@bongos/core 1.19.157 → 1.19.158

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.157",
-  "core_contract": "1.19.157",
-  "source_commit": "73f3bcf9079261bd3c6f3d41b8e9032d462525e6",
+  "core_version": "1.19.158",
+  "core_contract": "1.19.158",
+  "source_commit": "869be86d5fae7b2efd20ec3022caad72ac07894f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T16:17:26.638Z",
+  "built_at": "2026-08-16T16:29:58.341Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1256,
+    "functional_verbatim": 1257,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1581,
-  "tree_sha256": "49f7b05539e31435ee6f43cfd66ebef3dc5955514b0407af26d697b2164c7ad3",
+  "file_count": 1582,
+  "tree_sha256": "93a57750a045530d8d70e167025dec1fd016e18779abe75af330ec33807e0a57",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3777,7 +3777,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "c145e51c02f147b295287b9759d5f44ffc77a533908b151b69d13781d84bc433"
+      "sha256": "3d20563833a9daf20d14745f2ce1c5fe530fc918eac03427185998ff9b67beed"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3812,7 +3812,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "13bd93a19ec0d53642a161a01e4ec2ced6930d96f455c5fcc72fbdc43f72e1ac"
+      "sha256": "727fc8c7533eec1e4af477582bdd6428e9842b930b3cc898bb8a13ddead83ec3"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4187,12 +4187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cf2785db71e62b0236aa4ab290151e45b0e4fb4b4cb073b4f265fdb3d40e317a"
+      "sha256": "97ede86c0b0225546a5e0a73f17c7229d919363a624d023f7a17e99292cdebd9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "642076afa64bef47d5e2cbff117ee0d88ed1bec8b25ac674a15abb6c2e8f503e"
+      "sha256": "dd91875b5af28a006fd00eb8c82a54488a3b28b662853bc3d47dfe898d5b48ac"
     },
     {
       "path": "public-docs/index.html",
@@ -5177,7 +5177,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "4c3bef6907b4807d93426e754ff20c75e56b498e4302c1cd47e4b3953bd8b4d0"
+      "sha256": "5e7030e617e4db066136556a43cf030078b0d042ee480c9b7245eea05ab83776"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5787,7 +5787,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3b77f27b8cd3393fdfaf6d836b2e5cdd9955a4c7a41bbc3bb0e49f8df7882f9e"
+      "sha256": "f07273c75bd8064ab6d83e73c6639b74433c95702a5892783dadcf7682d619bd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7519,6 +7519,11 @@
       "mode": "0000644",
       "sha256": "b499ea62cdc1a615e565ce7b0379b2cab83b9aaa8098361f94d3eb93ebc7f927"
     },
+    {
+      "path": "tests/scouting_rollup_fanout.mjs",
+      "mode": "0000644",
+      "sha256": "1b58003a1fac89b05acfc3287e529a9e17e2b7a6ec48259b5700f6cc837cc554"
+    },
     {
       "path": "tests/scrubber_corpus.mjs",
       "mode": "0000644",

package/modules/platform-identity/platform-identity.js

@@ -423,21 +423,40 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
 // The scouting rollup: one row PER BUILDER, aggregated across every project they
 // build on. Joined to the account for display. Ranked by total credits then ships —
 // a talent signal, NOT an authority. Powers the Archon-only scouting view (#1002114).
+//
+// The scalar aggregates MUST see exactly one row per (builder, project): joining
+// unnest(disciplines) before GROUP BY multiplied every activity row by the number
+// of disciplines on it, inflating project_count and the credits/ships/karma sums
+// (task 1002911). So scalars aggregate in `agg` over the un-fanned table, and the
+// disciplines union is computed separately in `disc`. Proven against real SQL by
+// tests/scouting_rollup_fanout.mjs.
 async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `SELECT a.github_id,
+    `WITH agg AS (
+       SELECT a.github_id,
+              count(*)::int             AS project_count,
+              sum(a.credits)::int       AS total_credits,
+              sum(a.tasks_shipped)::int AS total_tasks_shipped,
+              sum(a.karma)::int         AS total_karma,
+              max(a.last_active)        AS last_active
+         FROM platform_identity_builder_project_activity a
+        GROUP BY a.github_id
+     ), disc AS (
+       SELECT x.github_id, array_agg(DISTINCT x.d) AS disciplines
+         FROM (SELECT a.github_id, unnest(a.disciplines) AS d
+                 FROM platform_identity_builder_project_activity a) x
+        WHERE x.d IS NOT NULL
+        GROUP BY x.github_id
+     )
+     SELECT agg.github_id,
             acc.github_login, acc.display_name, acc.avatar_url,
-            count(*)::int                        AS project_count,
-            sum(a.credits)::int                  AS total_credits,
-            sum(a.tasks_shipped)::int            AS total_tasks_shipped,
-            sum(a.karma)::int                    AS total_karma,
-            max(a.last_active)                   AS last_active,
-            array_agg(DISTINCT d) FILTER (WHERE d IS NOT NULL) AS disciplines
-       FROM platform_identity_builder_project_activity a
-       LEFT JOIN platform_identity_accounts acc ON acc.github_id = a.github_id
-       LEFT JOIN LATERAL unnest(a.disciplines) AS d ON true
-      GROUP BY a.github_id, acc.github_login, acc.display_name, acc.avatar_url
-      ORDER BY total_credits DESC, total_tasks_shipped DESC
+            agg.project_count, agg.total_credits, agg.total_tasks_shipped,
+            agg.total_karma, agg.last_active,
+            disc.disciplines
+       FROM agg
+       LEFT JOIN platform_identity_accounts acc ON acc.github_id = agg.github_id
+       LEFT JOIN disc ON disc.github_id = agg.github_id
+      ORDER BY agg.total_credits DESC, agg.total_tasks_shipped DESC
       LIMIT $1`,
     [limit],
   );

package/modules/platform-identity/tests/platform-identity.mjs

@@ -342,10 +342,27 @@ await ta('listScoutingRollup aggregates per builder across projects, ranked, joi
   assert.match(c.text, /FROM platform_identity_builder_project_activity a/);
   assert.match(c.text, /GROUP BY a\.github_id/);
   assert.match(c.text, /sum\(a\.credits\)/);
-  assert.match(c.text, /ORDER BY total_credits DESC/);
+  assert.match(c.text, /ORDER BY agg\.total_credits DESC, agg\.total_tasks_shipped DESC/);
   assert.deepEqual(c.params, [50]);
 });
 
+await ta('listScoutingRollup scalar aggregation is fan-out-free (task 1002911)', async () => {
+  // The old query LEFT JOIN LATERAL unnest(a.disciplines)'d BEFORE GROUP BY, so
+  // sums/counts multiplied by the discipline count. Structural guard: the agg CTE
+  // (the scalar sums) must contain no unnest/LATERAL; unnest may appear only in
+  // the disc CTE. Real-SQL proof of the semantics: tests/scouting_rollup_fanout.mjs.
+  const pool = mockPool([{ rows: [] }]);
+  await P.listScoutingRollup({ pool, limit: 10 });
+  const sql = pool.calls[0].text;
+  assert.doesNotMatch(sql, /LATERAL/i, 'no lateral join anywhere in the rollup');
+  const aggCte = sql.slice(sql.indexOf('WITH agg AS'), sql.indexOf('disc AS'));
+  assert.match(aggCte, /sum\(a\.credits\)/, 'scalar sums live in the agg CTE');
+  assert.doesNotMatch(aggCte, /unnest/i, 'the scalar-aggregation CTE must not fan rows out');
+  const discCte = sql.slice(sql.indexOf('disc AS'), sql.indexOf('SELECT agg.github_id'));
+  assert.match(discCte, /unnest\(a\.disciplines\)/, 'disciplines union is computed separately');
+  assert.match(discCte, /array_agg\(DISTINCT x\.d\)/, 'disciplines are deduped across projects');
+});
+
 console.log('\nauthorization codes:');
 
 await ta('mintAuthCode stores the HASH of the code (never the plaintext) + binds it', async () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.157",
+  "version": "1.19.158",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.157",
+      "version": "1.19.158",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.157",
+  "version": "1.19.158",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -76,7 +76,7 @@ const INTEGRATION = new Set([
   'claim_gate_open_blocker', 'claim_gate_rebase', 'clawback_confirmed_backlog', 'discord_autojoin', 'discord_oauth',
   'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'reward_mode_cost_plus_only',
-  'session_records', 'setup_smoke',
+  'scouting_rollup_fanout', 'session_records', 'setup_smoke',
   'status-probe',
 ]);
 

package/src/module-api.js

@@ -741,8 +741,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.155 with no explicit bump. run 31957976979. (task 1002620)
 //   1.19.157 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.156 with no explicit bump. run 31958139486. (task 1002620)
+//   1.19.158 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.157 with no explicit bump. run 31958753412. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.157'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.158'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/scouting_rollup_fanout.mjs

@@ -0,0 +1,113 @@
+// tests/scouting_rollup_fanout.mjs — task 1002911 (real DB).
+//
+// listScoutingRollup used to `LEFT JOIN LATERAL unnest(a.disciplines)` BEFORE
+// GROUP BY, multiplying every activity row by max(1, cardinality(disciplines)) —
+// so project_count and the credits/ships/karma sums were inflated for any builder
+// with 2+ disciplines on a project row. The module's own test suite is DB-free
+// and can only regex-match the SQL text; THIS test proves the aggregation
+// semantics against real SQL: it replays the module's actual migrations, seeds a
+// multi-discipline builder across two projects, and asserts exact totals.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; also in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/scouting_rollup_fanout.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`scouting_rollup_fanout.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const MULTI = 90002911, SOLO = 90002912, GHOST = 90002913;
+const ALL_IDS = [MULTI, SOLO, GHOST];
+const CLIENTS = ['t1002911-p1', 't1002911-p2'];
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  // The module's actual migrations (idempotent CREATE TABLE IF NOT EXISTS).
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url)
+     VALUES ($1, 'multi', 'Multi', 'a'), ($2, 'solo', 'Solo', 'b'), ($3, 'ghost', 'Ghost', 'c')`,
+    [MULTI, SOLO, GHOST],
+  );
+  // MULTI: two projects, 2 and 3 disciplines — the exact fan-out shape the old
+  // query inflated (credits would have summed 100*2 + 50*3 = 350, count 5).
+  // SOLO: one project, one discipline (was always correct — must stay correct).
+  // GHOST: one project, NO disciplines (old query kept it via LEFT JOIN + FILTER).
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity
+       (client_id, github_id, credits, tasks_shipped, karma, disciplines, last_active)
+     VALUES ($1, $3, 100, 5, 3, '{engineer,ui}',        '2026-01-01T00:00:00Z'),
+            ($2, $3,  50, 2, 1, '{artist,engineer,ui}', '2026-02-01T00:00:00Z'),
+            ($1, $4,  60, 4, 2, '{engineer}',           '2026-03-01T00:00:00Z'),
+            ($2, $5,  10, 1, 0, '{}',                   '2026-04-01T00:00:00Z')`,
+    [...CLIENTS, MULTI, SOLO, GHOST],
+  );
+
+  const rows = (await pi.listScoutingRollup({ limit: 500, pool })).filter((r) => ALL_IDS.includes(Number(r.github_id)));
+  const by = Object.fromEntries(rows.map((r) => [Number(r.github_id), r]));
+
+  const m = by[MULTI];
+  ok(m, 'multi-discipline builder appears in the rollup');
+  ok(m.project_count === 2, `project_count is 2, not fanned (got ${m.project_count})`);
+  ok(m.total_credits === 150, `total_credits is 100+50=150, not inflated (got ${m.total_credits})`);
+  ok(m.total_tasks_shipped === 7, `total_tasks_shipped is 5+2=7 (got ${m.total_tasks_shipped})`);
+  ok(m.total_karma === 4, `total_karma is 3+1=4 (got ${m.total_karma})`);
+  ok(new Date(m.last_active).toISOString() === '2026-02-01T00:00:00.000Z', 'last_active is the max across projects');
+  assert.deepEqual([...m.disciplines].sort(), ['artist', 'engineer', 'ui']);
+  pass++; console.log('  ok - disciplines are the deduped union across projects');
+  ok(m.github_login === 'multi', 'account display fields join through');
+
+  const s = by[SOLO];
+  ok(s.project_count === 1 && s.total_credits === 60 && s.total_tasks_shipped === 4 && s.total_karma === 2,
+    'single-discipline builder totals are unchanged');
+  assert.deepEqual(s.disciplines, ['engineer']);
+  pass++; console.log('  ok - single discipline survives as a one-element array');
+
+  const g = by[GHOST];
+  ok(g, 'a builder with an empty disciplines array still appears');
+  ok(g.disciplines === null, 'empty disciplines roll up as NULL (matches the old FILTER behavior)');
+  ok(g.project_count === 1 && g.total_credits === 10, 'empty-disciplines totals are correct');
+
+  const fixtureOrder = rows.map((r) => Number(r.github_id));
+  assert.deepEqual(fixtureOrder, [MULTI, SOLO, GHOST]);
+  pass++; console.log('  ok - ranked by total_credits DESC');
+
+  const limited = await pi.listScoutingRollup({ limit: 1, pool });
+  ok(limited.length === 1, 'LIMIT is respected');
+
+  console.log(`\nscouting_rollup_fanout.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}