@bongos/core 1.19.1045 → 1.19.1047

package/tests/{scouting_page_gate.mjs → page_gate_second_door.mjs}

@@ -1,12 +1,16 @@
-// tests/scouting_page_gate.mjs
+// tests/page_gate_second_door.mjs
 //
-// The OTHER half of R14 (task 1002290, ADR 0210 D3): the `/builders/people`
-// SHELL must admit exactly the two audiences `GET /scouting` admits.
+// The page gates' `alsoAdmits` SECOND DOOR (ADR 0210), proven on the one gate that
+// declares it: requireCorePinPage, the /deploy shell, whose routes admit a hosted
+// project's own owner beside `core.pin.move` (ADR 0339, task 1004174). The door's
+// first user was the hall's /people page; task 1003444 deleted that page (ADR 0337
+// D5) and retargeted this file (formerly tests/scouting_page_gate.mjs) here.
 //
-// WHY THIS IS ITS OWN FILE, AND ITS OWN GATE. `runPageGate` grew an optional
+// WHY THIS IS ITS OWN FILE. `runPageGate` grew an optional
 // `alsoAdmits` door — new authorization code that runs on EVERY page-gate
 // denial, for every gate. The route proof
-// (tests/scouting_owner_access_and_reach.mjs) cannot reach it: page gates are
+// (tests/core_upgrade_owner_door.mjs) proves the widening itself; this file pins
+// the door's failure modes, which a route proof cannot reach: page gates are
 // driven by a session, and that file's ESM imports pull `auth.js` in through the
 // module graph before any session double could be installed. This file installs
 // the double FIRST, exactly as tests/government_page_gates.mjs does, and so gets
@@ -21,12 +25,12 @@
 //   3. every way the second door can fail — module absent, function absent, a
 //      throw, a non-boolean, and a name that resolves only through the prototype
 //      — fails CLOSED. A fail-open default in an authz path is the bug class;
-//   4. the other four gates are untouched, and their seam is never even
+//   4. the other gates are untouched, and their seam is never even
 //      consulted, because they declare no second door.
 //
 // DB-free: a session double and a port double. No Postgres, no HTTP.
 //
-// Run:  node tests/scouting_page_gate.mjs
+// Run:  node tests/page_gate_second_door.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -53,12 +57,13 @@ async function t(name, fn) {
 }
 
 // The cast. `rank` is the caller's rank ON THE HUB; `github_id` is the account
-// whose project memberships the ownership door asks about. The whole point of
-// R14 is the first row: a project's registrant is an Archon on their OWN
-// instance and, here, very often a xenos holding nothing at all.
+// whose project memberships the ownership door asks about. The first row is the
+// point: a project's registrant is an Archon on their OWN instance and, on the
+// hub, very often a xenos holding nothing at all.
 const OWNER = { builder_id: 1, github_id: '9001', rank: 'xenos' };
 const STRANGER = { builder_id: 2, github_id: '9002', rank: 'xenos' };
-const OPERATOR = { builder_id: 5, github_id: '9005', rank: 'metic' };
+// core.pin.move is archon-floor (ADR 0293), so the permission-door control is an Archon.
+const OPERATOR = { builder_id: 5, github_id: '9005', rank: 'archon' };
 
 // The ownership answer, as the platform-identity.hub port supplies it.
 const OWNS = new Set(['9001']);
@@ -94,33 +99,33 @@ async function runGate(gate, session, hub) {
   return { res, nexted };
 }
 
-const DENIED_CURATE = { code: 302, loc: '/builders?denied=project.curate' };
+const DENIED_PIN = { code: 302, loc: '/builders?denied=core.pin.move' };
 
-console.log('the /people shell follows its data route:');
+console.log('the /deploy shell follows its data routes:');
 
 await t('a PROJECT OWNER reaches the shell, holding no permission at all', async () => {
-  const { nexted } = await runGate('requireProjectCuratePage', OWNER, workingHub);
+  const { nexted } = await runGate('requireCorePinPage', OWNER, workingHub);
   assert.ok(nexted,
     'the page gate must admit the audience its data route admits — otherwise the widening is real in the API and unreachable in the product');
 });
 
 await t('CONTROL: the permission door still opens the shell on its own', async () => {
-  const { nexted } = await runGate('requireProjectCuratePage', OPERATOR, workingHub);
-  assert.ok(nexted, 'ADR 0157 put project.curate at the metic floor; R14 did not move it');
+  const { nexted } = await runGate('requireCorePinPage', OPERATOR, workingHub);
+  assert.ok(nexted, 'core.pin.move admits an Archon (ADR 0293); ADR 0339 did not move it');
   // ...and it does not need the second door at all.
-  const { nexted: noHub } = await runGate('requireProjectCuratePage', OPERATOR, null);
+  const { nexted: noHub } = await runGate('requireCorePinPage', OPERATOR, null);
   assert.ok(noHub, 'an operator gets in on a vanilla instance with no hub module');
 });
 
 await t('a builder who is neither gets the byte-identical redirect the gate always sent', async () => {
-  const { res, nexted } = await runGate('requireProjectCuratePage', STRANGER, workingHub);
-  assert.equal(nexted, false, 'building on a project is not owning one');
-  assert.deepEqual(res._redirect, DENIED_CURATE,
+  const { res, nexted } = await runGate('requireCorePinPage', STRANGER, workingHub);
+  assert.equal(nexted, false, 'a xenos who owns no project stays out');
+  assert.deepEqual(res._redirect, DENIED_PIN,
     'the denial keeps naming the permission (task 1002613), so the hall shell can still render WHY');
 });
 
 await t('an unauthenticated visitor is still bounced into sign-in, never to the second door', async () => {
-  const { res, nexted } = await runGate('requireProjectCuratePage', null, workingHub);
+  const { res, nexted } = await runGate('requireCorePinPage', null, workingHub);
   assert.equal(nexted, false);
   assert.match(res._redirect.loc, /auth\/web\/start/, 'no session means sign-in, not a denial page');
 });
@@ -139,12 +144,12 @@ await t('every way the second door can fail, it fails CLOSED', async () => {
     ['the function resolves only through the prototype', Object.create({ isProjectOwner: () => true })],
   ];
   for (const [why, hub] of cases) {
-    const { res, nexted } = await runGate('requireProjectCuratePage', OWNER, hub);
+    const { res, nexted } = await runGate('requireCorePinPage', OWNER, hub);
     assert.equal(nexted, false, `${why}: must not admit`);
-    assert.deepEqual(res._redirect, DENIED_CURATE,
+    assert.deepEqual(res._redirect, DENIED_PIN,
       `${why}: must still redirect rather than hang, throw, or answer JSON`);
   }
-  const { nexted } = await runGate('requireProjectCuratePage', OWNER, workingHub);
+  const { nexted } = await runGate('requireCorePinPage', OWNER, workingHub);
   assert.ok(nexted, 'CONTROL: the same caller IS admitted when the door works — the six refusals are the door, not the caller');
 });
 
@@ -152,7 +157,7 @@ await t('the second door is consulted only where the AUTHORITY answer was no', a
   // A permission holder must not pay for it, and — more important — the seam
   // must never be able to NARROW a caller the permission already admitted.
   const spy = { isProjectOwner: () => { throw new Error('the seam must not be consulted for a caller the permission already admitted'); } };
-  const { nexted } = await runGate('requireProjectCuratePage', OPERATOR, spy);
+  const { nexted } = await runGate('requireCorePinPage', OPERATOR, spy);
   assert.ok(nexted, 'the atom holder is admitted before the second door is reached');
 });
 
@@ -176,14 +181,14 @@ await t('the OTHER page gates are untouched — their seam is never consulted at
 
 await t('only the gates WITH A PROOF declare a second door (a widening must be opted into, one gate at a time)', () => {
   const src = require('node:fs').readFileSync(new URL('../src/bongos/auth.js', import.meta.url), 'utf8');
-  // Keyed by GATE, not just the door's name, so a third gate borrowing 'isProjectOwner'
+  // Keyed by GATE, not just the door's name, so a second gate borrowing 'isProjectOwner'
   // fails here instead of hiding behind an unchanged list of names. Each entry names the
   // file that proves its widening:
-  //   requireProjectCuratePage — this file (ADR 0210 D3);
-  //   requireCorePinPage       — tests/core_upgrade_owner_door.mjs (ADR 0339, task 1004174).
+  //   requireCorePinPage — tests/core_upgrade_owner_door.mjs (ADR 0339, task 1004174).
+  // (requireProjectCuratePage, the /people gate, was deleted with its page — task 1003444.)
   const declarations = [...src.matchAll(/(require\w+Page):\s*Object\.freeze\(\{[^}]*alsoAdmits:\s*'([^']+)'/g)]
     .map((m) => `${m[1]}:${m[2]}`);
-  assert.deepEqual(declarations, ['requireProjectCuratePage:isProjectOwner', 'requireCorePinPage:isProjectOwner'],
+  assert.deepEqual(declarations, ['requireCorePinPage:isProjectOwner'],
     'a second alsoAdmits appearing without its own proof is how a page gate quietly widens');
   const plain = [...src.matchAll(/alsoAdmits:\s*'([^']+)'/g)].length;
   assert.equal(plain, declarations.length, 'every alsoAdmits sits on a named page gate this test can see');

package/tests/profile_rollup_consent.mjs

@@ -4,7 +4,7 @@
 // unnest(), so the rollup queries need a live Postgres (the task-1002911
 // precedent). Replays the module's actual migrations, then asserts:
 //   1. listScoutingRollup lists ONLY consented + not-hidden builders (D2/D3) —
-//      provisional, hidden and never-accepted accounts drop out of /people +
+//      provisional, hidden and never-accepted accounts drop out of
 //      /scouting by construction. Consent is TWO columns since ADR 0213
 //      (profile_state='active' AND terms_accepted_at IS NOT NULL), and the
 //      LEGACY fixture is the pre-terms row that proves the second one.
@@ -151,7 +151,7 @@ try {
     [...ALL_CLIENTS, ACTIVE, HIDDEN, PROV, LEGACY],
   );
 
-  // 1 — the scouting/people predicate (D2/D3).
+  // 1 — the scouting predicate (D2/D3).
   const listed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
   ok(listed.includes(ACTIVE), 'active + accepted + visible builder is listed');
   ok(!listed.includes(HIDDEN), 'hide_stats builder drops out of the scouting rollup');
@@ -209,11 +209,11 @@ try {
 
   // 4b — the live hide toggle (R03, task 1002279): flipping hide_stats takes
   // effect IMMEDIATELY on every public read — the profile port and the
-  // /people + /scouting rollup — while the self view keeps serving.
+  // /scouting rollup — while the self view keeps serving.
   await pi.setAccountHideStats({ githubId: ACTIVE, githubLogin: 'active-b', hide: true }, { pool });
   ok(await pi.getPublicProfileExtras(ACTIVE, { pool }) === null, 'hide ON → public read drops to null immediately');
   const hiddenListed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
-  ok(!hiddenListed.includes(ACTIVE), 'hide ON → the builder drops out of /people + /scouting immediately');
+  ok(!hiddenListed.includes(ACTIVE), 'hide ON → the builder drops out of /scouting immediately');
   const stillOwn = await pi.getOwnProfileExtras(ACTIVE, { pool });
   ok(stillOwn && stillOwn.totals.credits === 175, 'hide ON → the self view still serves their own numbers');
   let hiddenAcct = await pi.getAccount(ACTIVE, { pool });

package/tests/profile_route.mjs

@@ -18,7 +18,7 @@
 //   2. flipping hide_stats removes it on the IMMEDIATE next load, and the
 //      response is `Cache-Control: no-store` — the old `public, max-age=60`
 //      would keep serving the pre-hide body for a minute (ADR 0171 D5);
-//   3. `/scouting` (the endpoint the hall's /people page renders) drops the
+//   3. `/scouting` (the recruiting directory's endpoint) drops the
 //      hidden builder too — enforcement is on every read path, not the profile;
 //   4. the leak guard BITES: planting a private field turns the key-list and
 //      sentinel assertions red (a leak test that cannot fail is not a test);
@@ -35,14 +35,9 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import http from 'node:http';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const express = require('express');
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
-const sourceOf = (rel) => readFileSync(join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
 
 let passed = 0;
 let failed = 0;
@@ -410,8 +405,8 @@ const engine = {
     const sql = String(text);
     engine.calls.push({ sql, params });
 
-    // listScoutingRollup — the ONE read behind GET /scouting and the hall's
-    // /people page. Honors exactly the predicates the query declares.
+    // listScoutingRollup — the ONE read behind GET /scouting. Honors exactly
+    // the predicates the query declares.
     if (/AS project_count/.test(sql)) {
       let rows = SCOUTING_TABLE;
       if (/pa\.profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
@@ -666,24 +661,6 @@ await t('R06.3 GET /scouting ranks the visible builder, lists the HIDDEN one by
   }
 });
 
-await t('R06.3 the /people page reads /scouting and nothing else', async () => {
-  // /people is the hall's render of the same endpoint, so whatever /scouting
-  // drops, /people drops. Pin that it has no second data source.
-  //
-  // MATCHED AS AN EXPRESSION, NOT A STRING LITERAL. This used to capture the
-  // whole URL out of `fetch('…')` and compare it to one hardcoded string, which
-  // pinned the row limit as a side effect of pinning the ENDPOINT — so task
-  // 1003110 naming that limit (`DIRECTORY_LIMIT`, the one constant that feeds
-  // both the request and the "showing the first N" copy) failed a test about
-  // data sources. What is load-bearing here is the count and the destination:
-  // ONE read, and it goes to the scouting rollup. How the query string is
-  // assembled is the page's business.
-  const args = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/\bfetch\(\s*([^,)]+)/g)].map((m) => m[1].trim());
-  assert.equal(args.length, 1, '/people has exactly one data source');
-  assert.match(args[0], /^'\/api\/bongos\/scouting\?limit='/,
-    'and it is the scouting rollup — nothing may re-enter through a second endpoint');
-});
-
 scout.server.close();
 server.close();
 

package/tests/scouting_owner_access_and_reach.mjs

@@ -12,9 +12,8 @@
 //   WHO APPEARS IN IT.  The recruiting opt-out (`recruiter_discoverable`, privacy
 //     spec D1) gated nothing until this task: a public account that had opted out
 //     still appeared. listScoutingRollup now joins scoutingListableSql, so an
-//     opted-out builder is absent from /scouting AND from the hall's /people —
-//     which is the SAME endpoint, proved from source below rather than asserted
-//     twice — and flipping the toggle back restores them.
+//     opted-out builder is absent from /scouting — its one reader's predicate is
+//     proved from source below — and flipping the toggle back restores them.
 //
 //   AND NEITHER AXIS TOUCHES THE OTHER (ADR 0016).  Being scoutable is not
 //     authority and opting out is not a punishment: an opted-out builder who owns
@@ -641,13 +640,10 @@ await t('CALIBRATION: the interpreter refuses what it cannot model, rather than
   ));
 });
 
-await t('/people is the SAME endpoint, so "absent from /people" is true by construction', async () => {
-  const page = fs.readFileSync(path.join(repo, 'modules/hall-ui/public/people.js'), 'utf8');
-  assert.match(page, /fetch\('\/api\/bongos\/scouting/,
-    'the hall directory reads GET /scouting; if it ever grows its own query, this proof stops covering it');
+await t('listScoutingRollup, the one reader behind GET /scouting, joins the composed predicate', async () => {
   const source = fs.readFileSync(path.join(repo, 'modules/platform-identity/platform-identity.js'), 'utf8');
   assert.match(source, /scoutingListableSql\('pa'\)/,
-    'and listScoutingRollup — the one reader behind both surfaces — joins the composed predicate');
+    'the reader joins scoutingListableSql, so "absent from /scouting" holds by construction');
 });
 
 // ===========================================================================

package/modules/hall-ui/public/people.html

@@ -1,79 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>People — {{worldName}}</title>
-  <meta name="description" content="The builder directory: everyone building across {{worldName}} projects, searchable and ranked by track record.">
-  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
-  <!-- task 1003470: the identity cell (avatar, name, login) is the one thing the
-       directory adds to the shell's ledger. -->
-  <link rel="stylesheet" href="/builders/people.css">
-</head>
-<body data-page="people" data-page-title="People">
-
-<div class="app">
-  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
-  <div class="app-scrim" id="app-scrim" hidden></div>
-  <div class="app-body">
-    <header class="app-topbar" id="app-topbar"></header>
-    <div class="app-content">
-      <!-- The board page head (task 1003307): the label voice, because on a
-           working surface the page's own name is the least interesting thing on
-           it. The sub is rewritten by people.js once the directory has loaded. -->
-      <div class="page-head page-head--board">
-        <h1 class="page-head__h">People</h1>
-        <p class="page-head__sub" id="people-sub">Everyone building across hosted projects, ranked by track record. Descriptive only — cross-project numbers never carry authority here.</p>
-      </div>
-
-      <main id="hall-main">
-        <!-- task 1003470: ONE directory. Its legacy door /scouting rendered this
-             same page from the same script, and task 1003440 deleted it — the same
-             /api/bongos/scouting rollup used to be drawn three different ways. -->
-        <section class="scroll" id="people-scroll" aria-labelledby="people-h">
-          <h2 id="people-h" class="scroll__h">Builder directory<span class="count-pill" id="people-count" hidden></span></h2>
-          <div id="people-filters"></div>
-          <div id="people-body">
-            <div class="profile__placeholder">Loading the directory…</div>
-          </div>
-          <!-- task 1003110: the clipped-directory footnote. Hidden unless the
-               response came back FULL, which is the only truncation signal the
-               rollup offers; people.js writes it. -->
-          <p class="ledger__note" id="people-foot" hidden></p>
-        </section>
-
-        <!-- task 1002291 (ADR 0334): builders who hid their cross-project record
-             but are still open to recruiting, listed by name alone (privacy spec
-             D2). Its own panel because they are never ranked; hidden unless the
-             response carries a row, and people.js writes it. -->
-        <section class="scroll" id="people-named-scroll" aria-labelledby="people-named-h" hidden>
-          <h2 id="people-named-h" class="scroll__h">Listed by name only<span class="count-pill" id="people-named-count" hidden></span></h2>
-          <p class="scroll__lede" id="people-named-lede">These builders are open to recruiting but keep their cross-project record hidden, so only who they are is shown. They are never ranked, and a role filter never finds them.</p>
-          <div id="people-named-body"></div>
-          <p class="ledger__note" id="people-named-foot" hidden></p>
-        </section>
-      </main>
-
-      <footer class="app-foot" id="app-foot"></footer>
-    </div>
-  </div>
-</div>
-
-<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
-
-<!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
-     chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-26-swupdate"></script>
-<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
-<script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
-     branding pack's currency label, loaded BEFORE people.js. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
-<script src="/builders/brand-apply.js"></script>
-<script src="/builders/hall-kit.js"></script>
-<script src="/builders/people.js"></script>
-</body>
-</html>