@bongos/core 1.19.102 → 1.19.103

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.102",
-  "core_contract": "1.19.102",
-  "source_commit": "484851c87018d5e1be475e9964f1215eaf50e4b1",
+  "core_version": "1.19.103",
+  "core_contract": "1.19.103",
+  "source_commit": "4c26152f4ffe43100617e89d904852639f51a9dc",
   "source_ref": "HEAD",
-  "built_at": "2026-08-13T23:21:54.630Z",
+  "built_at": "2026-08-13T23:41:03.246Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 301,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1232,
+    "functional_verbatim": 1234,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1554,
-  "tree_sha256": "5858094e2d3e98c087659218b83067785b4a98e0ee29e6f26c06dc354d8eaeea",
+  "file_count": 1556,
+  "tree_sha256": "b559bea5c153dfcb5b4007dee090a97532674449005645ee1953761712bcf02a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3754,6 +3754,11 @@
       "mode": "0000644",
       "sha256": "b6eea95dbe66a3126fc2c73d93237cf38dd648a803e910eb88fbd5c780ccef62"
     },
+    {
+      "path": "modules/platform-identity/project-stats.js",
+      "mode": "0000644",
+      "sha256": "6ce71a9bd387a2b79d4c57a6669f028a807ef88ff205f65c20c55ce3d9889214"
+    },
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
@@ -3762,7 +3767,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "33acce5b2f0c9ea9aef4a0d38f5245e56be4cd2756bc1d49129d5fadeb56a4a1"
+      "sha256": "188583ffb979d305c57a8f0958806ee0bd813007df158d74e45a0d415a3ff6aa"
     },
     {
       "path": "modules/platform-identity/routes/scouting.js",
@@ -4142,12 +4147,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c83bac76021e0d2fae2092fabdb4cd4614af07caf2dab896b07ff1ecbcdd1409"
+      "sha256": "b3854f65fe8ad4aead3d08a87f9f2200d87e2b049aed77f7849d51f9aa6f6e5b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3d78882106612f2950816b2c7849605ae097a8a8b41fda1b6e1dc0e9d056bc96"
+      "sha256": "7467e0451b4fd162c287c7a5eceee8da746785a3da989bda154830ead5728f3d"
     },
     {
       "path": "public-docs/index.html",
@@ -4387,7 +4392,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "1fdc2c4e3d58ae089a71bade6aa3f5f3259447b243eacdc75b8a91797ea065e7"
+      "sha256": "3ae9d1edc18eef49ebdf90d0c20c00defda76bfb393936c4a615720314a2886e"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4407,7 +4412,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "081e903fcb943e4facda8e83c9247a31602bf7750d5d7740353c97a4ccbcf1e2"
+      "sha256": "f70211d0d2bfe21fa7000ab82d0adcaa97df1f28763e366965da2b92847b31b6"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5717,7 +5722,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "36d78bc9f5db096873e060769bd9b9fd24b65d5a2141e65e57adfdd30df81342"
+      "sha256": "18be8d4886ea03a65a0cd5d817c811ca0496ea509df5716f416d985a5d682b84"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7234,10 +7239,15 @@
       "mode": "0000644",
       "sha256": "dc354f082204073409aea90df9b91f149d474c6930b761ed5c9928bb76e1358f"
     },
+    {
+      "path": "tests/project_stats.mjs",
+      "mode": "0000644",
+      "sha256": "21bd2a2d0ebb234cd3b9770d126e77ce48f5c630fe7deee2585706d4eb072b53"
+    },
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "6a59da0cfbf5d2be741ed26f3350a39d49a64b6f1dffb89f69666af7ba938dd1"
+      "sha256": "d8fd9759b99b2136f8b438727b74b15346db7cbd8f0ef8b67aec3049f059df2b"
     },
     {
       "path": "tests/provision.mjs",

package/modules/platform-identity/project-stats.js

@@ -0,0 +1,207 @@
+// modules/platform-identity/project-stats.js — real Builders + Tags for the hub
+// catalog, read from each project's OWN public API (task 1002771).
+//
+// WHY THE DATA IS NOT HERE. The apex catalog stores four fields (origin, name,
+// tagline, art_url) and nothing else; the membership and activity tables that
+// would know a builder count are written only by the federated check-in a hosted
+// instance posts on sign-in, so they hold one row across the whole platform and
+// would report ZERO for every hand-wired project (task 1002760 documents why).
+// Zero is not an absence — it is the claim "nobody builds here" — so task 1002764
+// removed the columns rather than show a wrong number.
+//
+// But every Cloud Bongos instance already serves an unauthenticated
+// /api/bongos/public/* surface, and the hub's server can read it instance-to-
+// instance with no CORS involved. The project itself is the authority on its own
+// builder count, which is a better source than anything the apex could infer.
+//
+// SCALE, recorded so it is not rediscovered: this PULL model is right for a
+// handful and fine for a few dozen behind the cache. It does not scale to
+// hundreds — at that point instances should PUSH these stats on check-in, which
+// is the shape platform_identity_builder_project_activity already has. Swapping
+// pull for push must not change the column, which is why the route depends on
+// getProjectStats() and not on fetch().
+
+const fs = require('node:fs');
+const path = require('node:path');
+const dns = require('node:dns').promises;
+const net = require('node:net');
+
+const TTL_MS = 10 * 60 * 1000;   // owner's choice, 2026-08-13
+const FETCH_TIMEOUT_MS = 2500;   // per request
+const COLD_DEADLINE_MS = 3000;   // total wait a COLD cache may cost a page load
+
+const _cache = new Map();        // origin → { at, stats }
+const _inflight = new Map();     // origin → Promise (collapses concurrent refreshes)
+
+// The core's own modules/ directory IS the canonical core set — so a module the
+// core adds later is excluded automatically and nobody maintains a list. Anything
+// an instance runs beyond it is project-specific, and that is what a tag is.
+let _coreModules = null;
+function coreModules() {
+  if (_coreModules) return _coreModules;
+  try {
+    _coreModules = new Set(
+      fs.readdirSync(path.join(__dirname, '..'), { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => d.name),
+    );
+  } catch {
+    _coreModules = new Set();
+  }
+  return _coreModules;
+}
+
+// Machine identities, not people. Counting them inflates every project: the raw
+// leaderboards read 13/3/3 against real 11/1/1, so this filter is the difference
+// between a true number and a wrong one.
+function isSystemAccount(login) {
+  return /-system$/.test(String(login || ''));
+}
+
+// ── SSRF GUARD ──
+// This is the one place the server makes an outbound request to an address that
+// came out of the database, so it is the one place that has to assume the address
+// is hostile. "The catalog is Archon-curated" is a real mitigation but not a
+// sufficient one, for a specific reason: a curated origin is trusted, and a
+// REDIRECT TARGET is not. Following redirects hands the choice of final address
+// back to the remote server, which is the whole SSRF primitive — a listed project
+// could 302 us at 169.254.169.254 (cloud metadata) or a loopback admin port.
+//
+// So: redirects are refused outright rather than followed (a public JSON endpoint
+// has no reason to redirect), and the hostname must resolve to a PUBLIC address.
+//
+// Known and accepted limit: resolving here and connecting in fetch() is a
+// TOCTOU window — a DNS record could change between the two. Closing it properly
+// means pinning the resolved IP into the connection, which needs a custom agent.
+// Refusing redirects removes the attacker-steerable half, which is the half that
+// matters; the residual requires control of DNS for a curated origin.
+const BLOCKED_V4 = [
+  [/^10\./, 'private'], [/^127\./, 'loopback'], [/^0\./, 'unspecified'],
+  [/^169\.254\./, 'link-local / cloud metadata'], [/^192\.168\./, 'private'],
+  [/^172\.(1[6-9]|2\d|3[01])\./, 'private'], [/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./, 'CGNAT'],
+  [/^(22[4-9]|23\d)\./, 'multicast'], [/^(24\d|25[0-5])\./, 'reserved'],
+];
+function blockedReason(addr) {
+  const ip = String(addr).replace(/^::ffff:/i, '');   // unwrap IPv4-mapped IPv6
+  if (net.isIPv4(ip)) {
+    for (const [re, why] of BLOCKED_V4) if (re.test(ip)) return why;
+    return null;
+  }
+  const v6 = ip.toLowerCase();
+  if (v6 === '::1' || v6 === '::') return 'loopback';
+  if (/^f[cd]/.test(v6)) return 'unique-local';
+  if (/^fe[89ab]/.test(v6)) return 'link-local';
+  return null;
+}
+
+async function assertPublicHost(hostname) {
+  // a literal IP needs no lookup — check it directly
+  if (net.isIP(hostname)) {
+    const why = blockedReason(hostname);
+    if (why) throw new Error(`refused ${hostname} (${why})`);
+    return;
+  }
+  const addrs = await dns.lookup(hostname, { all: true });
+  if (!addrs.length) throw new Error(`no address for ${hostname}`);
+  for (const { address } of addrs) {
+    const why = blockedReason(address);
+    if (why) throw new Error(`refused ${hostname} → ${address} (${why})`);
+  }
+}
+
+function publicUrl(origin, route) {
+  const u = new URL(origin);
+  if (u.protocol !== 'https:' && u.protocol !== 'http:') throw new Error('bad scheme');
+  return new URL(`/api/bongos/public/${route}`, u).href;
+}
+
+async function getJson(url) {
+  await assertPublicHost(new URL(url).hostname);
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    headers: { accept: 'application/json' },
+    redirect: 'error',   // never let the remote choose our final address
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  return res.json();
+}
+
+// One project's stats. Either half may fail on its own — a project whose
+// leaderboard is down can still report its modules — so they settle independently
+// and a missing half is null (an em dash) rather than a discarded pair.
+async function fetchStats(origin) {
+  const [lb, mods] = await Promise.allSettled([
+    getJson(publicUrl(origin, 'leaderboard')),
+    getJson(publicUrl(origin, 'modules')),
+  ]);
+
+  let builders = null;
+  if (lb.status === 'fulfilled' && Array.isArray(lb.value?.leaderboard)) {
+    builders = lb.value.leaderboard.filter((b) => !isSystemAccount(b?.github_login)).length;
+  }
+
+  let tags = null;
+  if (mods.status === 'fulfilled' && mods.value?.enabled && typeof mods.value.enabled === 'object') {
+    const core = coreModules();
+    tags = Object.entries(mods.value.enabled)
+      .filter(([key, on]) => on === true && !core.has(key))
+      .map(([key]) => key)
+      .sort();
+  }
+
+  return { builders, tags };
+}
+
+function refresh(origin) {
+  if (_inflight.has(origin)) return _inflight.get(origin);
+  const p = fetchStats(origin)
+    .then((stats) => {
+      _cache.set(origin, { at: Date.now(), stats });
+      return stats;
+    })
+    .catch(() => {
+      // Remember the FAILURE for a full TTL too. Without this a permanently
+      // unreachable project is re-fetched on every request and pays the timeout
+      // every time — the exact way one dead project slows the whole page.
+      const stats = { builders: null, tags: null };
+      _cache.set(origin, { at: Date.now(), stats });
+      return stats;
+    })
+    .finally(() => _inflight.delete(origin));
+  _inflight.set(origin, p);
+  return p;
+}
+
+// Stale-while-revalidate: a warm cache answers instantly, a STALE cache answers
+// instantly and refreshes behind the request, and only a COLD cache waits — and
+// then only until COLD_DEADLINE_MS, after which whatever has not arrived renders
+// as a dash and fills itself in on the next load. The hub's speed must never
+// become hostage to the slowest project's uptime.
+async function getProjectStats(origins = []) {
+  const now = Date.now();
+  const cold = [];
+
+  for (const origin of origins) {
+    const hit = _cache.get(origin);
+    if (!hit) cold.push(origin);
+    else if (now - hit.at > TTL_MS) refresh(origin);   // stale: revalidate, do not await
+  }
+
+  if (cold.length) {
+    await Promise.race([
+      Promise.allSettled(cold.map((o) => refresh(o))),
+      new Promise((r) => setTimeout(r, COLD_DEADLINE_MS)),
+    ]);
+  }
+
+  // null-prototype: an origin literally equal to '__proto__' would otherwise
+  // retarget the object's prototype instead of adding a key
+  const out = Object.create(null);
+  for (const origin of origins) out[origin] = _cache.get(origin)?.stats || { builders: null, tags: null };
+  return out;
+}
+
+// tests
+function _reset() { _cache.clear(); _inflight.clear(); _coreModules = null; }
+
+module.exports = { getProjectStats, isSystemAccount, coreModules, blockedReason, assertPublicHost, _reset, TTL_MS };

package/modules/platform-identity/routes/projects.js

@@ -13,6 +13,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
+const projectStats = require('../project-stats');
 
 const { pool, requireBuilder, requirePermission, validateOrRespond, parseId, corsPublicGet } = api;
 
@@ -100,7 +101,26 @@ module.exports = function projectsRoutes() {
   // rank: public — a curated public showcase; no auth by design.
   router.get('/projects/featured', async (_req, res) => {
     try {
-      res.json({ projects: await pi.listFeaturedProjects({ pool }) });
+      const projects = await pi.listFeaturedProjects({ pool });
+      // Builders + tags come from each project's OWN public API, because the
+      // apex catalog does not know them and the membership tables would report
+      // zero for every hand-wired project (task 1002771; see project-stats.js).
+      // Enrichment is best-effort by construction: a project that is down gets
+      // nulls, which the table renders as an em dash. It must never fail the
+      // listing — a broken stats fetch cannot take the catalog down with it.
+      let stats = {};
+      try {
+        stats = await projectStats.getProjectStats(projects.map((p) => p.origin));
+      } catch (err) {
+        console.error('[platform-identity] project stats enrichment failed (non-fatal):', err.message);
+      }
+      res.json({
+        projects: projects.map((p) => ({
+          ...p,
+          builders: stats[p.origin]?.builders ?? null,
+          tags: stats[p.origin]?.tags ?? null,
+        })),
+      });
     } catch (err) {
       console.error('[platform-identity] GET /projects/featured', err);
       res.fail('explore_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.102",
+  "version": "1.19.103",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.102",
+      "version": "1.19.103",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.102",
+  "version": "1.19.103",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -540,6 +540,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   box-shadow:0 0 0 3px color-mix(in srgb,var(--acc) 22%,transparent);}
 .tbl .ptitle{font-family:var(--font-display);font-weight:700;font-size:15px;color:var(--ink);}
 .tbl .ptag{font-size:12.5px;color:var(--ink-faint);font-weight:600;}
+.tbl .num{font-family:var(--font-mono);font-weight:500;}
+.tbl .tags{display:flex;gap:6px;flex-wrap:wrap;}
+.tbl .tags span{font-family:var(--font-mono);font-size:10.5px;padding:2px 8px;border-radius:999px;
+  border:1px solid var(--line);color:var(--ink-faint);white-space:nowrap;}
 .tbl .pill{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
   border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);}
 :root[data-mode="dark"] .tbl .pill{color:var(--sun-lit);}
@@ -553,6 +557,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .colStatus{width:1%;white-space:nowrap;}
 .tbl .colGo{width:1%;white-space:nowrap;padding-left:8px;}
 .tbl .colName{width:auto;}
+@media (max-width:780px){.tbl .colTags{display:none;}}
 
 /* ── the project card ──
    An overlay INSIDE the map, not a destination: opening a project must not cost

package/public-landing/projects.html

@@ -182,6 +182,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       <thead>
         <tr>
           <th class="colName" data-sort="name" aria-sort="ascending">Project</th>
+          <th class="right" data-sort="builders">Builders</th>
+          <th class="colTags">Runs</th>
           <th class="right colStatus">Status</th>
           <th class="colGo"></th>
         </tr>
@@ -196,6 +198,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
           <td class="colName"><span class="pname"><span class="pdot" style="--acc:var(--accent)"></span>
             <span><span class="ptitle" data-brand-product-inline>Cloud Bongos</span><span id="selfPill"></span><br>
             <span class="ptag">this platform</span></span></span></td>
+          <td class="right num" id="selfBuilders">—</td>
+          <td class="colTags" id="selfTags">—</td>
           <td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>
           <td class="colGo"><a class="btn small ghost" href="#" data-self-open>Open →</a></td>
         </tr>
@@ -568,6 +572,18 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     if (!me) return 'none';
     return me.rank === 'archon' ? 'owner' : 'builder';
   }
+  /* A tag is a module the project RUNS beyond the core set — a fact it declares
+     about itself, not a guess about what it is. Capped so one heavily-moduled
+     project cannot blow the column open; the overflow is counted, never hidden
+     silently. null = we could not ask (em dash); [] = asked, runs nothing beyond
+     core, which is a real answer and still reads as a dash in the cell. */
+  var TAG_CAP = 3;
+  function tagsHtml(tags) {
+    if (!Array.isArray(tags) || !tags.length) return '—';
+    var shown = tags.slice(0, TAG_CAP).map(function (t) { return '<span>' + esc(t) + '</span>'; });
+    if (tags.length > TAG_CAP) shown.push('<span>+' + (tags.length - TAG_CAP) + '</span>');
+    return '<span class="tags">' + shown.join('') + '</span>';
+  }
   function matchesMapQuery(p, q) {
     if (!q) return true;
     return (String(p.name || '') + ' ' + String(p.tagline || '')).toLowerCase().indexOf(q) !== -1;
@@ -622,6 +638,13 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
           accentOf(p) + '"></span>' +
           '<span><span class="ptitle">' + esc(p.name) + '</span>' + pill + '<br>' +
           '<span class="ptag">' + esc(p.tagline || '') + '</span></span></span></td>' +
+        /* Builders and Runs come from the project's OWN public API, enriched
+           server-side (task 1002771). null is unknown — the project was
+           unreachable — and an em dash says exactly that. 0 is a real answer and
+           renders as 0, because "nobody has joined yet" is a different fact from
+           "we could not ask". */
+        '<td class="right num">' + (p.builders == null ? '—' : esc(String(p.builders))) + '</td>' +
+        '<td class="colTags">' + tagsHtml(p.tags) + '</td>' +
         /* liveness on a catalog row is NOT probed by this surface. A chip that
            said "live" here would claim more than anything verified (C6); the
            verification overlay on owned orbs is its own task. */
@@ -641,6 +664,15 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     });
     list.sort(function (x, y) {
       if (mapSort.key === 'name') return String(x.name || '').localeCompare(String(y.name || '')) * mapSort.dir;
+      /* unknown (null) sorts to the BOTTOM in both directions — it is not a low
+         number, and letting it ride the comparator would rank "we could not ask"
+         above a project that honestly has one builder */
+      if (mapSort.key === 'builders') {
+        if (x.builders == null && y.builders == null) return 0;
+        if (x.builders == null) return 1;
+        if (y.builders == null) return -1;
+        return (x.builders - y.builders) * mapSort.dir;
+      }
       return 0;
     });
     renderOrbs(list);
@@ -759,6 +791,25 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     if (ev.key === 'Escape') closeCard();
   });
 
+  /* The platform's own row is not in the catalog (it is synthesized — task
+     1002760), so the server-side enrichment never sees it. It can answer for
+     itself though: this is its own origin, so one same-origin call gets the same
+     number by the same rule the server applies to everyone else — real builders,
+     machine accounts excluded. Its Runs cell stays a dash honestly: every module
+     this instance enables is a CORE module, so it declares nothing beyond the
+     baseline and there is no tag to show. */
+  function loadSelfStats() {
+    return fetch(API + '/public/leaderboard', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (d) {
+        var rows = (d && d.leaderboard) || [];
+        if (!rows.length) return;
+        var real = rows.filter(function (b) { return !/-system$/.test(String(b.github_login || '')); });
+        $('selfBuilders').textContent = String(real.length);
+      })
+      .catch(function () { /* unreachable → the dash already in the markup stands */ });
+  }
+
   function loadCatalog() {
     fetch(API + '/projects/featured', { credentials: 'same-origin' })
       .then(function (res) { if (!res.ok) throw new Error('catalog'); return res.json(); })
@@ -1467,7 +1518,9 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     })
     /* the catalog is PUBLIC, so it loads either way — the map is the view a
        signed-out stranger lands on and it must not depend on identity */
-    .then(loadCatalog, loadCatalog);
+    .then(loadCatalog, loadCatalog)
+    /* the platform's own count is public too, so it loads either way */
+    .then(loadSelfStats, loadSelfStats);
 })();
 </script>
 </body>

package/src/module-api.js

@@ -631,8 +631,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.100 with no explicit bump. run 31752022322. (task 1002620)
 //   1.19.102 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.101 with no explicit bump. run 31753496152. (task 1002620)
+//   1.19.103 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.102 with no explicit bump. run 31754659965. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.102'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.103'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/project_stats.mjs

@@ -0,0 +1,206 @@
+// tests/project_stats.mjs — the hub's cross-instance stats fetcher (task 1002771).
+//
+// The hub reads Builders + Runs from each project's OWN public API, because the
+// apex catalog does not know them and the membership tables would report zero for
+// every hand-wired project (task 1002760). The risk in that design is not the
+// happy path — it is the failure modes: a dead project must cost a dash, not the
+// page; a machine account must not be counted as a person; and "we could not ask"
+// must never be rendered as "the answer is none".
+//
+// Run:  node --test tests/project_stats.mjs
+//
+// Fixture origins are literal PUBLIC IPs on purpose: net.isIP() short-circuits
+// the SSRF guard's DNS lookup, so these exercise the fetch/cache/filter logic
+// without a resolver in the loop. The guard itself is tested separately below.
+
+import test, { beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const stats = require('../modules/platform-identity/project-stats.js');
+
+const realFetch = globalThis.fetch;
+afterEach(() => { globalThis.fetch = realFetch; });
+beforeEach(() => { stats._reset(); });
+
+function json(body) {
+  return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(body) });
+}
+// route a fake instance: { leaderboard: [...], enabled: {...} }
+function stub(map) {
+  globalThis.fetch = (url) => {
+    const u = new URL(url);
+    const site = map[u.origin];
+    if (!site) return Promise.reject(new Error('unreachable'));
+    if (u.pathname.endsWith('/leaderboard')) {
+      return site.leaderboard ? json({ leaderboard: site.leaderboard }) : Promise.reject(new Error('down'));
+    }
+    if (u.pathname.endsWith('/modules')) {
+      return site.enabled ? json({ enabled: site.enabled }) : Promise.reject(new Error('down'));
+    }
+    return Promise.reject(new Error('404'));
+  };
+}
+
+test('system accounts are excluded — they are machines, not builders', async () => {
+  // measured live: raw leaderboards read 13/3/3 against real 11/1/1
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [
+        { github_login: 'ada' }, { github_login: 'grace' },
+        { github_login: 'bfg-system' }, { github_login: 'discord-bot-system' },
+      ],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].builders, 2, 'four rows, two of them machines');
+});
+
+test('a tag is a NON-core module — core modules carry no information', async () => {
+  // every instance runs the core set, so including it would print the same
+  // fifteen tags on every row
+  const core = [...stats.coreModules()];
+  assert.ok(core.includes('grading'), 'the core set is read from the repo, not hardcoded');
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [],
+      enabled: { grading: true, lifecycle: true, game: true, 'art-pipeline': true },
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['art-pipeline', 'game']);
+});
+
+test('a disabled module is not a tag', async () => {
+  stub({ 'https://8.8.8.8': { leaderboard: [], enabled: { game: false, 'art-pipeline': true } } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['art-pipeline']);
+});
+
+test('an unreachable project yields nulls — never zero, never a throw', async () => {
+  // 0 would be the claim "nobody builds here". null is "we could not ask".
+  stub({});   // nothing resolves
+  const out = await stats.getProjectStats(['https://9.9.9.9']);
+  assert.equal(out['https://9.9.9.9'].builders, null);
+  assert.equal(out['https://9.9.9.9'].tags, null);
+});
+
+test('one dead half does not discard the half that answered', async () => {
+  // a project whose leaderboard is down can still report its modules
+  stub({ 'https://8.8.8.8': { leaderboard: null, enabled: { game: true } } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].builders, null, 'the dead half is unknown');
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['game'], 'the live half still answers');
+});
+
+test('a dead project does not take the healthy ones down with it', async () => {
+  stub({ 'https://1.1.1.1': { leaderboard: [{ github_login: 'a' }], enabled: {} } });
+  const out = await stats.getProjectStats(['https://1.1.1.1', 'https://9.9.9.9']);
+  assert.equal(out['https://1.1.1.1'].builders, 1);
+  assert.equal(out['https://9.9.9.9'].builders, null);
+});
+
+test('results are cached — a warm origin is not re-fetched', async () => {
+  let calls = 0;
+  const site = { leaderboard: [{ github_login: 'a' }], enabled: {} };
+  stub({ 'https://8.8.8.8': site });
+  const counting = globalThis.fetch;
+  globalThis.fetch = (u) => { calls++; return counting(u); };
+
+  await stats.getProjectStats(['https://8.8.8.8']);
+  const first = calls;
+  assert.ok(first > 0, 'the cold call must actually fetch');
+  await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(calls, first, 'the second call must be served from cache');
+});
+
+test('a FAILURE is cached too, or one dead project pays its timeout on every request', async () => {
+  let calls = 0;
+  globalThis.fetch = () => { calls++; return Promise.reject(new Error('down')); };
+  await stats.getProjectStats(['https://9.9.9.9']);
+  const first = calls;
+  await stats.getProjectStats(['https://9.9.9.9']);
+  assert.equal(calls, first, 'a known-dead origin must not be retried on the next page load');
+});
+
+test('concurrent requests for the same origin collapse into one fetch', async () => {
+  let calls = 0;
+  globalThis.fetch = (url) => {
+    calls++;
+    return new Promise((r) => setTimeout(() => r({
+      ok: true, status: 200, json: () => Promise.resolve({ leaderboard: [], enabled: {} }),
+    }), 10));
+  };
+  await Promise.all([
+    stats.getProjectStats(['https://8.8.8.8']),
+    stats.getProjectStats(['https://8.8.8.8']),
+    stats.getProjectStats(['https://8.8.8.8']),
+  ]);
+  assert.equal(calls, 2, 'two endpoints for one origin, not six for three callers');
+});
+
+test('a non-http origin is refused rather than fetched', async () => {
+  globalThis.fetch = () => { throw new Error('must not be called'); };
+  const out = await stats.getProjectStats(['file:///etc/passwd']);
+  assert.equal(out['file:///etc/passwd'].builders, null);
+});
+
+test('the cache TTL is the owner-chosen ten minutes', () => {
+  assert.equal(stats.TTL_MS, 10 * 60 * 1000);
+});
+
+/* ── SSRF guard (grader finding, task 1002771 round 2) ──────────────────────
+   This is the one place the server dials an address that came out of the
+   database, so it is the one place that must treat the address as hostile.
+   "The catalog is Archon-curated" covers the ORIGIN but not a REDIRECT TARGET —
+   following redirects hands the final address back to the remote server, which
+   is the SSRF primitive itself. ── */
+
+test('loopback, private, link-local and metadata addresses are refused', () => {
+  const blocked = {
+    '127.0.0.1': 'loopback',
+    '169.254.169.254': 'cloud metadata',      // the one that matters
+    '10.0.0.5': 'private',
+    '192.168.1.1': 'private',
+    '172.16.0.1': 'private',
+    '172.31.255.255': 'private (upper bound)',
+    '100.64.0.1': 'CGNAT',
+    '0.0.0.0': 'unspecified',
+    '::1': 'IPv6 loopback',
+    'fd00::1': 'IPv6 unique-local',
+    'fe80::1': 'IPv6 link-local',
+    '::ffff:127.0.0.1': 'IPv4-mapped loopback',
+  };
+  for (const [addr, why] of Object.entries(blocked)) {
+    assert.ok(stats.blockedReason(addr), `${addr} (${why}) must be refused`);
+  }
+});
+
+test('ordinary public addresses are allowed', () => {
+  for (const addr of ['8.8.8.8', '104.21.64.15', '172.15.0.1', '172.32.0.1', '2606:4700::1']) {
+    assert.equal(stats.blockedReason(addr), null, `${addr} is public and must be allowed`);
+  }
+});
+
+test('a literal private IP as the origin host is refused before any fetch', async () => {
+  globalThis.fetch = () => { throw new Error('fetch must not be reached'); };
+  const out = await stats.getProjectStats(['http://169.254.169.254']);
+  assert.equal(out['http://169.254.169.254'].builders, null);
+});
+
+test('redirects are refused, never followed', async () => {
+  // following would let a curated origin choose our final address
+  const src = await import('node:fs').then((fs) =>
+    fs.readFileSync(new URL('../modules/platform-identity/project-stats.js', import.meta.url), 'utf8'));
+  assert.match(src, /redirect:\s*'error'/, 'the remote must not choose where we end up');
+  assert.doesNotMatch(src, /redirect:\s*'follow'/);
+});
+
+test('an origin named __proto__ cannot retarget the result prototype', async () => {
+  globalThis.fetch = () => Promise.reject(new Error('down'));
+  const out = await stats.getProjectStats(['__proto__']);
+  assert.equal(Object.getPrototypeOf(out), null, 'the result map is null-prototype');
+  assert.equal(({}).builders, undefined, 'Object.prototype is untouched');
+});

package/tests/projects_hub.mjs

@@ -379,10 +379,14 @@ test('the row keeps its own Open link working underneath the card', () => {
 
 test('the table declares no column it has no source for', () => {
   const thead = (HUB.match(/<thead>([\s\S]*?)<\/thead>/) || [, ''])[1];
-  for (const dead of [/>Builders</, />Type</, />Tags</]) {
-    assert.doesNotMatch(thead, dead, `a permanently-empty column must not be advertised`);
-  }
-  assert.match(thead, />Project</, 'the name column is real');
+  // Type is still absent: the owner's call is that a project DECLARES its type
+  // at creation, so until that field exists the hub must not guess one.
+  assert.doesNotMatch(thead, />Type</, 'Type has no source until a project declares it');
+  // Builders and Runs came back in task 1002771 WITH a source behind them
+  assert.match(thead, />Builders</);
+  assert.match(thead, />Runs</);
+  assert.match(SCRIPT, /p\.builders/, 'the Builders cell must read real data');
+  assert.match(SCRIPT, /tagsHtml\(p\.tags\)/, 'the Runs cell must read real data');
 });
 
 test('header and body agree on the column count', () => {
@@ -395,9 +399,9 @@ test('header and body agree on the column count', () => {
 });
 
 test('no sort control is offered for a column that cannot sort', () => {
-  // `data-sort="builders"` was declared sortable while the comparator handled
-  // only 'name' — clicking it did nothing at all
-  assert.doesNotMatch(HUB, /data-sort="builders"/);
+  // `data-sort="builders"` was once declared sortable while the comparator
+  // handled only 'name' — clicking it did nothing at all. The column is back
+  // (task 1002771) and so is its comparator arm; this keeps the two in step.
   const sorts = [...HUB.matchAll(/data-sort="([^"]+)"/g)].map((m) => m[1]);
   const comparator = (SCRIPT.match(/list\.sort\(function[\s\S]*?\n    \}\);/) || [''])[0];
   for (const key of sorts) {
@@ -405,8 +409,47 @@ test('no sort control is offered for a column that cannot sort', () => {
   }
 });
 
-test('the CSS for the dropped columns went with them', () => {
-  for (const orphan of ['.colType', '.colTags', '.tbl .num', '.tbl .tags']) {
-    assert.ok(!COSMOS.includes(orphan), `${orphan} is dead once its column is gone`);
+test('Type left no styling behind, and the live columns kept theirs', () => {
+  assert.ok(!COSMOS.includes('.colType'), '.colType is dead — the column is gone');
+  for (const live of ['.tbl .num', '.tbl .tags', '.colTags']) {
+    assert.ok(COSMOS.includes(live), `${live} styles a column that now renders real data`);
   }
 });
+
+/* ── Real Builders + Runs (task 1002771) ────────────────────────────────────
+   The columns came back only once something could fill them: each project's
+   OWN public API. The distinction these pin is between "we could not ask"
+   (null → em dash) and "we asked, the answer is none" (0 / []). ── */
+
+test('unknown and zero are rendered as different things', () => {
+  // 0 builders is a real answer — "nobody has joined yet". null is not an
+  // answer at all. Collapsing them would restate the lie 1002764 removed.
+  assert.match(SCRIPT, /p\.builders == null \? '—'/,
+    'only null becomes a dash; 0 must render as 0');
+});
+
+test('a project that cannot be reached degrades to a dash, not to a wrong number', () => {
+  const fn = (SCRIPT.match(/function tagsHtml\(tags\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'tagsHtml() must exist');
+  assert.match(fn, /Array\.isArray\(tags\)/, 'a non-array (null) must not be spread into the cell');
+  assert.match(fn, /return '—'/);
+});
+
+test('the tag list is capped, and the overflow is counted rather than hidden', () => {
+  const fn = (SCRIPT.match(/function tagsHtml\(tags\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(fn, /TAG_CAP/, 'one heavily-moduled project must not blow the column open');
+  assert.match(fn, /\+' \+ \(tags\.length - TAG_CAP\)/, 'a silent truncation reads as "that is all of them"');
+});
+
+test('sorting by builders puts UNKNOWN last, never first', () => {
+  const comparator = (SCRIPT.match(/list\.sort\(function[\s\S]*?\n    \}\);/) || [''])[0];
+  assert.match(comparator, /x\.builders == null\) return 1/,
+    'null is not a low number — it must sink in both directions');
+  assert.match(comparator, /y\.builders == null\) return -1/);
+});
+
+test('the platform answers for itself by the same rule it applies to others', () => {
+  // the self row is synthesized, so the server-side enrichment never sees it
+  assert.match(SCRIPT, /function loadSelfStats/);
+  assert.match(SCRIPT, /-system\$/, 'machine accounts are excluded here too, or the platform inflates itself');
+});