@bongos/core 1.19.115 → 1.19.116

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.115",
-  "core_contract": "1.19.115",
-  "source_commit": "f98d169e99486bbb55d50e2fb3b18d2d0e035400",
+  "core_version": "1.19.116",
+  "core_contract": "1.19.116",
+  "source_commit": "be42420efe0538b351e5eed4a355a47e28b430f5",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T17:50:49.780Z",
+  "built_at": "2026-08-14T18:14:13.252Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 302,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1235,
+    "functional_verbatim": 1236,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1558,
-  "tree_sha256": "85dc1b669e706f57dd7ae065edc3c04eba737c5875959566b2487e6b01053e59",
+  "file_count": 1559,
+  "tree_sha256": "8ac36ba3efd387f4c72fecb2fde8b6d68ae8c016c5e8336c2f78a24abb5791e1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4152,12 +4152,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d7ad6805c0d040d4d14e0f95b7be3fc175b3e89068e8cb17b08be555827fe029"
+      "sha256": "87bcf76333165f80466bc093e13d0ad6313d63db0e8518b083adf18cfc4c373d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "feca9d093739c6fc3c7067bc4fbe725ff7e8cffd9420ddb6d2be632542b03667"
+      "sha256": "f7a325a5a15a160f72580f8af598cf302a68ec9fc04a03085dcdfa341c52dc89"
     },
     {
       "path": "public-docs/index.html",
@@ -5204,6 +5204,11 @@
       "mode": "0000644",
       "sha256": "5de4203d6a764c8aec374c7802f69f659816d2c0d75bbe70144f7dfb56df2e39"
     },
+    {
+      "path": "scripts/gds/seed-bv1-profile-page-tasks.js",
+      "mode": "0000644",
+      "sha256": "68f6edfcea2eaaf1262dc125d538f2b3806c58864839d6e34c3135235f29ed4b"
+    },
     {
       "path": "scripts/gds/seed-bv1-profiles-tasks.js",
       "mode": "0000644",
@@ -5727,7 +5732,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e80df1f75bd2a569a72d29eaa00146960390d86ef9a6fd66535d89aac6e6bd39"
+      "sha256": "298ca0ddbe3bcae48f5c360ca66aea09a798f317816cbbb9180142b12a7fb6ae"
     },
     {
       "path": "src/module-loader/catalog.js",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.115",
+  "version": "1.19.116",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.115",
+      "version": "1.19.116",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.115",
+  "version": "1.19.116",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/seed-bv1-profile-page-tasks.js

@@ -0,0 +1,161 @@
+// Seed the delta tasks the profile-page spike (task 1002783) surfaced, under
+// goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
+//
+// Source of truth: docs/specs/bongos-v1-builder-profile-page.md (status: final).
+// The Phase-1 spine (R01-R06) was already seeded by seed-bv1-profiles-tasks.js;
+// this file adds ONLY what that spec found on top of it, so the two seeders are
+// disjoint and both stay re-runnable.
+//
+// Idempotent on (source, source_ref) — re-running resolves to the existing rows
+// and re-asserts the dependency edges.
+//
+// Run: node scripts/gds/seed-bv1-profile-page-tasks.js
+
+const { apiCall } = require('./cli-lib');
+
+const VER = 'BONGOS-V1';
+const GOAL = 1000045;
+const SRC = 'planning-session';
+const SPEC = 'docs/specs/bongos-v1-builder-profile-page.md';
+
+// Tasks that already exist and that these depend on — referenced by id, since
+// they were seeded by the sibling seeder (or by the wave task 1002781).
+const R01 = 1002277;   // spike · design profile↔rollup join + consent model
+const R02 = 1002278;   // feature · profile API returns cross-project record
+const R03 = 1002279;   // feature · hide flag
+const R05 = 1002281;   // feature · shareable-by-login profile URL
+const SETTINGS_SPIKE = 1002784;   // spike · account settings page — inventory + placement
+const PRIVACY_SPIKE = 1002785;    // spike · account privacy model + invite inbox
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Throttled + 429-aware wrapper. The seeder makes ~20 writes in a burst, which
+// is exactly the shape the per-IP limiter is there to catch.
+async function api(method, path, body, _tries = 0) {
+  await sleep(400);
+  const r = await apiCall(method, `/api/gds${path}`, body);
+  if (r.status === 429 && _tries < 8) {
+    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return r;
+}
+
+// deps entries are either a local ref ('P01') or a numeric id of an existing task.
+const TASKS = [
+  {
+    ref: 'P01', kind: 'feature', disc: 'engineer', prio: 5, est: 180, crit: ['C1'], deps: [R01],
+    title: 'P01 · Builder handle on platform accounts (seed, dedupe, reserved list, rename)',
+    desc: `Add a \`handle\` column to platform_identity_accounts: seeded from github_login at creation, deduped with a numeric suffix on collision, validated against a small reserved list (me, new, edit, settings, admin, api, u), builder-editable at a low rate limit, previous handle retained for a 301 window. github_id stays the join key everywhere — the handle is presentation only. WHY: github_login is mutable, so hanging the canonical profile URL on it means every GitHub rename silently 404s that builder's shared links. Namespaced module migration (ADR 0083). Spec: ${SPEC} (Decision 3).`,
+  },
+  {
+    ref: 'P02', kind: 'feature', disc: 'engineer', prio: 5, est: 180, crit: ['C1'], deps: [R01],
+    title: 'P02 · Profile fields: bio + typed links on the platform account',
+    desc: `Add \`bio\` (plain text, ~280 chars, NO markdown and no auto-linking) and \`links\` (a TYPED, capped set — website, X, LinkedIn, Discord; max 4) to platform_identity_accounts, plus the authenticated write. Server-side validation must enforce https-only AND reject non-http(s) schemes and userinfo/host tricks — do not rely on the client. Render with rel="nofollow ugc noopener". WHY typed-and-capped rather than a free-form link list: a public, indexable page with user-controlled links is an SEO-spam magnet, and this removes the incentive without a moderation queue. Spec: ${SPEC} (Decision 4).`,
+  },
+  {
+    ref: 'P03', kind: 'decision', disc: 'engineer', prio: 5, est: 60, crit: ['C1'], deps: [], ready: true,
+    title: 'P03 · Owner decision: provisional vs active profile state for check-in-created accounts',
+    desc: `Goal 1000045 justifies "public by default" as tied to having a platform account, "which already carries platform T&C consent". That premise is not currently true for every account: POST /sso/membership/check-in and POST /sso/activity/rollup cause the hub to upsert an account for a builder who has never visited the hub and never saw a platform T&C. Under auto-create (see task 1002783) those people would get a public, indexable, cross-project profile from a sign-in they performed on someone else's instance. RECOMMENDATION: a profile_state of 'provisional' (created by check-in — still counted in aggregates, but not publicly listed, not at the handle URL, not in the sitemap, not in hub search) vs 'active' (has signed in at the hub at least once). One column, one branch. This is an owner product/consent call, and it changes the shape of P09. Spec: ${SPEC}.`,
+  },
+  {
+    ref: 'P04', kind: 'feature', disc: 'ui', prio: 4, est: 180, crit: ['C1'], deps: ['P01', 'P02', SETTINGS_SPIKE],
+    title: 'P04 · Settings → Profile rail group (the single profile-edit surface)',
+    desc: `One edit surface for the profile, as a new rail group in the hall Settings page (the RAIL_GROUPS pattern in modules/hall-ui/public/settings.js) — not a separate edit page. Holds handle, bio, links alongside the display-name and disciplines controls that already live there. Account-global fields must be edited where they are stored; final hub-vs-per-project placement is task ${SETTINGS_SPIKE}'s call, which is why this waits on it. Spec: ${SPEC} (Decision 4).`,
+  },
+  {
+    ref: 'P05', kind: 'verify', disc: 'engineer', prio: 5, est: 120, crit: ['C1'], deps: [R02],
+    title: 'P05 · Leak test for the hub profile read (mirror of tests/profile_route.mjs)',
+    desc: `The instance route GET /builders/:id/profile projects an explicit public column whitelist and tests/profile_route.mjs proves the private columns (anthropic_email, anthropic_user_id, monthly_budget_usd, system_role, box_blocked*, deactivated_reason) never appear anywhere in the serialized response. The new cross-project read needs its OWN mirror test over the account + rollup projection before it is public — same sentinel-string technique, same 404-on-unknown-id assertion. Never spread a raw row. Spec: ${SPEC} (Constraints §1).`,
+  },
+  {
+    ref: 'P06', kind: 'feature', disc: 'ui', prio: 3, est: 120, crit: ['C1'], deps: ['P02'],
+    title: 'P06 · "Complete your profile" needs-attention inbox line item (dismissible)',
+    desc: `When bio or preferred_disciplines are empty, nudge the builder — as a DISMISSIBLE line item in the needs-attention inbox (goal-inbox.js / #attention-scroll), never a new Home card. That is the hall placement rule (modules/hall-ui/CLAUDE.md → Placement): an action awaiting the builder is an inbox line. This is the replacement for the profile-setup wizard that task 1002783 rejected. Spec: ${SPEC} (Decision 2).`,
+  },
+  {
+    ref: 'P07', kind: 'feature', disc: 'engineer', prio: 3, est: 210, crit: ['C1'], deps: [R02],
+    title: 'P07 · Hub recent works via push — recent_ships[] on the activity rollup',
+    desc: `The hub has no tasks table for other projects, so "recent works" cannot render there today. The existing PULL pattern (modules/platform-identity/project-stats.js) fans out to each project's public API — right for a builder count on a catalog page, wrong per-profile-view, and it cannot serve a CLI-only project at all. Extend the POST /sso/activity/rollup payload (which already carries credits/ships/karma/rank/disciplines per project) with a capped recent_ships[] — 3 per project: title, id, shipped_at, and a link into that instance — plus the instance-side reporter in core auth.js. Reuses a table and a reporter that already exist; costs no fan-out read; stays descriptive-analytics-only. Spec: ${SPEC} (page spec, section 4).`,
+  },
+  {
+    ref: 'P08', kind: 'feature', disc: 'ui', prio: 4, est: 150, crit: ['C1'], deps: ['P01', R05],
+    title: 'P08 · Canonical profile URL wiring (instance rel=canonical → hub; numeric id redirects)',
+    desc: `One canonical public profile, two render paths: the hub's server-rendered handle URL is canonical, and the hall's own profile page stays the LOCAL view and emits rel=canonical to it when the builder has a platform account. The numeric ?id= form never dies — it is stable and rename-proof, so keep it as a permanent fallback that redirects to the canonical handle URL. Coordinate with goal 1000048 R14 (public builder-profile SEO page) so only ONE page gets built. Spec: ${SPEC} (Decision 1).`,
+  },
+  {
+    ref: 'P09', kind: 'feature', disc: 'engineer', prio: 3, est: 150, crit: ['C1'], deps: ['P01', PRIVACY_SPIKE],
+    title: 'P09 · noindex until first ship + sitemap consent gate for builder profiles',
+    desc: `A public, indexable profile that anyone can mint is a backlink-farming surface. Gate indexing on the builder having at least one shipped work, and gate sitemap inclusion on consent (private accounts and — if the owner accepts P03 — provisional accounts are excluded). Coordinates with goal 1000048 R15 (builder profiles in sitemap, consent-gated). Shape depends on the P03 decision. Spec: ${SPEC} (Visibility rules).`,
+  },
+  {
+    ref: 'P10', kind: 'verify', disc: 'engineer', prio: 3, est: 90, crit: ['C2'], deps: [PRIVACY_SPIKE, R03],
+    title: 'P10 · PROOF: a private account\'s profile 404s to a stranger and renders to its owner',
+    desc: `Verify the profile page honours the privacy model: a private account's handle URL returns 404 — NOT 403, because a 403 confirms the handle exists — to everyone except the account itself, which sees its own profile with a "private" banner. Also assert the stats-hidden case renders no partial numbers (a count beside a hidden total is a leak by subtraction). The authoritative model is task ${PRIVACY_SPIKE}'s; if it lands a different rule, this proof follows it and the spec is the thing that is wrong. Spec: ${SPEC} (Visibility rules).`,
+  },
+];
+
+(async () => {
+  const idByRef = {};
+  let created = 0;
+  let existing = 0;
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER,
+      goal_id: GOAL,
+      title: t.title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: t.disc,
+      priority: t.prio,
+      est_minutes: t.est,
+      criterion_ids: t.crit,
+      source: SRC,
+      source_ref: `bv1-profile-page-${t.ref}`,
+    });
+    if (!r.ok) {
+      console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`);
+      continue;
+    }
+    const task = r.data.task || r.data;
+    idByRef[t.ref] = task.id;
+    if (r.data.idempotent || r.data.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    // A dep is either a local ref (resolved from this run) or a literal task id.
+    const depIds = t.deps.map((d) => (typeof d === 'number' ? d : idByRef[d])).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) {
+      console.log(`  ${t.ref}: dep resolve gap, skipping`);
+      continue;
+    }
+    // PUT replaces the full set, so a re-run converges instead of erroring on
+    // an edge that already exists.
+    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) {
+      console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.data)}`);
+      continue;
+    }
+    edges += depIds.length;
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting zero-dep roots to ready…');
+  for (const t of TASKS.filter((x) => x.ready)) {
+    const id = idByRef[t.ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();

package/src/module-api.js

@@ -657,8 +657,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.113 with no explicit bump. run 31816599678. (task 1002620)
 //   1.19.115 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.114 with no explicit bump. run 31825824596. (task 1002620)
+//   1.19.116 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.115 with no explicit bump. run 31827642395. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.115'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.116'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');