@bongos/core 1.19.168 → 1.19.170

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.168",
-  "core_contract": "1.19.168",
-  "source_commit": "d1de1d92631455296b40254771a484510790afe2",
+  "core_version": "1.19.170",
+  "core_contract": "1.19.170",
+  "source_commit": "2fd8009b960bd910fe95b3169d504adc7fe309d1",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T17:40:10.703Z",
+  "built_at": "2026-08-16T18:45:10.150Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1265,
+    "functional_verbatim": 1268,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1591,
-  "tree_sha256": "decba66e24c9eb800c760c258aeff0daefebef5fd777a6f7000df6a3c6e464c7",
+  "file_count": 1594,
+  "tree_sha256": "938326e2e51b3c2bf0a7ab516c8444005ec95028f247df10cc55bedae67b099f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "c8143e170b5ac87e7cdd243eb83edb8b22ad252382c86544f96e7a38311e0380"
+      "sha256": "d6d6163164f98c96a8e25dfe84825669bf8324f1f1b98adb0674781ad235ad10"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "dd11d5decd14af95cc23c2bef8dfe8c477132fb07d671682b228107fe69d7ea4"
+      "sha256": "386706d0ef3d09c5e074bdc45bfc0de869d732eb1cb2a2280472f02f797f2b74"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "257ac54c66f7969090065a34c29e2874fa6f9d111b6e75f0510ab1a2fcb3ef17"
+      "sha256": "7d462b5b80c9db9159981406398fc62c5ba71043c6a3b9433852d06d612bf2b0"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4245c4fb82c1c4f5c87788030dc4640987fe22e0d588072d4549e9982cea7ecc"
+      "sha256": "4acb1dde6f894ba37cff7e27e0110f12ae30c7cb6e4d972d6e85d2877489b6d0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "4889c6c70c1f58d90006800cf2bd363b4c2cc546c69042a1faae5106c16aab03"
+      "sha256": "4c7679ef258644ab12db1b8fe412b388f96f4296c6aae45d6ab637a8f3b9a037"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1347,12 +1347,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "879ef6fd06bde11c040c5ef67ccf495f0be6eb95e11be6f8979c9d560a33da64"
+      "sha256": "ccf59372e0456f36d83154d6dff4dbf5382e8d69023bee82b318b8e9cfb2c50b"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "9382373e7be837c0ce4e26f23c3cd32bf20ab09858650bdee318dd90a06dedbe"
+      "sha256": "4deac83a1d7c12e1a24109e856d9a6fef6b539afafdca55a525ab6786fe4e235"
     },
     {
       "path": "docs/architecture.md",
@@ -2662,7 +2662,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "257ac54c66f7969090065a34c29e2874fa6f9d111b6e75f0510ab1a2fcb3ef17"
+      "sha256": "7d462b5b80c9db9159981406398fc62c5ba71043c6a3b9433852d06d612bf2b0"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3382,12 +3382,12 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "eaea5b3ca78fa89fbff71bb0209f24afd010e064dec5e4b4803edc2bdd07e1c1"
+      "sha256": "ae68a26d5d37ac75968ac11335b7062a448798cb3af0e0a4f81963f3382f204d"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
       "mode": "0000644",
-      "sha256": "9b6c826e4c444ff68a7dcc0df1a76122ead297220685e701dc0d45edafa6ca4b"
+      "sha256": "2b69d258218e92b9fe2922496632e43d4bdb81f641f09469f5f6df85494a9fca"
     },
     {
       "path": "modules/hall-ui/public/shell.js",
@@ -3784,15 +3784,20 @@
       "mode": "0000644",
       "sha256": "4885d452673c2d6170835c8d7f03c101847ddb313a69dfb66c8e640f875ecdc1"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_007_profile_consent.sql",
+      "mode": "0000644",
+      "sha256": "cce2f971f030aa628f9d7855f2e421595ea71cb314e90965206dbe970b7beded"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "71bd26b5e4ba6012e3119a99c1aa1046d61b12b17e1018f55c9ee11b6ec29895"
+      "sha256": "e993fb26e61249bf89c0b0a5977c60e9d974810ffe1b67e94d909e8b52e00d5e"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "3d20563833a9daf20d14745f2ce1c5fe530fc918eac03427185998ff9b67beed"
+      "sha256": "96907af1af78c472118ecf5ed9f269d6d2ce940b09535aae3b3df4de4d2337c1"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3809,6 +3814,11 @@
       "mode": "0000644",
       "sha256": "7fdb5a107e1ad84214c0d07507a7fd14b9234c9907224fddc0f6a70c850f460a"
     },
+    {
+      "path": "modules/platform-identity/routes/profile.js",
+      "mode": "0000644",
+      "sha256": "6ea29b4f07417fa925b7987dd7fbe8a0262b7fec83ceffade9fccbc220289bba"
+    },
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
@@ -3817,17 +3827,17 @@
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
-      "sha256": "c6db7fa003caaf55d2ecb68f1ff73d7d89d8b71b6d999ed3ebf71286e8726359"
+      "sha256": "886c9d98c94e84d2e51e21d5e716caafe757edbb49073d7dc096221b339ffd27"
     },
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "1a3b19e793387c8410062cb2d53f981eb108ff72c31e09741bcc7c8622ca2b80"
+      "sha256": "45c8a071f8bf61bd97bce83518fe3bd1b32cff99f31281c2cba84ad500359d60"
     },
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "727fc8c7533eec1e4af477582bdd6428e9842b930b3cc898bb8a13ddead83ec3"
+      "sha256": "18bf8d0cb42d76bc5413c760b13837fe439a6e719b88a84db96f143b829e67d5"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4202,12 +4212,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5dc4705ddce9ec0b3e3925e5f3babfe6c648e5d6039b949ff74b2afa571cd8d1"
+      "sha256": "0b596f97bbd28b6ddfda4a9265effcb0ea8711a4bb57948c35b80d7cf79c23d9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d661d208ae737337262da1c9abd9a5d6cafe5ef36b53699c2913bfd96dd13ec8"
+      "sha256": "ae9625129bd03cb29845f65e1be3abd91c48259d85a9c23095370e43a0a0e8aa"
     },
     {
       "path": "public-docs/index.html",
@@ -5192,7 +5202,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "5e7030e617e4db066136556a43cf030078b0d042ee480c9b7245eea05ab83776"
+      "sha256": "21bcaeaa9d8b2048b9c3f9ff9b251a9203a9259c991a536636c0ec3c8745bbd5"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5572,7 +5582,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "a8215fa2659638d5850acb787eb3b193b18b545bc7e86f801764cab328b0c837"
+      "sha256": "04cddf3c307c2f3bf22b8b29140973b80b549a04f1ba90be38ed7f1a794352ad"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5712,7 +5722,7 @@
     {
       "path": "src/bongos/routes/builders.js",
       "mode": "0000644",
-      "sha256": "43a409918ba54af69d0c7183af510ff9d73b26566a1a520ad97d84360abcc79b"
+      "sha256": "9423af249991f4d40e03ffa8d73a3584279f9d1095115c420047a735103bb417"
     },
     {
       "path": "src/bongos/routes/github.js",
@@ -5812,7 +5822,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "55951238fbbe742e078f5f6c3d8fbaaf2af2219be6775c38c4366d035554f6a0"
+      "sha256": "28605499539ca63e000ac2fc52af1a3d75dbb2fd947846426619a189a2afd92b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7369,10 +7379,15 @@
       "mode": "0000644",
       "sha256": "3c85d28ecc55e375988f3e55aee993c8c84220889678262d8207146c2772f3f5"
     },
+    {
+      "path": "tests/profile_rollup_consent.mjs",
+      "mode": "0000644",
+      "sha256": "b926ffa5d4e96ef223e4057ecc3e64d678ca1e16ec4afe79cb90cbf3e35e65e0"
+    },
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "dc354f082204073409aea90df9b91f149d474c6930b761ed5c9928bb76e1358f"
+      "sha256": "3b3045a6143d67c963516ed5703b5dabb9b8945a392118721e6a0a56258f1732"
     },
     {
       "path": "tests/project_stats.mjs",
@@ -7567,7 +7582,7 @@
     {
       "path": "tests/scouting_rollup_fanout.mjs",
       "mode": "0000644",
-      "sha256": "1b58003a1fac89b05acfc3287e529a9e17e2b7a6ec48259b5700f6cc837cc554"
+      "sha256": "3451cb25abd4eb819a7b951d1e06310d575faf6145808711fcdd2e2afb655ec3"
     },
     {
       "path": "tests/scrubber_corpus.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 271 operations across 45 resource groups
+- 273 operations across 45 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -409,6 +409,10 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/cross-project — rank: any-builder — GET /me/cross-project
+      getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
+      // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project
+      patchMeCrossProject: (args) => request("PATCH", "/me/cross-project", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name

package/clients/bongos-client/index.cjs

@@ -408,6 +408,10 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/cross-project — rank: any-builder — GET /me/cross-project
+      getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
+      // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project
+      patchMeCrossProject: (args) => request("PATCH", "/me/cross-project", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name

package/clients/bongos-client/index.d.ts

@@ -30,7 +30,7 @@ export interface GetBoxesResponse { boxes: unknown }
 export interface GetBuildersDirectoryResponse { builders: unknown }
 export interface GetBuildersIdActiveClaimsResponse { builder_id: unknown; claims: unknown; stale_hours: unknown }
 export interface GetBuildersIdOnboardingResponse { builder_id: unknown; onboarding: unknown }
-export interface GetBuildersIdProfileResponse { builder: unknown; shipped_count: unknown; recent_ships: unknown; achievements: unknown }
+export interface GetBuildersIdProfileResponse { builder: unknown; shipped_count: unknown; recent_ships: unknown; achievements: unknown; cross_project?: unknown }
 export interface GetBuildersMePendingRankChangeResponse { change: unknown; greeting?: unknown }
 export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unknown }
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
@@ -51,6 +51,7 @@ export interface GetInboxResponse { ideas: unknown; open_count: unknown }
 export interface GetLeaderboardResponse { leaderboard: unknown; page: unknown }
 export interface GetLearningsResponse { learnings: unknown }
 export interface GetMeAchievementsResponse { unlocked: unknown }
+export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; cross_project: unknown }
 export interface GetMeDisplayNameResponse { display_name: unknown; max_length: unknown }
 export interface GetMeEventSoundPrefsResponse { prefs: unknown; effective: unknown; effective_wav: unknown; events: unknown }
 export interface GetMeRecentShipsResponse { ships: unknown }
@@ -124,6 +125,8 @@ export interface PatchGoalsIdVisibilityRequest { visibility: string }
 export interface PatchGoalsIdVisibilityResponse { ok: boolean; goal: unknown }
 export interface PatchInboxIdRequest { status?: "open" | "promoted" | "discarded" | "merged"; kind?: string; promoted_to_task_id?: number; reviewed_at?: unknown; merged_into_idea_id?: number; triage_note?: string }
 export interface PatchInboxIdResponse { idea: unknown }
+export interface PatchMeCrossProjectRequest { hide_stats: boolean }
+export interface PatchMeCrossProjectResponse { hide_stats: boolean }
 export interface PatchMeDisciplinesRequest { preferred_disciplines: string[] }
 export interface PatchMeDisciplinesResponse { builder: unknown; onboarding: unknown }
 export interface PatchMeDisplayNameResponse { display_name: unknown; max_length: unknown }
@@ -645,6 +648,10 @@ export interface BongosClient {
     getMeAchievements(args?: RequestArgs): Promise<GetMeAchievementsResponse>;
     /** POST /me/anthropic-link — rank: any-builder */
     postMeAnthropicLink(args: RequestArgs & { body: PostMeAnthropicLinkRequest }): Promise<PostMeAnthropicLinkResponse>;
+    /** GET /me/cross-project — rank: any-builder */
+    getMeCrossProject(args?: RequestArgs): Promise<GetMeCrossProjectResponse>;
+    /** PATCH /me/cross-project — rank: any-builder */
+    patchMeCrossProject(args: RequestArgs & { body: PatchMeCrossProjectRequest }): Promise<PatchMeCrossProjectResponse>;
     /** PATCH /me/disciplines — rank: any-builder */
     patchMeDisciplines(args: RequestArgs & { body: PatchMeDisciplinesRequest }): Promise<PatchMeDisciplinesResponse>;
     /** GET /me/display-name — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -405,6 +405,10 @@ export function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/cross-project — rank: any-builder — GET /me/cross-project
+      getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
+      // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project
+      patchMeCrossProject: (args) => request("PATCH", "/me/cross-project", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name

package/docs/api/openapi.json

@@ -6267,6 +6267,91 @@
         ]
       }
     },
+    "/me/cross-project": {
+      "get": {
+        "operationId": "get_me_cross_project",
+        "tags": [
+          "me"
+        ],
+        "summary": "GET /me/cross-project",
+        "description": "the caller's OWN cross-project record + hide flag (own data).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/profile.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMeCrossProjectResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "patch": {
+        "operationId": "patch_me_cross_project",
+        "tags": [
+          "me"
+        ],
+        "summary": "PATCH /me/cross-project",
+        "description": "flip the caller's OWN hide flag (C2's self-serve opt-out; own data, keyed on the authenticated github_id).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/profile.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchMeCrossProjectRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchMeCrossProjectResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/disciplines": {
       "patch": {
         "operationId": "patch_me_disciplines",
@@ -12617,7 +12702,8 @@
           "builder": {},
           "shipped_count": {},
           "recent_ships": {},
-          "achievements": {}
+          "achievements": {},
+          "cross_project": {}
         },
         "required": [
           "builder",
@@ -12849,6 +12935,21 @@
           "unlocked"
         ]
       },
+      "GetMeCrossProjectResponse": {
+        "type": "object",
+        "properties": {
+          "hide_stats": {
+            "type": "boolean"
+          },
+          "profile_state": {},
+          "cross_project": {}
+        },
+        "required": [
+          "hide_stats",
+          "profile_state",
+          "cross_project"
+        ]
+      },
       "GetMeDisplayNameResponse": {
         "type": "object",
         "properties": {
@@ -13807,6 +13908,29 @@
           "idea"
         ]
       },
+      "PatchMeCrossProjectRequest": {
+        "type": "object",
+        "properties": {
+          "hide_stats": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "hide_stats"
+        ],
+        "additionalProperties": false
+      },
+      "PatchMeCrossProjectResponse": {
+        "type": "object",
+        "properties": {
+          "hide_stats": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "hide_stats"
+        ]
+      },
       "PatchMeDisciplinesRequest": {
         "type": "object",
         "properties": {
@@ -17098,9 +17222,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 271,
-  "x-schema-count": 303,
+  "x-endpoint-count": 273,
+  "x-schema-count": 306,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 205,
+  "x-response-schemas": 207,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 271 endpoints across 44 route files.
+> **Generated from the live route files** — the route file is authoritative. 273 endpoints across 45 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -282,13 +282,15 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (21)
+## `me` (23)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/me` | `any-builder` | — | PMS-V2 task 188: response now also carries `unlocked` (server-joined achievement metadata) + `locked_with_progress` (server-computed huma… |
 | GET | `/api/bongos/me/achievements` | `any-builder` | — | The builder's unlocked achievements (joined to achievement metadata). |
 | POST | `/api/bongos/me/anthropic-link` | `any-builder` | `anthropic_email`, `anthropic_user_id` | V3.R10 (task 235), criterion C3 — link the authed builder's Anthropic account. |
+| GET | `/api/bongos/me/cross-project` | `any-builder` | — | the caller's OWN cross-project record + hide flag (own data). |
+| PATCH | `/api/bongos/me/cross-project` | `any-builder` | `hide_stats` | flip the caller's OWN hide flag (C2's self-serve opt-out; own data, keyed on the authenticated github_id). |
 | PATCH | `/api/bongos/me/disciplines` | `any-builder` | `preferred_disciplines` | Self-service edit of the authenticated builder's preferred disciplines (migrations 027 + 086 / V3.R80). |
 | GET | `/api/bongos/me/display-name` | `any-builder` | — | Per-builder DISPLAY NAME (task 1669). |
 | PATCH | `/api/bongos/me/display-name` | `any-builder` | _undocumented_ | PATCH the display name. |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -408,6 +408,10 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/cross-project — rank: any-builder — GET /me/cross-project
+      getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
+      // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project
+      patchMeCrossProject: (args) => request("PATCH", "/me/cross-project", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name

package/modules/hall-ui/public/settings.html

@@ -79,6 +79,20 @@
               <p class="section-note">Saves when you press Save; shows everywhere at once.</p>
             </section>
 
+            <!-- Cross-project record (platform-identity module, ADR 0171 / task 1002279).
+                 Revealed only when the module's own endpoint answers; hidden on a
+                 vanilla instance. P04 later moves this into the Profile rail group. -->
+            <section class="scroll" id="cross-project-scroll" aria-labelledby="cross-project-h" data-group="account" hidden>
+              <h2 id="cross-project-h" class="scroll__h">Cross-project record</h2>
+              <p class="scroll__lede">
+                Your track record across every project you build on, shown on your
+                public profile. Hiding it takes effect immediately everywhere —
+                your profile, the People directory, and recruiting views.
+              </p>
+              <div id="cross-project-rows"></div>
+              <p class="settings-status" id="cross-project-status" role="status" aria-live="polite"></p>
+            </section>
+
             <!-- CRAFT — discipline preferences (GET /me, PATCH /me/disciplines). -->
             <section class="scroll" id="craft-scroll" aria-labelledby="craft-h" data-group="account" hidden>
               <h2 id="craft-h" class="scroll__h">Preferred disciplines</h2>

package/modules/hall-ui/public/settings.js

@@ -550,6 +550,86 @@
     }
   }
 
+  // ---- section: CROSS-PROJECT RECORD (hide flag — ADR 0171 D4, task 1002279)
+  //
+  // GET/PATCH /api/bongos/me/cross-project (platform-identity module — hub only).
+  // One on/off toggle: "show my cross-project record on my public profile".
+  // Enforcement is server-side in the module's read functions, so flipping it
+  // takes effect immediately on the profile, /people, and /scouting. The section
+  // reveals ONLY when the module's endpoint answers (404 on a vanilla instance →
+  // stays hidden, no error state). P04 later re-homes this in the Profile rail
+  // group; storage is account-global on the hub (not behavior_prefs).
+  function renderCrossProject(data) {
+    const wrap = $('#cross-project-rows');
+    if (!wrap) return;
+    const hidden = !!(data && data.hide_stats);
+    const on = !hidden; // the toggle reads as "shown"
+    const cp = data && data.cross_project;
+    const totals = cp && cp.totals ? cp.totals : null;
+    const totalsLine = totals
+      ? `Your record: ${totals.projects} project${totals.projects === 1 ? '' : 's'} · ` +
+        `${totals.credits} credits · ${totals.works_shipped} works shipped · ${totals.karma} karma.`
+      : 'No cross-project activity reported yet.';
+    const consentNote = data && data.profile_state !== 'active'
+      ? ' Your profile publishes after your next sign-in at the hub.'
+      : '';
+    wrap.innerHTML =
+      '<div class="sound-row" data-cross-project="hide">' +
+      '<div class="sound-row__text">' +
+      '<div class="sound-row__label">Show my cross-project record</div>' +
+      `<div class="sound-row__desc">${escapeHtml(totalsLine + consentNote)} You always see your own numbers here.</div>` +
+      '</div>' +
+      `<button type="button" class="sound-toggle" data-on="${on ? '1' : '0'}" aria-pressed="${on ? 'true' : 'false'}">${on ? 'Shown' : 'Hidden'}</button>` +
+      '</div>';
+  }
+
+  // PATCH the hide flag. Body: { hide_stats: <bool> } (routes/profile.js).
+  async function saveCrossProject(hide, btn) {
+    const status = $('#cross-project-status');
+    if (status) status.textContent = 'Saving…';
+    if (btn) btn.disabled = true;
+    try {
+      const res = await api.request('PATCH', `${API}/me/cross-project`, { body: { hide_stats: hide } });
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) throw new Error(`cross-project PATCH → ${res.status}`);
+      await loadCrossProject(); // re-render from the server's truth (flag + record)
+      const msg = hide
+        ? 'Cross-project record hidden — removed from your profile and directories immediately.'
+        : 'Cross-project record shown on your public profile.';
+      if (status) status.textContent = msg;
+      toast(msg);
+    } catch (err) {
+      console.error('[settings] save cross-project failed', err);
+      if (status) status.textContent = 'Could not save. Try again.';
+      toast('Could not save your cross-project preference. Try again.');
+      if (btn) btn.disabled = false;
+    }
+  }
+
+  let crossProjectWired = false;
+  async function loadCrossProject() {
+    const section = $('#cross-project-scroll');
+    if (!section) return;
+    try {
+      const res = await api.request('GET', `${API}/me/cross-project`);
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) return; // module off / route absent → the section stays hidden
+      renderCrossProject(res.data);
+      section.hidden = false;
+      if (!crossProjectWired) {
+        crossProjectWired = true;
+        $('#cross-project-rows').addEventListener('click', (e) => {
+          const b = e.target.closest('.sound-toggle');
+          if (!b || b.disabled) return;
+          saveCrossProject(b.dataset.on === '1', b); // shown → hide; hidden → show
+        });
+      }
+    } catch (err) {
+      // Network/parse failure on an optional module section — stay hidden, log only.
+      console.error('[settings] failed to load cross-project', err);
+    }
+  }
+
   // ---- section 2: CRAFT (discipline preferences) ---------------------------
 
   // Valid disciplines are limited (see me.js + db.updateBuilderDisciplines):
@@ -1098,6 +1178,7 @@
   const PANEL_ANCHORS = {
     'connections': 'connections-scroll',
     'display-name': 'display-name-scroll',
+    'cross-project': 'cross-project-scroll',
     'disciplines': 'craft-scroll',
     'cli': 'cli-scroll',
     'art-key': 'art-key',
@@ -1250,6 +1331,9 @@
     await loadWandering();
     // Rendering loads independently too (rich in-feed cards on/off, task 1279).
     await loadRender();
+    // Cross-project record (hide flag) — reveals only where the platform-identity
+    // module answers (the hub); silent no-op elsewhere (task 1002279).
+    await loadCrossProject();
     // Image key (per-builder Gemini key, task 1013) — own try/catch; `me` carries
     // the `needs` art_key item that drives the covered/action-needed banner.
     await loadArtKey(me);