@
     {
       "path": "modules/hall-ui/public/people.html",
       "mode": "0000644",
-      "sha256": "d94e1d3bf0a0f819469b995b4723f756d301fffcc6f42fb132bdaa82815f7011"
+      "sha256": "4da8ca7dc9321f3d7303332e78ec9caeb6ea65a71fa670b20f593874514585ac"
     },
     {
       "path": "modules/hall-ui/public/people.js",
       "mode": "0000644",
-      "sha256": "37d7c9b14bb42a473ef7caf45f138cd87b01b976bb593d1fd2a0c82c94208539"
+      "sha256": "4f5ececf426b07f6df121c857f15c436e1ae4c1269c7352104f258a21589eca1"
     },
     {
       "path": "modules/hall-ui/public/people.states.json",
       "mode": "0000644",
-      "sha256": "6f7612bf9ef7da53e2f66337921ee30a13f8a28bde61044f9263bc45a8074edc"
+      "sha256": "5db6df77fb3ea39e03de3489178ab2bf3e978fdd7f67b795ce0da207c71e3eb9"
     },
     {
       "path": "modules/hall-ui/public/primer.css",
@@ -6402,7 +6417,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "3c66a404347ef1b93edcf5c63a902c9561b0a3f9bd9bc6c17e8a2a1f1b5f6707"
+      "sha256": "301c45e4f72024c7b1507245a9fccf4388224bb544ad747712c69155d41d1861"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -6417,7 +6432,7 @@
     {
       "path": "modules/platform-identity/account-visibility.js",
       "mode": "0000644",
-      "sha256": "020279ae50f2f9e7a004fe571e5ca14493ad26bd22c395cc4805f759f5560b72"
+      "sha256": "59275121f2a8c6a044659ca94c7f7671f65be27bfc4a6759ec94afc962fc01cd"
     },
     {
       "path": "modules/platform-identity/activity-snapshots.js",
@@ -6434,6 +6449,11 @@
       "mode": "0000644",
       "sha256": "8217660dc23b57ba0fb54d6375aca9aec190c7abb1d70f9d44d4e290da272c64"
     },
+    {
+      "path": "modules/platform-identity/builder-search.js",
+      "mode": "0000644",
+      "sha256": "69e85980a3cb693fa3d39f05b6fadee34799e27c66a2e63fe86ca461f2cfa394"
+    },
     {
       "path": "modules/platform-identity/canonical-profile.js",
       "mode": "0000644",
@@ -6452,7 +6472,7 @@
     {
       "path": "modules/platform-identity/hub-keys.js",
       "mode": "0000644",
-      "sha256": "01d30570d828a1f06ccac693cc5c268d00fb091a13412a3f3890f10828a05203"
+      "sha256": "a8dcce2d4be3d041c349c59cfc0eab2171a08869225f3ccfdb525c70faffb8eb"
     },
     {
       "path": "modules/platform-identity/invite-authz.js",
@@ -6574,10 +6594,15 @@
       "mode": "0000644",
       "sha256": "b9b4ca90e638af35682b04d311b2ed42f4630a41e003ee329648374fe74fef09"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_023_builder_search_trgm.sql",
+      "mode": "0000644",
+      "sha256": "f119d0d4f8775e2ec1e0e30702ba9564d7f4f712853751e2e66bb3c103cf1da4"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "cc6f7ab084ee74715241220339411d1a10c8d6697af143df452278ea2c634f79"
+      "sha256": "a0f4d7143929eee513926111a314c5687005c95ebff998d0d59dd498bb5c62f2"
     },
     {
       "path": "modules/platform-identity/origin-containment.js",
@@ -6624,6 +6649,11 @@
       "mode": "0000644",
       "sha256": "4f6854050e3c7459f698c550577fa97958a573d7f1981c9de4d29417af2669c0"
     },
+    {
+      "path": "modules/platform-identity/routes/community-search.js",
+      "mode": "0000644",
+      "sha256": "f2f8f4f7a94b7f3a917b583a71fcaf482d110ed06e22a1c1aaad6d9a71a34cad"
+    },
     {
       "path": "modules/platform-identity/routes/connections.js",
       "mode": "0000644",
@@ -6632,7 +6662,7 @@
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
-      "sha256": "c920f13eea6bdfc2f361d7c23500d295bb87066205ee2f4792adc22fc5dfa715"
+      "sha256": "56700357273c03d412afce1ef9937ba811257d0c5110f08d757bbef3e517a416"
     },
     {
       "path": "modules/platform-identity/routes/profile.js",
@@ -6652,7 +6682,7 @@
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
-      "sha256": "0f898c038abc6c0aceb2f5649008cdc7fc66bc1b7f83129aae3da65f1eb33c15"
+      "sha256": "fbd1f8679be51718131d3d95d6ed7d8dcd1ebe091df6cfc190b69fd62c00013c"
     },
     {
       "path": "modules/platform-identity/routes/sso.js",
@@ -6664,6 +6694,11 @@
       "mode": "0000644",
       "sha256": "b4da61899339ac5e9fac517efa4b3d98e39a8e7d38fd8b0cffbd8464ba85e902"
     },
+    {
+      "path": "modules/platform-identity/scouting-name-only.js",
+      "mode": "0000644",
+      "sha256": "cfffe99b93ad044a115f322eec909983b0e12428975d7cf1e0f2bd9060f922ce"
+    },
     {
       "path": "modules/platform-identity/terms-acceptance.js",
       "mode": "0000644",
@@ -7487,12 +7522,12 @@
     {
       "path": "modules/public-landing/public/projects-floor.states.json",
       "mode": "0000644",
-      "sha256": "b02464625daff141f318ae902151b914661236bb369147507f5920dd0cd9665d"
+      "sha256": "598d3d330ec8f054a8af2ca0b354e7f3a604c6335a34607dd6bcd4cd2dae4584"
     },
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "60439c0cfe1c6ac00bc2054342f9065f03e0a2a7cc8f8fb6ba4c7ba8f754661f"
+      "sha256": "5239de18d6e58de7e8e22f4666965afe956f567b3f31304a206feb9f476258cc"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -8207,7 +8242,7 @@
     {
       "path": "modules/ui-design/styles/expedition/mock.html",
       "mode": "0000644",
-      "sha256": "baeccde1879cfb781ddf8da40f0080352fe6a2c1f015b1c8bbfe8fad49f1b6d0"
+      "sha256": "3596b070d8ece6f93894257fd9d8ae5c6a4a12690302c13e6eafa971161b102d"
     },
     {
       "path": "modules/ui-design/styles/expedition/mock.states.json",
@@ -8262,12 +8297,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c40b22193411a5ab4aeb39970ddc87ab3cc170bc0bc31648ee97abca8ce4fcea"
+      "sha256": "c5cc97b40c78fcf1e0eb46f141d801315cb7cdc9afb99ee7435707df4a067f04"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "14e4e326449774e1d15023eb3ff52f1bf147b710ae6be8e83b422f05c69e0abe"
+      "sha256": "3f6fc02ebfabdea595b601e08e7bb9aa2004f576bc4497ecf1d36482889b8efb"
     },
     {
       "path": "public-docs/index.html",
@@ -10022,12 +10057,12 @@
     {
       "path": "src/bongos/auth-idp.js",
       "mode": "0000644",
-      "sha256": "836cf0862d14c753ef3f39117cb75cb4750e6078483ef1a708e32eb1af42930c"
+      "sha256": "fb4d7e17e113cdb41e118d3ecaefc6dc81676dcb780deb3f13532bd998b1412d"
     },
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "799551a37691db4e4516d29a319d0e60d2dea88166b753ce55321e421a05ee3d"
+      "sha256": "f35226f4ab906fa8dbcd688e1c429ce9f161e616f6b5c4a96dee3cebdf33e4b1"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -10312,7 +10347,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d156fd5b889037c1ff215c0d48ceadb9cf07717bda0b547a77a5eccf3d0835bf"
+      "sha256": "2bc85f866eb82befe5dd49e4e5b3c1ed1195f33eb2d00a8f5c8f952d82c99843"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10407,7 +10442,7 @@
     {
       "path": "tests/account_privacy_flags.mjs",
       "mode": "0000644",
-      "sha256": "8318379f7c012dbd56ac983649da92182d4a1b7178833285b6cd7fd75d46fa13"
+      "sha256": "1b49da051770c8bcce351c5d6dd96070962913bb63c687a7b5ae0cc0248ad1e6"
     },
     {
       "path": "tests/achievements_reconcile.mjs",
@@ -10582,12 +10617,12 @@
     {
       "path": "tests/application_echo.mjs",
       "mode": "0000644",
-      "sha256": "779f856c9433f8adc9c79ca988151a12158bcb97f746a9b29a8ca14b09499440"
+      "sha256": "eec3a0404674e2a02d3ba7f38ec9fee92e5f06870240161d98986d525cb03d3f"
     },
     {
       "path": "tests/application_lifecycle.mjs",
       "mode": "0000644",
-      "sha256": "249c97a172d0b77dae22dc561dc7c02dd48b636956df296647d62d7c6e213727"
+      "sha256": "975389846058a123344a6cd56d2355b606c86e2ce59a48981782f61204090096"
     },
     {
       "path": "tests/architect.mjs",
@@ -11029,6 +11064,11 @@
       "mode": "0000644",
       "sha256": "2ddceb37d46eda5c3ab2a56b54c86f3cf55596479b5fe7f30646f45b1ac11ac2"
     },
+    {
+      "path": "tests/card_apply_ui.mjs",
+      "mode": "0000644",
+      "sha256": "998dcc1ca4ff0dfc2368fe4237a5b00bc98fbf7824cd1992f1f7e90bb01c1c56"
+    },
     {
       "path": "tests/cascade-dispatch.mjs",
       "mode": "0000644",
@@ -11169,6 +11209,11 @@
       "mode": "0000644",
       "sha256": "654e70af16092ed0dc76c058b245863c8470b8c3441c39e4c4f5bfd40f60c138"
     },
+    {
+      "path": "tests/community_search_route.mjs",
+      "mode": "0000644",
+      "sha256": "4562631deca93ab222d9ead95c31cbc0964f30194dd59e025bfee35c4d18bb80"
+    },
     {
       "path": "tests/compose_demo_credentials.mjs",
       "mode": "0000644",
@@ -11542,7 +11587,7 @@
     {
       "path": "tests/effective_visibility_predicate.mjs",
       "mode": "0000644",
-      "sha256": "17b7292dba01d25f160d2dd292661e5c236b3f390399e66bfab09124b551eb8f"
+      "sha256": "385ffb03ca61b6422f521dfefa4ab584af1fe87cd8bd4c6fb4cf3a5d631acc28"
     },
     {
       "path": "tests/est_advisory.mjs",
@@ -12642,7 +12687,7 @@
     {
       "path": "tests/idp_device_exchange.mjs",
       "mode": "0000644",
-      "sha256": "bbc81764a9a531afb15f58f925fb72a3f213e1a1c010c45325f741b41428923e"
+      "sha256": "3a57c5a71dae3b35d90fb360efc8ae39ca889f18dbc18d504a68cbc01f0c219c"
     },
     {
       "path": "tests/idp_federation.mjs",
@@ -13012,7 +13057,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "868942895e19730936594efb9f0fb69e4e511397ed738c05e0b27073c01846f7"
+      "sha256": "02f08f0c3449d0d3d7e3df4f2116aba31a01732b7f083dad0d1d11358c90ff53"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -13254,6 +13299,11 @@
       "mode": "0000644",
       "sha256": "e3b2f36780b35fd66690b1c426832322b2781c5386cf7fd50e995a7c2cc089bb"
     },
+    {
+      "path": "tests/people_name_only.mjs",
+      "mode": "0000644",
+      "sha256": "a94562e7680e7153b065fa5b152e13d9880de477e7e9f2a4c9b8de0224266ead"
+    },
     {
       "path": "tests/permission_path.mjs",
       "mode": "0000644",
@@ -13357,7 +13407,7 @@
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "b0ce292dc642be5100cce00c199ef3dc253098ddd952eb7618c6ca6ff3fc54e5"
+      "sha256": "2e23ed585a9cc31bc3627c284ba7fd1e9234ef746d050d79fa771e8029eaf1e8"
     },
     {
       "path": "tests/profile_ui_cross_project.mjs",
@@ -13797,7 +13847,7 @@
     {
       "path": "tests/recruiter_sliver_boundary.mjs",
       "mode": "0000644",
-      "sha256": "a9ad552e7060898e5c94db8af29e63d7cad568294c240c48bef78859a0558ec6"
+      "sha256": "522df6e7930347ff312ef5b2cb98cfde3c53f7465a133618dd970872241bc2b3"
     },
     {
       "path": "tests/redteam_followup_kind.mjs",
@@ -13962,7 +14012,7 @@
     {
       "path": "tests/scouting_owner_access_and_reach.mjs",
       "mode": "0000644",
-      "sha256": "d5ba589fac458e51cf16ed25d01744c3bb020d607d13b85b23d780a655f30261"
+      "sha256": "bbaff2a089e24b294961d8be52714be3704b81b934457a0872e32bdf3b330a96"
     },
     {
       "path": "tests/scouting_page_gate.mjs",
@@ -14732,7 +14782,7 @@
     {
       "path": "tests/ui_design_styles.mjs",
       "mode": "0000644",
-      "sha256": "a2ab80b7fb38695bb65c617eff1c39cfbe17403b1586cb1b20e3dee50e5a23fa"
+      "sha256": "e10c29d3cf8ad7b617276c1af424a6f7c84b6b5b2c20c0284f229a0f0077c678"
     },
     {
       "path": "tests/unit_report_status.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 416 operations across 62 resource groups
+- 417 operations across 63 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -308,6 +308,10 @@ function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "community": {
+      // GET /community/search — rank: public — GET /community/search
+      getCommunitySearch: (args) => request("GET", "/community/search", { hasBody: false }, args),
+    },
     "connections": {
       // GET /connections — rank: any-builder — GET /connections
       getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -307,6 +307,10 @@ function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "community": {
+      // GET /community/search — rank: public — GET /community/search
+      getCommunitySearch: (args) => request("GET", "/community/search", { hasBody: false }, args),
+    },
     "connections": {
       // GET /connections — rank: any-builder — GET /connections
       getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -49,6 +49,7 @@ export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unk
 export interface GetClosenessForMeResponse { closeness: unknown; count: unknown; returned: unknown }
 export interface GetClosenessWeightsResponse { weights: unknown; window_days: unknown; note: unknown }
 export interface GetClosenessWithBuilderIdResponse { closeness: unknown; why: unknown }
+export interface GetCommunitySearchResponse { query: unknown; discipline: unknown; count: unknown; results: unknown; page: unknown }
 export interface GetConnectionsDegreeHandleResponse { handle: unknown; degree: unknown; mutuals: unknown; mutual_count: unknown; truncated: unknown }
 export interface GetConnectionsRequestsResponse { incoming: unknown; outgoing: unknown; incoming_count: unknown; outgoing_count: unknown }
 export interface GetConnectionsResponse { connections: unknown; count: unknown }
@@ -134,7 +135,7 @@ export interface GetPublicUptimeResponse { services: unknown }
 export interface GetPublicVersionsResponse { versions: unknown; page: PageInfo }
 export interface GetRemovalProposalsResponse { pending: unknown; count: unknown }
 export interface GetScoutingHandleResponse { sliver: unknown }
-export interface GetScoutingResponse { builders: unknown }
+export interface GetScoutingResponse { builders: unknown; name_only: unknown }
 export interface GetSecurityDocsResponse { docs: unknown }
 export interface GetSecurityDocsSlugResponse { doc: unknown }
 export interface GetSecurityReportsResponse { reports: unknown; bounty_table: unknown; statuses: unknown }
@@ -694,6 +695,10 @@ export interface BongosClient {
     /** GET /closeness/with/{builderId} — rank: any-builder */
     getClosenessWithBuilderId(args?: RequestArgs): Promise<GetClosenessWithBuilderIdResponse>;
   };
+  "community": {
+    /** GET /community/search — rank: public */
+    getCommunitySearch(args?: RequestArgs): Promise<GetCommunitySearchResponse>;
+  };
   "connections": {
     /** GET /connections — rank: any-builder */
     getConnections(args?: RequestArgs): Promise<GetConnectionsResponse>;

package/clients/bongos-client/index.mjs

@@ -304,6 +304,10 @@ export function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "community": {
+      // GET /community/search — rank: public — GET /community/search
+      getCommunitySearch: (args) => request("GET", "/community/search", { hasBody: false }, args),
+    },
     "connections": {
       // GET /connections — rank: any-builder — GET /connections
       getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),

package/docs/adr/0208-application-lifecycle-the-handle-waits-and-the-vouch-has-no-minter.md

@@ -3,6 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-29
 - **Task:** [task 1002284](https://cloudbongos.com/builders#/task/1002284) (R08, goal 1000045 — criteria C3/C4)
+- **Resolved by:** [ADR 0333](0333-the-application-vouch-is-a-third-token-spent-once-and-bound-to-its-login.md) (task 1002285) — D1's handle and D2's minter, verifier tightening and jti choice are built there.
 - **Relates to:** [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) (the design this builds — D1, D3.2, D4), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (descriptive analytics are never authority), [ADR 0141](<redacted>.md) (identity federated, authority local), [ADR 0171](0171-profile-rollup-join-and-consent.md) D2 (the non-numeric principal guard), [ADR 0116](0116-api-error-envelope-and-code-taxonomy.md) (a refusal names the action available), [ADR 0202](0202-connections-graph-and-bounded-degree.md) D4 (the `account-visibility.js` "its own small file" precedent this reuses)
 
 ## Context

package/docs/adr/0333-the-application-vouch-is-a-third-token-spent-once-and-bound-to-its-login.md

@@ -0,0 +1,86 @@
+# ADR 0333 — The application vouch is a third token kind, spent once, bound to the login it names, and carries a handle only past the consent floor
+
+- **Status:** accepted
+- **Date:** 2026-09-24
+- **Task:** [task 1002285](https://cloudbongos.com/builders#/task/1002285) (R09, goal 1000045 — criterion C4)
+- **Relates to:** [ADR 0201](0201-cross-project-application-vouched-row-live-record.md) D2 (the vouch, the header, the handle), [ADR 0208](0208-application-lifecycle-the-handle-waits-and-the-vouch-has-no-minter.md) D1 + D2 (the handle waits; the minter that cannot express it), [ADR 0260](0260-the-application-is-the-consent-and-the-echo-is-the-gate.md) (the live consumer, built dormant), [ADR 0141](<redacted>.md) §1 (the signed assertion), [ADR 0144](0144-federated-single-logout-backchannel.md) (the logout token), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (a vouch is never authority), [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) §2 (boundary-forced duplication)
+
+## Context
+
+ADR 0201 D2 decided that an application relayed by the hub carries a hub-signed vouch in a header, so a project's reviewer can safely see the applicant's cross-project record beside the name. ADR 0208 D2 then found that the vouch could not be built as D2.1 wrote it: `mintHubAssertion` has no `purpose`, and — worse — `verifyHubAssertion` accepted *any* identity payload, purpose or not, so a captured vouch would have verified as a device sign-in. ADR 0260 built everything downstream of the vouch (the D7 applicant view, the echo-gated `POST /sso/applicant-profile`, the queue's live read keyed on `applicant_github_id`) and left it dormant, because nothing wrote that column.
+
+This task writes it. Four choices in the writer are not obvious, and ADR 0208 D2 explicitly asked for one of them to be *chosen* rather than inherited.
+
+## Decision
+
+### D1 — A third mint/verify pair over one shared envelope, on both sides
+
+`mintHubApplicationVouch` (hub) and `<redacted>` (instance) carry `purpose: 'application'` **and** identity (`sub`, `applicant_login`, `handle`). The three token kinds now differ only in their claims, so each side mints and verifies them through one envelope — `signHubToken` in `hub-keys.js`, `verifyHubToken` in `auth-idp.js` (signature first, Ed25519 hardcoded, issuer, audience, expiry) — rather than three copies of the same twenty lines of crypto. Each verifier then demands exactly what the other two lack:
+
+| Kind | Identity | `purpose` |
+|---|---|---|
+| login assertion | required | **forbidden** |
+| logout token | absent | `backchannel-logout` |
+| application vouch | required, as `applicant_login` | `application` |
+
+The existing error messages are preserved byte-for-byte (the envelope takes the kind's name as a label).
+
+**The vouch's login rides as `applicant_login`, not `github_login`, and that is what makes it safe on cores that have not upgraded.** Every login verifier any core ever shipped demands `github_login`, so a vouch relayed to a project still on an older pin is refused there as a device sign-in too — the purpose refusal in D2 only exists on cores that run this release, and the hub cannot know which pin a project runs. Found by review before ship: with a shared `github_login` claim, an older project that ignored the header could have exchanged a captured vouch for a CLI session within its ~120s life. The two defences are independent, and `tests/idp_device_exchange.mjs` asserts each on its own.
+
+### D2 — `verifyHubAssertion` refuses ANY `purpose`, not a list of known ones
+
+ADR 0208 D2 named the window: the tightening is free only while no minter puts a purpose on an identity token, and this task is the one that starts doing so. The check is presence (`hasOwnProperty`), so `purpose: null`, `''` and any future marker are refused too. A list of forbidden purposes would reopen the device-login replay the day someone adds a fourth kind and forgets the list.
+
+### D3 — The jti is CHOSEN: a separate single-use store, and a vouch must carry one
+
+One vouch vouches one application. The store is its own register — not the CLI assertion map it could have inherited — for the reason the logout store gave: no two token kinds share dedupe state. All three registers now come from one `jtiStore()` factory, so they cannot drift apart. The vouch is spent when it is read, before the INSERT: a write that then fails answers 500, the hub reports the project unreachable, and the applicant's retry mints a fresh vouch — so a spent-but-unwritten vouch costs nothing. `<redacted>` also **requires** a `jti` (its siblings tolerate a missing one) and **requires an audience**: the shared envelope skips the audience check when no client id is given, and a vouch checked that way would accept one minted for any project on the platform.
+
+### D4 — The vouch must name the login the request names; otherwise the row is written unvouched
+
+The body's `github_login` is a string anyone may type. Without the match, any valid vouch could be stapled to a request naming someone else, and the reviewer would read "Identity vouched" beside a name the vouch never confirmed — the exact impersonation surface ADR 0201 exists to close. A mismatch, like every other failure (absent, forged, expired, foreign, replayed, no hub key), writes the unvouched row: **never a refusal** (ADR 0201 D2.3).
+
+### D4b — A vouched re-application takes over an UNVOUCHED pending row for its own login
+
+The one-open-row index means a later application for a login that already has a pending row cannot insert. Left alone, anyone who filed an unvouched request under a well-known builder's login first — off the landing page, no header needed — would pre-empt that builder's real, vouched application for as long as the row sat there: the reviewer would see "Name unvouched" beside the squatter's name and note. So when the INSERT hits the index and the request carried a verified vouch for that login, the route UPDATEs the pending row with the vouch **and replaces its display name and note** with the vouched request's own, so the words beside "Identity vouched" are the vouched applicant's. The UPDATE's own `WHERE applicant_github_id IS NULL` means a row that is already vouched is never re-stamped, and an unvouched re-application still changes nothing (D1.4). Found by review before ship; the first draft named it as a limit instead.
+
+### D5 — The handle is identity, not record; it rides only past the consent floor, and it is stored
+
+`applicant_handle` (`core_254`) is written in the same statement as `applicant_github_id` and `vouched_at`, so the three can never disagree. ADR 0260 D4 says nothing about the applicant is stored — that sentence is about the **record**, which is still resolved live on every render; the handle is in the class of `github_login` and `applicant_github_id`, which the row already holds.
+
+The hub puts a handle in the vouch only when the account clears `isAccountActive` (active **and** the platform terms accepted) — the same floor the applicant view applies — so the vouch never discloses a handle the reviewer's own queue would not show. A **private** account's handle does ride: applying is the consent (ADR 0260 D2), and its D3 sliver carries the handle anyway. The identity itself comes from the hub session, not the account row, so a provisional account is still vouched — just handle-less. The instance re-checks the handle against the hub's handle charset (a boundary-forced mirror of `normalizeHandle`, driven against it in `tests/idp_device_exchange.mjs`) and stores null for anything else.
+
+**Storing it does not outlive a withdrawal, because nothing withdraws a handle.** The floor it passed is write-once in both halves — `profile_state` never demotes from `active`, and `terms_accepted_at` is COALESCE-stamped once (ADR 0213) — and neither `hide_stats` nor going private withholds a handle on any surface (the sliver carries it; `hide_stats` suppresses numbers, never addressability). So the stored handle never shows a reviewer more than the live applicant view would, except after a rename (below).
+
+Since ADR 0260 moved the record read server-side and keyed it on `github_id`, the handle is no longer the lookup key ADR 0201 D2.5–6 needed. It is what the reviewer's queue can call the applicant when the hub is unreachable, and it is returned only by the archon-gated `GET /access-requests`.
+
+### D6 — On the hub the vouch is best-effort, never a gate
+
+A hub with no signing key sends no header and reads nothing — the project writes the unvouched row it always wrote. A failed account read still vouches the identity, handle-less. A mint failure sends no vouch. None of them delays or fails the application. The echo — which is what authorizes the project's later profile read — is written by the same relay on the same `requested` outcome, so a vouch never arrives without the echo it needs, except when the echo write itself fails (below).
+
+### D7 — The instance reaches it through a narrow doorway port
+
+`readApplicationVouch(token, { githubLogin })` joins the doorway beside `<redacted>`. Core supplies the hub public key and this instance's client id; the onboarding module passes a token and a login and can neither substitute a key nor re-address the audience.
+
+## Consequences
+
+- The ADR 0260 path lights up with no UI or route change: a vouched row's `applicant_github_id` drives the live profile read, and `watch.js` already renders the pill and the profile block.
+- It lights up only when **both** ends run this release: the hub mints, the project verifies and has `core_254`. Either alone is inert and safe — an old project ignores the header, an old hub sends none.
+- The approve path and `hasInvitedAccessRequest` are unchanged and still name no vouch column; `tests/application_lifecycle.mjs` now asserts that for a row written by the real writer, not only a seeded one.
+
+## Honest limits
+
+- **The vouch travels with every relay, including to a project whose door then refuses.** The header is minted before the project answers, so an invite-only or unpublished project's server receives the account id and (past the consent floor) the handle of someone who pressed Apply there. It learns no more than the body already tells it — the login and display name — plus the handle and the numeric GitHub id, both public-shaped identity, and it was the applicant who chose to knock.
+- **The jti store is per-process memory.** A restart inside the ~120s window forgets spent vouches; the audience binding stays the primary control, and a replay can only re-assert the identity it already carried at the project it was minted for.
+- **The handle is a snapshot.** A rename after applying is not followed; the hub's previous-handle 301 covers one, and the live profile block shows the current handle whenever the hub answers.
+- **A vouched row can still show no record** when the relay's best-effort echo write failed, since ADR 0260 D3 gates the profile read on the echo. That is the degrade the queue already renders.
+- **No Postgres executes the new INSERT in CI** — the ADR 0208 limit stands. The fake pool in `tests/application_lifecycle.mjs` matches the column list and `VALUES` exactly, so dropping or reordering a vouch column reds the suite; the migration is additive and idempotent.
+
+## Rejected
+
+- **A `purpose` argument on `mintHubAssertion`.** ADR 0208 D2's reason: it would look like D2.1 shipped while leaving the device-login replay open.
+- **Reusing the CLI assertion's jti map.** Shared dedupe state across token kinds is what the logout store already declined.
+- **Refusing an invalid or mismatched vouch.** Hands an attacker a way to make applications fail and locks out older hubs (ADR 0201 D2.3).
+- **Taking the row's login from the vouch instead of the body.** A mismatch means something is wrong; silently renaming the request to whoever the vouch names would hide it.
+- **Upgrading a squatted row but keeping its name and note.** It would stamp "Identity vouched" beside words someone else may have typed.
+- **Asking the project's version before minting, to skip older pins.** A second round-trip on every application to learn what a claim name (D1) already guarantees on every pin.
+- **Sending the handle regardless of consent.** A provisional or no-terms account discloses nothing on any other surface; the vouch would have been the one exception.