@bongos/core 1.19.171 → 1.19.173

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.171",
-  "core_contract": "1.19.171",
-  "source_commit": "d102a0205fd62edcc81a804a8c439af4cde60606",
+  "core_version": "1.19.173",
+  "core_contract": "1.19.173",
+  "source_commit": "dfc63944c504d88bf4ebb93b033c06b7b3b472a7",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T19:20:36.950Z",
+  "built_at": "2026-08-16T19:48:53.327Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1269,
+    "functional_verbatim": 1272,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1595,
-  "tree_sha256": "1596294ffbb9fe146a18ced51823d4b074c23b5dd47601619bcd16752c5eaf04",
+  "file_count": 1598,
+  "tree_sha256": "ac7b1f942e74709cb79d331fe15d21c4fcfdb8c30c8f0d88fd199404d06462b1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "d6d6163164f98c96a8e25dfe84825669bf8324f1f1b98adb0674781ad235ad10"
+      "sha256": "6b865314ad2d5e2e3e0e017a6bed7ae435ecfbca3859bdf763b59411a1d3d9f8"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "386706d0ef3d09c5e074bdc45bfc0de869d732eb1cb2a2280472f02f797f2b74"
+      "sha256": "c137a0e79a5e9065b071f87150639bff98cbda8f0d50a27027b42fa48ae200f6"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "7d462b5b80c9db9159981406398fc62c5ba71043c6a3b9433852d06d612bf2b0"
+      "sha256": "2fef3ad1be5b853de1d6df155bb5717b581cf8b6afa3851add9ea81032c159a6"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4acb1dde6f894ba37cff7e27e0110f12ae30c7cb6e4d972d6e85d2877489b6d0"
+      "sha256": "52dbea93e7039796ebf579e816bd3ed54727077e5383d27a348d36572a85b90d"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "4c7679ef258644ab12db1b8fe412b388f96f4296c6aae45d6ab637a8f3b9a037"
+      "sha256": "b2d21163a9fb149a98051dfde08e1cee81969194e74d3e272bb7779da9461c1b"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1347,12 +1347,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "ccf59372e0456f36d83154d6dff4dbf5382e8d69023bee82b318b8e9cfb2c50b"
+      "sha256": "74ee845dae6f2757b564c1a760042391f3eb3af21dd3abe4a8590b3c3f88c4b3"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "4deac83a1d7c12e1a24109e856d9a6fef6b539afafdca55a525ab6786fe4e235"
+      "sha256": "1c8b42344fa248bd6e38d370cc117c5017fdd58071ba9cb2ca6e55a1678c5e56"
     },
     {
       "path": "docs/architecture.md",
@@ -2662,7 +2662,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "7d462b5b80c9db9159981406398fc62c5ba71043c6a3b9433852d06d612bf2b0"
+      "sha256": "2fef3ad1be5b853de1d6df155bb5717b581cf8b6afa3851add9ea81032c159a6"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3789,15 +3789,20 @@
       "mode": "0000644",
       "sha256": "cce2f971f030aa628f9d7855f2e421595ea71cb314e90965206dbe970b7beded"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_008_handle.sql",
+      "mode": "0000644",
+      "sha256": "f78eb8f7b6ee1ea3ddd789d6019b9715ae193ff0cb7890aeb24d8473033a911a"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "e993fb26e61249bf89c0b0a5977c60e9d974810ffe1b67e94d909e8b52e00d5e"
+      "sha256": "c4c02577f7318e994301bbe700e20dfb24519e411fee04539755f7374a73590b"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "96907af1af78c472118ecf5ed9f269d6d2ce940b09535aae3b3df4de4d2337c1"
+      "sha256": "59d9ef7d052890fdf09fd0a9f04432ab1baddc7c8dfe49950893b9dd67b89d66"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3817,13 +3822,18 @@
     {
       "path": "modules/platform-identity/routes/profile.js",
       "mode": "0000644",
-      "sha256": "6ea29b4f07417fa925b7987dd7fbe8a0262b7fec83ceffade9fccbc220289bba"
+      "sha256": "29e7f6304b4215fd79c35662c48370a04a5a9ffa2c3c4ae3d1fabf277d407eb2"
     },
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
       "sha256": "a3e25369ad9edc6aed1a8a6997d6b6cb794dce14abb3605954d535525af1a93a"
     },
+    {
+      "path": "modules/platform-identity/routes/public-profile.js",
+      "mode": "0000644",
+      "sha256": "9032ff152e6440187f0f9bd2b1a3bb9ea24167c9f6d79ae3345a26a0e2fdc356"
+    },
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
@@ -3837,7 +3847,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "18bf8d0cb42d76bc5413c760b13837fe439a6e719b88a84db96f143b829e67d5"
+      "sha256": "53b5bdd5c9eb4a14695289dd1396231d29e0f53c8709bd591dc328362da88072"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4212,12 +4222,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "90e1fc07f655eb2874620b5a85f965e4f32cc20aeddb552dbc8885c4681150d9"
+      "sha256": "6c8e9ca33aba6a1b42addf6f862daad54f2e0ba87a43090129a2afe23edc53e6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2b1408849261b93418e448820da8081a7ec83fa6b5c2a51b9e1aa5dca7456efb"
+      "sha256": "1c163fb61de2b5c9024266f6b1bd494687307421fb05370874842e67639e0311"
     },
     {
       "path": "public-docs/index.html",
@@ -5822,7 +5832,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "17202c8572c75ca1af5cd2eee1c8dd1ba4b6ea4c5fd7cd757eaf97907d26a268"
+      "sha256": "479f80926d0dfcd56bfb6b47dfe8fac208ce8ce3c873e6a016c4af0e5f015edd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6904,6 +6914,11 @@
       "mode": "0000644",
       "sha256": "82bf1cc68150c247c108308d360d6408511f31a7af11d5e7a4721e7ea282f2bb"
     },
+    {
+      "path": "tests/handle_machinery.mjs",
+      "mode": "0000644",
+      "sha256": "a86e615af8b148572abf562b3c7b0d556076286e76e2d8d576f782a90ba3d457"
+    },
     {
       "path": "tests/helpers.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 273 operations across 45 resource groups
+- 275 operations across 46 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -423,6 +423,8 @@ function createClient(opts = {}) {
       getMeEventSoundPrefs: (args) => request("GET", "/me/event-sound-prefs", { hasBody: false }, args),
       // PATCH /me/event-sound-prefs — rank: any-builder — PATCH /me/event-sound-prefs
       patchMeEventSoundPrefs: (args) => request("PATCH", "/me/event-sound-prefs", { hasBody: true }, args),
+      // PATCH /me/handle — rank: any-builder — PATCH /me/handle
+      patchMeHandle: (args) => request("PATCH", "/me/handle", { hasBody: true }, args),
       // GET /me/interaction — rank: any-builder — GET /me/interaction
       getMeInteraction: (args) => request("GET", "/me/interaction", { hasBody: false }, args),
       // PATCH /me/interaction — rank: any-builder — PATCH /me/interaction
@@ -500,6 +502,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -422,6 +422,8 @@ function createClient(opts = {}) {
       getMeEventSoundPrefs: (args) => request("GET", "/me/event-sound-prefs", { hasBody: false }, args),
       // PATCH /me/event-sound-prefs — rank: any-builder — PATCH /me/event-sound-prefs
       patchMeEventSoundPrefs: (args) => request("PATCH", "/me/event-sound-prefs", { hasBody: true }, args),
+      // PATCH /me/handle — rank: any-builder — PATCH /me/handle
+      patchMeHandle: (args) => request("PATCH", "/me/handle", { hasBody: true }, args),
       // GET /me/interaction — rank: any-builder — GET /me/interaction
       getMeInteraction: (args) => request("GET", "/me/interaction", { hasBody: false }, args),
       // PATCH /me/interaction — rank: any-builder — PATCH /me/interaction
@@ -499,6 +501,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -51,7 +51,7 @@ export interface GetInboxResponse { ideas: unknown; open_count: unknown }
 export interface GetLeaderboardResponse { leaderboard: unknown; page: unknown }
 export interface GetLearningsResponse { learnings: unknown }
 export interface GetMeAchievementsResponse { unlocked: unknown }
-export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; cross_project: unknown }
+export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; handle: unknown; cross_project: unknown }
 export interface GetMeDisplayNameResponse { display_name: unknown; max_length: unknown }
 export interface GetMeEventSoundPrefsResponse { prefs: unknown; effective: unknown; effective_wav: unknown; events: unknown }
 export interface GetMeRecentShipsResponse { ships: unknown }
@@ -68,6 +68,7 @@ export interface GetModulesSubmissionsResponse { submissions: unknown }
 export interface GetMyProjectsInvitesResponse { invites: unknown }
 export interface GetMyProjectsResponse { owned: unknown; building: unknown }
 export interface GetOverrideRequestsResponse { requests: unknown }
+export interface GetProfilesHandleResponse { account: unknown; cross_project: unknown }
 export interface GetProjectsFeaturedResponse { projects: unknown }
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown }
@@ -131,6 +132,8 @@ export interface PatchMeDisciplinesRequest { preferred_disciplines: string[] }
 export interface PatchMeDisciplinesResponse { builder: unknown; onboarding: unknown }
 export interface PatchMeDisplayNameResponse { display_name: unknown; max_length: unknown }
 export interface PatchMeEventSoundPrefsResponse { prefs: unknown; effective: unknown; effective_wav: unknown; events: unknown }
+export interface PatchMeHandleRequest { handle: string }
+export interface PatchMeHandleResponse { handle: unknown; previous_handle: unknown }
 export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown; defaults: unknown; known_skills: unknown; allowed_models: unknown }
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
@@ -662,6 +665,8 @@ export interface BongosClient {
     getMeEventSoundPrefs(args?: RequestArgs): Promise<GetMeEventSoundPrefsResponse>;
     /** PATCH /me/event-sound-prefs — rank: any-builder */
     patchMeEventSoundPrefs(args?: RequestArgs): Promise<PatchMeEventSoundPrefsResponse>;
+    /** PATCH /me/handle — rank: any-builder */
+    patchMeHandle(args: RequestArgs & { body: PatchMeHandleRequest }): Promise<PatchMeHandleResponse>;
     /** GET /me/interaction — rank: any-builder */
     getMeInteraction(args?: RequestArgs): Promise<ApiResponse>;
     /** PATCH /me/interaction — rank: any-builder */
@@ -739,6 +744,10 @@ export interface BongosClient {
     /** POST /override-requests/{id}/decide — rank: metic+archon */
     postOverrideRequestsIdDecide(args: RequestArgs & { body: PostOverrideRequestsIdDecideRequest }): Promise<ApiResponse>;
   };
+  "profiles": {
+    /** GET /profiles/{handle} — rank: public */
+    getProfilesHandle(args?: RequestArgs): Promise<GetProfilesHandleResponse>;
+  };
   "projects": {
     /** GET /projects — rank: metic+archon */
     getProjects(args?: RequestArgs): Promise<GetProjectsResponse>;

package/clients/bongos-client/index.mjs

@@ -419,6 +419,8 @@ export function createClient(opts = {}) {
       getMeEventSoundPrefs: (args) => request("GET", "/me/event-sound-prefs", { hasBody: false }, args),
       // PATCH /me/event-sound-prefs — rank: any-builder — PATCH /me/event-sound-prefs
       patchMeEventSoundPrefs: (args) => request("PATCH", "/me/event-sound-prefs", { hasBody: true }, args),
+      // PATCH /me/handle — rank: any-builder — PATCH /me/handle
+      patchMeHandle: (args) => request("PATCH", "/me/handle", { hasBody: true }, args),
       // GET /me/interaction — rank: any-builder — GET /me/interaction
       getMeInteraction: (args) => request("GET", "/me/interaction", { hasBody: false }, args),
       // PATCH /me/interaction — rank: any-builder — PATCH /me/interaction
@@ -496,6 +498,10 @@ export function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/docs/api/openapi.json

@@ -157,6 +157,10 @@
       "name": "override-requests",
       "description": "Endpoints under `/api/bongos/override-requests`."
     },
+    {
+      "name": "profiles",
+      "description": "Endpoints under `/api/bongos/profiles`."
+    },
     {
       "name": "projects",
       "description": "Endpoints under `/api/bongos/projects`."
@@ -6575,6 +6579,55 @@
         ]
       }
     },
+    "/me/handle": {
+      "patch": {
+        "operationId": "patch_me_handle",
+        "tags": [
+          "me"
+        ],
+        "summary": "PATCH /me/handle",
+        "description": "rename the caller's OWN handle (own data, keyed on the authenticated github_id). Rules live in setAccountHandle: canonical form, reserved words refused, one rename per window, previous handle kept for the 301 window. Upsert-first (the setAccountHideStats precedent) so a hub builder who never federated can still claim a handle — never demotes consent.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/profile.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchMeHandleRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchMeHandleResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/interaction": {
       "get": {
         "operationId": "get_me_interaction",
@@ -8114,6 +8167,48 @@
         ]
       }
     },
+    "/profiles/{handle}": {
+      "get": {
+        "operationId": "get_profiles_handle",
+        "tags": [
+          "profiles"
+        ],
+        "summary": "GET /profiles/:handle",
+        "description": "a handle-addressed public profile. Every field is already world-readable on the numeric profile route + the leaderboard; the handle is just the rename-proof address (spec Decision 3). Whitelisting happens inside the module (getPublicProfileByHandle); no-store because the payload embeds cross_project and hide must beat the cache (ADR 0171 D5).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/public-profile.js",
+        "parameters": [
+          {
+            "name": "handle",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `handle`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProfilesHandleResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": []
+      }
+    },
     "/projects": {
       "get": {
         "operationId": "get_projects",
@@ -12942,11 +13037,13 @@
             "type": "boolean"
           },
           "profile_state": {},
+          "handle": {},
           "cross_project": {}
         },
         "required": [
           "hide_stats",
           "profile_state",
+          "handle",
           "cross_project"
         ]
       },
@@ -13202,6 +13299,17 @@
           "requests"
         ]
       },
+      "GetProfilesHandleResponse": {
+        "type": "object",
+        "properties": {
+          "account": {},
+          "cross_project": {}
+        },
+        "required": [
+          "account",
+          "cross_project"
+        ]
+      },
       "GetProjectsFeaturedResponse": {
         "type": "object",
         "properties": {
@@ -13984,6 +14092,31 @@
           "events"
         ]
       },
+      "PatchMeHandleRequest": {
+        "type": "object",
+        "properties": {
+          "handle": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 39
+          }
+        },
+        "required": [
+          "handle"
+        ],
+        "additionalProperties": false
+      },
+      "PatchMeHandleResponse": {
+        "type": "object",
+        "properties": {
+          "handle": {},
+          "previous_handle": {}
+        },
+        "required": [
+          "handle",
+          "previous_handle"
+        ]
+      },
       "PatchMeSkillPrefsResponse": {
         "type": "object",
         "properties": {
@@ -17222,9 +17355,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 273,
-  "x-schema-count": 306,
+  "x-endpoint-count": 275,
+  "x-schema-count": 309,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 207,
+  "x-response-schemas": 209,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 273 endpoints across 45 route files.
+> **Generated from the live route files** — the route file is authoritative. 275 endpoints across 46 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -282,7 +282,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (23)
+## `me` (24)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -296,6 +296,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | PATCH | `/api/bongos/me/display-name` | `any-builder` | _undocumented_ | PATCH the display name. |
 | GET | `/api/bongos/me/event-sound-prefs` | `any-builder` | — | Per-builder per-event sound variant selection (task 582, migration 164). |
 | PATCH | `/api/bongos/me/event-sound-prefs` | `any-builder` | _undocumented_ | PATCH a partial set of event sound overrides. |
+| PATCH | `/api/bongos/me/handle` | `any-builder` | `handle` | rename the caller's OWN handle (own data, keyed on the authenticated github_id). |
 | GET | `/api/bongos/me/interaction` | `any-builder` | — | Per-builder INTERACTION PROFILE (task 2010, shares the behavior_prefs jsonb / migration 119). |
 | PATCH | `/api/bongos/me/interaction` | `any-builder` | _undocumented_ | PATCH the interaction profile. |
 | GET | `/api/bongos/me/model-allocation` | `any-builder` | — |  |
@@ -351,6 +352,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/override-requests` | `metic+archon` | — | GET /override-requests?status=open — Archon queue. |
 | POST | `/api/bongos/override-requests/:id/decide` | `metic+archon` | `decision`, `note` | POST /override-requests/:id/decide — body: { decision: 'approve'\|'deny', note? } On approve, atomically flips the task completed→confirme… |
 
+## `profiles` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/profiles/:handle` | `public` | — | a handle-addressed public profile. |
+
 ## `projects` (5)
 
 | Method | Path | Rank | Body | Description |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -422,6 +422,8 @@ function createClient(opts = {}) {
       getMeEventSoundPrefs: (args) => request("GET", "/me/event-sound-prefs", { hasBody: false }, args),
       // PATCH /me/event-sound-prefs — rank: any-builder — PATCH /me/event-sound-prefs
       patchMeEventSoundPrefs: (args) => request("PATCH", "/me/event-sound-prefs", { hasBody: true }, args),
+      // PATCH /me/handle — rank: any-builder — PATCH /me/handle
+      patchMeHandle: (args) => request("PATCH", "/me/handle", { hasBody: true }, args),
       // GET /me/interaction — rank: any-builder — GET /me/interaction
       getMeInteraction: (args) => request("GET", "/me/interaction", { hasBody: false }, args),
       // PATCH /me/interaction — rank: any-builder — PATCH /me/interaction
@@ -499,6 +501,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/modules/platform-identity/migrations/platform_identity_008_handle.sql

@@ -0,0 +1,70 @@
+-- platform_identity_008_handle.sql — the builder handle (P01, task 1002797 /
+-- goal 1000045; profile-page spec Decision 3, ratified ADR 0171 D8).
+--
+-- The canonical profile URL must not hang on github_login: a login is mutable,
+-- so every GitHub rename would silently 404 the builder's shared links. The
+-- handle is presentation only — github_id stays the join key everywhere.
+--
+--   handle            — unique case-insensitively; seeded from github_login.
+--   previous_handle   — the single-slot 301 window: kept on rename until the
+--                       next rename. R05's resolver 301s it to the current
+--                       handle (an exact current-handle match always wins).
+--   handle_changed_at — set on RENAME only, never on seed; the low rate limit
+--                       reads it (one rename per window — setAccountHandle).
+--
+-- Seeding walks accounts oldest-first with exactly the go-forward JS algorithm
+-- (ensureHandle in platform-identity.js): lowercase the login, strip anything
+-- outside [a-z0-9-], trim hyphens; empty → builder-<github_id>; reserved or
+-- taken → numeric suffix -2, -3, … . Sequential plpgsql on purpose: a set-based
+-- ROW_NUMBER pass can manufacture collisions against its own suffixes (a
+-- literal foo-2 login vs foo's second seed), and a failed prod migration costs
+-- more than a slow loop over a small table. The reserved list below mirrors
+-- RESERVED_HANDLES in platform-identity.js — keep them in lockstep.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent: the
+-- handle IS NULL guard makes a re-run a no-op.
+
+BEGIN;
+
+ALTER TABLE platform_identity_accounts
+  ADD COLUMN IF NOT EXISTS handle text,
+  ADD COLUMN IF NOT EXISTS previous_handle text,
+  ADD COLUMN IF NOT EXISTS handle_changed_at timestamptz;
+
+CREATE UNIQUE INDEX IF NOT EXISTS platform_identity_accounts_handle_uniq
+  ON platform_identity_accounts (lower(handle)) WHERE handle IS NOT NULL;
+
+-- The 301-window lookup path (R05 resolves previous handles too).
+CREATE INDEX IF NOT EXISTS platform_identity_accounts_prev_handle_idx
+  ON platform_identity_accounts (lower(previous_handle)) WHERE previous_handle IS NOT NULL;
+
+DO $$
+DECLARE
+  r RECORD;
+  base text;
+  cand text;
+  n int;
+BEGIN
+  FOR r IN
+    SELECT github_id, github_login
+      FROM platform_identity_accounts
+     WHERE handle IS NULL
+     ORDER BY created_at, id
+  LOOP
+    base := trim(both '-' from regexp_replace(lower(coalesce(r.github_login, '')), '[^a-z0-9-]', '', 'g'));
+    IF base = '' THEN
+      base := 'builder-' || r.github_id;
+    END IF;
+    cand := base;
+    n := 1;
+    WHILE cand IN ('me', 'new', 'edit', 'settings', 'admin', 'api', 'u')
+       OR EXISTS (SELECT 1 FROM platform_identity_accounts WHERE lower(handle) = lower(cand))
+    LOOP
+      n := n + 1;
+      cand := base || '-' || n;
+    END LOOP;
+    UPDATE platform_identity_accounts SET handle = cand WHERE github_id = r.github_id;
+  END LOOP;
+END $$;
+
+COMMIT;

package/modules/platform-identity/module.json

@@ -10,7 +10,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting", "profile"],
+    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile"],
     "migrations": true,
     "pollers": ["code-sweep"]
   },