@bongos/core 1.19.1016 → 1.19.1018

package/modules/platform-identity/routes/scouting.js

@@ -10,11 +10,14 @@
 // ../scouting-authz.js, which carries the full argument for why reading an
 // instance-asserted ownership claim is not the ADR 0201 D3 inversion.
 //
-// WHO APPEARS IN IT: consent is enforced IN listScoutingRollup itself, by the
-// shared scoutingListableSql predicate — active, publicly visible, not hidden,
-// and not opted out of recruiting (ADR 0171 D2/D3 + privacy spec D1). So this
-// surface honors both the hide flag and the recruiting opt-out by construction,
-// and widening WHO may read it could not widen WHAT is shown.
+// WHO APPEARS IN IT: consent is enforced in the two reads themselves, by shared
+// predicates. `builders` is listScoutingRollup over scoutingListableSql —
+// active, publicly visible, not hidden, not opted out (ADR 0171 D2/D3 + privacy
+// spec D1). `name_only` (ADR 0334, task 1002291) is the hidden-but-reachable
+// builder the spec's D2 lists "name-only": login, name and avatar, via
+// scouting-name-only.js. So the opt-out removes a builder and hide only strips
+// their row to identity, by construction; widening WHO may read it could not
+// widen WHAT is shown.
 //
 // TWO READS, TWO AUDIENCES — and the difference is the point (ADR 0215 D4, task
 // 1002968). `GET /scouting` is the DIRECTORY: the full rollup for builders who
@@ -37,6 +40,7 @@ const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
 const recruiterSliver = require('../recruiter-sliver');
+const scoutingNameOnly = require('../scouting-name-only');
 
 const { pool, requireBuilder, parsePagination } = api;
 
@@ -77,12 +81,15 @@ module.exports = function scoutingRoutes() {
     async (req, res) => {
       const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
       try {
-        const builders = await pi.listScoutingRollup({ limit, pool });
+        const [builders, nameOnly] = await Promise.all([
+          pi.listScoutingRollup({ limit, pool }),
+          scoutingNameOnly.listScoutingNameOnly({ limit, pool }),
+        ]);
         // Same rollup-derived data as the sliver, so the same rule: hide and the
         // recruiting opt-out must beat any cache (ADR 0171 D5). This route
         // predates that posture and was the only rollup read still missing it.
         res.set('Cache-Control', 'no-store');
-        res.json({ builders });
+        res.json({ builders, name_only: nameOnly });
       } catch (err) {
         log.error(`GET /scouting failed: ${err && err.message}`);
         res.fail('scouting_failed', { status: 500, message: 'internal error' });

package/modules/platform-identity/scouting-name-only.js

@@ -0,0 +1,47 @@
+// modules/platform-identity/scouting-name-only.js — the recruiting directory's
+// NAME-ONLY tier: builders who hid their cross-project record but are still open
+// to recruiting (ADR 0334, task 1002291 / R15; privacy spec D2, whose recruiter
+// column lists a hidden builder "name-only (if not opted out)").
+//
+// WHAT IT RETURNS. For each such account: its GitHub login, display name and
+// avatar — what that builder's own public profile page already shows — and
+// nothing else. No id, no count, no date, no craft: every one of those is
+// derived from the record the builder hid. The projection is written out key by
+// key, so a column added to the statement later cannot ride into a response.
+//
+// WHO IS IN IT is scoutingNameOnlySql (account-visibility.js): publicly visible
+// AND hidden AND reachable. Two things it deliberately does NOT do:
+//   - consult the activity rollup. Listing only hidden builders who have built
+//     something would make presence here say so, and that is rollup-derived.
+//   - order by anything but the login. The ranked tier's order IS the record, so
+//     a hidden row ordered by it would leak its rank by position.
+//
+// WHO MAY READ IT is the directory's door (routes/scouting.js, ADR 0210). Not
+// authority in either direction (ADR 0016).
+//
+// Its own file because platform-identity.js sits at the 1,500-line ratchet.
+// Proof: tests/scouting_owner_access_and_reach.mjs §2b; the one-reader pin is in
+// tests/effective_visibility_predicate.mjs.
+'use strict';
+
+const { scoutingNameOnlySql } = require('./account-visibility');
+
+// listScoutingNameOnly({ limit, pool }) — the name-only tier, alphabetical by
+// login, bounded by the same `limit` the ranked tier takes.
+async function listScoutingNameOnly({ limit, pool }) {
+  const { rows } = await pool.query(
+    `SELECT github_login, display_name, avatar_url
+       FROM platform_identity_accounts
+      WHERE ${scoutingNameOnlySql()}
+      ORDER BY lower(github_login), github_login
+      LIMIT $1`,
+    [limit],
+  );
+  return rows.map((r) => ({
+    github_login: r.github_login ?? null,
+    display_name: r.display_name ?? null,
+    avatar_url: r.avatar_url ?? null,
+  }));
+}
+
+module.exports = { listScoutingNameOnly };

package/modules/public-landing/public/projects-floor.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The all-null floor card (task 1003301) on the hub's own catalog (task 1003345): the same page, the same stub, the catalog aliased to featured-hub.json — the landing's three plus Tidewater, a null row nobody owns. Demo, the landing catalog's floor row, is owned by the signed-in stub, and an owned orb's plain click opens its manage view, never its card. Since task 1003352 it also carries the card BACKDROP state: featured-hub gives Example World a card_backdrop, so the owner's plate can be seen standing in front of the project's own picture. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-floor.states.json",
+  "_": "The all-null floor card (task 1003301) on the hub's own catalog (task 1003345): the same page, the same stub, the catalog aliased to featured-hub.json — the landing's three plus Tidewater, a null row nobody owns. Demo, the landing catalog's floor row, is owned by the signed-in stub, and an owned orb's plain click opens its manage view, never its card. Since task 1003352 it also carries the card BACKDROP state: featured-hub gives Example World a card_backdrop, so the owner's plate can be seen standing in front of the project's own picture. Tidewater's null relationship is also the ONLY fixture row the signed-in stub neither owns nor builds on, which is exactly what the Apply button needs (R10, task 1002286) — card-floor is its one rendered state. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-floor.states.json",
   "page": "/projects",
   "surface": "public-landing",
   "modes": [
@@ -55,7 +55,14 @@
         "visible": [
           "#cardOpen",
           "#cardRuns",
-          "#cardListed"
+          "#cardListed",
+          "#cardApply"
+        ],
+        "text": [
+          [
+            "#cardApply",
+            "Apply to join"
+          ]
         ]
       }
     },

package/modules/public-landing/public/projects.html

@@ -1649,6 +1649,7 @@ summary{min-height:24px;padding:3px 0;}
   }
   var catalog = [];
   var mineOrigins = {};   /* normalized host → 'owner' | 'builder' */
+  var appliedOrigins = {}; /* normalized host → true; GET /my-projects' applied echo (R10, task 1002286) */
   var ownedInstances = []; /* the viewer's OWN provisioning rows (never torn_down) */
   var ownedByHost = {};    /* lower(domain) → instance row — the dedupe join */
   /* What the platform's own entry is FOR SEARCH. It is deliberately not pushed
@@ -2166,6 +2167,63 @@ summary{min-height:24px;padding:3px 0;}
       : '';
   }
 
+  /* ══ APPLY TO JOIN (R10, task 1002286) ═══════════════════════════════
+     The card's own door onto the join relay platform-identity already runs
+     (POST /my-projects/join, R08 task 1002284): one click, on the origin the
+     card already has — no URL to type, unlike the separate join-by-URL field
+     task 1003774 is adding to View · Your projects. Hidden for the platform's
+     own card, a member (the “yours”/“you build here” chip already says so) and
+     a signed-out visitor (there is no session to file the request under).
+     Applied is read from the hub's own echo (GET /my-projects' `applied`,
+     loadMemberships) and updated the moment a request lands — the echo
+     carries no status (ADR 0201 D1.3), so Applied IS pending here; there is
+     nothing truer to say until membership itself appears. ══ */
+  function cardApplyHtml(p, rel) {
+    if (p.isSelf || isMember(rel) || !me) return '';
+    return appliedOrigins[hostOf(p.origin)]
+      ? '<button type="button" class="btn ghost" id="cardApply" disabled>Applied</button>'
+      : '<button type="button" class="btn ghost" id="cardApply">Apply to join</button>';
+  }
+  /* The relay's own outcome (my-projects.js RELAY_SENTENCE) is shown verbatim
+     — this page invents no wording of its own for a door it did not build.
+     Only `status === 'requested'` moves the button to Applied; every other
+     2xx (already_member, invite_only, open_enrollment, members_only,
+     not_published) is the door's answer, not a click that went through. */
+  function submitApply(btn, p) {
+    btn.disabled = true;
+    btn.textContent = 'Applying…';
+    var msg = $('cardApplyMsg');
+    fetch(API + '/my-projects/join', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ origin: p.origin }),
+    }).then(function (res) {
+      if (res.status === 401) {
+        btn.textContent = 'Apply to join'; btn.disabled = false;
+        if (msg) { msg.className = 'projMsg err'; msg.innerHTML = signInAgain(); }
+        return;
+      }
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok && data && data.status === 'requested') {
+          appliedOrigins[hostOf(p.origin)] = true;
+          btn.textContent = 'Applied';
+          if (msg) { msg.className = 'projMsg ok'; msg.textContent = data.message || 'Requested.'; }
+          return;
+        }
+        btn.textContent = 'Apply to join';
+        btn.disabled = false;
+        var e = apiError(data, res.status);
+        if (msg) {
+          msg.className = 'projMsg' + (res.ok ? '' : ' err');
+          msg.textContent = (res.ok && data && data.message) || e.message || 'Could not reach that project — try again in a moment.';
+        }
+      });
+    }).catch(function () {
+      btn.textContent = 'Apply to join';
+      btn.disabled = false;
+      if (msg) { msg.className = 'projMsg err'; msg.textContent = 'Couldn’t reach the platform — check your connection and try again.'; }
+    });
+  }
+
   function openCard(p, rel, returnTo) {
     var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
     /* the art: catalog text an Archon typed, scheme-checked server-side and
@@ -2195,13 +2253,16 @@ summary{min-height:24px;padding:3px 0;}
        is member-gated AND address-gated: a member's entry, only where the hall
        is somewhere other than the site the first door already opens. */
     var hall = isMember(rel) ? hallUrlOf(p) : '';
+    var applyBtn = cardApplyHtml(p, rel);
     $('cardActions').innerHTML = (href
       ? '<a class="cardOpen" id="cardOpen" href="' + esc(href) + '"' +
         (p.isSelf ? '' : ' target="_blank" rel="noopener"') + '>' +
         (p.isSelf ? 'Home →' : 'Open site →') + '</a>'
       : '') + (hall
       ? '<a class="cardHall" id="cardHall" href="' + esc(hall) + '" target="_blank" rel="noopener">' + HALL_GLYPH + 'Builders\' hall</a>'
-      : '');
+      : '') + applyBtn + (applyBtn ? '<p class="projMsg" id="cardApplyMsg"></p>' : '');
+    var applyEl = $('cardApply');
+    if (applyEl && !applyEl.disabled) applyEl.addEventListener('click', function () { submitApply(applyEl, p); });
     closeMenus();
     cardReturn = returnTo || null;
     $('cardScrim').hidden = false;
@@ -2446,16 +2507,20 @@ summary{min-height:24px;padding:3px 0;}
   /* "Mine" is a MEMBERSHIP, not the catalog's advisory owner column: the
      authority is platform_identity_project_memberships, whose role is
      owner|builder|visitor, and GET /my-projects already returns the
-     { owned, building } split. 401 (signed out) is not an error here. */
+     { owned, building, applied } split — `applied` is the statusless echo
+     (ADR 0201 D1.3) the card's Apply button reads back (R10, task 1002286).
+     401 (signed out) is not an error here. */
   function loadMemberships() {
     return fetch(API + '/my-projects', { credentials: 'same-origin' })
-      .then(function (res) { return res.ok ? res.json() : { owned: [], building: [] }; })
+      .then(function (res) { return res.ok ? res.json() : { owned: [], building: [], applied: [] }; })
       .then(function (d) {
         mineOrigins = {};
+        appliedOrigins = {};
         (d.owned || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'owner'; });
         (d.building || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'builder'; });
+        (d.applied || []).forEach(function (m) { if (m.origin) appliedOrigins[hostOf(m.origin)] = true; });
       })
-      .catch(function () { mineOrigins = {}; });
+      .catch(function () { mineOrigins = {}; appliedOrigins = {}; });
   }
 
   /* The owner-scoped half of the sky (task 1002744). The public catalog

package/modules/ui-design/styles/expedition/mock.html

@@ -39,9 +39,7 @@ body {
   --gutter: clamp(16px, 4vw, 26px);
   --band: clamp(40px, 7vh, 72px);
   margin: 0;
-  background: var(--bg);
-  background-image: radial-gradient(var(--dots) .9px, transparent 1px);
-  background-size: var(--dot-pitch) var(--dot-pitch);
+  background-color: var(--bg);
   color: var(--ink);
   font-family: var(--font-body);
   font-size: 16px;
@@ -101,6 +99,21 @@ body {
   }
 }
 
+/* the halftone screen, fixed under the content. Not body's own background-image on purpose:
+   the branding pack's `backdrop` emits a `body{background:...}` rule after the page's own
+   stylesheet (serve-internal.js themeMarkup()), and that shorthand resets background-image
+   to none on any served page. A texture on body silently does not exist; a texture on a
+   layer does (the same pattern as the blueprint look's grid, task 1003633). */
+body::before {
+  content: "";
+  position: fixed;
+  inset: 0;
+  z-index: -1;
+  pointer-events: none;
+  background-image: radial-gradient(var(--dots) .9px, transparent 1px);
+  background-size: var(--dot-pitch) var(--dot-pitch);
+}
+
 *, *::before, *::after { box-sizing: border-box; }
 a { color: inherit; }
 :focus-visible { outline: 2px solid var(--focus); outline-offset: 3px; }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1016",
+  "version": "1.19.1018",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1016",
+      "version": "1.19.1018",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1016",
+  "version": "1.19.1018",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth-idp.js

@@ -29,6 +29,7 @@ const { branding, userAgent } = require('../branding');
 const { firstTimeAdmissionBlocked, maybeSeatFirstAdmin, openEnrollmentEnabled, reportActivityRollup, reportMembershipCheckIn, safeSyncRankRole } = require('./auth-admission.js');
 const { loadIdpConfig } = require('./auth-config.js');
 const { newSessionToken } = require('./auth-github.js');
+const log = require('./logger').logger.child({ src: 'auth-idp' });
 
 function idpAuthorizeUrl(origin, clientId, state, redirectUri) {
   const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/bongos/sso/authorize`);
@@ -149,32 +150,38 @@ function loadHubPublicKey() {
   }
 }
 
-// Verify a hub-signed assertion (the compact-JWT format minted by the hub's
-// platform-identity/hub-keys.js — kept in lockstep across the core<->module
-// boundary, ADR 0091 §2). Verifies the Ed25519 signature FIRST (against the given
-// public key), then the issuer, audience (must equal THIS instance's client_id),
-// and expiry. The verify algorithm is HARDCODED to Ed25519 (`crypto.verify(null,…)`)
-// regardless of the header's `alg` field, so there is no algorithm-confusion attack.
-// Returns the validated payload, or throws. Pure over its inputs (testable).
-function verifyHubAssertion(token, { publicKey, clientId, nowMs = Date.now() } = {}) {
+// verifyHubToken — the envelope every hub token shares (hub-keys.js signHubToken,
+// lockstep across the boundary, ADR 0091 §2): Ed25519 signature FIRST, alg hardcoded
+// so there is no algorithm confusion, then issuer, audience (when given) and expiry.
+// Which KIND of token it is, each verifier below decides from the claims.
+function verifyHubToken(token, { publicKey, clientId, nowMs = Date.now(), label }) {
   if (!publicKey) throw new Error('hub public key not configured');
   const parts = String(token || '').split('.');
-  if (parts.length !== 3) throw new Error('malformed assertion');
+  if (parts.length !== 3) throw new Error(`malformed ${label}`);
   const [h, p, s] = parts;
   let header;
   try { header = JSON.parse(Buffer.from(h, 'base64url').toString('utf8')); }
-  catch { throw new Error('malformed assertion header'); }
-  if (!header || header.alg !== 'EdDSA') throw new Error('unexpected assertion alg');
+  catch { throw new Error(`malformed ${label} header`); }
+  if (!header || header.alg !== 'EdDSA') throw new Error(`unexpected ${label} alg`);
   // Signature over the exact `header.payload` bytes — verify BEFORE trusting claims.
   const ok = crypto.verify(null, Buffer.from(`${h}.${p}`, 'utf8'), publicKey, Buffer.from(s, 'base64url'));
-  if (!ok) throw new Error('assertion signature invalid');
+  if (!ok) throw new Error(`${label} signature invalid`);
   let payload;
   try { payload = JSON.parse(Buffer.from(p, 'base64url').toString('utf8')); }
-  catch { throw new Error('malformed assertion payload'); }
-  if (payload.iss !== HUB_ASSERTION_ISSUER) throw new Error('unexpected assertion issuer');
-  if (clientId != null && String(payload.aud) !== String(clientId)) throw new Error('assertion audience mismatch');
-  if (typeof payload.exp !== 'number' || payload.exp < Math.floor(nowMs / 1000)) throw new Error('assertion expired');
+  catch { throw new Error(`malformed ${label} payload`); }
+  if (payload.iss !== HUB_ASSERTION_ISSUER) throw new Error(`unexpected ${label} issuer`);
+  if (clientId != null && String(payload.aud) !== String(clientId)) throw new Error(`${label} audience mismatch`);
+  if (typeof payload.exp !== 'number' || payload.exp < Math.floor(nowMs / 1000)) throw new Error(`${label} expired`);
+  return payload;
+}
+
+// Verify a hub-signed LOGIN assertion: the envelope, identity, and NO `purpose` —
+// any purpose, not a list, so no identity-bearing token kind can pass as a device
+// sign-in (ADR 0208 D2, ADR 0333 D2).
+function verifyHubAssertion(token, { publicKey, clientId, nowMs = Date.now() } = {}) {
+  const payload = verifyHubToken(token, { publicKey, clientId, nowMs, label: 'assertion' });
   if (payload.sub == null || !payload.github_login) throw new Error('assertion missing identity');
+  if (Object.prototype.hasOwnProperty.call(payload, 'purpose')) throw new Error('assertion carries a purpose — not a login assertion');
   return payload;
 }
 
@@ -195,41 +202,46 @@ const HUB_LOGOUT_PURPOSE = 'backchannel-logout';
 // github_login (rejected by verifyHubAssertion). Returns the validated payload
 // ({ sub: github_id, ... }) or throws. Pure over its inputs (testable, no I/O).
 function verifyHubLogoutToken(token, { publicKey, clientId, nowMs = Date.now() } = {}) {
-  if (!publicKey) throw new Error('hub public key not configured');
-  const parts = String(token || '').split('.');
-  if (parts.length !== 3) throw new Error('malformed logout token');
-  const [h, p, s] = parts;
-  let header;
-  try { header = JSON.parse(Buffer.from(h, 'base64url').toString('utf8')); }
-  catch { throw new Error('malformed logout token header'); }
-  if (!header || header.alg !== 'EdDSA') throw new Error('unexpected logout token alg');
-  // Signature over the exact `header.payload` bytes — verify BEFORE trusting claims.
-  const ok = crypto.verify(null, Buffer.from(`${h}.${p}`, 'utf8'), publicKey, Buffer.from(s, 'base64url'));
-  if (!ok) throw new Error('logout token signature invalid');
-  let payload;
-  try { payload = JSON.parse(Buffer.from(p, 'base64url').toString('utf8')); }
-  catch { throw new Error('malformed logout token payload'); }
-  if (payload.iss !== HUB_ASSERTION_ISSUER) throw new Error('unexpected logout token issuer');
-  if (clientId != null && String(payload.aud) !== String(clientId)) throw new Error('logout token audience mismatch');
-  if (typeof payload.exp !== 'number' || payload.exp < Math.floor(nowMs / 1000)) throw new Error('logout token expired');
+  const payload = verifyHubToken(token, { publicKey, clientId, nowMs, label: 'logout token' });
   if (payload.purpose !== HUB_LOGOUT_PURPOSE) throw new Error('not a back-channel logout token');
   if (payload.sub == null) throw new Error('logout token missing subject');
   return payload;
 }
 
+// The purpose marker on a hub APPLICATION VOUCH — lockstep with hub-keys.js.
+const HUB_APPLICATION_PURPOSE = 'application';
+
+// Verify a hub-signed APPLICATION VOUCH (ADR 0333): purpose 'application', identity
+// (sub + applicant_login), and — stricter than its siblings — a required audience
+// (the envelope skips the check without one) and a jti (single use needs one).
+function verifyHubApplicationVouch(token, { publicKey, clientId, nowMs = Date.now() } = {}) {
+  if (clientId == null || clientId === '') throw new Error('application vouch audience not configured');
+  const payload = verifyHubToken(token, { publicKey, clientId, nowMs, label: 'application vouch' });
+  if (payload.purpose !== HUB_APPLICATION_PURPOSE) throw new Error('not an application vouch');
+  if (payload.sub == null || !payload.applicant_login) throw new Error('application vouch missing identity');
+  if (!payload.jti) throw new Error('application vouch missing jti');
+  return payload;
+}
+
+// jtiStore — a single-use jti register. One per token kind, so no two kinds share
+// dedupe state; entries expire with their token. In-memory per process.
+function jtiStore() {
+  const seen = new Map(); // jti -> expiry ms
+  return function seenAndRecord(jti, expSeconds, nowMs = Date.now()) {
+    for (const [k, exp] of seen) if (exp < nowMs) seen.delete(k);
+    if (!jti) return false; // no jti → cannot dedupe (aud + TTL remain the guards)
+    if (seen.has(jti)) return true;
+    seen.set(jti, expSeconds ? expSeconds * 1000 : nowMs + 120000);
+    return false;
+  };
+}
+
 // Anti-replay for CLI assertions (ADR 0141 §1, defense-in-depth on top of the
 // aud-scoping fix): a jti may be exchanged ONCE. In-memory per process, TTL = the
 // assertion's own expiry, so a captured assertion can't be replayed into multiple
 // sessions even inside its ~120s life. A restart clears it — acceptable given the
 // short window and that the aud binding is the primary control.
-const _seenAssertionJti = new Map(); // jti -> expiry ms
-function _assertionJtiSeenAndRecord(jti, expSeconds, nowMs = Date.now()) {
-  for (const [k, exp] of _seenAssertionJti) if (exp < nowMs) _seenAssertionJti.delete(k);
-  if (!jti) return false; // no jti → cannot dedupe (aud + TTL remain the guards)
-  if (_seenAssertionJti.has(jti)) return true;
-  _seenAssertionJti.set(jti, expSeconds ? expSeconds * 1000 : nowMs + 120000);
-  return false;
-}
+const _assertionJtiSeenAndRecord = jtiStore();
 
 // Anti-replay for back-channel LOGOUT tokens (task 1002238, symmetric with the CLI
 // assertion path above). Honor a logout token's jti ONCE: the FIRST use revokes,
@@ -241,13 +253,43 @@ function _assertionJtiSeenAndRecord(jti, expSeconds, nowMs = Date.now()) {
 // share dedupe state. In-memory per process; a restart clears it (acceptable — the
 // window is short and the aud binding is the primary control). Exported for the
 // route (routes/auth.js) since the DB revoke lives there, not in the kernel.
-const _seenLogoutJti = new Map(); // jti -> expiry ms
-function logoutTokenJtiSeenAndRecord(jti, expSeconds, nowMs = Date.now()) {
-  for (const [k, exp] of _seenLogoutJti) if (exp < nowMs) _seenLogoutJti.delete(k);
-  if (!jti) return false; // no jti → cannot dedupe (aud + TTL remain the guards)
-  if (_seenLogoutJti.has(jti)) return true;
-  _seenLogoutJti.set(jti, expSeconds ? expSeconds * 1000 : nowMs + 120000);
-  return false;
+const logoutTokenJtiSeenAndRecord = jtiStore();
+
+// Anti-replay for APPLICATION VOUCHES — chosen, not inherited (ADR 0333 D3): one
+// vouch vouches one application.
+const vouchJtiSeenAndRecord = jtiStore();
+
+// The hub's handle charset (platform-identity.js normalizeHandle — boundary-forced
+// mirror, pinned by tests/idp_device_exchange.mjs). Anything else is stored as null.
+const HUB_HANDLE_RE = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$/;
+
+// applicationVouchIdentity — { githubId, handle } from a verified, unspent vouch that
+// names the request's own login, else null; never throws. Null is never a refusal
+// (ADR 0201 D2.3): the route writes the unvouched row. Key + audience injected.
+function applicationVouchIdentity(token, { githubLogin, publicKey, clientId, nowMs = Date.now() } = {}) {
+  if (!token || !publicKey || !clientId) return null;
+  let payload;
+  try {
+    payload = verifyHubApplicationVouch(token, { publicKey, clientId, nowMs });
+  } catch (err) {
+    log.info({ reason: err.message }, 'application vouch not accepted — the request is written unvouched');
+    return null;
+  }
+  // The body's login is a string anyone may type: a vouch for another account is no vouch.
+  if (String(payload.applicant_login).toLowerCase() !== String(githubLogin || '').toLowerCase()) return null;
+  if (vouchJtiSeenAndRecord(payload.jti, payload.exp, nowMs)) return null;
+  return {
+    githubId: String(payload.sub),
+    handle: typeof payload.handle === 'string' && HUB_HANDLE_RE.test(payload.handle) ? payload.handle : null,
+  };
+}
+
+// readApplicationVouch — the doorway port: supplies THIS instance's hub key and
+// client_id itself, so a module can neither swap the key nor re-address the check.
+function readApplicationVouch(token, { githubLogin } = {}) {
+  if (!token) return null;
+  const idp = loadIdpConfig();
+  return applicationVouchIdentity(token, { githubLogin, publicKey: idp && loadHubPublicKey(), clientId: idp && idp.clientId });
 }
 
 // Complete a CLI federation exchange: verify the hub assertion, then run the SAME
@@ -318,6 +360,7 @@ async function completeDeviceExchange({ assertion, userAgent: ua }) {
 // without creds or network.
 
 module.exports = {
+  applicationVouchIdentity,
   buildIdpAuthorizeUrl,
   completeDeviceExchange,
   completeIdpFlow,
@@ -325,6 +368,8 @@ module.exports = {
   idpAuthorizeUrl,
   loadHubPublicKey,
   logoutTokenJtiSeenAndRecord,
+  readApplicationVouch,
+  verifyHubApplicationVouch,
   verifyHubAssertion,
   verifyHubLogoutToken,
 };

package/src/bongos/auth.js

@@ -57,7 +57,7 @@ const { branding, userAgent } = require('../branding');
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
 const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
-const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
+const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, readApplicationVouch, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
 
 const MAX_AUTH_TOKEN_CANDIDATES = 6;
@@ -901,6 +901,7 @@ module.exports = {
   openEnrollmentEnabled,
   joinabilityMode,
   readApplicantProfileFromHub,
+  readApplicationVouch,
   firstTimeAdmissionBlocked,
   instanceNeedsFirstAdmin,
   webAdmissionStatus,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1016'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1018'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -346,6 +346,12 @@ module.exports = {
   //     re-address it. Fails soft to null on every error, so a hub outage costs
   //     the profile block and never the queue.
   get readApplicantProfileFromHub() { return require('./bongos/auth').readApplicantProfileFromHub; },
+  // readApplicationVouch(token, { githubLogin }) — the write-side twin (task
+  //     1002285, ADR 0201 D2): verify the hub's application vouch on a public
+  //     access request → { githubId, handle } or null. Core supplies this
+  //     instance's hub key and client_id itself, so a module can neither
+  //     substitute a key nor re-address the check. Null is never a refusal.
+  get readApplicationVouch() { return require('./bongos/auth').readApplicationVouch; },
   // userAgent — the instance's HTTP User-Agent string (branding-derived). The
   // carved lifecycle module's github-push.js stamps every GitHub API request with
   // it instead of reaching into src/branding.js directly (BV1.R86).

package/tests/account_privacy_flags.mjs

@@ -416,7 +416,10 @@ test('the recruiting surface really is exactly two reads, and each one joins REA
   assert.match(route, /'\/scouting\/:handle'/, 'and the pre-accept sliver');
 
   const av = readFileSync(join(ROOT, 'modules/platform-identity/account-visibility.js'), 'utf8');
-  for (const composed of ['scoutingListableSql', 'recruiterSliverVisibleSql']) {
+  // The directory reads TWO tiers since task 1002291 — ranked, and the hidden
+  // builders it lists by name — and the opt-out must empty both, or "removes you
+  // from the People directory" is false for a builder who also hid their record.
+  for (const composed of ['scoutingListableSql', 'scoutingNameOnlySql', 'recruiterSliverVisibleSql']) {
     const body = av.slice(av.indexOf(`function ${composed}(`));
     assert.match(body.slice(0, body.indexOf('\n}')), /recruiterReachSql\(alias\)/,
       `${composed} stopped composing the reach axis — opting out would no longer empty that surface`);