@bongos/core 1.19.156 → 1.19.158

package/modules/platform-identity/tests/platform-identity.mjs

@@ -342,10 +342,27 @@ await ta('listScoutingRollup aggregates per builder across projects, ranked, joi
   assert.match(c.text, /FROM platform_identity_builder_project_activity a/);
   assert.match(c.text, /GROUP BY a\.github_id/);
   assert.match(c.text, /sum\(a\.credits\)/);
-  assert.match(c.text, /ORDER BY total_credits DESC/);
+  assert.match(c.text, /ORDER BY agg\.total_credits DESC, agg\.total_tasks_shipped DESC/);
   assert.deepEqual(c.params, [50]);
 });
 
+await ta('listScoutingRollup scalar aggregation is fan-out-free (task 1002911)', async () => {
+  // The old query LEFT JOIN LATERAL unnest(a.disciplines)'d BEFORE GROUP BY, so
+  // sums/counts multiplied by the discipline count. Structural guard: the agg CTE
+  // (the scalar sums) must contain no unnest/LATERAL; unnest may appear only in
+  // the disc CTE. Real-SQL proof of the semantics: tests/scouting_rollup_fanout.mjs.
+  const pool = mockPool([{ rows: [] }]);
+  await P.listScoutingRollup({ pool, limit: 10 });
+  const sql = pool.calls[0].text;
+  assert.doesNotMatch(sql, /LATERAL/i, 'no lateral join anywhere in the rollup');
+  const aggCte = sql.slice(sql.indexOf('WITH agg AS'), sql.indexOf('disc AS'));
+  assert.match(aggCte, /sum\(a\.credits\)/, 'scalar sums live in the agg CTE');
+  assert.doesNotMatch(aggCte, /unnest/i, 'the scalar-aggregation CTE must not fan rows out');
+  const discCte = sql.slice(sql.indexOf('disc AS'), sql.indexOf('SELECT agg.github_id'));
+  assert.match(discCte, /unnest\(a\.disciplines\)/, 'disciplines union is computed separately');
+  assert.match(discCte, /array_agg\(DISTINCT x\.d\)/, 'disciplines are deduped across projects');
+});
+
 console.log('\nauthorization codes:');
 
 await ta('mintAuthCode stores the HASH of the code (never the plaintext) + binds it', async () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.156",
+  "version": "1.19.158",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.156",
+      "version": "1.19.158",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.156",
+  "version": "1.19.158",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -76,7 +76,7 @@ const INTEGRATION = new Set([
   'claim_gate_open_blocker', 'claim_gate_rebase', 'clawback_confirmed_backlog', 'discord_autojoin', 'discord_oauth',
   'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'reward_mode_cost_plus_only',
-  'session_records', 'setup_smoke',
+  'scouting_rollup_fanout', 'session_records', 'setup_smoke',
   'status-probe',
 ]);
 

package/src/module-api.js

@@ -739,8 +739,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.154 with no explicit bump. run 31957556550. (task 1002620)
 //   1.19.156 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.155 with no explicit bump. run 31957976979. (task 1002620)
+//   1.19.157 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.156 with no explicit bump. run 31958139486. (task 1002620)
+//   1.19.158 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.157 with no explicit bump. run 31958753412. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.156'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.158'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/scouting_rollup_fanout.mjs

@@ -0,0 +1,113 @@
+// tests/scouting_rollup_fanout.mjs — task 1002911 (real DB).
+//
+// listScoutingRollup used to `LEFT JOIN LATERAL unnest(a.disciplines)` BEFORE
+// GROUP BY, multiplying every activity row by max(1, cardinality(disciplines)) —
+// so project_count and the credits/ships/karma sums were inflated for any builder
+// with 2+ disciplines on a project row. The module's own test suite is DB-free
+// and can only regex-match the SQL text; THIS test proves the aggregation
+// semantics against real SQL: it replays the module's actual migrations, seeds a
+// multi-discipline builder across two projects, and asserts exact totals.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; also in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/scouting_rollup_fanout.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`scouting_rollup_fanout.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const MULTI = 90002911, SOLO = 90002912, GHOST = 90002913;
+const ALL_IDS = [MULTI, SOLO, GHOST];
+const CLIENTS = ['t1002911-p1', 't1002911-p2'];
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  // The module's actual migrations (idempotent CREATE TABLE IF NOT EXISTS).
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url)
+     VALUES ($1, 'multi', 'Multi', 'a'), ($2, 'solo', 'Solo', 'b'), ($3, 'ghost', 'Ghost', 'c')`,
+    [MULTI, SOLO, GHOST],
+  );
+  // MULTI: two projects, 2 and 3 disciplines — the exact fan-out shape the old
+  // query inflated (credits would have summed 100*2 + 50*3 = 350, count 5).
+  // SOLO: one project, one discipline (was always correct — must stay correct).
+  // GHOST: one project, NO disciplines (old query kept it via LEFT JOIN + FILTER).
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity
+       (client_id, github_id, credits, tasks_shipped, karma, disciplines, last_active)
+     VALUES ($1, $3, 100, 5, 3, '{engineer,ui}',        '2026-01-01T00:00:00Z'),
+            ($2, $3,  50, 2, 1, '{artist,engineer,ui}', '2026-02-01T00:00:00Z'),
+            ($1, $4,  60, 4, 2, '{engineer}',           '2026-03-01T00:00:00Z'),
+            ($2, $5,  10, 1, 0, '{}',                   '2026-04-01T00:00:00Z')`,
+    [...CLIENTS, MULTI, SOLO, GHOST],
+  );
+
+  const rows = (await pi.listScoutingRollup({ limit: 500, pool })).filter((r) => ALL_IDS.includes(Number(r.github_id)));
+  const by = Object.fromEntries(rows.map((r) => [Number(r.github_id), r]));
+
+  const m = by[MULTI];
+  ok(m, 'multi-discipline builder appears in the rollup');
+  ok(m.project_count === 2, `project_count is 2, not fanned (got ${m.project_count})`);
+  ok(m.total_credits === 150, `total_credits is 100+50=150, not inflated (got ${m.total_credits})`);
+  ok(m.total_tasks_shipped === 7, `total_tasks_shipped is 5+2=7 (got ${m.total_tasks_shipped})`);
+  ok(m.total_karma === 4, `total_karma is 3+1=4 (got ${m.total_karma})`);
+  ok(new Date(m.last_active).toISOString() === '2026-02-01T00:00:00.000Z', 'last_active is the max across projects');
+  assert.deepEqual([...m.disciplines].sort(), ['artist', 'engineer', 'ui']);
+  pass++; console.log('  ok - disciplines are the deduped union across projects');
+  ok(m.github_login === 'multi', 'account display fields join through');
+
+  const s = by[SOLO];
+  ok(s.project_count === 1 && s.total_credits === 60 && s.total_tasks_shipped === 4 && s.total_karma === 2,
+    'single-discipline builder totals are unchanged');
+  assert.deepEqual(s.disciplines, ['engineer']);
+  pass++; console.log('  ok - single discipline survives as a one-element array');
+
+  const g = by[GHOST];
+  ok(g, 'a builder with an empty disciplines array still appears');
+  ok(g.disciplines === null, 'empty disciplines roll up as NULL (matches the old FILTER behavior)');
+  ok(g.project_count === 1 && g.total_credits === 10, 'empty-disciplines totals are correct');
+
+  const fixtureOrder = rows.map((r) => Number(r.github_id));
+  assert.deepEqual(fixtureOrder, [MULTI, SOLO, GHOST]);
+  pass++; console.log('  ok - ranked by total_credits DESC');
+
+  const limited = await pi.listScoutingRollup({ limit: 1, pool });
+  ok(limited.length === 1, 'LIMIT is respected');
+
+  console.log(`\nscouting_rollup_fanout.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}