@bongos/core 1.19.168 → 1.19.170

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.168",
+  "version": "1.19.170",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.168",
+      "version": "1.19.170",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.168",
+  "version": "1.19.170",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -75,7 +75,7 @@ const INTEGRATION = new Set([
   'consumer_layout_boot',
   'claim_gate_open_blocker', 'claim_gate_rebase', 'clawback_confirmed_backlog', 'discord_autojoin', 'discord_oauth',
   'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
-  'memory_pull', 'needs_rebase', 'parallel-load', 'reward_mode_cost_plus_only',
+  'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
   'scouting_rollup_fanout', 'session_records', 'setup_smoke',
   'status-probe',
 ]);

package/src/bongos/auth.js

@@ -764,9 +764,17 @@ async function completeIdpFlow({ code, redirectUri, userAgent: ua }) {
     expiresAt,
   });
   await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) — federated web sign-in.
-  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: identity.display_name, avatarUrl: identity.avatar_url });
-  reportActivityRollup({ builderId: builder.id, githubId: ghId });
+  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) —
+  // federated web sign-in. The rollup is CHAINED after the check-in (ADR 0171 D7):
+  // the hub now requires a membership row before accepting activity, so a first
+  // sign-in's rollup must not race its own check-in. Both swallow all errors, so
+  // the chain never rejects and the sign-in never waits on it.
+  // Both helpers are async (always return a promise) and swallow their own
+  // errors; the .catch is belt-and-braces so this floating chain can never
+  // surface an unhandledRejection even if a future edit lets one throw.
+  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: identity.display_name, avatarUrl: identity.avatar_url })
+    .then(() => reportActivityRollup({ builderId: builder.id, githubId: ghId }))
+    .catch(() => {});
   return { token, builder, expiresAt };
 }
 
@@ -935,9 +943,13 @@ async function completeDeviceExchange({ assertion, userAgent: ua }) {
     expiresAt: null,
   });
   await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) — federated CLI sign-in.
-  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: payload.display_name, avatarUrl: payload.avatar_url });
-  reportActivityRollup({ builderId: builder.id, githubId: ghId });
+  // Fire-and-forget hub membership check-in + activity rollup (ADR 0141 §3/§4) —
+  // federated CLI sign-in. Rollup chained after check-in (ADR 0171 D7): the hub's
+  // membership requirement must not race a first sign-in; both swallow errors.
+  // Async + self-swallowing helpers; .catch is belt-and-braces (see web flow).
+  reportMembershipCheckIn({ githubId: ghId, githubLogin: ghLogin, displayName: payload.display_name, avatarUrl: payload.avatar_url })
+    .then(() => reportActivityRollup({ builderId: builder.id, githubId: ghId }))
+    .catch(() => {});
   return { token, builder };
 }
 

package/src/bongos/routes/builders.js

@@ -460,13 +460,17 @@ module.exports = function buildBuildersRouter() {
       const b = await db.getBuilderById(targetId);
       if (!b) return res.fail('builder_not_found', 404);
       // Recent ships + shipped-count read the lifecycle port; the achievement
-      // shelf reads the reward port. Both resolveOptional — on a vanilla instance
-      // without economy the achievement shelf degrades to empty, not a 500.
+      // shelf reads the reward port; the cross-project record reads the hub port
+      // (ADR 0171 D1 — registered only where the platform-identity module is
+      // enabled, i.e. the hub). All resolveOptional — on a vanilla instance the
+      // shelf degrades to empty and the cross_project section is absent, not a 500.
       const reward = seams.resolveOptional('reward');
-      const [shippedCount, recentShips, achievements] = await Promise.all([
+      const hub = seams.resolveOptional('platform-identity.hub');
+      const [shippedCount, recentShips, achievements, crossProject] = await Promise.all([
         lc().countShippedTasksForBuilder(targetId),
         lc().recentShippedTasksByBuilder(targetId, 5),
         reward ? reward.getBuilderAchievements(targetId) : [],
+        hub ? hub.getPublicProfileExtras(b.github_id) : null,
       ]);
       // WHITELIST — only the leaderboard-equivalent public field set. Never spread
       // the raw row: it carries anthropic_email / anthropic_user_id /
@@ -484,8 +488,24 @@ module.exports = function buildBuildersRouter() {
         preferred_disciplines: b.preferred_disciplines,
       };
       // Identity + counters change rarely; a short public cache matches
-      // /public/leaderboard's posture.
-      res.set('Cache-Control', 'public, max-age=60');
+      // /public/leaderboard's posture. On the hub the response carries the
+      // cross_project section, whose hide flag must take effect IMMEDIATELY
+      // (ADR 0171 D5) — a 60s cached copy would keep serving hidden stats — so
+      // when the hub port resolves the response is no-store.
+      res.set('Cache-Control', hub ? 'no-store' : 'public, max-age=60');
+      // cross_project is attached only where the hub port exists (two literal
+      // branches so gen-api-docs proves the shape — the key merges as optional);
+      // null there means "no public cross-project record" (hidden / provisional /
+      // none — deliberately indistinguishable). Viewer-independent (ADR 0171 D4).
+      if (hub) {
+        return res.json({
+          builder,
+          shipped_count: shippedCount,
+          recent_ships: recentShips,
+          achievements,
+          cross_project: crossProject,
+        });
+      }
       res.json({
         builder,
         shipped_count: shippedCount,

package/src/module-api.js

@@ -763,8 +763,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.166 with no explicit bump. run 31961815831. (task 1002620)
 //   1.19.168 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.167 with no explicit bump. run 31962256201. (task 1002620)
+//   1.19.169 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.168 with no explicit bump. run 31964702865. (task 1002620)
+//   1.19.170 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.169 with no explicit bump. run 31965483417. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.168'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.170'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/profile_rollup_consent.mjs

@@ -0,0 +1,187 @@
+// tests/profile_rollup_consent.mjs — task 1002278 (R02, ADR 0171; real DB).
+//
+// Proves the consent + hide semantics against real SQL — pg-mem cannot execute
+// unnest(), so the rollup queries need a live Postgres (the task-1002911
+// precedent). Replays the module's actual migrations, then asserts:
+//   1. listScoutingRollup lists ONLY active + not-hidden builders (D2/D3) —
+//      provisional and hidden accounts drop out of /people + /scouting by
+//      construction.
+//   2. getRollupForBuilder aggregates un-fanned and names ONLY projects whose
+//      catalog row is publicly listed (featured + active); everything else is
+//      counted in more_projects, never named. client_id never crosses.
+//   3. getPublicProfileExtras is fail-closed (missing/provisional/hidden/
+//      non-numeric → null); getOwnProfileExtras serves the self view anyway.
+//   4. upsertAccount's consent upgrade is one-way (activate flips provisional →
+//      active; a later plain upsert never demotes).
+//   5. upsertActivity stores a validated rank (off-ladder → NULL) + capped
+//      disciplines against the real columns (D7).
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/profile_rollup_consent.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`profile_rollup_consent.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const ACTIVE = 90002278, HIDDEN = 90002279, PROV = 90002280, LAZY = 90002281;
+const ALL_IDS = [ACTIVE, HIDDEN, PROV, LAZY];
+const PUB_CLIENT = 't1002278-pub', PRIV_CLIENT = 't1002278-priv', LOST_CLIENT = 't1002278-lost';
+const ALL_CLIENTS = [PUB_CLIENT, PRIV_CLIENT, LOST_CLIENT];
+const PUB_ORIGIN = 'https://t1002278-pub.example', PRIV_ORIGIN = 'https://t1002278-priv.example';
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_project_memberships WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [[PUB_ORIGIN, PRIV_ORIGIN]]).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE client_id = ANY($1::text[])`, [ALL_CLIENTS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  // The module's actual migrations (idempotent).
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_004_projects.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, profile_state, hide_stats)
+     VALUES ($1, 'active-b', 'Active', 'active', false),
+            ($2, 'hidden-b', 'Hidden', 'active', true),
+            ($3, 'prov-b',   'Prov',   'provisional', false)`,
+    [ACTIVE, HIDDEN, PROV],
+  );
+  // Three reporting projects: one publicly catalogued (featured+active), one
+  // catalogued but NOT featured (→ never named), one with no catalog row at all.
+  await q(
+    `INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin)
+     VALUES ($1, 'x', 'Pub Proj', $4), ($2, 'x', 'Priv Proj', $5), ($3, 'x', 'Lost Proj', NULL)`,
+    [...ALL_CLIENTS, PUB_ORIGIN, PRIV_ORIGIN],
+  );
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, featured, status)
+     VALUES ($1, 'Pub Proj', true, 'active'), ($2, 'Priv Proj', false, 'active')`,
+    [PUB_ORIGIN, PRIV_ORIGIN],
+  );
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity
+       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active)
+     VALUES ($1, $4, 100, 5, 3, 'metic',  '{engineer,ui}', '2026-01-01T00:00:00Z'),
+            ($2, $4,  50, 2, 1, 'archon', '{artist}',      '2026-02-01T00:00:00Z'),
+            ($3, $4,  25, 1, 0, NULL,     '{}',            '2026-03-01T00:00:00Z'),
+            ($1, $5,  60, 4, 2, 'metic',  '{engineer}',    '2026-01-01T00:00:00Z'),
+            ($1, $6,  10, 1, 0, 'xenos',  '{engineer}',    '2026-01-01T00:00:00Z')`,
+    [...ALL_CLIENTS, ACTIVE, HIDDEN, PROV],
+  );
+
+  // 1 — the scouting/people predicate (D2/D3).
+  const listed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
+  ok(listed.includes(ACTIVE), 'active + visible builder is listed');
+  ok(!listed.includes(HIDDEN), 'hide_stats builder drops out of the scouting rollup');
+  ok(!listed.includes(PROV), 'provisional (no hub-session consent) builder drops out');
+
+  // 2 — getRollupForBuilder semantics.
+  const r = await pi.getRollupForBuilder(ACTIVE, { pool });
+  assert.deepEqual(r.totals, { projects: 3, credits: 175, works_shipped: 8, karma: 4 });
+  pass++; console.log('  ok - totals aggregate un-fanned across the builder\'s projects');
+  assert.deepEqual([...r.disciplines].sort(), ['artist', 'engineer', 'ui']);
+  pass++; console.log('  ok - disciplines are the deduped union');
+  ok(new Date(r.last_active).toISOString() === '2026-03-01T00:00:00.000Z', 'last_active is the max');
+  ok(r.projects.length === 1 && r.projects[0].name === 'Pub Proj', 'only the publicly-catalogued project is named');
+  assert.deepEqual(Object.keys(r.projects[0]).sort(), ['name', 'origin', 'rank_held']);
+  pass++; console.log('  ok - named rows carry exactly name/origin/rank_held');
+  ok(r.projects[0].rank_held === 'metic', 'rank_held is that project\'s reported standing');
+  ok(r.more_projects === 2, 'unfeatured + uncatalogued projects are counted, never named');
+  ok(!JSON.stringify(r).includes('client_id'), 'client_id never crosses the shape');
+  ok(!JSON.stringify(r).includes('Priv Proj'), 'a non-public project name never crosses');
+
+  // 3 — the port reads.
+  ok(await pi.getPublicProfileExtras(HIDDEN, { pool }) === null, 'public read → null for a hidden builder');
+  ok(await pi.getPublicProfileExtras(PROV, { pool }) === null, 'public read → null for a provisional builder');
+  ok(await pi.getPublicProfileExtras(99999999999, { pool }) === null, 'public read → null with no account');
+  ok(await pi.getPublicProfileExtras('system:bfg', { pool }) === null, 'non-numeric principal → null, no bigint cast error');
+  const pub = await pi.getPublicProfileExtras(ACTIVE, { pool });
+  ok(pub && pub.totals.credits === 175, 'public read returns the rollup for an active, visible builder');
+  const own = await pi.getOwnProfileExtras(HIDDEN, { pool });
+  ok(own && own.totals.credits === 60, 'self view serves a hidden builder their own numbers');
+
+  // 4 — one-way consent upgrade on the real upsert.
+  await pi.upsertAccount({ githubId: LAZY, githubLogin: 'lazy-b' }, { pool });
+  let acct = await pi.getAccount(LAZY, { pool });
+  ok(acct.profile_state === 'provisional', 'a plain upsert creates a provisional account');
+  await pi.upsertAccount({ githubId: LAZY, githubLogin: 'lazy-b', activate: true }, { pool });
+  acct = await pi.getAccount(LAZY, { pool });
+  ok(acct.profile_state === 'active', 'an authorize-path upsert (activate) flips it active');
+  await pi.upsertAccount({ githubId: LAZY, githubLogin: 'lazy-b' }, { pool });
+  acct = await pi.getAccount(LAZY, { pool });
+  ok(acct.profile_state === 'active', 'a later plain upsert never demotes an active account');
+
+  // 4b — the live hide toggle (R03, task 1002279): flipping hide_stats takes
+  // effect IMMEDIATELY on every public read — the profile port and the
+  // /people + /scouting rollup — while the self view keeps serving.
+  await pi.setAccountHideStats({ githubId: ACTIVE, githubLogin: 'active-b', hide: true }, { pool });
+  ok(await pi.getPublicProfileExtras(ACTIVE, { pool }) === null, 'hide ON → public read drops to null immediately');
+  const hiddenListed = (await pi.listScoutingRollup({ limit: 500, pool })).map((r) => Number(r.github_id));
+  ok(!hiddenListed.includes(ACTIVE), 'hide ON → the builder drops out of /people + /scouting immediately');
+  const stillOwn = await pi.getOwnProfileExtras(ACTIVE, { pool });
+  ok(stillOwn && stillOwn.totals.credits === 175, 'hide ON → the self view still serves their own numbers');
+  let hiddenAcct = await pi.getAccount(ACTIVE, { pool });
+  ok(hiddenAcct.profile_state === 'active', 'the toggle never touches profile_state');
+  ok(hiddenAcct.github_login === 'active-b', 'the toggle never clobbers identity fields');
+  await pi.setAccountHideStats({ githubId: ACTIVE, githubLogin: 'active-b', hide: false }, { pool });
+  const backPub = await pi.getPublicProfileExtras(ACTIVE, { pool });
+  ok(backPub && backPub.totals.credits === 175, 'hide OFF → the public read returns immediately');
+
+  // 4c — hide-before-federating: a builder with NO account row can still hide;
+  // the insert creates a fail-closed provisional account carrying the flag.
+  const EARLY = 90002282;
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = $1`, [EARLY]).catch(() => {});
+  const early = await pi.setAccountHideStats({ githubId: EARLY, githubLogin: 'early-b', hide: true }, { pool });
+  ok(early.hide_stats === true && early.profile_state === 'provisional',
+    'hide with no account row creates a provisional, hidden account');
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = $1`, [EARLY]).catch(() => {});
+
+  // 5 — rollup payload sanitization against the real columns (D7).
+  await pi.upsertActivity({
+    clientId: PUB_CLIENT, githubId: LAZY, credits: 1,
+    rank: 'Supreme Overlord',
+    disciplines: ['engineer', 42, 'x'.repeat(33), 'a', 'b', 'c', 'd', 'e', 'f', 'g'],
+  }, { pool });
+  const { rows: [act] } = await q(
+    `SELECT rank_held, disciplines FROM platform_identity_builder_project_activity
+      WHERE client_id = $1 AND github_id = $2`, [PUB_CLIENT, LAZY]);
+  ok(act.rank_held === null, 'an off-ladder rank is stored as NULL');
+  ok(act.disciplines.length <= 8 && act.disciplines.every((d) => d.length <= 32),
+    'disciplines land validated + capped');
+
+  console.log(`\nprofile_rollup_consent.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/profile_route.mjs

@@ -73,6 +73,36 @@ const PUBLIC_KEYS = [
   'total_credits', 'karma', 'created_at', 'preferred_disciplines',
 ];
 
+// ---- the cross_project scope (ADR 0171, task 1002278) ---------------------
+//
+// On the hub the route resolves the 'platform-identity.hub' port and attaches
+// its whitelist-shaped return as `cross_project`. The stub below mirrors the
+// module's contract over an in-memory fixture that — like FULL_ROW above —
+// deliberately carries the module-internal values (a client_id, a non-public
+// project's name) so the raw-text scan proves the whitelist held end-to-end.
+const SECRET_CLIENT_ID = 'cli_DO_NOT_LEAK_9f3a';
+const SECRET_PROJECT_NAME = 'DO_NOT_LEAK_PRIVATE_PROJECT';
+const CROSS_PROJECT_ROWS = [
+  { client_id: SECRET_CLIENT_ID, name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic', is_public: true },
+  { client_id: SECRET_CLIENT_ID, name: SECRET_PROJECT_NAME, origin: 'https://priv.example', rank_held: 'archon', is_public: false },
+];
+// What the port returns for an active, visible account: the module's whitelist
+// shape — named projects only where the catalog row is public; the rest counted.
+function stubPublicProfileExtras() {
+  const named = CROSS_PROJECT_ROWS.filter((r) => r.is_public)
+    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held }));
+  return {
+    totals: { projects: 2, credits: 150, works_shipped: 7, karma: 4 },
+    disciplines: ['engineer', 'ui'],
+    last_active: '2026-08-01T00:00:00.000Z',
+    projects: named,
+    more_projects: CROSS_PROJECT_ROWS.length - named.length,
+  };
+}
+// The key contract for the cross_project object + its project rows.
+const CP_PUBLIC_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+const CP_PROJECT_ROW_KEYS = ['name', 'origin', 'rank_held'];
+
 // ---- stubs ----------------------------------------------------------------
 
 // auth: the profile route is public, but the router factory references
@@ -139,7 +169,7 @@ function get(port, path) {
       res.on('end', () => {
         const text = Buffer.concat(chunks).toString('utf8');
         let json = null; try { json = JSON.parse(text); } catch (_) {}
-        resolve({ status: res.statusCode, json, text });
+        resolve({ status: res.statusCode, json, text, headers: res.headers });
       });
     });
     req.on('error', reject);
@@ -192,6 +222,61 @@ await t('non-numeric id → 400 bad_builder_id', async () => {
   assert.equal(r.json && r.json.error && r.json.error.code, 'bad_builder_id');
 });
 
+// ---- cross_project (ADR 0171, task 1002278) -------------------------------
+// The hub port resolves at REQUEST time, so the port-absent tests above ran
+// against the same server; registering the stub here flips the route into its
+// hub posture for the tests below.
+
+await t('hub port ABSENT → no cross_project key + the cacheable posture stays', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  assert.ok(!('cross_project' in r.json), 'cross_project must be absent on a non-hub instance');
+  assert.equal(r.headers['cache-control'], 'public, max-age=60');
+});
+
+let hubExtras = stubPublicProfileExtras();
+seams.registerProvider('platform-identity.hub', {
+  getPublicProfileExtras: async () => hubExtras,
+  getOwnProfileExtras: async () => stubPublicProfileExtras(),
+});
+
+await t('hub port present → cross_project carries exactly the whitelist shape', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  const cp = r.json.cross_project;
+  assert.ok(cp, 'cross_project attached when the port resolves');
+  assert.deepEqual(Object.keys(cp).sort(), [...CP_PUBLIC_KEYS].sort(), 'cross_project keys are exactly the contract');
+  assert.deepEqual(Object.keys(cp.totals).sort(), ['credits', 'karma', 'projects', 'works_shipped']);
+  for (const row of cp.projects) {
+    assert.deepEqual(Object.keys(row).sort(), [...CP_PROJECT_ROW_KEYS].sort(), 'project rows carry only name/origin/rank_held');
+  }
+  assert.equal(cp.projects.length, 1, 'only the public catalog row is named');
+  assert.equal(cp.more_projects, 1, 'the non-public project is counted, never named');
+});
+
+await t('hub port present → module-internal sentinels leak NOWHERE in the response', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  for (const secret of [SECRET_CLIENT_ID, SECRET_PROJECT_NAME, SECRET_EMAIL, SECRET_USER, SECRET_REASON]) {
+    assert.ok(!r.text.includes(secret), `response body must not contain "${secret}"`);
+  }
+  assert.ok(!r.text.includes('client_id'), 'no client_id key may cross the port');
+});
+
+await t('hub port present → hide must beat the cache: Cache-Control is no-store', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.headers['cache-control'], 'no-store');
+});
+
+await t('hub port returns null (hidden/provisional/none) → cross_project: null, still no-store', async () => {
+  hubExtras = null;
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  assert.ok('cross_project' in r.json, 'the key is present on the hub');
+  assert.equal(r.json.cross_project, null, 'null — no partial numbers, indistinguishable from no-account');
+  assert.equal(r.headers['cache-control'], 'no-store');
+});
+
 server.close();
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/scouting_rollup_fanout.mjs

@@ -53,11 +53,15 @@ try {
   // The module's actual migrations (idempotent CREATE TABLE IF NOT EXISTS).
   await q(migrationSql('platform_identity_001_tables.sql'));
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
   await cleanup();
 
+  // profile_state='active' — since ADR 0171 the rollup only lists consented,
+  // visible builders; this test is about AGGREGATION, so fixtures opt in.
+  // (The predicate itself is proven by tests/profile_rollup_consent.mjs.)
   await q(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url)
-     VALUES ($1, 'multi', 'Multi', 'a'), ($2, 'solo', 'Solo', 'b'), ($3, 'ghost', 'Ghost', 'c')`,
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
+     VALUES ($1, 'multi', 'Multi', 'a', 'active'), ($2, 'solo', 'Solo', 'b', 'active'), ($3, 'ghost', 'Ghost', 'c', 'active')`,
     [MULTI, SOLO, GHOST],
   );
   // MULTI: two projects, 2 and 3 disciplines — the exact fan-out shape the old