@bongos/core 1.19.1044 → 1.19.1046

package/modules/hall-ui/records/roster-and-ledger.md

@@ -1,9 +1,9 @@
-# The roster and ledger pages — goals, sessions and people (task 1003470; scouting became /people in task 1003440)
+# The roster and ledger pages — goals, sessions and people (task 1003470; scouting became /people in task 1003440; /people deleted in task 1003444)
 
 **The ROSTER and LEDGER pages landed next (task 1003470)** — goals, sessions, people and scouting. Goals is the archetype page (`docs/design/mocks/hall/goals/v3.html`) and the page the owner was looking at when he called the re-skin a re-skin, so this pass changed its COMPOSITION rather than its tokens. Five things it settled:
 
 - **The goals list is ONE panel.** The filter bar, the count line, the readiness band and the groups sit on one `.scroll` (`.goals-panel`); the bar of twelve controls on the ground over a `--bg-card` panel PER GROUP is gone. Three lenses stay in the open (version, state, sort) and the five rarely turned sit behind the kit's Filters disclosure, **which counts and chips whatever is active so a hidden filter can never narrow the board silently.** `rows|cards` is a VIEW, not a filter: a segmented toggle on the count line writes a hidden `#f-goal-view`, so task 1003136's fork in `renderList` and the `otb.goals.view` pref are unchanged; the pressed side takes `--accent-tint` (the tint the world gives a current thing), **never the accent fill.**
 - **Three languages on a row, not four.** The ring is the goal's own done-when (satisfied over total, **the arc in INK — the accent lights the pressable and a progress arc is neither**); the facts line is every label a goal carries; the right column is ONE thing — `claim next` as the shell's `.btn-accent` (**the row's only accent**), `what's blocking` as a ghost pill, or a one-line state with a drawn check. The readiness is the family's `.ov-figs` band with the roll line's own `.gr-mark` dots (**classes, not inline styles**), so the band and the rows read as one language.
 - **The card is the row folded.** The toggle stays because the mock keeps it (a card wall is the better read when scanning for a NAME), but a card inside the panel draws no box — a `--bg-card` tile on a `--bg-card` panel is the card-in-a-card v3 removed — so `.goal-grid` paints the hairline BETWEEN its rows (a 1px row gap over `--rule-soft`, each cell on the panel's ground) and every cell renders the same facts from `goalRenderFacts`.
-- **People and scouting are ONE page.** `/scouting` was the legacy door to the same `/api/gds/scouting` rollup, drawn a third way; it now renders `people.html`'s body and `scouting.js` is deleted. **Task 1003440 then deleted the door itself**: `scouting.html` and `scouting.states.json` are gone, the `SCOUTING_PAGE_RE` page gate with them, and `/builders/scouting` now 301s to `/people` (`SCOUTING_LEGACY_RE` in `serve-internal.js`) so an old bookmark still lands on the directory. `tests/hall_roster_world.mjs` pins both halves — the files are absent, and the redirect exists with no dead gate behind it. On the row the name is the shell's `.lb-name` to the builder's **GitHub** page — the one door every listed builder has, since the directory is cross-project and no local profile id exists. The gate copy is written from `OTB.rankLabel('metic')`; it used to say "Archon-only", wrong since ADR 0210.
+- **People and scouting are ONE page.** `/scouting` was the legacy door to the same `/api/gds/scouting` rollup, drawn a third way; it now renders `people.html`'s body and `scouting.js` is deleted. **Task 1003440 then deleted the door itself**: `scouting.html` and `scouting.states.json` are gone, the `SCOUTING_PAGE_RE` page gate with them, and `/builders/scouting` now 301s to `/people` (`SCOUTING_LEGACY_RE` in `serve-internal.js`) so an old bookmark still lands on the directory. `tests/hall_roster_world.mjs` pins both halves — the files are absent, and the redirect exists with no dead gate behind it. On the row the name is the shell's `.lb-name` to the builder's **GitHub** page — the one door every listed builder has, since the directory is cross-project and no local profile id exists. The gate copy is written from `OTB.rankLabel('metic')`; it used to say "Archon-only", wrong since ADR 0210. **Task 1003444 then deleted `/people` itself** (owner call, 2026-09-25 — [ADR 0337](../../../docs/adr/0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) D5): cross-project discovery is the hub's, so `people.html`, `people.js`, `people.states.json` and the `scouting.json` harness fixture are gone, the identity cell `/roster` shared moved from `people.css` to `roster.css`, and the `requireProjectCuratePage` page gate (with its `alsoAdmits` door) went with the page. `/builders/people` and `/builders/scouting` now 302 to `/roster` (`RETIRED_DIRECTORY_RE`); GET `/scouting`'s own route gate is unchanged. Cross-project search and the recruiter name-only panel are absent until the hub community page (task 1003363) ships.
 - **The session ledger's nowrap + wrapper pair was a live bug.** `sessions.css` forced `white-space: nowrap` on every cell, `.ledger-table-wrap` existed only to give that a scrollport, and the shell's sticky `th` then stuck to the WRAPPER — the column heads rendered over the first row on desktop. Both are gone; the shell's card strip handles a phone as on every other ledger. **Every id on a row is a door** (the session id was painted in `--info` — a link to nowhere); the row shows what the session EARNED; the totals ride the shell's top strip (`.ov-summary`) with **six fixed columns so the sixth tile is never stranded on its own row**. The hand-rolled server-side pager is untouched (the sanctioned exception below).

package/modules/platform-identity/account-visibility.js

@@ -124,8 +124,8 @@ function isAccountActive(account) {
 // The rollup axis: visible AND not hidden (task 1002967 — ADR 0171 D2 extended)
 // -------------------------------------------------------------------------
 
-// The predicate the two ROLLUP readers join — listScoutingRollup (/people,
-// /scouting) and getPublicProfileExtras (the platform-identity.hub port behind
+// The predicate the two ROLLUP readers join — listScoutingRollup
+// (/scouting) and getPublicProfileExtras (the platform-identity.hub port behind
 // core GET /builders/:id/profile). COMPOSED from accountVisibleSql, never
 // restated, so changing what "visible" means moves this with it.
 function rollupVisibleSql(alias) {
@@ -185,7 +185,7 @@ function recruiterReachSql(alias) {
 
 // scoutingListableSql — THE predicate the recruiting directory joins: the rollup
 // axis AND the reach axis (ADR 0210, task 1002290). listScoutingRollup is the
-// one reader; /scouting and the hall's /people are its two surfaces.
+// one reader; GET /scouting is its surface (the hall's /people went, task 1003444).
 //
 // WHY REACH BELONGS HERE AND NOT IN rollupVisibleSql. The two axes answer
 // different questions and only one surface asks both. `hide_stats` suppresses

package/modules/platform-identity/platform-identity.js

@@ -701,8 +701,8 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
 //
 // Consent by construction (ADR 0171 D2/D3, extended by tasks 1002967 + 1002290):
 // only builders whose account passes scoutingListableSql — active, publicly
-// visible, not hidden, AND not opted out of recruiting — appear. /people and
-// /scouting are live cross-project surfaces, so the predicate lives IN the query,
+// visible, not hidden, AND not opted out of recruiting — appear. /scouting is a
+// live cross-project surface, so the predicate lives IN the query,
 // not in any caller's memory, and it is the SHARED one so this list can never
 // disagree with /profiles/:handle about who is visible. Provisional, private,
 // hidden and opted-out builders drop out entirely; the projection stays an

package/modules/platform-identity/routes/profile.js

@@ -14,7 +14,7 @@
 //                             account_visibility + recruiter_discoverable (task
 //                             1002966, privacy spec D1). hide_stats takes effect
 //                             immediately on every public surface (profile
-//                             cross_project, /people, /scouting): enforcement
+//                             cross_project, /scouting): enforcement
 //                             lives in the module's read functions (D2) and the
 //                             hub profile response is no-store (D5), so there is
 //                             no cache to outwait. The other two are STORED here

package/modules/platform-identity/routes/sso.js

@@ -174,9 +174,10 @@ function registerSeams() {
       // which a database error must never be allowed to say.
       hiddenGithubIds: (githubIds) => pi.hiddenGithubIds(githubIds, { pool }),
       // task 1002290 (ADR 0210): "does this hub account own a project?", the
-      // second audience the /people page gate admits beside `project.curate`.
-      // The ownership fact lives in this module, so the answer does too; core
-      // asks through the port and treats an absent one as a denial.
+      // second audience a page gate's `alsoAdmits` door admits — today the /deploy
+      // shell (requireCorePinPage, ADR 0339); /people, its first user, is deleted
+      // (task 1003444). The ownership fact lives in this module, so the answer does
+      // too; core asks through the port and treats an absent one as a denial.
       isProjectOwner: (githubId) => scoutingAuthz.hasOwnerMembership(githubId, { pool }),
       // task 1002347 (BV1.R28, ADR 0251): the names behind `invites.seeking` —
       // the creation wizard's "who is worth inviting" list. Consent-filtered by

package/modules/platform-identity/scouting-authz.js

@@ -1,6 +1,6 @@
 // modules/platform-identity/scouting-authz.js — WHO may read the cross-project
-// recruiting directory (GET /scouting; the hall's /people page renders the same
-// data). ADR 0210, task 1002290 — goal 1000045 C5: "project owners (not only
+// recruiting directory (GET /scouting; the hall's /people page that rendered it
+// was deleted in task 1003444). ADR 0210, task 1002290 — goal 1000045 C5: "project owners (not only
 // Archons) browse builder profiles to recruit".
 //
 // TWO DOORS, DELIBERATELY DIFFERENT KINDS — the modules/lifecycle/goal-authz.js

package/modules/platform-identity/tests/platform-identity.mjs

@@ -680,7 +680,7 @@ await ta('listScoutingRollup scalar aggregation is fan-out-free (task 1002911)',
 });
 
 await ta('listScoutingRollup enforces consent IN the query (ADR 0171 D2/D3)', async () => {
-  // /people and /scouting must honor hide BY CONSTRUCTION: the predicate lives
+  // /scouting must honor hide BY CONSTRUCTION: the predicate lives
   // in the scalar-aggregation CTE, not in any caller. Semantics proven against
   // real SQL by tests/profile_rollup_consent.mjs.
   const pool = mockPool([{ rows: [] }]);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1044",
+  "version": "1.19.1046",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1044",
+      "version": "1.19.1046",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1044",
+  "version": "1.19.1046",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7565,5 +7565,17 @@
       "id": "1003518",
       "text": "A blocker that was linked to the wrong task — a duplicate, or a mistake — can now be unlinked, and the task goes back to being claimable if nothing else was holding it. Before this the only way out was to mark the blocker reso"
     }
+  ],
+  "1.19.1045": [
+    {
+      "id": "1003458",
+      "text": "The Tasks board and the Goals page now claim and release work through one shared piece of code instead of two copies that had already drifted apart — the same refusal was worded differently on each page, and one had lost its \""
+    }
+  ],
+  "1.19.1046": [
+    {
+      "id": "1003444",
+      "text": "The hall's People page is gone, as you asked. An old People link now opens the Builders page instead, and People is no longer in the side menu. Searching for builders across projects comes back when the hub's community page is"
+    }
   ]
 }

package/src/bongos/auth.js

@@ -425,17 +425,14 @@ function signInWithReturn(req) {
 const PAGE_GATES = Object.freeze({
   requireBuilderPage: Object.freeze({ permission: 'page.view.public', deniedTo: '/builders' }),
   requireGovernmentPage: Object.freeze({ permission: 'page.view.government', deniedTo: '/builders' }),
-  // `alsoAdmits` — a SECOND, non-rank audience this page's DATA ROUTE admits, so
-  // the page can follow it (ADR 0210, task 1002290). /people fronts GET /scouting,
-  // which since R14 admits a `project.curate` holder OR a PROJECT OWNER; a page
-  // gate that could only ever ask about a permission would leave the widened
-  // audience staring at a redirect. The value names a function on the
-  // `platform-identity.hub` port — the module that owns the ownership fact — and
-  // is consulted ONLY after the permission check has already refused, so it can
-  // widen and never narrow. Absent port, absent function, or a throw: no admit.
-  requireProjectCuratePage: Object.freeze({
-    permission: 'project.curate', deniedTo: '/builders', alsoAdmits: 'isProjectOwner',
-  }),
+  // `alsoAdmits` (on requireCorePinPage below) — a SECOND, non-rank audience a
+  // page's DATA ROUTE admits, so the page can follow it (ADR 0210). A page gate that
+  // could only ever ask about a permission would leave the widened audience staring
+  // at a redirect. The value names a function on the `platform-identity.hub` port —
+  // the module that owns the ownership fact — and is consulted ONLY after the
+  // permission check has already refused, so it can widen and never narrow. Absent
+  // port, absent function, or a throw: no admit. Its first user, the hall's /people
+  // page, was deleted by task 1003444 (ADR 0337 D5).
   // The /board-room page (ADR 0266) — gated on `board.vote.cast`, the SAME atom
   // the vote route checks, so the surface's reach equals the right to vote.
   //
@@ -464,7 +461,7 @@ const PAGE_GATES = Object.freeze({
   //
   // SINCE ADR 0339 (task 1004174) its routes admit a SECOND audience — a hosted
   // project's own owner, for that project only — so the shell follows through the same
-  // `alsoAdmits` door /people uses (ADR 0210). It admits the SHELL for an owner of any
+  // `alsoAdmits` door (ADR 0210). It admits the SHELL for an owner of any
   // live project; which project they may read or move is still the routes' question,
   // asked per request against that project's row.
   requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders', alsoAdmits: 'isProjectOwner' }),
@@ -619,17 +616,6 @@ async function requireGovernmentPage(req, res, next) {
   return runPageGate('requireGovernmentPage', req, res, next);
 }
 
-// The /people builder-directory page (task 1002577) — gated on the
-// `project.curate` ATOM, the same key its one data route (GET /scouting,
-// modules/platform-identity) checks, so the page layer can never drift wider
-// than the API it fronts. R14 (goal 1000045, ADR 0210) widened that route to a
-// SECOND audience that is not a rank at all — a project owner — so this gate
-// carries the same OR through `alsoAdmits` above: the two doors of the page are
-// exactly the two doors of the route, and neither layer can drift from it.
-async function requireProjectCuratePage(req, res, next) {
-  return runPageGate('requireProjectCuratePage', req, res, next);
-}
-
 // The /board-room page (ADR 0266) — gated on the `board.vote.cast` ATOM, the
 // same key the vote route checks, so the page layer can never drift NARROWER
 // than the API it fronts. That is the direction that matters here: the Board
@@ -940,7 +926,6 @@ module.exports = {
   requireBuilder,
   requireBuilderPage,
   requireGovernmentPage,
-  requireProjectCuratePage,
   requireBoardVotePage,
   requireCorePinPage,
   requireFleetPage,

package/src/bongos/serve-internal.js

@@ -936,17 +936,13 @@ function mountInternalSurfaces(app) {
   // statically, and a comment in that gap drops the regex out of the map, which
   // makes the page test as UNGATED while looking gated here. Prose goes above.
   const BOARD_ROOM_PAGE_RE = /^\/builders\/board-room(?:\.html)?\/?$/;
-  // The /people builder directory (task 1002577): gated on `project.curate`, the
-  // exact permission its data route (GET /scouting) checks — same posture as the
-  // /government tab above (the page can never drift wider than the API it fronts).
-  const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
   // /deploy — the owner's deploy door (task 1003159, ADR 0293). Gated on the
   // `core.pin.move` atom, the same key its preview and its move both check, so the
   // shell's reach equals the right to press the button. Archon-floor and system:true,
   // which makes this the narrowest page gate here — correct for the one surface whose
   // button restarts the live service and changes what code the platform runs.
   //
-  // DECLARED HERE, WITH THE OTHER GATES, AND NOT BELOW: the SCOUTING_LEGACY_RE block
+  // DECLARED HERE, WITH THE OTHER GATES, AND NOT BELOW: the RETIRED_DIRECTORY_RE block
   // that follows is a matcher immediately followed by the redirect it feeds, and
   // tests/hall_roster_world.mjs reads them as one span. Wedging a declaration between
   // the two separates a matcher from its handler for a reader as well as for that test.
@@ -959,23 +955,24 @@ function mountInternalSurfaces(app) {
   const DEPLOY_PAGE_RE = /^\/builders\/deploy(?:\.html)?\/?$/;
   // The fleet cost page (task 1001949), on the atom its one read checks.
   const FLEET_PAGE_RE = /^\/builders\/fleet(?:\.html)?\/?$/;
-  // /scouting WAS the legacy twin of /people — the same /api/gds/scouting
-  // directory, left behind when task 1002577 graduated it into the hall. Task
-  // 1003470 had already made the two one page (scouting.html rendered people's
-  // body byte-for-byte and scouting.js was deleted); task 1003440 removes the
-  // door itself, because a second URL onto one directory is a surface to keep in
-  // sync for no reader. The URL survives as a 301 so an old bookmark lands on the
-  // directory instead of a 404. It carries no page gate: the redirect discloses
-  // nothing, and /people's wall applies the instant the browser follows it.
-  const SCOUTING_LEGACY_RE = /^\/builders\/scouting(?:\.html)?\/?$/;
+  // /people and its legacy twin /scouting were the hall's cross-project builder
+  // directory. Task 1003440 deleted the /scouting door; task 1003444 deleted
+  // /people itself (owner call, 2026-09-25 — ADR 0337 D5): cross-project
+  // discovery belongs to the hub, and /roster is the hall's directory. Both URLs
+  // survive as redirects to /roster so a bookmark lands somewhere instead of a
+  // 404. 302, not 301: /roster is interim until the hub community page (task
+  // 1003363) ships, and a browser caches a 301 past any re-point. No page gate:
+  // the redirect discloses nothing, and /roster is deliberately public.
+  // GET /scouting's own gate (platform-identity) is untouched by this.
+  const RETIRED_DIRECTORY_RE = /^\/builders\/(?:people|scouting)(?:\.html)?\/?$/;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (req.method !== 'GET' && req.method !== 'HEAD') return next();
-    if (!SCOUTING_LEGACY_RE.test(path.posix.normalize(req.path))) return next();
+    if (!RETIRED_DIRECTORY_RE.test(path.posix.normalize(req.path))) return next();
     const qs = req.url.includes('?') ? req.url.slice(req.url.indexOf('?')) : '';
     // On the builders subdomain the /builders prefix is redundant (the canonical
     // redirect above strips it), so emit the clean path and save a second hop.
-    return res.redirect(301, `${isBuildersHost(req) ? '' : '/builders'}/people${qs}`);
+    return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/roster${qs}`);
   });
 
   // /deploy EXISTS ONLY WHERE THE DOOR DOES (task 1004296). The owner, 2026-09-25: /deploy is
@@ -1019,9 +1016,6 @@ function mountInternalSurfaces(app) {
     if (BOARD_ROOM_PAGE_RE.test(norm)) {
       return gdsAuth.requireBoardVotePage(req, res, next);
     }
-    if (PEOPLE_PAGE_RE.test(norm)) {
-      return gdsAuth.requireProjectCuratePage(req, res, next);
-    }
     // ADR 0293: the deploy door, on the same atom its two routes check.
     if (DEPLOY_PAGE_RE.test(norm)) {
       return gdsAuth.requireCorePinPage(req, res, next);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1044'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1046'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/account_privacy_flags.mjs

@@ -418,7 +418,7 @@ test('the recruiting surface really is exactly two reads, and each one joins REA
   const av = readFileSync(join(ROOT, 'modules/platform-identity/account-visibility.js'), 'utf8');
   // The directory reads TWO tiers since task 1002291 — ranked, and the hidden
   // builders it lists by name — and the opt-out must empty both, or "removes you
-  // from the People directory" is false for a builder who also hid their record.
+  // from the recruiting directory" is false for a builder who also hid their record.
   for (const composed of ['scoutingListableSql', 'scoutingNameOnlySql', 'recruiterSliverVisibleSql']) {
     const body = av.slice(av.indexOf(`function ${composed}(`));
     assert.match(body.slice(0, body.indexOf('\n}')), /recruiterReachSql\(alias\)/,

package/tests/auth_resolve_failure.mjs

@@ -93,22 +93,22 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   // rot: a NEW bare `async function require*` added later fails this test.
   //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
   //   requireBuilderPage        \
-  //   requireGovernmentPage      \ all FOUR delegate to runPageGate, guarded by
-  //   requireProjectCuratePage   /  BV1.R107 (the /people curate gate; the
-  //   requireBoardVotePage      /   ADR 0266 /board-room vote gate)
+  //   requireGovernmentPage      \ all delegate to runPageGate, guarded by
+  //   requireBoardVotePage       /  BV1.R107 (and the ADR 0266 /board-room vote gate)
   //   requireCorePinPage        /   ADR 0293's /deploy door — the narrowest of them,
   //                                 on the archon-floor `core.pin.move` atom.
   //   requireFleetPage            — task 1001949's /fleet cost page, same delegation.
   // Task 1003450 removed two more — requireNonXenosPage and the R113
   // requireGovernmentManagePage — which had both ended up dispatched from no
-  // route at all; tests/hall_page_gate_map.mjs now fails if that recurs.
+  // route at all; tests/hall_page_gate_map.mjs now fails if that recurs. Task
+  // 1003444 removed requireProjectCuratePage with the /people page it fronted.
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireCorePinPage', 'requireFleetPage', 'requireGovernmentPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireCorePinPage', 'requireFleetPage', 'requireGovernmentPage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireProjectCuratePage', 'requireBoardVotePage', 'requireCorePinPage', 'requireFleetPage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireBoardVotePage', 'requireCorePinPage', 'requireFleetPage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }