@bongos/core 1.19.1024 → 1.19.1026

package/modules/platform-identity/routes/community-leaderboard.js

@@ -0,0 +1,69 @@
+// modules/platform-identity/routes/community-leaderboard.js — GET
+// /community/leaderboard, the PUBLIC windowed leaderboard behind the hub's
+// /community page (D3, docs/specs/bongos-v1-community-tab.md; task 1002978,
+// goal 1000110 CT2). The sibling of routes/community-search.js: same module,
+// same public posture. Who appears and how a window is counted live entirely in
+// ../community-leaderboard.js; this file is the HTTP shell — validation, the
+// per-IP read cap, the response envelope. It never reads a session, so the
+// board is the same for every viewer.
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const leaderboard = require('../community-leaderboard');
+const { createReadRateLimit } = require('../read-rate-limit');
+
+const { pool, corsPublicGet } = api;
+
+const READ_RATE_LIMIT = 60; // per IP per minute — the community-search budget
+const READ_RATE_SCOPE = 'community-leaderboard-read';
+const leaderboardReadRateLimit = createReadRateLimit({ scope: READ_RATE_SCOPE, limit: READ_RATE_LIMIT });
+
+module.exports = function communityLeaderboardRoutes() {
+  const router = express.Router();
+
+  router.use('/community/leaderboard', corsPublicGet('/community/leaderboard'));
+
+  // rank: public — the cross-project leaderboard (?window=7d|30d|365d|all,
+  // default all; ?discipline=; ?limit=&offset=). Eligibility is the privacy
+  // matrix's numbers predicate (active + public + stats shown); the recruiting
+  // opt-out does not apply. no-store: hide must beat the cache (ADR 0171 D5).
+  // Rollout note: until a builder's first changed report after snapshot history
+  // began, their whole lifetime total counts inside every window (spec D2's
+  // missing-baseline-is-zero rule) — expected on day one, and self-correcting.
+  router.get('/community/leaderboard', leaderboardReadRateLimit, async (req, res) => {
+    const window = req.query.window === undefined || req.query.window === ''
+      ? leaderboard.DEFAULT_WINDOW
+      : req.query.window;
+    if (!leaderboard.isWindow(window)) {
+      return res.fail('bad_window', { status: 400, message: `window must be one of: ${leaderboard.WINDOWS.join(', ')}` });
+    }
+    const discipline = (typeof req.query.discipline === 'string' ? req.query.discipline : '').trim();
+    if (discipline.length > leaderboard.MAX_DISCIPLINE_CHARS) {
+      return res.fail('discipline_too_long', { status: 400, message: `discipline must be at most ${leaderboard.MAX_DISCIPLINE_CHARS} characters` });
+    }
+    try {
+      const board = await leaderboard.listLeaderboard({
+        window, discipline, limit: req.query.limit, offset: req.query.offset, pool,
+      });
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        window: board.window,
+        since: board.since,
+        discipline: discipline || null,
+        count: board.results.length,
+        results: board.results,
+        page: { limit: board.limit, offset: board.offset },
+      });
+    } catch (err) {
+      api.logger('platform-identity').error({ err: err && err.message }, 'GET /community/leaderboard failed');
+      res.fail('leaderboard_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};
+
+module.exports._internals = { READ_RATE_LIMIT, READ_RATE_SCOPE };

package/modules/platform-identity/routes/community-search.js

@@ -16,6 +16,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const builderSearch = require('../builder-search');
+const { createReadRateLimit } = require('../read-rate-limit');
 
 const { pool, corsPublicGet } = api;
 
@@ -33,39 +34,11 @@ const log = {
 
 // Per-IP read cap for this UNAUTHENTICATED route (the public-profile.js R05
 // posture: the global limiter only meters WRITES, so an uncapped scraper could
-// otherwise run the trigram leg at line rate). Vendored, not shared — the core
-// /public/* limiter is not on the doorway, and each public GET here owns its
-// own budget rather than reaching into a sibling module's copy.
+// otherwise run the trigram leg at line rate). Its own budget, built by the
+// module's shared factory (task 1002978) rather than a vendored copy.
 const READ_RATE_WINDOW_MS = 60 * 1000;
 const READ_RATE_LIMIT = 60;
-const buckets = new Map(); // ip -> timestamp[]
-
-const sweepTimer = setInterval(() => {
-  const cutoff = Date.now() - READ_RATE_WINDOW_MS;
-  for (const [k, arr] of buckets) {
-    while (arr.length && arr[0] < cutoff) arr.shift();
-    if (arr.length === 0) buckets.delete(k);
-  }
-}, 5 * 60 * 1000);
-if (typeof sweepTimer.unref === 'function') sweepTimer.unref();
-
-function searchReadRateLimit(req, res, next) {
-  const now = Date.now();
-  const key = req.ip || req.socket?.remoteAddress || 'unknown';
-  let bucket = buckets.get(key);
-  if (!bucket) { bucket = []; buckets.set(key, bucket); }
-  const cutoff = now - READ_RATE_WINDOW_MS;
-  while (bucket.length && bucket[0] < cutoff) bucket.shift();
-  if (bucket.length >= READ_RATE_LIMIT) {
-    const retryAfter = Math.max(1, Math.ceil((bucket[0] + READ_RATE_WINDOW_MS - now) / 1000));
-    res.set('Retry-After', String(retryAfter));
-    res.set('X-RateLimit-Scope', 'community-search-read');
-    res.set('X-RateLimit-Limit', String(READ_RATE_LIMIT));
-    return res.fail('rate_limited', 429, { scope: 'community-search-read', retry_after_seconds: retryAfter });
-  }
-  bucket.push(now);
-  return next();
-}
+const searchReadRateLimit = createReadRateLimit({ scope: 'community-search-read', limit: READ_RATE_LIMIT, windowMs: READ_RATE_WINDOW_MS });
 
 module.exports = function communitySearchRoutes() {
   const router = express.Router();

package/modules/platform-identity/routes/projects.js

@@ -120,7 +120,7 @@ module.exports = function projectsRoutes() {
   // as any-builder — wrong in the dangerous direction (the ADR 0210 rule).
 
   // rank: metic+archon — own-or-metic in effect: invite a builder into a project
-  // (ADR 0141 §5, task #1002115), called by a `project.curate` holder OR the project's OWN
+  // (ADR 0141 §5, task 1002115), called by a `project.curate` holder OR the project's OWN
   // OWNER (task 1003580; the ownership proof is `provisioning_instances.owner_builder_id`,
   // reached through a port — see invite-authz.js). The wizard's audience is any signed-in
   // GitHub user, typically a xenos who used to get 403 on their own project. A caller who is

package/modules/platform-identity/terms-acceptance.js

@@ -30,12 +30,22 @@
 // reaches these statements, which is the whole point: an acceptance record a
 // caller could assert would be evidence of nothing.
 //
-// IDEMPOTENT BY CONSTRUCTION: the conflict branch is COALESCE(existing, new), so
-// the FIRST acceptance stands and a second sign-in never rewrites or duplicates
-// it. The two columns are only ever written together, so they cannot diverge.
+// THE FIRST ACCEPTANCE A HUMAN GAVE STANDS. The conflict branch keeps an existing
+// acceptance (COALESCE), so a second sign-in never rewrites or duplicates one.
+// The three columns are only ever written together, so they cannot diverge.
+//
+// HOW IT WAS GIVEN IS RECORDED TOO (task 1003360, ADR 0217 D3). Every acceptance
+// written here is marked terms_accepted_source = 'signin'. The only other value,
+// the grandfather marker, is written by migration platform_identity_024 alone —
+// accounts that already existed were accepted on their owner's behalf, and the
+// record says so rather than passing that off as a sign-in. A grandfather is not
+// an acceptance its owner gave, so it is the one acceptance that does not
+// "stand": the owner's next sign-in replaces it with their own. This file only
+// ever READS the marker. tests/terms_acceptance.mjs holds both rules, and fails
+// any other server file that writes these columns or names the marker.
 //
 // A LATER REVISION IS A KNOWN GAP, NOT A SILENT ONE. Because the version is
-// recorded and never overwritten, publishing a new TERMS_VERSION leaves every
+// recorded and a sign-in never overwrites it, publishing a new TERMS_VERSION leaves every
 // existing row naming the text it actually agreed to — so the platform can see
 // who has not accepted the new one. Re-acceptance on revision is deliberately
 // NOT built here (ADR 0213 D4): it is a product flow, not a storage shape.
@@ -60,7 +70,7 @@ function assertPlaceholder(fn, value) {
 // The acceptance columns, for an INSERT column list. Leading comma: it appends
 // to an existing list rather than standing alone.
 function acceptanceInsertColumns() {
-  return ', terms_accepted_at, terms_version';
+  return ', terms_accepted_at, terms_version, terms_accepted_source';
 }
 
 // The matching VALUES fragment. A row created by a NON-activating caller
@@ -70,23 +80,33 @@ function acceptanceInsertValues(activateParam, versionParam) {
   assertPlaceholder('acceptanceInsertValues', activateParam);
   assertPlaceholder('acceptanceInsertValues', versionParam);
   return `, CASE WHEN ${activateParam}::boolean THEN now() ELSE NULL END`
-    + `, CASE WHEN ${activateParam}::boolean THEN ${versionParam}::text ELSE NULL END`;
+    + `, CASE WHEN ${activateParam}::boolean THEN ${versionParam}::text ELSE NULL END`
+    + `, CASE WHEN ${activateParam}::boolean THEN 'signin' ELSE NULL END`;
 }
 
-// The ON CONFLICT DO UPDATE SET fragment — the idempotent half. COALESCE keeps
-// the FIRST acceptance, so signing in again re-reads the terms but does not
-// restamp them; a non-activating upsert leaves both columns exactly as they are,
-// mirroring the one-way rule profile_state already follows.
+// The ON CONFLICT DO UPDATE SET fragment — the write-once half. On the
+// activating sign-in: a grandfathered acceptance is replaced outright; any other
+// acceptance on record is kept (COALESCE), so a second sign-in re-reads the terms
+// without restamping them; and the source becomes 'signin' either way, since a
+// human just accepted. Keying the replacement on the grandfather marker, not on
+// "no signin recorded", matters: an acceptance with no source (written by the
+// pre-024 code in the deploy window) is a real sign-in and keeps its date. A
+// non-activating upsert leaves every column exactly as it is, mirroring the
+// one-way rule profile_state already follows. Postgres evaluates each right-hand
+// side against the row BEFORE the update, so all three read the same old source.
 //
 // Trailing comma: it sits between two other assignments in the SET list.
 function acceptanceConflictSet(activateParam, versionParam) {
   assertPlaceholder('acceptanceConflictSet', activateParam);
   assertPlaceholder('acceptanceConflictSet', versionParam);
   const self = 'platform_identity_accounts';
-  return `terms_accepted_at = CASE WHEN ${activateParam}::boolean`
-    + ` THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
-    + ` terms_version = CASE WHEN ${activateParam}::boolean`
-    + ` THEN COALESCE(${self}.terms_version, ${versionParam}::text) ELSE ${self}.terms_version END,`;
+  const signin = `${activateParam}::boolean`;
+  const replaces = `WHEN ${signin} AND ${self}.terms_accepted_source = 'grandfathered'`;
+  return `terms_accepted_at = CASE ${replaces} THEN now()`
+    + ` WHEN ${signin} THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
+    + ` terms_version = CASE ${replaces} THEN ${versionParam}::text`
+    + ` WHEN ${signin} THEN COALESCE(${self}.terms_version, ${versionParam}::text) ELSE ${self}.terms_version END,`
+    + ` terms_accepted_source = CASE WHEN ${signin} THEN 'signin' ELSE ${self}.terms_accepted_source END,`;
 }
 
 module.exports = {

package/modules/public-landing/public/terms.html

@@ -67,7 +67,8 @@
     <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
     <p><b>What is public.</b> Once you have signed in here and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in here stays provisional and is published nowhere.</p>
     <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
-    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written only by signing in here, and only once &mdash; signing in again does not change the original date. This is version <b>2026-08-29</b>.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written by signing in here, and only once &mdash; signing in again does not change the original date. This is version <b>2026-08-29</b>.</p>
+    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in.</p>
     <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1024",
+  "version": "1.19.1026",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1024",
+      "version": "1.19.1026",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1024",
+  "version": "1.19.1026",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -87,6 +87,11 @@ const INTEGRATION = new Set([
   // WHERE NOT EXISTS statement) and the upsertActivity wiring against real SQL —
   // a fake pool can prove the query shape but not which reports it inserts.
   'activity_snapshots_db',
+  // task 1002978: the windowed leaderboard against real SQL. Which snapshot
+  // becomes a window baseline (a LATERAL at-or-before probe), a missing baseline
+  // counting as zero, and the privacy matrix filtering are all planner facts the
+  // DB-free route test can only assert the shape of.
+  'community_leaderboard_db',
   'asset_version', 'auth_flow_slice1', 'backfill_sessions', 'bfg', 'bfg_write',
   'box_connect_e2e', 'box_onboard', 'boxes', 'cf_tunnel', 'cli_token_reissue',
   // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live
@@ -198,6 +203,11 @@ const INTEGRATION = new Set([
   // DB-free siblings (session_records, session_cost) cover the transcript
   // de-duplication half.
   'session_cost_row_raise',
+  // task 1003360: the T&C grandfather migration against real SQL. The DB-free
+  // sibling (the T&C acceptance suite) pins the statement text and runs the conflict
+  // branch over a fake table; only a real engine runs the one-shot DO block and
+  // shows a legacy account published again and marked apart from a sign-in.
+  'terms_grandfather_db',
   'setup_smoke',
   'status-probe',
 ]);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1024'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1026'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/access_requests_invite.mjs

@@ -4,7 +4,9 @@
 // branch is pinned: already a member, an invite already standing, a pending
 // request resolved in place, a fresh row, a bad username, a DB failure. Plus
 // the public POST's three doors against the same router: apply reaches the
-// queries, invite_only and open refuse before any.
+// queries, invite_only and open refuse before any. Task 1002814 (ADR 0335 D2)
+// adds the invite row's own marks — kind, created_by, the inviter's note — and
+// the outstanding-invite list; tests/application_lifecycle.mjs executes them.
 //
 // The doorway is stubbed in require.cache BEFORE the route loads (the route
 // destructures pool/validators at require time — the web_admission_status
@@ -76,6 +78,15 @@ function post(pathname, body) {
     req.end();
   });
 }
+function get(pathname) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, json: data ? JSON.parse(data) : null }));
+    }).on('error', reject);
+  });
+}
 const reset = (m, s) => { mode = m; script = s; calls = []; };
 const none = { rows: [] };
 const one = (row = {}) => ({ rows: [row] });
@@ -112,14 +123,80 @@ test('invite: a pending request is resolved in place — the same row the sign-i
   assert.deepEqual(calls[2].params, [42, 'Octocat'], 'resolved by the Archon; the login is trimmed and un-@ed, case kept for lower()');
 });
 
-test('invite: no request at all → a fresh invited row, 201', async () => {
-  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited' })]);
+test('invite: no request at all → a fresh invited row, 201, marked as an invite from its sender', async () => {
+  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited', kind: 'invite' })]);
   const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
   assert.equal(r.status, 201);
   assert.equal(r.json.request.status, 'invited');
+  assert.equal(r.json.request.kind, 'invite');
   assert.match(calls[3].sql, /INSERT INTO access_requests/);
   assert.match(calls[3].sql, /'invited'/);
-  assert.deepEqual(calls[3].params, ['octocat', 42]);
+  assert.match(calls[3].sql, /'invite'/, 'kind = invite, so the row can be told apart from an approved application (ADR 0335 D2.1)');
+  assert.match(calls[3].sql, /\bcreated_by\b/, 'created_by names the sender, and no rescind overwrites it (D2.2)');
+  assert.deepEqual(calls[3].params, ['octocat', null, 42]);
+});
+
+test('invite: an optional note rides on the invite row — the inviter’s words', async () => {
+  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited', kind: 'invite' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat', note: '  Come build the parser with us  ' });
+  assert.equal(r.status, 201);
+  assert.match(calls[3].sql, /\bnote\b/);
+  assert.deepEqual(calls[3].params, ['octocat', 'Come build the parser with us', 42]);
+});
+
+test('invite: a note over 500 characters → 400 before any query', async () => {
+  reset('invite_only', []);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat', note: 'x'.repeat(501) });
+  assert.equal(r.status, 400);
+  assert.equal(calls.length, 0);
+});
+
+test('invite: resolving a pending application in place leaves it an application — its kind, sender column and note untouched', async () => {
+  reset('invite_only', [none, none, one({ id: 7, github_login: 'octocat', status: 'invited', kind: 'application' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat', note: 'not their words' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.request.kind, 'application', 'it was an application, and its history says so (D2.1)');
+  const update = calls[2].sql;
+  assert.match(update, /UPDATE access_requests/);
+  assert.doesNotMatch(update, /\bkind\s*=/, 'the resolve never re-labels an application as an invite');
+  assert.doesNotMatch(update, /\bcreated_by\b/, 'created_by is set on invite rows only (D2.2)');
+  assert.doesNotMatch(update, /\bnote\b/, 'the applicant’s note is theirs — an inviter’s note never overwrites it');
+});
+
+// ── GET /access-requests/invites — the sender's outstanding list ─────────────
+
+test('invites list: outstanding invites only, each naming who sent it', async () => {
+  const sent = { id: 8, github_login: 'octocat', note: 'hi', created_at: '2026-09-25T00:00:00Z', invited_by_login: 'archon' };
+  reset('invite_only', [one(sent)]);
+  const r = await get('/api/gds/access-requests/invites');
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.invites, [sent]);
+  assert.equal(calls.length, 1);
+  const { sql } = calls[0];
+  assert.match(sql, /ar\.kind = 'invite'/, 'an approved application is not an invite this project sent');
+  assert.match(sql, /ar\.status = 'invited'/, 'a rescinded invite is no longer outstanding');
+  assert.match(sql, /NOT EXISTS \(SELECT 1 FROM builders b\s+WHERE lower\(b\.github_login\) = lower\(ar\.github_login\)\)/,
+    'an invitee who already signed in is a member, not an outstanding invite');
+  assert.match(sql, /LEFT JOIN builders ib ON ib\.id = ar\.created_by/, 'the sender is read from created_by, which survives a rescind');
+  assert.doesNotMatch(sql, /ar\.created_by = \$/, 'without ?mine=1 the list is the whole project’s');
+  assert.deepEqual(calls[0].params, []);
+});
+
+test('invites list ?mine=1: only the caller’s own invites', async () => {
+  reset('invite_only', [none]);
+  const r = await get('/api/gds/access-requests/invites?mine=1');
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.invites, []);
+  assert.match(calls[0].sql, /AND ar\.created_by = \$1/);
+  assert.deepEqual(calls[0].params, [42], 'narrowed to the acting builder, never to a caller-supplied id');
+});
+
+test('invites list: a DB failure → 500 list_invites_failed, no internals in the message', async () => {
+  reset('invite_only', [new Error('connection refused')]);
+  const r = await get('/api/gds/access-requests/invites');
+  assert.equal(r.status, 500);
+  assert.equal(r.json.error.code, 'list_invites_failed');
+  assert.doesNotMatch(r.json.error.message, /connection refused/);
 });
 
 test('invite: a bad username → 400 before any query', async () => {