@bongos/core 1.19.1024 → 1.19.1026

package/migrations/core_255_access_requests_invite_kind.sql

@@ -0,0 +1,52 @@
+-- core_255_access_requests_invite_kind.sql — an invite can be told apart from an
+-- approved application, and keeps who sent it (task 1002814, R2 of the project
+-- admin console wave; ADR 0335 D2).
+--
+-- An archon's invite (POST /access-requests/invite) writes the same
+-- status='invited' row an approved application ends in, because that row is what
+-- the sign-in gate reads. Until now nothing else distinguished the two, and the
+-- only trace of the inviter was resolved_by_builder_id — which a rescind
+-- overwrites with whoever rescinded (ADR 0201 D4.2).
+--
+--   kind        'application' (the default — the public POST names neither
+--               column) or 'invite'. An invite that approves a pending
+--               application in place leaves it 'application': it was one.
+--   created_by  the sender, set on invite rows only; a rescind never touches it.
+--   note        no new column — on an invite row it holds the inviter's words,
+--               and `kind` says whose.
+--
+-- THE BACKFILL IS EXACT (D2.4). The invite route has always inserted with
+-- resolved_at = now() beside created_at's now() default, so every row it wrote
+-- has created_at = resolved_at, and no approved application can (it is resolved
+-- after it was filed). The one miss is an old invite later rescinded — the
+-- rescind moved resolved_at — which stays 'application' and admits nobody either
+-- way. Guarded on kind, so a replay touches nothing.
+--
+-- NOT AUTHORITY (D2.5, ADR 0016). No admission read looks at either column: an
+-- invite and an approved application admit through the identical
+-- status = 'invited' read. tests/project_admin_console_model.mjs pins that.
+--
+-- Purely additive + idempotent (IF NOT EXISTS skips the column AND its CHECK on a
+-- replay). The previous release never names either column, and its inserts take
+-- the defaults, so a rollback runs unchanged. access_requests is CORE-owned
+-- (060_access_requests), so this is a core_ migration (ADR 0108 §5); migrate.sh
+-- records the stem.
+
+BEGIN;
+
+ALTER TABLE access_requests
+  ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'application'
+    CONSTRAINT access_requests_kind_check CHECK (kind IN ('application', 'invite')),
+  ADD COLUMN IF NOT EXISTS created_by bigint REFERENCES builders(id);
+
+UPDATE access_requests
+   SET kind = 'invite', created_by = resolved_by_builder_id
+ WHERE status = 'invited' AND kind = 'application' AND created_at = resolved_at;
+
+COMMENT ON COLUMN access_requests.kind IS
+  'application (the default: filed through the public POST) or invite (sent by a builder via POST /access-requests/invite) — ADR 0335 D2. An invite that approved a pending application in place stays application. DESCRIPTIVE ONLY — no admission path reads it (ADR 0016): status=''invited'' is the whole gate.';
+
+COMMENT ON COLUMN access_requests.created_by IS
+  'The builder who sent an invite (kind=invite rows only; NULL on applications). Its own column because a rescind overwrites resolved_by_builder_id (ADR 0201 D4.2, ADR 0335 D2.2). DESCRIPTIVE ONLY — no admission path reads it (ADR 0016).';
+
+COMMIT;

package/modules/government/catalog.js

@@ -179,7 +179,7 @@ const PERMISSIONS = [
   // one of them would make this delegation self-reversible.
   { key: 'builder.status.set', system: false, floor: 'archon', guards: 'PATCH /builders/:id/status — offboard / (de)activate' },
   { key: 'auth.session.revoke', system: false, floor: 'archon', guards: 'POST /auth/revoke, /auth/revoke-all' },
-  { key: 'access_request.review', system: false, floor: 'archon', guards: 'GET/PATCH /access-requests/:id, POST /access-requests/invite — admit a builder' },
+  { key: 'access_request.review', system: false, floor: 'archon', guards: 'GET/PATCH /access-requests/:id, POST /access-requests/invite, GET /access-requests/invites — admit a builder' },
 
   // ── operational — floor metic (the working rank's review/triage/authoring) ────
   { key: 'idea.triage', system: false, floor: 'metic', guards: 'PATCH /inbox/:id' },

package/modules/hall-ui/public/goal-map.html

@@ -96,7 +96,7 @@
 <div class="card glass" id="card" role="tooltip" aria-hidden="true"></div>
 <div class="menu glass" id="menu" hidden role="menu" aria-label="Chart the routes"></div>
 
-<aside class="room" id="room" hidden aria-label="The list">
+<aside class="room" id="room" hidden aria-label="The ledger">
   <div class="head"><h2 id="roomTitle">the ledger</h2><span class="lbl" id="roomCount"></span></div>
   <div class="filters" id="filters" role="group" aria-label="Filter"></div>
   <div class="rows" id="rows"></div>

package/modules/onboarding/routes/access-requests.js

@@ -25,6 +25,11 @@
 //   POST /api/bongos/access-requests/invite   Archon-only — invite a GitHub
 //                                          username before any request exists:
 //                                          the way in on an invite-only project.
+//                                          The row says it is an invite (`kind`)
+//                                          and who sent it (`created_by`).
+//   GET  /api/bongos/access-requests/invites  Archon-only — the outstanding
+//                                          invites: sent, not rescinded, and not
+//                                          yet signed in (ADR 0335 D2).
 //
 // Which door a project runs — open / apply / invite_only / locked — is the
 // COMPOSITION of three owner-set knobs, read through the doorway's
@@ -300,24 +305,34 @@ module.exports = function buildAccessRequestsRouter() {
       return res.fail('bad_status', 400);
     }
     try {
+      // `kind` + `invited_by_login` let the invited history tell an invite from
+      // an approved application (ADR 0335 D2) — descriptive, like the vouch.
       const { rows } = await pool.query(
         `SELECT ar.id, ar.github_login, ar.display_name, ar.note, ar.status,
-                ar.created_at, ar.resolved_at,
+                ar.created_at, ar.resolved_at, ar.kind,
                 ar.applicant_github_id, ar.applicant_handle, ar.vouched_at,
                 (ar.applicant_github_id IS NOT NULL) AS vouched,
-                rb.github_login AS resolved_by_login
+                rb.github_login AS resolved_by_login,
+                ib.github_login AS invited_by_login
            FROM access_requests ar
            LEFT JOIN builders rb ON rb.id = ar.resolved_by_builder_id
+           LEFT JOIN builders ib ON ib.id = ar.created_by
           WHERE ar.status = $1
           ORDER BY ar.created_at DESC
           LIMIT 200`,
         [status]
       );
+      // On an invite row the stored note is the INVITER's words, but this read's
+      // `note` has always meant the applicant's (the hall quotes it as theirs),
+      // so an invite's note travels as `invite_note` instead.
+      const shaped = rows.map(({ note, ...r }) => (r.kind === 'invite'
+        ? { ...r, note: null, invite_note: note }
+        : { ...r, note, invite_note: null }));
       // C4's other half (privacy spec D7, task 1002972): the applicant's own
       // profile, as their OWN privacy rules would show it, resolved from the hub
       // at render. See attachApplicantProfiles — it is keyed on the vouch, never
       // on the login, and every row it cannot resolve carries `profile: null`.
-      res.json({ requests: await attachApplicantProfiles(rows) });
+      res.json({ requests: await attachApplicantProfiles(shaped) });
     } catch (err) {
       log.error('[gds] GET /access-requests', err);
       res.fail('list_failed', { status: 500, message: 'internal error' });
@@ -451,18 +466,25 @@ module.exports = function buildAccessRequestsRouter() {
   // Archons inviting the same login at once can each insert a row (the unique
   // index covers pending only): harmless — the gate reads "any invited row" —
   // and it shows as two lines in the invited history, so no lock is taken.
-  // body: { github_login }. 201 with a new row; 200 with the row when a pending
-  // request was resolved; 200 already_invited when an invite already stands;
-  // 409 already_member when they have an account.
+  //
+  // A fresh row is marked kind='invite' with created_by = the sender (a rescind
+  // overwrites resolved_by) and the optional note as the inviter's words. A pending
+  // request resolved in place stays an application with its applicant's own note
+  // (ADR 0335 D2.1–D2.3; task 1002814).
+  // body: { github_login, note? }. 201 with a new row; 200 with the row when a
+  // pending request was resolved; 200 already_invited when an invite already
+  // stands; 409 already_member when they have an account.
   // rank: archon — the same gate as resolving a request.
   router.post('/access-requests/invite', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     if (validateOrRespond(req, res, {
       github_login: { required: true, type: 'string', minLength: 1, maxLength: 60 },
+      note: { type: 'string', maxLength: 500 },
     })) return;
     const login = normalizeLogin(req.body.github_login);
     if (!GITHUB_LOGIN_RE.test(login)) {
       return res.fail('bad_github_login', { status: 400, message: 'That does not look like a GitHub username.' });
     }
+    const note = (req.body.note || '').trim() || null;
     try {
       const member = await pool.query(
         `SELECT 1 FROM builders WHERE lower(github_login) = lower($1) LIMIT 1`,
@@ -485,17 +507,17 @@ module.exports = function buildAccessRequestsRouter() {
                 resolved_by_builder_id = $1,
                 resolved_at = now()
           WHERE lower(github_login) = lower($2) AND status = 'pending'
-          RETURNING id, github_login, status, resolved_at`,
+          RETURNING id, github_login, status, kind, resolved_at`,
         [req.builder.id, login]
       );
       if (resolved.rows.length > 0) {
         return res.json({ ok: true, request: resolved.rows[0] });
       }
       const { rows } = await pool.query(
-        `INSERT INTO access_requests (github_login, status, resolved_by_builder_id, resolved_at)
-         VALUES ($1, 'invited', $2, now())
-         RETURNING id, github_login, status, resolved_at`,
-        [login, req.builder.id]
+        `INSERT INTO access_requests (github_login, note, kind, created_by, status, resolved_by_builder_id, resolved_at)
+         VALUES ($1, $2, 'invite', $3, 'invited', $3, now())
+         RETURNING id, github_login, status, kind, resolved_at`,
+        [login, note, req.builder.id]
       );
       return res.status(201).json({ ok: true, request: rows[0] });
     } catch (err) {
@@ -504,5 +526,34 @@ module.exports = function buildAccessRequestsRouter() {
     }
   });
 
+  // GET /access-requests/invites[?mine=1] — the outstanding invites: kind='invite',
+  // still 'invited' (not rescinded), and no builder row yet (not yet accepted by
+  // signing in), each naming its sender; ?mine=1 keeps only the caller's own
+  // (ADR 0335 D2; task 1002814). Rescind one with PATCH /access-requests/:id.
+  // rank: archon — it names logins that are not members yet.
+  router.get('/access-requests/invites', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+    const mine = req.query.mine === '1';
+    const mineClause = mine ? 'AND ar.created_by = $1' : '';
+    try {
+      const { rows } = await pool.query(
+        `SELECT ar.id, ar.github_login, ar.note, ar.created_at,
+                ib.github_login AS invited_by_login
+           FROM access_requests ar
+           LEFT JOIN builders ib ON ib.id = ar.created_by
+          WHERE ar.kind = 'invite' AND ar.status = 'invited'
+            AND NOT EXISTS (SELECT 1 FROM builders b
+                             WHERE lower(b.github_login) = lower(ar.github_login))
+            ${mineClause}
+          ORDER BY ar.created_at DESC
+          LIMIT 200`,
+        mine ? [req.builder.id] : []
+      );
+      res.json({ invites: rows });
+    } catch (err) {
+      log.error('[gds] GET /access-requests/invites', err);
+      res.fail('list_invites_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/platform-identity/community-leaderboard.js

@@ -0,0 +1,235 @@
+// modules/platform-identity/community-leaderboard.js — the PUBLIC windowed
+// leaderboard (D3, docs/specs/bongos-v1-community-tab.md; task 1002978, goal
+// 1000110 CT2): "who earned the most across every project, this week / month /
+// year / ever", optionally narrowed to one discipline. The read behind
+// GET /community/leaderboard, for the hub's /community page (task 1003363).
+//
+// WHO: rollupVisibleSql — active + public + NOT hide_stats, the privacy matrix's
+// NUMBERS predicate, imported from account-visibility.js and never restated. A
+// leaderboard row IS stats, so hide_stats excludes; private and provisional
+// accounts never reach it. Deliberately NOT scoutingListableSql: the recruiting
+// opt-out governs the recruiting directory only (spec D3). Viewer-independent —
+// nothing here takes a viewer, so every caller sees the same board.
+//
+// WHAT (spec D2): all-time = the live rollup rows summed across projects. A
+// window = per (project, builder), the live row minus the last snapshot
+// at-or-before the window start (activity-snapshots.js), summed across projects;
+// no such snapshot counts as zero. So until a builder's first changed report
+// after snapshots began, their whole lifetime total counts inside every window —
+// the spec's accepted rollout behaviour, self-correcting. Deltas attribute to
+// REPORTING time, not earning time (the spec's stated V1 limitation).
+//
+// TWO HALVES, because the board is public and unauthenticated. The expensive
+// half — every builder's window totals, one snapshot probe per activity row — is
+// memoized per window for TOTALS_TTL_MS, so traffic cannot multiply it. The cheap
+// half — who is eligible, and their name and avatar — is re-read on EVERY
+// request, so a builder who hides or goes private leaves the board on the very
+// next request (hide must beat the cache, ADR 0171 D5). The memo can only lag on
+// numbers, never on who is shown.
+//
+// A builder with nothing to show in the window (credits, ships and karma all
+// unchanged) is left off that window's board rather than listed at zero.
+// github_id never crosses the projection; handle is the address.
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { rollupVisibleSql } = require('./account-visibility');
+// The sibling public community read's paging + input caps, shared rather than
+// copied so the two routes cannot drift apart.
+const { clampOffset, MAX_OFFSET, MAX_DISCIPLINE_CHARS } = require('./builder-search');
+
+// The spec's four windows. null = all-time (no baseline subtracted).
+const WINDOW_DAYS = Object.freeze({ '7d': 7, '30d': 30, '365d': 365, all: null });
+const WINDOWS = Object.freeze(Object.keys(WINDOW_DAYS));
+const DEFAULT_WINDOW = 'all';
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+const DEFAULT_LIMIT = 25;
+const MAX_LIMIT = 100;
+// How long one window's totals are reused. Numbers are reporting-time already
+// (they move when an instance reports), so half a minute of lag is invisible;
+// eligibility is never memoized.
+const TOTALS_TTL_MS = 30 * 1000;
+
+function isWindow(value) {
+  return typeof value === 'string' && Object.prototype.hasOwnProperty.call(WINDOW_DAYS, value);
+}
+
+// The instant a window opens, or null for all-time. `now` is injectable so a
+// test can pin the boundary.
+function windowStart(window, now = new Date()) {
+  const days = WINDOW_DAYS[window];
+  if (days == null) return null;
+  return new Date(now.getTime() - days * DAY_MS);
+}
+
+function clampLimit(limit) {
+  const n = parseInt(limit, 10);
+  if (!Number.isFinite(n) || n <= 0) return DEFAULT_LIMIT;
+  return Math.min(n, MAX_LIMIT);
+}
+
+// Every eligible builder's totals for one window, unsorted and unpaged:
+// [{ githubId, credits, tasks_shipped, karma, disciplines }]. The expensive
+// half. Arithmetic is bigint: the columns are instance-reported int4, and one
+// extreme report must not overflow the whole public board into a 500.
+async function computeWindowTotals(since, pool) {
+  const { rows } = await pool.query(
+    `WITH act AS (
+       SELECT a.client_id, a.github_id, a.credits, a.tasks_shipped, a.karma, a.disciplines
+         FROM platform_identity_builder_project_activity a
+         JOIN platform_identity_accounts pa ON pa.github_id = a.github_id
+        WHERE ${rollupVisibleSql('pa')}
+     ), per_project AS (
+       -- The baseline probe walks platform_identity_activity_snapshots_builder_time
+       -- in index order. All-time binds $1 NULL, so the probe never runs.
+       SELECT act.github_id,
+              act.credits::bigint - COALESCE(b.credits, 0)             AS credits,
+              act.tasks_shipped::bigint - COALESCE(b.tasks_shipped, 0) AS tasks_shipped,
+              act.karma::bigint - COALESCE(b.karma, 0)                 AS karma
+         FROM act
+         LEFT JOIN LATERAL (
+           SELECT s.credits, s.tasks_shipped, s.karma
+             FROM platform_identity_activity_snapshots s
+            WHERE $1::timestamptz IS NOT NULL
+              AND s.client_id = act.client_id AND s.github_id = act.github_id
+              AND s.reported_at <= $1::timestamptz
+            ORDER BY s.reported_at DESC, s.id DESC
+            LIMIT 1
+         ) b ON true
+     ), board AS (
+       SELECT github_id,
+              sum(credits)::bigint       AS credits,
+              sum(tasks_shipped)::bigint AS tasks_shipped,
+              sum(karma)::bigint         AS karma
+         FROM per_project
+        GROUP BY github_id
+     ), disc AS (
+       SELECT x.github_id, array_agg(DISTINCT x.d ORDER BY x.d) AS disciplines
+         FROM (SELECT act.github_id, unnest(act.disciplines) AS d FROM act) x
+        WHERE x.d IS NOT NULL
+        GROUP BY x.github_id
+     )
+     SELECT board.github_id, board.credits, board.tasks_shipped, board.karma, disc.disciplines
+       FROM board
+       LEFT JOIN disc ON disc.github_id = board.github_id
+      WHERE board.credits <> 0 OR board.tasks_shipped <> 0 OR board.karma <> 0`,
+    [since],
+  );
+  // int8 arrives from node-postgres as a string; any real total is far inside
+  // Number's exact-integer range.
+  return rows.map((r) => ({
+    githubId: String(r.github_id),
+    credits: Number(r.credits),
+    tasks_shipped: Number(r.tasks_shipped),
+    karma: Number(r.karma),
+    disciplines: Array.isArray(r.disciplines) ? r.disciplines : [],
+  }));
+}
+
+// window -> { expires, since, promise }. Concurrent requests share one
+// in-flight computation; a failed one is dropped so the next request retries.
+const totalsMemo = new Map();
+
+function memoizedWindowTotals(window, pool) {
+  const hit = totalsMemo.get(window);
+  if (hit && hit.pool === pool && hit.expires > Date.now()) return hit;
+  const since = windowStart(window);
+  const entry = { pool, since, expires: Date.now() + TOTALS_TTL_MS, promise: computeWindowTotals(since, pool) };
+  entry.promise.catch(() => { if (totalsMemo.get(window) === entry) totalsMemo.delete(window); });
+  totalsMemo.set(window, entry);
+  return entry;
+}
+
+function clearTotalsMemo() {
+  totalsMemo.clear();
+}
+
+// The cheap half, re-read on every request: which of these builders are
+// eligible RIGHT NOW, and how they are shown. Map githubId -> identity.
+async function eligibleIdentities(githubIds, pool) {
+  if (githubIds.length === 0) return new Map();
+  const { rows } = await pool.query(
+    `SELECT pa.github_id, pa.handle, pa.github_login, pa.display_name, pa.avatar_url
+       FROM platform_identity_accounts pa
+      WHERE pa.github_id = ANY($1::bigint[])
+        AND ${rollupVisibleSql('pa')}`,
+    [githubIds],
+  );
+  return new Map(rows.map((r) => [String(r.github_id), r]));
+}
+
+// Credits, then ships, then karma, then handle/login so a tie is stable —
+// compared by code unit, so the order never depends on the server's locale.
+const byText = (x, y) => { const a = String(x ?? ''); const b = String(y ?? ''); return a < b ? -1 : a > b ? 1 : 0; };
+function compareRows(a, b) {
+  return (b.credits - a.credits) || (b.tasks_shipped - a.tasks_shipped) || (b.karma - a.karma)
+    || byText(a.handle, b.handle) || byText(a.github_login, b.github_login);
+}
+
+// listLeaderboard — one page of the board. Throws on an unknown window (the
+// route validates and 400s first). Returns { window, since, results, limit,
+// offset }: `since` is the window start the totals were computed from (null
+// for all-time) and limit/offset are the CLAMPED values, so the route echoes
+// rather than re-derives them. `place` is the 1-based position on the whole
+// board — named so it can never be read as a builder's rank. Passing `now`
+// pins the window start and bypasses the memo (tests of the boundary).
+async function listLeaderboard({ window = DEFAULT_WINDOW, discipline, limit, offset, now, pool = defaultPool } = {}) {
+  if (!isWindow(window)) throw new Error(`listLeaderboard: unknown window ${JSON.stringify(window)}`);
+  const lim = clampLimit(limit);
+  const off = clampOffset(offset);
+  const disc = typeof discipline === 'string' ? discipline.trim().slice(0, MAX_DISCIPLINE_CHARS) : '';
+
+  let since;
+  let totals;
+  if (now !== undefined) {
+    since = windowStart(window, now);
+    totals = await computeWindowTotals(since, pool);
+  } else {
+    const entry = memoizedWindowTotals(window, pool);
+    since = entry.since;
+    totals = await entry.promise;
+  }
+
+  const candidates = disc ? totals.filter((t) => t.disciplines.includes(disc)) : totals;
+  const identities = await eligibleIdentities(candidates.map((t) => t.githubId), pool);
+  const board = candidates
+    .filter((t) => identities.has(t.githubId))
+    .map((t) => {
+      const who = identities.get(t.githubId);
+      return {
+        handle: who.handle,
+        github_login: who.github_login,
+        display_name: who.display_name,
+        avatar_url: who.avatar_url,
+        credits: t.credits,
+        tasks_shipped: t.tasks_shipped,
+        karma: t.karma,
+        disciplines: t.disciplines,
+      };
+    })
+    .sort(compareRows);
+
+  return {
+    window,
+    since: since ? since.toISOString() : null,
+    results: board.slice(off, off + lim).map((row, i) => ({ place: off + i + 1, ...row })),
+    limit: lim,
+    offset: off,
+  };
+}
+
+module.exports = {
+  listLeaderboard,
+  clearTotalsMemo,
+  windowStart,
+  isWindow,
+  clampLimit,
+  WINDOWS,
+  DEFAULT_WINDOW,
+  DEFAULT_LIMIT,
+  MAX_LIMIT,
+  MAX_OFFSET,
+  MAX_DISCIPLINE_CHARS,
+  TOTALS_TTL_MS,
+};

package/modules/platform-identity/connection-suggestions.js

@@ -137,7 +137,7 @@ async function identityById(githubIds, { pool = defaultPool } = {}) {
 }
 
 function mutualReason(n) {
-  return `${n} mutual connection${n === 1 ? '' : 's'}`;
+  return `${n} connection${n === 1 ? '' : 's'} in common`;
 }
 
 // listConnectionSuggestions({ githubId, pool }) → [{ handle, display_name,

package/modules/platform-identity/migrations/platform_identity_024_terms_grandfathered.sql

@@ -0,0 +1,68 @@
+-- platform_identity_024_terms_grandfathered.sql — grandfather existing accounts
+-- onto the platform T&C, and record that they were grandfathered rather than
+-- signed in (task 1003360; owner decision on blocker 1000123; ADR 0217 D3,
+-- amending ADR 0213 D4).
+--
+-- WHY. Migration 019 made consent two columns and deliberately backfilled
+-- nothing, so every account the hub had already witnessed ('active') stopped
+-- being published until its owner next signed in. The owner chose instead to
+-- grandfather them — nothing goes dark — having been shown that this records a
+-- consent which did not happen. So the record must not hide it: a grandfathered
+-- acceptance is marked as such, and /terms says so.
+--
+-- WHAT IT DOES, once:
+--   1. adds terms_accepted_source ('signin' | 'grandfathered'). A named marker,
+--      not a magic timestamp, so any later audit can count the two apart.
+--   2. marks every acceptance already on record as 'signin' — until now the one
+--      statement that could write an acceptance was the hub sign-in
+--      (upsertAccount's activate branch, ADR 0213 D1). This runs FIRST, or step 3's
+--      rows would be relabelled too.
+--   3. grandfathers every 'active' account with no acceptance: stamped now(),
+--      with the version in force today, marked 'grandfathered'. profile_state is
+--      not touched — a 'provisional' account was never public and stays
+--      unpublished; this keeps published profiles published, it publishes nobody.
+--
+-- ONE-SHOT, ON PURPOSE. The writes run only in the transaction that creates the
+-- column. Grandfathering is an event at this deploy ("accounts that existed
+-- before these terms"), not a rule: replaying this file (the integration tests
+-- do) must never grandfather an account created since.
+--
+-- The version literal is pinned, not a placeholder: it names the text these
+-- accounts were accepted under, and a later revision must not rewrite that.
+--
+-- AFTER THIS, the grandfather mark gives way to a real acceptance: the owner's
+-- next hub sign-in restamps all three columns as a 'signin'
+-- (terms-acceptance.js acceptanceConflictSet). No runtime code writes
+-- 'grandfathered'; tests/terms_acceptance.mjs fails any that does.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Safe to re-run.
+
+BEGIN;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+     WHERE table_schema = current_schema()
+       AND table_name = 'platform_identity_accounts'
+       AND column_name = 'terms_accepted_source'
+  ) THEN
+    ALTER TABLE platform_identity_accounts
+      ADD COLUMN terms_accepted_source text
+        CHECK (terms_accepted_source IN ('signin', 'grandfathered'));
+
+    UPDATE platform_identity_accounts
+       SET terms_accepted_source = 'signin'
+     WHERE terms_accepted_at IS NOT NULL;
+
+    UPDATE platform_identity_accounts
+       SET terms_accepted_at = now(),
+           terms_version = '2026-08-29',
+           terms_accepted_source = 'grandfathered'
+     WHERE profile_state = 'active'
+       AND terms_accepted_at IS NULL;
+  END IF;
+END
+$$;
+
+COMMIT;

package/modules/platform-identity/module.json

@@ -10,7 +10,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile", "connections", "community-search"],
+    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile", "connections", "community-search", "community-leaderboard"],
     "migrations": true,
     "pollers": ["code-sweep", "visibility-pull"]
   },

package/modules/platform-identity/read-rate-limit.js

@@ -0,0 +1,61 @@
+// modules/platform-identity/read-rate-limit.js — a per-IP read cap for an
+// UNAUTHENTICATED public GET in this module. The global limiter meters writes
+// only, and core's per-IP sliding window (src/bongos/middleware/rate-limit.js
+// perIpSlidingWindow) reaches modules only as ready-built instances on the
+// doorway (ADR 0209: an instance per budget), none of which is this module's.
+// This is the module-side twin of that function — same 429 envelope and
+// headers — written once (task 1002978) and mounted by both community reads
+// (routes/community-leaderboard.js, routes/community-search.js).
+// routes/public-profile.js and routes/sso.js still carry older vendored copies.
+'use strict';
+
+const SWEEP_EVERY_MS = 5 * 60 * 1000;
+// Bounds the bucket map between sweeps: rotating source addresses (an IPv6
+// block) must not grow the heap without limit on an unauthenticated route.
+const MAX_TRACKED_IPS = 10000;
+
+// createReadRateLimit({ scope, limit, windowMs, maxTrackedIps }) → Express
+// middleware allowing `limit` requests per IP per sliding `windowMs`, then 429
+// rate_limited with Retry-After. `scope` names the budget in the response so a
+// client can tell which cap it hit. Buckets live in this closure: one budget
+// per call. The map is kept in least-recently-seen order, so at the tracking
+// cap the IP evicted is the one idle longest — O(1), no scan on the hot path.
+function createReadRateLimit({ scope, limit, windowMs = 60 * 1000, maxTrackedIps = MAX_TRACKED_IPS }) {
+  const buckets = new Map(); // ip -> timestamp[], least recently seen first
+
+  const sweepTimer = setInterval(() => {
+    const cutoff = Date.now() - windowMs;
+    for (const [k, arr] of buckets) {
+      while (arr.length && arr[0] < cutoff) arr.shift();
+      if (arr.length === 0) buckets.delete(k);
+    }
+  }, SWEEP_EVERY_MS);
+  if (typeof sweepTimer.unref === 'function') sweepTimer.unref();
+
+  return function readRateLimit(req, res, next) {
+    const now = Date.now();
+    const key = req.ip || req.socket?.remoteAddress || 'unknown';
+    let bucket = buckets.get(key);
+    if (bucket) {
+      buckets.delete(key); // re-inserted below: most recently seen goes last
+    } else {
+      if (buckets.size >= maxTrackedIps) buckets.delete(buckets.keys().next().value);
+      bucket = [];
+    }
+    buckets.set(key, bucket);
+    const cutoff = now - windowMs;
+    while (bucket.length && bucket[0] < cutoff) bucket.shift();
+    if (bucket.length >= limit) {
+      const retryAfter = Math.max(1, Math.ceil((bucket[0] + windowMs - now) / 1000));
+      res.set('Retry-After', String(retryAfter));
+      res.set('X-RateLimit-Scope', scope);
+      res.set('X-RateLimit-Limit', String(limit));
+      res.set('X-RateLimit-Window-Seconds', String(windowMs / 1000));
+      return res.fail('rate_limited', 429, { scope, retry_after_seconds: retryAfter });
+    }
+    bucket.push(now);
+    return next();
+  };
+}
+
+module.exports = { createReadRateLimit, MAX_TRACKED_IPS };