@bongos/core 1.19.167 → 1.19.169

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.167",
-  "core_contract": "1.19.167",
-  "source_commit": "35e223942ac5cbbccc7300e2db6175343b2f300a",
+  "core_version": "1.19.169",
+  "core_contract": "1.19.169",
+  "source_commit": "21b29b58735b3e1407e5a32314e6e163928aa766",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T17:31:19.570Z",
+  "built_at": "2026-08-16T18:29:19.872Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1265,
+    "functional_verbatim": 1267,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1591,
-  "tree_sha256": "b033aa8ae702d08b637604677eefba0fb49124560898516f90f6fbbe751ce09a",
+  "file_count": 1593,
+  "tree_sha256": "8457440205714a5e435a88d3ec027ba850403a9e1a079d9b42280393f7d287d5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4245c4fb82c1c4f5c87788030dc4640987fe22e0d588072d4549e9982cea7ecc"
+      "sha256": "afbaacddff0e422658021543825155933c49527b78f6e2693a23a62cfe97fe83"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1352,7 +1352,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "9382373e7be837c0ce4e26f23c3cd32bf20ab09858650bdee318dd90a06dedbe"
+      "sha256": "2da0e769d0f7f1af2ea503104a66f254cbc925dc1266908f4aeb6b933406cf18"
     },
     {
       "path": "docs/architecture.md",
@@ -3784,6 +3784,11 @@
       "mode": "0000644",
       "sha256": "4885d452673c2d6170835c8d7f03c101847ddb313a69dfb66c8e640f875ecdc1"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_007_profile_consent.sql",
+      "mode": "0000644",
+      "sha256": "cce2f971f030aa628f9d7855f2e421595ea71cb314e90965206dbe970b7beded"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -3792,7 +3797,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "3d20563833a9daf20d14745f2ce1c5fe530fc918eac03427185998ff9b67beed"
+      "sha256": "cf354fb34732141cb9a0774d11f1b344a3bc15e90814a80496a2024c941fcb77"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3817,17 +3822,17 @@
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
-      "sha256": "c6db7fa003caaf55d2ecb68f1ff73d7d89d8b71b6d999ed3ebf71286e8726359"
+      "sha256": "886c9d98c94e84d2e51e21d5e716caafe757edbb49073d7dc096221b339ffd27"
     },
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "1a3b19e793387c8410062cb2d53f981eb108ff72c31e09741bcc7c8622ca2b80"
+      "sha256": "45c8a071f8bf61bd97bce83518fe3bd1b32cff99f31281c2cba84ad500359d60"
     },
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "727fc8c7533eec1e4af477582bdd6428e9842b930b3cc898bb8a13ddead83ec3"
+      "sha256": "bff11d1f5ed3cadeccdb22c2754649ba281f43462fe4732d40f3ef011fe51af2"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4202,12 +4207,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "91c78ba67f8cece0ac27f0dd7ae8cd927e3d4e041eeb41d7de1ddb9897331554"
+      "sha256": "5a6c2bc1f2f6522a312cf2d980ff8fad527711139b2c8c0e5d4a32df9f91e697"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c1fd91411d3a575ba33f6632a8820320389a490c4678e9a238c288008f8d03b5"
+      "sha256": "e29a81671e4d241ceca9cdcc9ebb0a94d5c0012b216c4a2b66fd54c934e1ed8c"
     },
     {
       "path": "public-docs/index.html",
@@ -5192,7 +5197,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "5e7030e617e4db066136556a43cf030078b0d042ee480c9b7245eea05ab83776"
+      "sha256": "21bcaeaa9d8b2048b9c3f9ff9b251a9203a9259c991a536636c0ec3c8745bbd5"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5572,7 +5577,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "a8215fa2659638d5850acb787eb3b193b18b545bc7e86f801764cab328b0c837"
+      "sha256": "04cddf3c307c2f3bf22b8b29140973b80b549a04f1ba90be38ed7f1a794352ad"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5712,7 +5717,7 @@
     {
       "path": "src/bongos/routes/builders.js",
       "mode": "0000644",
-      "sha256": "43a409918ba54af69d0c7183af510ff9d73b26566a1a520ad97d84360abcc79b"
+      "sha256": "9423af249991f4d40e03ffa8d73a3584279f9d1095115c420047a735103bb417"
     },
     {
       "path": "src/bongos/routes/github.js",
@@ -5812,7 +5817,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4bd1d6d5c41a01b6338a148203a8a289864cee0dd7e3d2a4f5de15dd90c0443e"
+      "sha256": "723ed0f74974f36f8db1ae45eabf0a51679b6f6892f0b26e6275d99d9ace0f62"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7369,10 +7374,15 @@
       "mode": "0000644",
       "sha256": "3c85d28ecc55e375988f3e55aee993c8c84220889678262d8207146c2772f3f5"
     },
+    {
+      "path": "tests/profile_rollup_consent.mjs",
+      "mode": "0000644",
+      "sha256": "4db6fc34b52ed55c1e21bc3c8b7d9a63ef08f13571283a06393662d6e1468d40"
+    },
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "dc354f082204073409aea90df9b91f149d474c6930b761ed5c9928bb76e1358f"
+      "sha256": "3b3045a6143d67c963516ed5703b5dabb9b8945a392118721e6a0a56258f1732"
     },
     {
       "path": "tests/project_stats.mjs",
@@ -7567,7 +7577,7 @@
     {
       "path": "tests/scouting_rollup_fanout.mjs",
       "mode": "0000644",
-      "sha256": "1b58003a1fac89b05acfc3287e529a9e17e2b7a6ec48259b5700f6cc837cc554"
+      "sha256": "3451cb25abd4eb819a7b951d1e06310d575faf6145808711fcdd2e2afb655ec3"
     },
     {
       "path": "tests/scrubber_corpus.mjs",

package/clients/bongos-client/index.d.ts

@@ -30,7 +30,7 @@ export interface GetBoxesResponse { boxes: unknown }
 export interface GetBuildersDirectoryResponse { builders: unknown }
 export interface GetBuildersIdActiveClaimsResponse { builder_id: unknown; claims: unknown; stale_hours: unknown }
 export interface GetBuildersIdOnboardingResponse { builder_id: unknown; onboarding: unknown }
-export interface GetBuildersIdProfileResponse { builder: unknown; shipped_count: unknown; recent_ships: unknown; achievements: unknown }
+export interface GetBuildersIdProfileResponse { builder: unknown; shipped_count: unknown; recent_ships: unknown; achievements: unknown; cross_project?: unknown }
 export interface GetBuildersMePendingRankChangeResponse { change: unknown; greeting?: unknown }
 export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unknown }
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }

package/docs/api/openapi.json

@@ -12617,7 +12617,8 @@
           "builder": {},
           "shipped_count": {},
           "recent_ships": {},
-          "achievements": {}
+          "achievements": {},
+          "cross_project": {}
         },
         "required": [
           "builder",

package/modules/platform-identity/migrations/platform_identity_007_profile_consent.sql

@@ -0,0 +1,32 @@
+-- platform_identity_007_profile_consent.sql — profile consent state + the C2
+-- hide flag (ADR 0171 D3/D4, task 1002278 / goal 1000045).
+--
+-- profile_state is FAIL-CLOSED consent: an account is 'active' iff a human was
+-- demonstrably at the hub — the one path that proves it is a hub-session
+-- /sso/authorize (where T&C acceptance can later be captured, task 1002913).
+-- Device-poll and membership check-in create 'provisional' accounts; the
+-- activity-rollup endpoint creates no account at all. Public surfaces (the
+-- profile port, /people, /scouting) read only 'active' accounts.
+--
+-- Deliberately NO backfill joining core `builders`: that join is type-unsafe
+-- ('system:bfg'-style text ids vs bigint) and would put a core-table read inside
+-- a module migration (ADR 0083 boundary). All existing accounts start
+-- 'provisional' and lazily upgrade on their next hub-session authorize.
+--
+-- hide_stats is the account-global C2 opt-out — enforced in the module's read
+-- functions (ADR 0171 D2/D4), written by an own-scoped PATCH (task 1002279, R03).
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_accounts
+  ADD COLUMN IF NOT EXISTS profile_state text NOT NULL DEFAULT 'provisional'
+    CHECK (profile_state IN ('provisional', 'active')),
+  ADD COLUMN IF NOT EXISTS hide_stats boolean NOT NULL DEFAULT false;
+
+-- The public-surface predicate (profile_state = 'active' AND NOT hide_stats)
+-- filters per-builder; accounts are looked up by github_id (already indexed via
+-- the UNIQUE constraint), so no new index is needed.
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -101,17 +101,24 @@ function redirectUriAllowed(client, redirectUri) {
 
 // Upsert the platform account for a GitHub identity (keyed on the stable
 // github_id). Called at /sso/authorize for the signed-in hub user. Identity only.
-async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl }, { pool = defaultPool } = {}) {
+//
+// `activate` is the ONE consent upgrade path (ADR 0171 D3): an account becomes
+// profile_state='active' iff touched by a hub-session /sso/authorize — the path
+// where a human is demonstrably at the hub. Every other caller (device-poll,
+// membership check-in) leaves the fail-closed 'provisional' default; activation
+// is one-way (a later non-activating upsert never demotes an active account).
+async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url)
-     VALUES ($1, $2, $3, $4)
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
+     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END)
      ON CONFLICT (github_id) DO UPDATE SET
        github_login = EXCLUDED.github_login,
        display_name = EXCLUDED.display_name,
        avatar_url   = EXCLUDED.avatar_url,
+       profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END,
        updated_at   = now()
-     RETURNING id, github_id, github_login, display_name, avatar_url`,
-    [githubId, githubLogin, displayName ?? null, avatarUrl ?? null],
+     RETURNING id, github_id, github_login, display_name, avatar_url, profile_state`,
+    [githubId, githubLogin, displayName ?? null, avatarUrl ?? null, !!activate],
   );
   return rows[0];
 }
@@ -131,7 +138,7 @@ async function getAccountByLogin(githubLogin, { pool = defaultPool } = {}) {
 
 async function getAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `SELECT id, github_id, github_login, display_name, avatar_url, created_at, updated_at
+    `SELECT id, github_id, github_login, display_name, avatar_url, profile_state, hide_stats, created_at, updated_at
        FROM platform_identity_accounts WHERE github_id = $1`,
     [githubId],
   );
@@ -306,6 +313,19 @@ async function upsertMembership({ clientId, githubId, role = 'builder' }, { pool
   return rows[0];
 }
 
+// One membership row for (project, builder), any role — or null. Backs the
+// activity-rollup membership requirement (ADR 0171 D7): a client may only report
+// activity for a builder who actually has a membership on that project.
+async function getMembership(clientId, githubId, { pool = defaultPool } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, client_id, github_id, role, joined_at, last_active
+       FROM platform_identity_project_memberships
+      WHERE client_id = $1 AND github_id = $2`,
+    [clientId, githubId],
+  );
+  return rows[0] || null;
+}
+
 // All memberships for one account, newest-active first, joined to the project's
 // display fields (name/origin from sso_clients). Powers "My Projects" (task #1002112).
 async function listMembershipsForAccount(githubId, { pool = defaultPool } = {}) {
@@ -402,10 +422,23 @@ async function setClientStatus(clientId, status, { pool = defaultPool } = {}) {
 // Cross-project builder activity (the scouting data plane — ADR 0141 §4)
 // -------------------------------------------------------------------------
 
+// Rollup payload caps (ADR 0171 D7): the reported rank/disciplines are third-party
+// self-report headed for a public portfolio, so they are validated HERE, next to
+// the data, where no caller can forget. Rank must be one of the four core rank
+// keys (else stored null — a label is never invented); disciplines are string
+// elements only, bounded in count and length.
+const MAX_ROLLUP_DISCIPLINES = 8;
+const MAX_DISCIPLINE_LENGTH = 32;
+
 // Upsert one project's rollup for one builder (keyed by client_id + github_id).
 // Descriptive analytics — never authority. Refreshes last_active on each report.
 async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [] }, { pool = defaultPool } = {}) {
-  const disc = Array.isArray(disciplines) ? disciplines : [];
+  // api.LIVE_RANK_LADDER is a published doorway export (src/module-api.js, a
+  // lazy getter over db-kernel's canonical four-rank ladder).
+  const safeRank = api.LIVE_RANK_LADDER.includes(rank) ? rank : null;
+  const disc = (Array.isArray(disciplines) ? disciplines : [])
+    .filter((d) => typeof d === 'string' && d.length > 0 && d.length <= MAX_DISCIPLINE_LENGTH)
+    .slice(0, MAX_ROLLUP_DISCIPLINES);
   const { rows } = await pool.query(
     `INSERT INTO platform_identity_builder_project_activity
        (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active, updated_at)
@@ -415,7 +448,7 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
        rank_held = EXCLUDED.rank_held, disciplines = EXCLUDED.disciplines,
        last_active = now(), updated_at = now()
      RETURNING id, client_id, github_id`,
-    [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, rank, disc],
+    [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc],
   );
   return rows[0];
 }
@@ -430,6 +463,12 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
 // (task 1002911). So scalars aggregate in `agg` over the un-fanned table, and the
 // disciplines union is computed separately in `disc`. Proven against real SQL by
 // tests/scouting_rollup_fanout.mjs.
+//
+// Consent by construction (ADR 0171 D2/D3): only builders whose account is
+// profile_state='active' AND NOT hide_stats appear — /people and /scouting are
+// live cross-project surfaces, so the predicate lives IN the query, not in any
+// caller's memory. Provisional (no hub-session consent) and hidden builders drop
+// out entirely; the projection stays an explicit whitelist (no raw-row spread).
 async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `WITH agg AS (
@@ -440,6 +479,11 @@ async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
               sum(a.karma)::int         AS total_karma,
               max(a.last_active)        AS last_active
          FROM platform_identity_builder_project_activity a
+        WHERE EXISTS (
+                SELECT 1 FROM platform_identity_accounts pa
+                 WHERE pa.github_id = a.github_id
+                   AND pa.profile_state = 'active'
+                   AND NOT pa.hide_stats)
         GROUP BY a.github_id
      ), disc AS (
        SELECT x.github_id, array_agg(DISTINCT x.d) AS disciplines
@@ -463,6 +507,100 @@ async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
   return rows;
 }
 
+// Is this a value we can safely bind against the bigint github_id column?
+// Core builders include 'system:bfg'-style TEXT principals; binding one would
+// throw a bigint cast error mid-request, so every profile read guards here and
+// returns null instead (ADR 0171 D2).
+function isNumericGithubId(githubId) {
+  return /^\d+$/.test(String(githubId ?? ''));
+}
+
+// One builder's cross-project record (ADR 0171 D2/D6/D7, task 1002278) — the
+// whitelist-shaped aggregate the profile surfaces render. Aggregation mirrors
+// listScoutingRollup's corrected shape: scalars over the UN-FANNED activity
+// table, the disciplines union computed separately (never a pre-GROUP-BY unnest
+// fan-out — bug task 1002911). Per-project rows join the module-internal
+// client_id → sso_clients.origin → projects.origin two-hop; a project is NAMED
+// only when its catalog row is publicly listed today (featured + active — the
+// exact set listFeaturedProjects publishes; goal 1000046's visibility states
+// will widen this predicate when they land). Everything else is counted in
+// more_projects, never named ("the aggregate is not the leak, the name is").
+// client_id never appears in the returned shape.
+async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return null;
+  const { rows: aggRows } = await pool.query(
+    `WITH agg AS (
+       SELECT count(*)::int                        AS projects,
+              COALESCE(sum(a.credits), 0)::int       AS credits,
+              COALESCE(sum(a.tasks_shipped), 0)::int AS works_shipped,
+              COALESCE(sum(a.karma), 0)::int         AS karma,
+              max(a.last_active)                     AS last_active
+         FROM platform_identity_builder_project_activity a
+        WHERE a.github_id = $1
+     ), disc AS (
+       SELECT array_agg(DISTINCT x.d) AS disciplines
+         FROM (SELECT unnest(a.disciplines) AS d
+                 FROM platform_identity_builder_project_activity a
+                WHERE a.github_id = $1) x
+        WHERE x.d IS NOT NULL
+     )
+     SELECT agg.projects, agg.credits, agg.works_shipped, agg.karma,
+            agg.last_active, disc.disciplines
+       FROM agg LEFT JOIN disc ON true`,
+    [githubId],
+  );
+  const agg = aggRows[0];
+  const { rows: projRows } = await pool.query(
+    `SELECT p.name, p.origin, a.rank_held,
+            (p.id IS NOT NULL AND p.featured AND p.status = 'active') AS is_public
+       FROM platform_identity_builder_project_activity a
+       LEFT JOIN platform_identity_sso_clients c ON c.client_id = a.client_id
+       LEFT JOIN platform_identity_projects p ON p.origin = c.origin
+      WHERE a.github_id = $1
+      ORDER BY a.last_active DESC`,
+    [githubId],
+  );
+  const named = projRows
+    .filter((r) => r.is_public)
+    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held }));
+  return {
+    totals: {
+      projects: agg.projects,
+      credits: agg.credits,
+      works_shipped: agg.works_shipped,
+      karma: agg.karma,
+    },
+    disciplines: agg.disciplines || [],
+    last_active: agg.last_active,
+    projects: named,
+    more_projects: projRows.length - named.length,
+  };
+}
+
+// The PUBLIC read behind the 'platform-identity.hub' port (ADR 0171 D1/D2):
+// null unless the account exists, consented (profile_state='active') and is not
+// hidden (hide_stats) — the fail-closed rule every public surface inherits by
+// construction. A null is deliberately indistinguishable between "no account",
+// "provisional" and "hidden" (no partial numbers; a count plus a hidden total is
+// a leak by subtraction).
+async function getPublicProfileExtras(githubId, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return null;
+  const { rows } = await pool.query(
+    `SELECT profile_state, hide_stats FROM platform_identity_accounts WHERE github_id = $1`,
+    [githubId],
+  );
+  const acct = rows[0];
+  if (!acct || acct.profile_state !== 'active' || acct.hide_stats) return null;
+  return getRollupForBuilder(githubId, { pool });
+}
+
+// The SELF read (ADR 0171 D2's first narrow side door): a builder inspects their
+// own numbers in Settings regardless of profile_state/hide_stats. Callers MUST
+// key this by the authenticated session's github_id, never a caller-named one.
+async function getOwnProfileExtras(githubId, { pool = defaultPool } = {}) {
+  return getRollupForBuilder(githubId, { pool });
+}
+
 // -------------------------------------------------------------------------
 // Authorization codes (single-use, short-lived, bound)
 // -------------------------------------------------------------------------
@@ -548,15 +686,20 @@ module.exports = {
   // memberships
   MEMBERSHIP_ROLES,
   upsertMembership,
+  getMembership,
   listMembershipsForAccount,
   removeMembership,
   // invitations
   inviteToProject,
   listPendingInvitesForAccount,
   resolveInvite,
-  // cross-project activity + scouting
+  // cross-project activity + scouting + profile rollup
   upsertActivity,
   listScoutingRollup,
+  isNumericGithubId,
+  getRollupForBuilder,
+  getPublicProfileExtras,
+  getOwnProfileExtras,
   // codes
   mintAuthCode,
   redeemAuthCode,

package/modules/platform-identity/routes/scouting.js

@@ -1,9 +1,10 @@
-// modules/platform-identity/routes/scouting.js — the INTERNAL, Archon-only
-// cross-project scouting view (ADR 0141 §4, task #1002114). Ranks builders across
-// ALL hosted projects from platform_identity_builder_project_activity. It is a
-// talent tool for the platform operator — NOT shown to builders, and NOT authority
-// (the rollup is descriptive; authority stays local, ADR 0141 / ADR 0016). Consent
-// for cross-project aggregation is handled by the platform T&C (out of scope here).
+// modules/platform-identity/routes/scouting.js — the INTERNAL cross-project
+// scouting view (ADR 0141 §4, task #1002114; Metic floor per ADR 0157). Ranks
+// builders across ALL hosted projects from platform_identity_builder_project_activity.
+// A talent tool for the platform operator — NOT authority (the rollup is
+// descriptive; authority stays local, ADR 0141 / ADR 0016). Consent is enforced
+// IN listScoutingRollup itself (ADR 0171 D2/D3): only profile_state='active',
+// non-hidden builders appear, so this surface honors hide by construction.
 //
 // Reaches core only through the doorway (ADR 0083).
 'use strict';

package/modules/platform-identity/routes/sso.js

@@ -94,7 +94,26 @@ async function fanOutBackchannelLogout(githubId) {
   }
 }
 
+// Register the `platform-identity.hub` kernel PORT (ADR 0171 D1/D2) — the
+// declared-but-previously-unwired port from module.json `provides`. The core
+// profile route (src/bongos/routes/builders.js) resolves it beside 'reward' to
+// attach the cross_project section; on any instance without this module the
+// resolve returns null and the section is absent (degrade, don't 500). Shapes
+// are whitelisted INSIDE the module (client_id never crosses the port).
+// Registered from the route factory (the one boot hook that runs both live AND
+// when a test rebuilds the GDS router), hasProvider-guarded so re-instantiation
+// never trips the single-provider guard — the builder-settings pattern.
+function registerSeams() {
+  if (!api.hasProvider('platform-identity.hub')) {
+    api.registerProvider('platform-identity.hub', {
+      getPublicProfileExtras: (githubId) => pi.getPublicProfileExtras(githubId, { pool }),
+      getOwnProfileExtras: (githubId) => pi.getOwnProfileExtras(githubId, { pool }),
+    });
+  }
+}
+
 module.exports = function ssoRoutes() {
+  registerSeams();
   const router = express.Router();
 
   // Wire the federated single-logout fan-out to core's `builder.logout` event,
@@ -170,12 +189,16 @@ module.exports = function ssoRoutes() {
 
     // A live hub session — record/refresh the platform account and mint a
     // single-use code bound to (client_id, github_id, redirect_uri).
+    // `activate: true` — this is THE consent upgrade path (ADR 0171 D3): a
+    // hub-session authorize is the one place a human is demonstrably at the hub,
+    // so the account's profile_state lazily flips provisional → active here.
     try {
       await pi.upsertAccount({
         githubId: session.github_id,
         githubLogin: session.github_login,
         displayName: session.display_name,
         avatarUrl: session.avatar_url,
+        activate: true,
       }, { pool });
       const code = await pi.mintAuthCode({
         clientId,
@@ -382,6 +405,21 @@ module.exports = function ssoRoutes() {
       if (!client || client.status !== 'active' || !pi.clientSecretValid(client, b.client_secret)) {
         return res.fail('invalid_client', 401);
       }
+      // Impersonation hardening (ADR 0171 D7) — this data now feeds a PUBLIC
+      // portfolio, so a client may only report activity for a builder who
+      // actually holds a membership on that project. Non-numeric github_id is
+      // rejected before it can hit the bigint column; a 'pending' row is an
+      // invite pre-seed, not a membership (listMembershipsForAccount excludes
+      // it), so it does not satisfy the requirement. The instance sequences its
+      // check-in BEFORE this rollup (src/bongos/auth.js), so the legit first
+      // sign-in always has its membership row by the time this arrives.
+      if (!pi.isNumericGithubId(b.github_id)) {
+        return res.fail('invalid_github_id', 400);
+      }
+      const membership = await pi.getMembership(b.client_id, b.github_id, { pool });
+      if (!membership || membership.role === 'pending') {
+        return res.fail('membership_required', 409);
+      }
       await pi.upsertActivity({
         clientId: b.client_id,
         githubId: b.github_id,

package/modules/platform-identity/tests/platform-identity.mjs

@@ -128,8 +128,8 @@ t('a service principal (system_role set) may NOT federate', () => {
 
 console.log('\naccounts:');
 
-await ta('upsertAccount upserts on github_id and returns the row', async () => {
-  const row = { id: '1', github_id: '42', github_login: 'octocat', display_name: 'Octo', avatar_url: 'a' };
+await ta('upsertAccount upserts on github_id and returns the row (default: NOT activating)', async () => {
+  const row = { id: '1', github_id: '42', github_login: 'octocat', display_name: 'Octo', avatar_url: 'a', profile_state: 'provisional' };
   const pool = mockPool([{ rows: [row] }]);
   const out = await P.upsertAccount(
     { githubId: 42, githubLogin: 'octocat', displayName: 'Octo', avatarUrl: 'a' }, { pool });
@@ -137,7 +137,20 @@ await ta('upsertAccount upserts on github_id and returns the row', async () => {
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_accounts/);
   assert.match(c.text, /ON CONFLICT \(github_id\) DO UPDATE/);
-  assert.deepEqual(c.params, [42, 'octocat', 'Octo', 'a']);
+  assert.deepEqual(c.params, [42, 'octocat', 'Octo', 'a', false]);
+});
+
+await ta('upsertAccount consent upgrade is one-way (ADR 0171 D3): activate flips to active, default preserves the stored state', async () => {
+  const pool = mockPool([{ rows: [{ id: '1' }] }, { rows: [{ id: '1' }] }]);
+  await P.upsertAccount({ githubId: 42, githubLogin: 'octocat', activate: true }, { pool });
+  await P.upsertAccount({ githubId: 42, githubLogin: 'octocat' }, { pool });
+  const sql = pool.calls[0].text;
+  // INSERT: activate decides active vs the fail-closed provisional default.
+  assert.match(sql, /CASE WHEN \$5::boolean THEN 'active' ELSE 'provisional' END/);
+  // UPDATE: a non-activating upsert must KEEP the stored profile_state (never demote).
+  assert.match(sql, /CASE WHEN \$5::boolean THEN 'active' ELSE platform_identity_accounts\.profile_state END/);
+  assert.equal(pool.calls[0].params[4], true, 'activate:true passes true');
+  assert.equal(pool.calls[1].params[4], false, 'default passes false');
 });
 
 console.log('\nSSO client registry:');
@@ -334,6 +347,44 @@ await ta('upsertActivity upserts per (client_id, github_id) with the talent snap
   assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer']]);
 });
 
+await ta('upsertActivity sanitizes third-party self-report (ADR 0171 D7): off-ladder rank → null, disciplines validated + capped', async () => {
+  const pool = mockPool([{ rows: [{ id: '1' }] }]);
+  await P.upsertActivity({
+    clientId: 'c1', githubId: 42,
+    rank: 'Supreme Overlord', // not one of the four core rank keys → stored null
+    disciplines: [
+      'engineer', 42, null, { evil: true }, // non-strings dropped
+      'x'.repeat(33),                        // over-length dropped
+      'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', // valid tail — capped to 8 total
+    ],
+  }, { pool });
+  const c = pool.calls[0];
+  assert.equal(c.params[5], null, 'an invented rank label is never stored');
+  const disc = c.params[6];
+  assert.ok(disc.length <= 8, `disciplines capped at 8 (got ${disc.length})`);
+  assert.ok(disc.every((d) => typeof d === 'string' && d.length > 0 && d.length <= 32),
+    'only bounded string elements survive');
+  assert.equal(disc[0], 'engineer', 'valid elements pass through in order');
+});
+
+await ta('upsertActivity keeps a legitimate core rank key', async () => {
+  const pool = mockPool([{ rows: [{ id: '1' }] }]);
+  await P.upsertActivity({ clientId: 'c1', githubId: 42, rank: 'archon', disciplines: [] }, { pool });
+  assert.equal(pool.calls[0].params[5], 'archon');
+});
+
+await ta('getMembership reads one (client, builder) row — the rollup membership requirement', async () => {
+  const row = { id: '9', client_id: 'c1', github_id: '42', role: 'builder' };
+  const pool = mockPool([{ rows: [row] }]);
+  const out = await P.getMembership('c1', 42, { pool });
+  assert.deepEqual(out, row);
+  const c = pool.calls[0];
+  assert.match(c.text, /FROM platform_identity_project_memberships/);
+  assert.deepEqual(c.params, ['c1', 42]);
+  const miss = await P.getMembership('c1', 43, { pool });
+  assert.equal(miss, null);
+});
+
 await ta('listScoutingRollup aggregates per builder across projects, ranked, joined to accounts', async () => {
   const pool = mockPool([{ rows: [{ github_id: '42', github_login: 'octo', total_credits: 250, project_count: 2 }] }]);
   const out = await P.listScoutingRollup({ pool, limit: 50 });
@@ -363,6 +414,89 @@ await ta('listScoutingRollup scalar aggregation is fan-out-free (task 1002911)',
   assert.match(discCte, /array_agg\(DISTINCT x\.d\)/, 'disciplines are deduped across projects');
 });
 
+await ta('listScoutingRollup enforces consent IN the query (ADR 0171 D2/D3)', async () => {
+  // /people and /scouting must honor hide BY CONSTRUCTION: the predicate lives
+  // in the scalar-aggregation CTE, not in any caller. Semantics proven against
+  // real SQL by tests/profile_rollup_consent.mjs.
+  const pool = mockPool([{ rows: [] }]);
+  await P.listScoutingRollup({ pool, limit: 10 });
+  const aggCte = pool.calls[0].text.slice(0, pool.calls[0].text.indexOf('disc AS'));
+  assert.match(aggCte, /profile_state = 'active'/, 'provisional accounts drop out');
+  assert.match(aggCte, /NOT pa\.hide_stats/, 'hidden builders drop out');
+});
+
+console.log('\nprofile rollup port (ADR 0171, task 1002278):');
+
+await ta('getRollupForBuilder guards non-numeric github_id BEFORE any query (no bigint cast error)', async () => {
+  const pool = mockPool([]);
+  for (const bad of ['system:bfg', 'system:grader', '', null, undefined, '42abc']) {
+    assert.equal(await P.getRollupForBuilder(bad, { pool }), null, `"${bad}" → null`);
+  }
+  assert.equal(pool.calls.length, 0, 'no query is ever issued for a non-numeric id');
+});
+
+await ta('getRollupForBuilder aggregates un-fanned + names only publicly-catalogued projects', async () => {
+  const pool = mockPool([
+    { rows: [{ projects: 2, credits: 150, works_shipped: 7, karma: 4, last_active: 'T', disciplines: ['engineer', 'ui'] }] },
+    { rows: [
+      { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic', is_public: true },
+      { name: 'Secret Proj', origin: 'https://sec.example', rank_held: 'archon', is_public: false },
+    ] },
+  ]);
+  const out = await P.getRollupForBuilder(42, { pool });
+  assert.deepEqual(out.totals, { projects: 2, credits: 150, works_shipped: 7, karma: 4 });
+  assert.deepEqual(out.disciplines, ['engineer', 'ui']);
+  assert.equal(out.projects.length, 1, 'only the public catalog row is named');
+  assert.deepEqual(out.projects[0], { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic' });
+  assert.equal(out.more_projects, 1, 'the non-public project is counted, never named');
+  // The whitelist holds structurally: client_id never appears in the shape.
+  assert.ok(!JSON.stringify(out).includes('client_id'), 'client_id must not cross the port');
+  // The scalar aggregation must be un-fanned (the 1002911 rule), disciplines separate.
+  const aggSql = pool.calls[0].text;
+  const aggCte = aggSql.slice(aggSql.indexOf('WITH agg AS'), aggSql.indexOf('disc AS'));
+  assert.doesNotMatch(aggCte, /unnest/i, 'scalar CTE must not fan rows out');
+  assert.match(aggSql.slice(aggSql.indexOf('disc AS')), /array_agg\(DISTINCT x\.d\)/);
+});
+
+await ta('getPublicProfileExtras is fail-closed: null for missing / provisional / hidden accounts', async () => {
+  // No account row at all.
+  assert.equal(await P.getPublicProfileExtras(42, { pool: mockPool([{ rows: [] }]) }), null);
+  // Provisional (no hub-session consent yet).
+  assert.equal(await P.getPublicProfileExtras(42, {
+    pool: mockPool([{ rows: [{ profile_state: 'provisional', hide_stats: false }] }]) }), null);
+  // Active but hidden.
+  assert.equal(await P.getPublicProfileExtras(42, {
+    pool: mockPool([{ rows: [{ profile_state: 'active', hide_stats: true }] }]) }), null);
+  // Non-numeric principal — null before any query.
+  const silent = mockPool([]);
+  assert.equal(await P.getPublicProfileExtras('system:bfg', { pool: silent }), null);
+  assert.equal(silent.calls.length, 0);
+});
+
+await ta('getPublicProfileExtras returns the rollup for an active, visible account', async () => {
+  const pool = mockPool([
+    { rows: [{ profile_state: 'active', hide_stats: false }] },
+    { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
+    { rows: [] },
+  ]);
+  const out = await P.getPublicProfileExtras(42, { pool });
+  assert.deepEqual(out.totals, { projects: 1, credits: 10, works_shipped: 1, karma: 0 });
+  assert.deepEqual(out.disciplines, [], 'null disciplines surface as an empty array');
+  assert.deepEqual(out.projects, []);
+  assert.equal(out.more_projects, 0);
+});
+
+await ta('getOwnProfileExtras serves the self view regardless of flags (no flags lookup)', async () => {
+  const pool = mockPool([
+    { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
+    { rows: [] },
+  ]);
+  const out = await P.getOwnProfileExtras(42, { pool });
+  assert.ok(out && out.totals, 'self view returns the rollup');
+  assert.ok(!pool.calls.some((c) => /profile_state/.test(c.text)),
+    'the self read never consults profile_state/hide_stats');
+});
+
 console.log('\nauthorization codes:');
 
 await ta('mintAuthCode stores the HASH of the code (never the plaintext) + binds it', async () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.167",
+  "version": "1.19.169",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.167",
+      "version": "1.19.169",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.167",
+  "version": "1.19.169",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -75,7 +75,7 @@ const INTEGRATION = new Set([
   'consumer_layout_boot',
   'claim_gate_open_blocker', 'claim_gate_rebase', 'clawback_confirmed_backlog', 'discord_autojoin', 'discord_oauth',
   'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
-  'memory_pull', 'needs_rebase', 'parallel-load', 'reward_mode_cost_plus_only',
+  'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
   'scouting_rollup_fanout', 'session_records', 'setup_smoke',
   'status-probe',
 ]);

package/src/bongos/auth.js

@@ -764,9 +764,17 @@ async function completeIdpFlow({ code, redirectUri, userAgent: ua }) {
     expiresAt,
   });
   await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) — federated web sign-in.
-  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: identity.display_name, avatarUrl: identity.avatar_url });
-  reportActivityRollup({ builderId: builder.id, githubId: ghId });
+  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) —
+  // federated web sign-in. The rollup is CHAINED after the check-in (ADR 0171 D7):
+  // the hub now requires a membership row before accepting activity, so a first
+  // sign-in's rollup must not race its own check-in. Both swallow all errors, so
+  // the chain never rejects and the sign-in never waits on it.
+  // Both helpers are async (always return a promise) and swallow their own
+  // errors; the .catch is belt-and-braces so this floating chain can never
+  // surface an unhandledRejection even if a future edit lets one throw.
+  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: identity.display_name, avatarUrl: identity.avatar_url })
+    .then(() => reportActivityRollup({ builderId: builder.id, githubId: ghId }))
+    .catch(() => {});
   return { token, builder, expiresAt };
 }
 
@@ -935,9 +943,13 @@ async function completeDeviceExchange({ assertion, userAgent: ua }) {
     expiresAt: null,
   });
   await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) — federated CLI sign-in.
-  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: payload.display_name, avatarUrl: payload.avatar_url });
-  reportActivityRollup({ builderId: builder.id, githubId: ghId });
+  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) —
+  // federated CLI sign-in. Rollup chained after check-in (ADR 0171 D7): the hub's
+  // membership requirement must not race a first sign-in; both swallow errors.
+  // Async + self-swallowing helpers; .catch is belt-and-braces (see web flow).
+  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: payload.display_name, avatarUrl: payload.avatar_url })
+    .then(() => reportActivityRollup({ builderId: builder.id, githubId: ghId }))
+    .catch(() => {});
   return { token, builder };
 }
 

package/src/bongos/routes/builders.js

@@ -460,13 +460,17 @@ module.exports = function buildBuildersRouter() {
       const b = await db.getBuilderById(targetId);
       if (!b) return res.fail('builder_not_found', 404);
       // Recent ships + shipped-count read the lifecycle port; the achievement
-      // shelf reads the reward port. Both resolveOptional — on a vanilla instance
-      // without economy the achievement shelf degrades to empty, not a 500.
+      // shelf reads the reward port; the cross-project record reads the hub port
+      // (ADR 0171 D1 — registered only where the platform-identity module is
+      // enabled, i.e. the hub). All resolveOptional — on a vanilla instance the
+      // shelf degrades to empty and the cross_project section is absent, not a 500.
       const reward = seams.resolveOptional('reward');
-      const [shippedCount, recentShips, achievements] = await Promise.all([
+      const hub = seams.resolveOptional('platform-identity.hub');
+      const [shippedCount, recentShips, achievements, crossProject] = await Promise.all([
         lc().countShippedTasksForBuilder(targetId),
         lc().recentShippedTasksByBuilder(targetId, 5),
         reward ? reward.getBuilderAchievements(targetId) : [],
+        hub ? hub.getPublicProfileExtras(b.github_id) : null,
       ]);
       // WHITELIST — only the leaderboard-equivalent public field set. Never spread
       // the raw row: it carries anthropic_email / anthropic_user_id /
@@ -484,8 +488,24 @@ module.exports = function buildBuildersRouter() {
         preferred_disciplines: b.preferred_disciplines,
       };
       // Identity + counters change rarely; a short public cache matches
-      // /public/leaderboard's posture.
-      res.set('Cache-Control', 'public, max-age=60');
+      // /public/leaderboard's posture. On the hub the response carries the
+      // cross_project section, whose hide flag must take effect IMMEDIATELY
+      // (ADR 0171 D5) — a 60s cached copy would keep serving hidden stats — so
+      // when the hub port resolves the response is no-store.
+      res.set('Cache-Control', hub ? 'no-store' : 'public, max-age=60');
+      // cross_project is attached only where the hub port exists (two literal
+      // branches so gen-api-docs proves the shape — the key merges as optional);
+      // null there means "no public cross-project record" (hidden / provisional /
+      // none — deliberately indistinguishable). Viewer-independent (ADR 0171 D4).
+      if (hub) {
+        return res.json({
+          builder,
+          shipped_count: shippedCount,
+          recent_ships: recentShips,
+          achievements,
+          cross_project: crossProject,
+        });
+      }
       res.json({
         builder,
         shipped_count: shippedCount,

package/src/module-api.js

@@ -761,8 +761,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.165 with no explicit bump. run 31961272140. (task 1002620)
 //   1.19.167 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.166 with no explicit bump. run 31961815831. (task 1002620)
+//   1.19.168 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.167 with no explicit bump. run 31962256201. (task 1002620)
+//   1.19.169 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.168 with no explicit bump. run 31964702865. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.167'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.169'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/profile_rollup_consent.mjs

@@ -0,0 +1,162 @@
+// tests/profile_rollup_consent.mjs — task 1002278 (R02, ADR 0171; real DB).
+//
+// Proves the consent + hide semantics against real SQL — pg-mem cannot execute
+// unnest(), so the rollup queries need a live Postgres (the task-1002911
+// precedent). Replays the module's actual migrations, then asserts:
+//   1. listScoutingRollup lists ONLY active + not-hidden builders (D2/D3) —
+//      provisional and hidden accounts drop out of /people + /scouting by
+//      construction.
+//   2. getRollupForBuilder aggregates un-fanned and names ONLY projects whose
+//      catalog row is publicly listed (featured + active); everything else is
+//      counted in more_projects, never named. client_id never crosses.
+//   3. getPublicProfileExtras is fail-closed (missing/provisional/hidden/
+//      non-numeric → null); getOwnProfileExtras serves the self view anyway.
+//   4. upsertAccount's consent upgrade is one-way (activate flips provisional →
+//      active; a later plain upsert never demotes).
+//   5. upsertActivity stores a validated rank (off-ladder → NULL) + capped
+//      disciplines against the real columns (D7).
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/profile_rollup_consent.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`profile_rollup_consent.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const ACTIVE = 90002278, HIDDEN = 90002279, PROV = 90002280, LAZY = 90002281;
+const ALL_IDS = [ACTIVE, HIDDEN, PROV, LAZY];
+const PUB_CLIENT = 't1002278-pub', PRIV_CLIENT = 't1002278-priv', LOST_CLIENT = 't1002278-lost';
+const ALL_CLIENTS = [PUB_CLIENT, PRIV_CLIENT, LOST_CLIENT];
+const PUB_ORIGIN = 'https://t1002278-pub.example', PRIV_ORIGIN = 'https://t1002278-priv.example';
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_project_memberships WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [[PUB_ORIGIN, PRIV_ORIGIN]]).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE client_id = ANY($1::text[])`, [ALL_CLIENTS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  // The module's actual migrations (idempotent).
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_004_projects.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, profile_state, hide_stats)
+     VALUES ($1, 'active-b', 'Active', 'active', false),
+            ($2, 'hidden-b', 'Hidden', 'active', true),
+            ($3, 'prov-b',   'Prov',   'provisional', false)`,
+    [ACTIVE, HIDDEN, PROV],
+  );
+  // Three reporting projects: one publicly catalogued (featured+active), one
+  // catalogued but NOT featured (→ never named), one with no catalog row at all.
+  await q(
+    `INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin)
+     VALUES ($1, 'x', 'Pub Proj', $4), ($2, 'x', 'Priv Proj', $5), ($3, 'x', 'Lost Proj', NULL)`,
+    [...ALL_CLIENTS, PUB_ORIGIN, PRIV_ORIGIN],
+  );
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, featured, status)
+     VALUES ($1, 'Pub Proj', true, 'active'), ($2, 'Priv Proj', false, 'active')`,
+    [PUB_ORIGIN, PRIV_ORIGIN],
+  );
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity
+       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active)
+     VALUES ($1, $4, 100, 5, 3, 'metic',  '{engineer,ui}', '2026-01-01T00:00:00Z'),
+            ($2, $4,  50, 2, 1, 'archon', '{artist}',      '2026-02-01T00:00:00Z'),
+            ($3, $4,  25, 1, 0, NULL,     '{}',            '2026-03-01T00:00:00Z'),
+            ($1, $5,  60, 4, 2, 'metic',  '{engineer}',    '2026-01-01T00:00:00Z'),
+            ($1, $6,  10, 1, 0, 'xenos',  '{engineer}',    '2026-01-01T00:00:00Z')`,
+    [...ALL_CLIENTS, ACTIVE, HIDDEN, PROV],
+  );
+
+  // 1 — the scouting/people predicate (D2/D3).
+  const listed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
+  ok(listed.includes(ACTIVE), 'active + visible builder is listed');
+  ok(!listed.includes(HIDDEN), 'hide_stats builder drops out of the scouting rollup');
+  ok(!listed.includes(PROV), 'provisional (no hub-session consent) builder drops out');
+
+  // 2 — getRollupForBuilder semantics.
+  const r = await pi.getRollupForBuilder(ACTIVE, { pool });
+  assert.deepEqual(r.totals, { projects: 3, credits: 175, works_shipped: 8, karma: 4 });
+  pass++; console.log('  ok - totals aggregate un-fanned across the builder\'s projects');
+  assert.deepEqual([...r.disciplines].sort(), ['artist', 'engineer', 'ui']);
+  pass++; console.log('  ok - disciplines are the deduped union');
+  ok(new Date(r.last_active).toISOString() === '2026-03-01T00:00:00.000Z', 'last_active is the max');
+  ok(r.projects.length === 1 && r.projects[0].name === 'Pub Proj', 'only the publicly-catalogued project is named');
+  assert.deepEqual(Object.keys(r.projects[0]).sort(), ['name', 'origin', 'rank_held']);
+  pass++; console.log('  ok - named rows carry exactly name/origin/rank_held');
+  ok(r.projects[0].rank_held === 'metic', 'rank_held is that project\'s reported standing');
+  ok(r.more_projects === 2, 'unfeatured + uncatalogued projects are counted, never named');
+  ok(!JSON.stringify(r).includes('client_id'), 'client_id never crosses the shape');
+  ok(!JSON.stringify(r).includes('Priv Proj'), 'a non-public project name never crosses');
+
+  // 3 — the port reads.
+  ok(await pi.getPublicProfileExtras(HIDDEN, { pool }) === null, 'public read → null for a hidden builder');
+  ok(await pi.getPublicProfileExtras(PROV, { pool }) === null, 'public read → null for a provisional builder');
+  ok(await pi.getPublicProfileExtras(99999999999, { pool }) === null, 'public read → null with no account');
+  ok(await pi.getPublicProfileExtras('system:bfg', { pool }) === null, 'non-numeric principal → null, no bigint cast error');
+  const pub = await pi.getPublicProfileExtras(ACTIVE, { pool });
+  ok(pub && pub.totals.credits === 175, 'public read returns the rollup for an active, visible builder');
+  const own = await pi.getOwnProfileExtras(HIDDEN, { pool });
+  ok(own && own.totals.credits === 60, 'self view serves a hidden builder their own numbers');
+
+  // 4 — one-way consent upgrade on the real upsert.
+  await pi.upsertAccount({ githubId: LAZY, githubLogin: 'lazy-b' }, { pool });
+  let acct = await pi.getAccount(LAZY, { pool });
+  ok(acct.profile_state === 'provisional', 'a plain upsert creates a provisional account');
+  await pi.upsertAccount({ githubId: LAZY, githubLogin: 'lazy-b', activate: true }, { pool });
+  acct = await pi.getAccount(LAZY, { pool });
+  ok(acct.profile_state === 'active', 'an authorize-path upsert (activate) flips it active');
+  await pi.upsertAccount({ githubId: LAZY, githubLogin: 'lazy-b' }, { pool });
+  acct = await pi.getAccount(LAZY, { pool });
+  ok(acct.profile_state === 'active', 'a later plain upsert never demotes an active account');
+
+  // 5 — rollup payload sanitization against the real columns (D7).
+  await pi.upsertActivity({
+    clientId: PUB_CLIENT, githubId: LAZY, credits: 1,
+    rank: 'Supreme Overlord',
+    disciplines: ['engineer', 42, 'x'.repeat(33), 'a', 'b', 'c', 'd', 'e', 'f', 'g'],
+  }, { pool });
+  const { rows: [act] } = await q(
+    `SELECT rank_held, disciplines FROM platform_identity_builder_project_activity
+      WHERE client_id = $1 AND github_id = $2`, [PUB_CLIENT, LAZY]);
+  ok(act.rank_held === null, 'an off-ladder rank is stored as NULL');
+  ok(act.disciplines.length <= 8 && act.disciplines.every((d) => d.length <= 32),
+    'disciplines land validated + capped');
+
+  console.log(`\nprofile_rollup_consent.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/profile_route.mjs

@@ -73,6 +73,36 @@ const PUBLIC_KEYS = [
   'total_credits', 'karma', 'created_at', 'preferred_disciplines',
 ];
 
+// ---- the cross_project scope (ADR 0171, task 1002278) ---------------------
+//
+// On the hub the route resolves the 'platform-identity.hub' port and attaches
+// its whitelist-shaped return as `cross_project`. The stub below mirrors the
+// module's contract over an in-memory fixture that — like FULL_ROW above —
+// deliberately carries the module-internal values (a client_id, a non-public
+// project's name) so the raw-text scan proves the whitelist held end-to-end.
+const SECRET_CLIENT_ID = 'cli_DO_NOT_LEAK_9f3a';
+const SECRET_PROJECT_NAME = 'DO_NOT_LEAK_PRIVATE_PROJECT';
+const CROSS_PROJECT_ROWS = [
+  { client_id: SECRET_CLIENT_ID, name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic', is_public: true },
+  { client_id: SECRET_CLIENT_ID, name: SECRET_PROJECT_NAME, origin: 'https://priv.example', rank_held: 'archon', is_public: false },
+];
+// What the port returns for an active, visible account: the module's whitelist
+// shape — named projects only where the catalog row is public; the rest counted.
+function stubPublicProfileExtras() {
+  const named = CROSS_PROJECT_ROWS.filter((r) => r.is_public)
+    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held }));
+  return {
+    totals: { projects: 2, credits: 150, works_shipped: 7, karma: 4 },
+    disciplines: ['engineer', 'ui'],
+    last_active: '2026-08-01T00:00:00.000Z',
+    projects: named,
+    more_projects: CROSS_PROJECT_ROWS.length - named.length,
+  };
+}
+// The key contract for the cross_project object + its project rows.
+const CP_PUBLIC_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+const CP_PROJECT_ROW_KEYS = ['name', 'origin', 'rank_held'];
+
 // ---- stubs ----------------------------------------------------------------
 
 // auth: the profile route is public, but the router factory references
@@ -139,7 +169,7 @@ function get(port, path) {
       res.on('end', () => {
         const text = Buffer.concat(chunks).toString('utf8');
         let json = null; try { json = JSON.parse(text); } catch (_) {}
-        resolve({ status: res.statusCode, json, text });
+        resolve({ status: res.statusCode, json, text, headers: res.headers });
       });
     });
     req.on('error', reject);
@@ -192,6 +222,61 @@ await t('non-numeric id → 400 bad_builder_id', async () => {
   assert.equal(r.json && r.json.error && r.json.error.code, 'bad_builder_id');
 });
 
+// ---- cross_project (ADR 0171, task 1002278) -------------------------------
+// The hub port resolves at REQUEST time, so the port-absent tests above ran
+// against the same server; registering the stub here flips the route into its
+// hub posture for the tests below.
+
+await t('hub port ABSENT → no cross_project key + the cacheable posture stays', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  assert.ok(!('cross_project' in r.json), 'cross_project must be absent on a non-hub instance');
+  assert.equal(r.headers['cache-control'], 'public, max-age=60');
+});
+
+let hubExtras = stubPublicProfileExtras();
+seams.registerProvider('platform-identity.hub', {
+  getPublicProfileExtras: async () => hubExtras,
+  getOwnProfileExtras: async () => stubPublicProfileExtras(),
+});
+
+await t('hub port present → cross_project carries exactly the whitelist shape', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  const cp = r.json.cross_project;
+  assert.ok(cp, 'cross_project attached when the port resolves');
+  assert.deepEqual(Object.keys(cp).sort(), [...CP_PUBLIC_KEYS].sort(), 'cross_project keys are exactly the contract');
+  assert.deepEqual(Object.keys(cp.totals).sort(), ['credits', 'karma', 'projects', 'works_shipped']);
+  for (const row of cp.projects) {
+    assert.deepEqual(Object.keys(row).sort(), [...CP_PROJECT_ROW_KEYS].sort(), 'project rows carry only name/origin/rank_held');
+  }
+  assert.equal(cp.projects.length, 1, 'only the public catalog row is named');
+  assert.equal(cp.more_projects, 1, 'the non-public project is counted, never named');
+});
+
+await t('hub port present → module-internal sentinels leak NOWHERE in the response', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  for (const secret of [SECRET_CLIENT_ID, SECRET_PROJECT_NAME, SECRET_EMAIL, SECRET_USER, SECRET_REASON]) {
+    assert.ok(!r.text.includes(secret), `response body must not contain "${secret}"`);
+  }
+  assert.ok(!r.text.includes('client_id'), 'no client_id key may cross the port');
+});
+
+await t('hub port present → hide must beat the cache: Cache-Control is no-store', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.headers['cache-control'], 'no-store');
+});
+
+await t('hub port returns null (hidden/provisional/none) → cross_project: null, still no-store', async () => {
+  hubExtras = null;
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  assert.ok('cross_project' in r.json, 'the key is present on the hub');
+  assert.equal(r.json.cross_project, null, 'null — no partial numbers, indistinguishable from no-account');
+  assert.equal(r.headers['cache-control'], 'no-store');
+});
+
 server.close();
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/scouting_rollup_fanout.mjs

@@ -53,11 +53,15 @@ try {
   // The module's actual migrations (idempotent CREATE TABLE IF NOT EXISTS).
   await q(migrationSql('platform_identity_001_tables.sql'));
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
   await cleanup();
 
+  // profile_state='active' — since ADR 0171 the rollup only lists consented,
+  // visible builders; this test is about AGGREGATION, so fixtures opt in.
+  // (The predicate itself is proven by tests/profile_rollup_consent.mjs.)
   await q(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url)
-     VALUES ($1, 'multi', 'Multi', 'a'), ($2, 'solo', 'Solo', 'b'), ($3, 'ghost', 'Ghost', 'c')`,
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
+     VALUES ($1, 'multi', 'Multi', 'a', 'active'), ($2, 'solo', 'Solo', 'b', 'active'), ($3, 'ghost', 'Ghost', 'c', 'active')`,
     [MULTI, SOLO, GHOST],
   );
   // MULTI: two projects, 2 and 3 disciplines — the exact fan-out shape the old