@bongos/core 1.19.168 → 1.19.170

package/modules/platform-identity/migrations/platform_identity_007_profile_consent.sql

@@ -0,0 +1,32 @@
+-- platform_identity_007_profile_consent.sql — profile consent state + the C2
+-- hide flag (ADR 0171 D3/D4, task 1002278 / goal 1000045).
+--
+-- profile_state is FAIL-CLOSED consent: an account is 'active' iff a human was
+-- demonstrably at the hub — the one path that proves it is a hub-session
+-- /sso/authorize (where T&C acceptance can later be captured, task 1002913).
+-- Device-poll and membership check-in create 'provisional' accounts; the
+-- activity-rollup endpoint creates no account at all. Public surfaces (the
+-- profile port, /people, /scouting) read only 'active' accounts.
+--
+-- Deliberately NO backfill joining core `builders`: that join is type-unsafe
+-- ('system:bfg'-style text ids vs bigint) and would put a core-table read inside
+-- a module migration (ADR 0083 boundary). All existing accounts start
+-- 'provisional' and lazily upgrade on their next hub-session authorize.
+--
+-- hide_stats is the account-global C2 opt-out — enforced in the module's read
+-- functions (ADR 0171 D2/D4), written by an own-scoped PATCH (task 1002279, R03).
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_accounts
+  ADD COLUMN IF NOT EXISTS profile_state text NOT NULL DEFAULT 'provisional'
+    CHECK (profile_state IN ('provisional', 'active')),
+  ADD COLUMN IF NOT EXISTS hide_stats boolean NOT NULL DEFAULT false;
+
+-- The public-surface predicate (profile_state = 'active' AND NOT hide_stats)
+-- filters per-builder; accounts are looked up by github_id (already indexed via
+-- the UNIQUE constraint), so no new index is needed.
+
+COMMIT;

package/modules/platform-identity/module.json

@@ -10,7 +10,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting"],
+    "routes": ["sso", "projects", "my-projects", "scouting", "profile"],
     "migrations": true,
     "pollers": ["code-sweep"]
   },

package/modules/platform-identity/platform-identity.js

@@ -101,17 +101,24 @@ function redirectUriAllowed(client, redirectUri) {
 
 // Upsert the platform account for a GitHub identity (keyed on the stable
 // github_id). Called at /sso/authorize for the signed-in hub user. Identity only.
-async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl }, { pool = defaultPool } = {}) {
+//
+// `activate` is the ONE consent upgrade path (ADR 0171 D3): an account becomes
+// profile_state='active' iff touched by a hub-session /sso/authorize — the path
+// where a human is demonstrably at the hub. Every other caller (device-poll,
+// membership check-in) leaves the fail-closed 'provisional' default; activation
+// is one-way (a later non-activating upsert never demotes an active account).
+async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url)
-     VALUES ($1, $2, $3, $4)
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
+     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END)
      ON CONFLICT (github_id) DO UPDATE SET
        github_login = EXCLUDED.github_login,
        display_name = EXCLUDED.display_name,
        avatar_url   = EXCLUDED.avatar_url,
+       profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END,
        updated_at   = now()
-     RETURNING id, github_id, github_login, display_name, avatar_url`,
-    [githubId, githubLogin, displayName ?? null, avatarUrl ?? null],
+     RETURNING id, github_id, github_login, display_name, avatar_url, profile_state`,
+    [githubId, githubLogin, displayName ?? null, avatarUrl ?? null, !!activate],
   );
   return rows[0];
 }
@@ -131,7 +138,7 @@ async function getAccountByLogin(githubLogin, { pool = defaultPool } = {}) {
 
 async function getAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `SELECT id, github_id, github_login, display_name, avatar_url, created_at, updated_at
+    `SELECT id, github_id, github_login, display_name, avatar_url, profile_state, hide_stats, created_at, updated_at
        FROM platform_identity_accounts WHERE github_id = $1`,
     [githubId],
   );
@@ -306,6 +313,19 @@ async function upsertMembership({ clientId, githubId, role = 'builder' }, { pool
   return rows[0];
 }
 
+// One membership row for (project, builder), any role — or null. Backs the
+// activity-rollup membership requirement (ADR 0171 D7): a client may only report
+// activity for a builder who actually has a membership on that project.
+async function getMembership(clientId, githubId, { pool = defaultPool } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, client_id, github_id, role, joined_at, last_active
+       FROM platform_identity_project_memberships
+      WHERE client_id = $1 AND github_id = $2`,
+    [clientId, githubId],
+  );
+  return rows[0] || null;
+}
+
 // All memberships for one account, newest-active first, joined to the project's
 // display fields (name/origin from sso_clients). Powers "My Projects" (task #1002112).
 async function listMembershipsForAccount(githubId, { pool = defaultPool } = {}) {
@@ -402,10 +422,23 @@ async function setClientStatus(clientId, status, { pool = defaultPool } = {}) {
 // Cross-project builder activity (the scouting data plane — ADR 0141 §4)
 // -------------------------------------------------------------------------
 
+// Rollup payload caps (ADR 0171 D7): the reported rank/disciplines are third-party
+// self-report headed for a public portfolio, so they are validated HERE, next to
+// the data, where no caller can forget. Rank must be one of the four core rank
+// keys (else stored null — a label is never invented); disciplines are string
+// elements only, bounded in count and length.
+const MAX_ROLLUP_DISCIPLINES = 8;
+const MAX_DISCIPLINE_LENGTH = 32;
+
 // Upsert one project's rollup for one builder (keyed by client_id + github_id).
 // Descriptive analytics — never authority. Refreshes last_active on each report.
 async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [] }, { pool = defaultPool } = {}) {
-  const disc = Array.isArray(disciplines) ? disciplines : [];
+  // api.LIVE_RANK_LADDER is a published doorway export (src/module-api.js, a
+  // lazy getter over db-kernel's canonical four-rank ladder).
+  const safeRank = api.LIVE_RANK_LADDER.includes(rank) ? rank : null;
+  const disc = (Array.isArray(disciplines) ? disciplines : [])
+    .filter((d) => typeof d === 'string' && d.length > 0 && d.length <= MAX_DISCIPLINE_LENGTH)
+    .slice(0, MAX_ROLLUP_DISCIPLINES);
   const { rows } = await pool.query(
     `INSERT INTO platform_identity_builder_project_activity
        (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active, updated_at)
@@ -415,7 +448,7 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
        rank_held = EXCLUDED.rank_held, disciplines = EXCLUDED.disciplines,
        last_active = now(), updated_at = now()
      RETURNING id, client_id, github_id`,
-    [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, rank, disc],
+    [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc],
   );
   return rows[0];
 }
@@ -430,6 +463,12 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
 // (task 1002911). So scalars aggregate in `agg` over the un-fanned table, and the
 // disciplines union is computed separately in `disc`. Proven against real SQL by
 // tests/scouting_rollup_fanout.mjs.
+//
+// Consent by construction (ADR 0171 D2/D3): only builders whose account is
+// profile_state='active' AND NOT hide_stats appear — /people and /scouting are
+// live cross-project surfaces, so the predicate lives IN the query, not in any
+// caller's memory. Provisional (no hub-session consent) and hidden builders drop
+// out entirely; the projection stays an explicit whitelist (no raw-row spread).
 async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `WITH agg AS (
@@ -440,6 +479,11 @@ async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
               sum(a.karma)::int         AS total_karma,
               max(a.last_active)        AS last_active
          FROM platform_identity_builder_project_activity a
+        WHERE EXISTS (
+                SELECT 1 FROM platform_identity_accounts pa
+                 WHERE pa.github_id = a.github_id
+                   AND pa.profile_state = 'active'
+                   AND NOT pa.hide_stats)
         GROUP BY a.github_id
      ), disc AS (
        SELECT x.github_id, array_agg(DISTINCT x.d) AS disciplines
@@ -463,6 +507,120 @@ async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
   return rows;
 }
 
+// Is this a value we can safely bind against the bigint github_id column?
+// Core builders include 'system:bfg'-style TEXT principals; binding one would
+// throw a bigint cast error mid-request, so every profile read guards here and
+// returns null instead (ADR 0171 D2).
+function isNumericGithubId(githubId) {
+  return /^\d+$/.test(String(githubId ?? ''));
+}
+
+// One builder's cross-project record (ADR 0171 D2/D6/D7, task 1002278) — the
+// whitelist-shaped aggregate the profile surfaces render. Aggregation mirrors
+// listScoutingRollup's corrected shape: scalars over the UN-FANNED activity
+// table, the disciplines union computed separately (never a pre-GROUP-BY unnest
+// fan-out — bug task 1002911). Per-project rows join the module-internal
+// client_id → sso_clients.origin → projects.origin two-hop; a project is NAMED
+// only when its catalog row is publicly listed today (featured + active — the
+// exact set listFeaturedProjects publishes; goal 1000046's visibility states
+// will widen this predicate when they land). Everything else is counted in
+// more_projects, never named ("the aggregate is not the leak, the name is").
+// client_id never appears in the returned shape.
+async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return null;
+  const { rows: aggRows } = await pool.query(
+    `WITH agg AS (
+       SELECT count(*)::int                        AS projects,
+              COALESCE(sum(a.credits), 0)::int       AS credits,
+              COALESCE(sum(a.tasks_shipped), 0)::int AS works_shipped,
+              COALESCE(sum(a.karma), 0)::int         AS karma,
+              max(a.last_active)                     AS last_active
+         FROM platform_identity_builder_project_activity a
+        WHERE a.github_id = $1
+     ), disc AS (
+       SELECT array_agg(DISTINCT x.d) AS disciplines
+         FROM (SELECT unnest(a.disciplines) AS d
+                 FROM platform_identity_builder_project_activity a
+                WHERE a.github_id = $1) x
+        WHERE x.d IS NOT NULL
+     )
+     SELECT agg.projects, agg.credits, agg.works_shipped, agg.karma,
+            agg.last_active, disc.disciplines
+       FROM agg LEFT JOIN disc ON true`,
+    [githubId],
+  );
+  const agg = aggRows[0];
+  const { rows: projRows } = await pool.query(
+    `SELECT p.name, p.origin, a.rank_held,
+            (p.id IS NOT NULL AND p.featured AND p.status = 'active') AS is_public
+       FROM platform_identity_builder_project_activity a
+       LEFT JOIN platform_identity_sso_clients c ON c.client_id = a.client_id
+       LEFT JOIN platform_identity_projects p ON p.origin = c.origin
+      WHERE a.github_id = $1
+      ORDER BY a.last_active DESC`,
+    [githubId],
+  );
+  const named = projRows
+    .filter((r) => r.is_public)
+    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held }));
+  return {
+    totals: {
+      projects: agg.projects,
+      credits: agg.credits,
+      works_shipped: agg.works_shipped,
+      karma: agg.karma,
+    },
+    disciplines: agg.disciplines || [],
+    last_active: agg.last_active,
+    projects: named,
+    more_projects: projRows.length - named.length,
+  };
+}
+
+// The PUBLIC read behind the 'platform-identity.hub' port (ADR 0171 D1/D2):
+// null unless the account exists, consented (profile_state='active') and is not
+// hidden (hide_stats) — the fail-closed rule every public surface inherits by
+// construction. A null is deliberately indistinguishable between "no account",
+// "provisional" and "hidden" (no partial numbers; a count plus a hidden total is
+// a leak by subtraction).
+async function getPublicProfileExtras(githubId, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return null;
+  const { rows } = await pool.query(
+    `SELECT profile_state, hide_stats FROM platform_identity_accounts WHERE github_id = $1`,
+    [githubId],
+  );
+  const acct = rows[0];
+  if (!acct || acct.profile_state !== 'active' || acct.hide_stats) return null;
+  return getRollupForBuilder(githubId, { pool });
+}
+
+// The SELF read (ADR 0171 D2's first narrow side door): a builder inspects their
+// own numbers in Settings regardless of profile_state/hide_stats. Callers MUST
+// key this by the authenticated session's github_id, never a caller-named one.
+async function getOwnProfileExtras(githubId, { pool = defaultPool } = {}) {
+  return getRollupForBuilder(githubId, { pool });
+}
+
+// The C2 hide-stats WRITE (ADR 0171 D4, task 1002279): own-scoped — callers key
+// this by the AUTHENTICATED session's github_id. Upserts so a hub builder who
+// never federated (no account row yet) can still hide ahead of time: the insert
+// creates a fail-closed provisional account already carrying the flag; the
+// UPDATE branch touches ONLY hide_stats (never identity fields, never
+// profile_state — activation stays /sso/authorize's alone, D3).
+async function setAccountHideStats({ githubId, githubLogin, displayName, avatarUrl, hide }, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return null;
+  const { rows } = await pool.query(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, hide_stats)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (github_id) DO UPDATE SET
+       hide_stats = EXCLUDED.hide_stats,
+       updated_at = now()
+     RETURNING github_id, github_login, profile_state, hide_stats`,
+    [githubId, githubLogin, displayName ?? null, avatarUrl ?? null, !!hide],
+  );
+  return rows[0];
+}
+
 // -------------------------------------------------------------------------
 // Authorization codes (single-use, short-lived, bound)
 // -------------------------------------------------------------------------
@@ -548,15 +706,21 @@ module.exports = {
   // memberships
   MEMBERSHIP_ROLES,
   upsertMembership,
+  getMembership,
   listMembershipsForAccount,
   removeMembership,
   // invitations
   inviteToProject,
   listPendingInvitesForAccount,
   resolveInvite,
-  // cross-project activity + scouting
+  // cross-project activity + scouting + profile rollup
   upsertActivity,
   listScoutingRollup,
+  isNumericGithubId,
+  getRollupForBuilder,
+  getPublicProfileExtras,
+  getOwnProfileExtras,
+  setAccountHideStats,
   // codes
   mintAuthCode,
   redeemAuthCode,

package/modules/platform-identity/routes/profile.js

@@ -0,0 +1,77 @@
+// modules/platform-identity/routes/profile.js — the builder's OWN cross-project
+// profile controls (ADR 0171 D4, task 1002279 / goal 1000045). Two own-scoped
+// endpoints behind a live session; both key on req.builder.github_id — never a
+// caller-named id — so a builder can only ever read or flip their own flag.
+//
+//   GET   /me/cross-project — the Settings self view: the hide flag + consent
+//                             state + the builder's own rollup, served regardless
+//                             of flags (getOwnProfileExtras — a hidden builder
+//                             inspects their numbers HERE, not on the public
+//                             route, which stays viewer-independent).
+//   PATCH /me/cross-project — flip hide_stats. Takes effect immediately on every
+//                             public surface (profile cross_project, /people,
+//                             /scouting): enforcement lives in the module's read
+//                             functions (D2) and the hub profile response is
+//                             no-store (D5), so there is no cache to outwait.
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+
+const { pool, requireBuilder, validateOrRespond } = api;
+
+module.exports = function profileRoutes() {
+  const router = express.Router();
+
+  // rank: any-builder — the caller's OWN cross-project record + hide flag (own data).
+  router.get('/me/cross-project', requireBuilder, async (req, res) => {
+    try {
+      // Core builders include system:* principals whose github_id is not numeric;
+      // they have no platform identity — answer the empty shape, not a 500.
+      if (!pi.isNumericGithubId(req.builder.github_id)) {
+        return res.json({ hide_stats: false, profile_state: null, cross_project: null });
+      }
+      const [acct, extras] = await Promise.all([
+        pi.getAccount(req.builder.github_id, { pool }),
+        pi.getOwnProfileExtras(req.builder.github_id, { pool }),
+      ]);
+      res.json({
+        hide_stats: !!(acct && acct.hide_stats),
+        profile_state: acct ? acct.profile_state : null,
+        cross_project: extras,
+      });
+    } catch (err) {
+      console.error('[platform-identity] GET /me/cross-project', err);
+      res.fail('cross_project_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: any-builder — flip the caller's OWN hide flag (C2's self-serve opt-out;
+  // own data, keyed on the authenticated github_id).
+  router.patch('/me/cross-project', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      hide_stats: { required: true, type: 'boolean' },
+    })) return;
+    try {
+      if (!pi.isNumericGithubId(req.builder.github_id)) {
+        return res.fail('no_platform_identity', 400);
+      }
+      const row = await pi.setAccountHideStats({
+        githubId: req.builder.github_id,
+        githubLogin: req.builder.github_login,
+        displayName: req.builder.display_name,
+        avatarUrl: req.builder.avatar_url,
+        hide: req.body.hide_stats,
+      }, { pool });
+      res.json({ hide_stats: !!(row && row.hide_stats) });
+    } catch (err) {
+      console.error('[platform-identity] PATCH /me/cross-project', err);
+      res.fail('cross_project_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/platform-identity/routes/scouting.js

@@ -1,9 +1,10 @@
-// modules/platform-identity/routes/scouting.js — the INTERNAL, Archon-only
-// cross-project scouting view (ADR 0141 §4, task #1002114). Ranks builders across
-// ALL hosted projects from platform_identity_builder_project_activity. It is a
-// talent tool for the platform operator — NOT shown to builders, and NOT authority
-// (the rollup is descriptive; authority stays local, ADR 0141 / ADR 0016). Consent
-// for cross-project aggregation is handled by the platform T&C (out of scope here).
+// modules/platform-identity/routes/scouting.js — the INTERNAL cross-project
+// scouting view (ADR 0141 §4, task #1002114; Metic floor per ADR 0157). Ranks
+// builders across ALL hosted projects from platform_identity_builder_project_activity.
+// A talent tool for the platform operator — NOT authority (the rollup is
+// descriptive; authority stays local, ADR 0141 / ADR 0016). Consent is enforced
+// IN listScoutingRollup itself (ADR 0171 D2/D3): only profile_state='active',
+// non-hidden builders appear, so this surface honors hide by construction.
 //
 // Reaches core only through the doorway (ADR 0083).
 'use strict';

package/modules/platform-identity/routes/sso.js

@@ -94,7 +94,26 @@ async function fanOutBackchannelLogout(githubId) {
   }
 }
 
+// Register the `platform-identity.hub` kernel PORT (ADR 0171 D1/D2) — the
+// declared-but-previously-unwired port from module.json `provides`. The core
+// profile route (src/bongos/routes/builders.js) resolves it beside 'reward' to
+// attach the cross_project section; on any instance without this module the
+// resolve returns null and the section is absent (degrade, don't 500). Shapes
+// are whitelisted INSIDE the module (client_id never crosses the port).
+// Registered from the route factory (the one boot hook that runs both live AND
+// when a test rebuilds the GDS router), hasProvider-guarded so re-instantiation
+// never trips the single-provider guard — the builder-settings pattern.
+function registerSeams() {
+  if (!api.hasProvider('platform-identity.hub')) {
+    api.registerProvider('platform-identity.hub', {
+      getPublicProfileExtras: (githubId) => pi.getPublicProfileExtras(githubId, { pool }),
+      getOwnProfileExtras: (githubId) => pi.getOwnProfileExtras(githubId, { pool }),
+    });
+  }
+}
+
 module.exports = function ssoRoutes() {
+  registerSeams();
   const router = express.Router();
 
   // Wire the federated single-logout fan-out to core's `builder.logout` event,
@@ -170,12 +189,16 @@ module.exports = function ssoRoutes() {
 
     // A live hub session — record/refresh the platform account and mint a
     // single-use code bound to (client_id, github_id, redirect_uri).
+    // `activate: true` — this is THE consent upgrade path (ADR 0171 D3): a
+    // hub-session authorize is the one place a human is demonstrably at the hub,
+    // so the account's profile_state lazily flips provisional → active here.
     try {
       await pi.upsertAccount({
         githubId: session.github_id,
         githubLogin: session.github_login,
         displayName: session.display_name,
         avatarUrl: session.avatar_url,
+        activate: true,
       }, { pool });
       const code = await pi.mintAuthCode({
         clientId,
@@ -382,6 +405,21 @@ module.exports = function ssoRoutes() {
       if (!client || client.status !== 'active' || !pi.clientSecretValid(client, b.client_secret)) {
         return res.fail('invalid_client', 401);
       }
+      // Impersonation hardening (ADR 0171 D7) — this data now feeds a PUBLIC
+      // portfolio, so a client may only report activity for a builder who
+      // actually holds a membership on that project. Non-numeric github_id is
+      // rejected before it can hit the bigint column; a 'pending' row is an
+      // invite pre-seed, not a membership (listMembershipsForAccount excludes
+      // it), so it does not satisfy the requirement. The instance sequences its
+      // check-in BEFORE this rollup (src/bongos/auth.js), so the legit first
+      // sign-in always has its membership row by the time this arrives.
+      if (!pi.isNumericGithubId(b.github_id)) {
+        return res.fail('invalid_github_id', 400);
+      }
+      const membership = await pi.getMembership(b.client_id, b.github_id, { pool });
+      if (!membership || membership.role === 'pending') {
+        return res.fail('membership_required', 409);
+      }
       await pi.upsertActivity({
         clientId: b.client_id,
         githubId: b.github_id,

package/modules/platform-identity/tests/platform-identity.mjs

@@ -128,8 +128,8 @@ t('a service principal (system_role set) may NOT federate', () => {
 
 console.log('\naccounts:');
 
-await ta('upsertAccount upserts on github_id and returns the row', async () => {
-  const row = { id: '1', github_id: '42', github_login: 'octocat', display_name: 'Octo', avatar_url: 'a' };
+await ta('upsertAccount upserts on github_id and returns the row (default: NOT activating)', async () => {
+  const row = { id: '1', github_id: '42', github_login: 'octocat', display_name: 'Octo', avatar_url: 'a', profile_state: 'provisional' };
   const pool = mockPool([{ rows: [row] }]);
   const out = await P.upsertAccount(
     { githubId: 42, githubLogin: 'octocat', displayName: 'Octo', avatarUrl: 'a' }, { pool });
@@ -137,7 +137,20 @@ await ta('upsertAccount upserts on github_id and returns the row', async () => {
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_accounts/);
   assert.match(c.text, /ON CONFLICT \(github_id\) DO UPDATE/);
-  assert.deepEqual(c.params, [42, 'octocat', 'Octo', 'a']);
+  assert.deepEqual(c.params, [42, 'octocat', 'Octo', 'a', false]);
+});
+
+await ta('upsertAccount consent upgrade is one-way (ADR 0171 D3): activate flips to active, default preserves the stored state', async () => {
+  const pool = mockPool([{ rows: [{ id: '1' }] }, { rows: [{ id: '1' }] }]);
+  await P.upsertAccount({ githubId: 42, githubLogin: 'octocat', activate: true }, { pool });
+  await P.upsertAccount({ githubId: 42, githubLogin: 'octocat' }, { pool });
+  const sql = pool.calls[0].text;
+  // INSERT: activate decides active vs the fail-closed provisional default.
+  assert.match(sql, /CASE WHEN \$5::boolean THEN 'active' ELSE 'provisional' END/);
+  // UPDATE: a non-activating upsert must KEEP the stored profile_state (never demote).
+  assert.match(sql, /CASE WHEN \$5::boolean THEN 'active' ELSE platform_identity_accounts\.profile_state END/);
+  assert.equal(pool.calls[0].params[4], true, 'activate:true passes true');
+  assert.equal(pool.calls[1].params[4], false, 'default passes false');
 });
 
 console.log('\nSSO client registry:');
@@ -334,6 +347,44 @@ await ta('upsertActivity upserts per (client_id, github_id) with the talent snap
   assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer']]);
 });
 
+await ta('upsertActivity sanitizes third-party self-report (ADR 0171 D7): off-ladder rank → null, disciplines validated + capped', async () => {
+  const pool = mockPool([{ rows: [{ id: '1' }] }]);
+  await P.upsertActivity({
+    clientId: 'c1', githubId: 42,
+    rank: 'Supreme Overlord', // not one of the four core rank keys → stored null
+    disciplines: [
+      'engineer', 42, null, { evil: true }, // non-strings dropped
+      'x'.repeat(33),                        // over-length dropped
+      'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', // valid tail — capped to 8 total
+    ],
+  }, { pool });
+  const c = pool.calls[0];
+  assert.equal(c.params[5], null, 'an invented rank label is never stored');
+  const disc = c.params[6];
+  assert.ok(disc.length <= 8, `disciplines capped at 8 (got ${disc.length})`);
+  assert.ok(disc.every((d) => typeof d === 'string' && d.length > 0 && d.length <= 32),
+    'only bounded string elements survive');
+  assert.equal(disc[0], 'engineer', 'valid elements pass through in order');
+});
+
+await ta('upsertActivity keeps a legitimate core rank key', async () => {
+  const pool = mockPool([{ rows: [{ id: '1' }] }]);
+  await P.upsertActivity({ clientId: 'c1', githubId: 42, rank: 'archon', disciplines: [] }, { pool });
+  assert.equal(pool.calls[0].params[5], 'archon');
+});
+
+await ta('getMembership reads one (client, builder) row — the rollup membership requirement', async () => {
+  const row = { id: '9', client_id: 'c1', github_id: '42', role: 'builder' };
+  const pool = mockPool([{ rows: [row] }]);
+  const out = await P.getMembership('c1', 42, { pool });
+  assert.deepEqual(out, row);
+  const c = pool.calls[0];
+  assert.match(c.text, /FROM platform_identity_project_memberships/);
+  assert.deepEqual(c.params, ['c1', 42]);
+  const miss = await P.getMembership('c1', 43, { pool });
+  assert.equal(miss, null);
+});
+
 await ta('listScoutingRollup aggregates per builder across projects, ranked, joined to accounts', async () => {
   const pool = mockPool([{ rows: [{ github_id: '42', github_login: 'octo', total_credits: 250, project_count: 2 }] }]);
   const out = await P.listScoutingRollup({ pool, limit: 50 });
@@ -363,6 +414,111 @@ await ta('listScoutingRollup scalar aggregation is fan-out-free (task 1002911)',
   assert.match(discCte, /array_agg\(DISTINCT x\.d\)/, 'disciplines are deduped across projects');
 });
 
+await ta('listScoutingRollup enforces consent IN the query (ADR 0171 D2/D3)', async () => {
+  // /people and /scouting must honor hide BY CONSTRUCTION: the predicate lives
+  // in the scalar-aggregation CTE, not in any caller. Semantics proven against
+  // real SQL by tests/profile_rollup_consent.mjs.
+  const pool = mockPool([{ rows: [] }]);
+  await P.listScoutingRollup({ pool, limit: 10 });
+  const aggCte = pool.calls[0].text.slice(0, pool.calls[0].text.indexOf('disc AS'));
+  assert.match(aggCte, /profile_state = 'active'/, 'provisional accounts drop out');
+  assert.match(aggCte, /NOT pa\.hide_stats/, 'hidden builders drop out');
+});
+
+console.log('\nprofile rollup port (ADR 0171, task 1002278):');
+
+await ta('getRollupForBuilder guards non-numeric github_id BEFORE any query (no bigint cast error)', async () => {
+  const pool = mockPool([]);
+  for (const bad of ['system:bfg', 'system:grader', '', null, undefined, '42abc']) {
+    assert.equal(await P.getRollupForBuilder(bad, { pool }), null, `"${bad}" → null`);
+  }
+  assert.equal(pool.calls.length, 0, 'no query is ever issued for a non-numeric id');
+});
+
+await ta('getRollupForBuilder aggregates un-fanned + names only publicly-catalogued projects', async () => {
+  const pool = mockPool([
+    { rows: [{ projects: 2, credits: 150, works_shipped: 7, karma: 4, last_active: 'T', disciplines: ['engineer', 'ui'] }] },
+    { rows: [
+      { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic', is_public: true },
+      { name: 'Secret Proj', origin: 'https://sec.example', rank_held: 'archon', is_public: false },
+    ] },
+  ]);
+  const out = await P.getRollupForBuilder(42, { pool });
+  assert.deepEqual(out.totals, { projects: 2, credits: 150, works_shipped: 7, karma: 4 });
+  assert.deepEqual(out.disciplines, ['engineer', 'ui']);
+  assert.equal(out.projects.length, 1, 'only the public catalog row is named');
+  assert.deepEqual(out.projects[0], { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic' });
+  assert.equal(out.more_projects, 1, 'the non-public project is counted, never named');
+  // The whitelist holds structurally: client_id never appears in the shape.
+  assert.ok(!JSON.stringify(out).includes('client_id'), 'client_id must not cross the port');
+  // The scalar aggregation must be un-fanned (the 1002911 rule), disciplines separate.
+  const aggSql = pool.calls[0].text;
+  const aggCte = aggSql.slice(aggSql.indexOf('WITH agg AS'), aggSql.indexOf('disc AS'));
+  assert.doesNotMatch(aggCte, /unnest/i, 'scalar CTE must not fan rows out');
+  assert.match(aggSql.slice(aggSql.indexOf('disc AS')), /array_agg\(DISTINCT x\.d\)/);
+});
+
+await ta('getPublicProfileExtras is fail-closed: null for missing / provisional / hidden accounts', async () => {
+  // No account row at all.
+  assert.equal(await P.getPublicProfileExtras(42, { pool: mockPool([{ rows: [] }]) }), null);
+  // Provisional (no hub-session consent yet).
+  assert.equal(await P.getPublicProfileExtras(42, {
+    pool: mockPool([{ rows: [{ profile_state: 'provisional', hide_stats: false }] }]) }), null);
+  // Active but hidden.
+  assert.equal(await P.getPublicProfileExtras(42, {
+    pool: mockPool([{ rows: [{ profile_state: 'active', hide_stats: true }] }]) }), null);
+  // Non-numeric principal — null before any query.
+  const silent = mockPool([]);
+  assert.equal(await P.getPublicProfileExtras('system:bfg', { pool: silent }), null);
+  assert.equal(silent.calls.length, 0);
+});
+
+await ta('getPublicProfileExtras returns the rollup for an active, visible account', async () => {
+  const pool = mockPool([
+    { rows: [{ profile_state: 'active', hide_stats: false }] },
+    { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
+    { rows: [] },
+  ]);
+  const out = await P.getPublicProfileExtras(42, { pool });
+  assert.deepEqual(out.totals, { projects: 1, credits: 10, works_shipped: 1, karma: 0 });
+  assert.deepEqual(out.disciplines, [], 'null disciplines surface as an empty array');
+  assert.deepEqual(out.projects, []);
+  assert.equal(out.more_projects, 0);
+});
+
+await ta('setAccountHideStats flips ONLY the hide flag (never identity, never profile_state)', async () => {
+  const pool = mockPool([{ rows: [{ github_id: '42', hide_stats: true, profile_state: 'provisional' }] }]);
+  const out = await P.setAccountHideStats(
+    { githubId: 42, githubLogin: 'octo', displayName: 'Octo', avatarUrl: 'a', hide: true }, { pool });
+  assert.equal(out.hide_stats, true);
+  const c = pool.calls[0];
+  assert.match(c.text, /ON CONFLICT \(github_id\) DO UPDATE/);
+  // The UPDATE branch may set hide_stats + updated_at and NOTHING else — a
+  // settings toggle is not an identity refresh and must never touch consent.
+  const updateBranch = c.text.slice(c.text.indexOf('DO UPDATE'), c.text.indexOf('RETURNING'));
+  assert.match(updateBranch, /hide_stats = EXCLUDED\.hide_stats/);
+  assert.doesNotMatch(updateBranch, /github_login|display_name|avatar_url|profile_state/,
+    'the update branch must not clobber identity or consent');
+  assert.equal(c.params[4], true, 'hide passed as a boolean');
+});
+
+await ta('setAccountHideStats guards non-numeric github_id (system:* principals) → null, no query', async () => {
+  const pool = mockPool([]);
+  assert.equal(await P.setAccountHideStats({ githubId: 'system:bfg', hide: true }, { pool }), null);
+  assert.equal(pool.calls.length, 0);
+});
+
+await ta('getOwnProfileExtras serves the self view regardless of flags (no flags lookup)', async () => {
+  const pool = mockPool([
+    { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
+    { rows: [] },
+  ]);
+  const out = await P.getOwnProfileExtras(42, { pool });
+  assert.ok(out && out.totals, 'self view returns the rollup');
+  assert.ok(!pool.calls.some((c) => /profile_state/.test(c.text)),
+    'the self read never consults profile_state/hide_stats');
+});
+
 console.log('\nauthorization codes:');
 
 await ta('mintAuthCode stores the HASH of the code (never the plaintext) + binds it', async () => {