@bongos/core 1.19.172 → 1.19.173

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.172",
-  "core_contract": "1.19.172",
-  "source_commit": "d488f4a69b30ec2fe81f95cc1ec652c25af8fc68",
+  "core_version": "1.19.173",
+  "core_contract": "1.19.173",
+  "source_commit": "dfc63944c504d88bf4ebb93b033c06b7b3b472a7",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T19:39:18.102Z",
+  "built_at": "2026-08-16T19:48:53.327Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1271,
+    "functional_verbatim": 1272,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1597,
-  "tree_sha256": "c7aad1a023cefa6bce6c0403ed5d0bf9c1e5a28b4e38e14a85f1cfc697d5edb3",
+  "file_count": 1598,
+  "tree_sha256": "ac7b1f942e74709cb79d331fe15d21c4fcfdb8c30c8f0d88fd199404d06462b1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "a13c27a7d671408579dedf417b7f28486bebc52b7a685ba3900cd4eca843957c"
+      "sha256": "6b865314ad2d5e2e3e0e017a6bed7ae435ecfbca3859bdf763b59411a1d3d9f8"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "7b6abb75150b8fdc9fba1e0d765c049979da7cdd1d6a20eeeb6f3d5e3886ebc7"
+      "sha256": "c137a0e79a5e9065b071f87150639bff98cbda8f0d50a27027b42fa48ae200f6"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "a4a864366450b849bafc096807f37cd16c8ed624470473aaf4907b24ab104778"
+      "sha256": "2fef3ad1be5b853de1d6df155bb5717b581cf8b6afa3851add9ea81032c159a6"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c032e9796a9feeee86929323992511d5ed1cb448975481f98f86cee1b3790d50"
+      "sha256": "52dbea93e7039796ebf579e816bd3ed54727077e5383d27a348d36572a85b90d"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "cc177720f5f3b0971edac3f03464e3dd5930b48d12811cd9ab39a7b6ceaaeb9c"
+      "sha256": "b2d21163a9fb149a98051dfde08e1cee81969194e74d3e272bb7779da9461c1b"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1347,12 +1347,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d1595faad24aafba420199b3115b11ee5387de7c97c7f4fe7fe4f138f43dd79a"
+      "sha256": "74ee845dae6f2757b564c1a760042391f3eb3af21dd3abe4a8590b3c3f88c4b3"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "1435287ef26983d7088555abc9f18df97ceb4a8676be091ff49076e54a4366ab"
+      "sha256": "1c8b42344fa248bd6e38d370cc117c5017fdd58071ba9cb2ca6e55a1678c5e56"
     },
     {
       "path": "docs/architecture.md",
@@ -2662,7 +2662,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "a4a864366450b849bafc096807f37cd16c8ed624470473aaf4907b24ab104778"
+      "sha256": "2fef3ad1be5b853de1d6df155bb5717b581cf8b6afa3851add9ea81032c159a6"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3797,12 +3797,12 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "e993fb26e61249bf89c0b0a5977c60e9d974810ffe1b67e94d909e8b52e00d5e"
+      "sha256": "c4c02577f7318e994301bbe700e20dfb24519e411fee04539755f7374a73590b"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "115be49e667716d760610f8a9b167eeea4e0e6b61c40c7b9a439703847b61dcd"
+      "sha256": "59d9ef7d052890fdf09fd0a9f04432ab1baddc7c8dfe49950893b9dd67b89d66"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3829,6 +3829,11 @@
       "mode": "0000644",
       "sha256": "a3e25369ad9edc6aed1a8a6997d6b6cb794dce14abb3605954d535525af1a93a"
     },
+    {
+      "path": "modules/platform-identity/routes/public-profile.js",
+      "mode": "0000644",
+      "sha256": "9032ff152e6440187f0f9bd2b1a3bb9ea24167c9f6d79ae3345a26a0e2fdc356"
+    },
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
@@ -3842,7 +3847,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "4b7f13effc33d5d16a5f87d0915ed31e107f138ef135822745774f90192ad327"
+      "sha256": "53b5bdd5c9eb4a14695289dd1396231d29e0f53c8709bd591dc328362da88072"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4217,12 +4222,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3da96cec73d1af6c4f1470d29cc26187cc949eba5b6fb7291b89da3da4c7eae7"
+      "sha256": "6c8e9ca33aba6a1b42addf6f862daad54f2e0ba87a43090129a2afe23edc53e6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "dbf95e145339c9e8d52b1e532e452eb2d344c0c0f06a28f58c6e19366e256dd6"
+      "sha256": "1c163fb61de2b5c9024266f6b1bd494687307421fb05370874842e67639e0311"
     },
     {
       "path": "public-docs/index.html",
@@ -5827,7 +5832,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bc1f9966a0040b5239664c1a5d993c302b1fa9c56d2080c97b168115a4da847a"
+      "sha256": "479f80926d0dfcd56bfb6b47dfe8fac208ce8ce3c873e6a016c4af0e5f015edd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6912,7 +6917,7 @@
     {
       "path": "tests/handle_machinery.mjs",
       "mode": "0000644",
-      "sha256": "755f49404e97c60c8c264f5f4c9d563a7c4ee4f51b43afe96fd10acce52ebe7b"
+      "sha256": "a86e615af8b148572abf562b3c7b0d556076286e76e2d8d576f782a90ba3d457"
     },
     {
       "path": "tests/helpers.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 274 operations across 45 resource groups
+- 275 operations across 46 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -502,6 +502,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -501,6 +501,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -68,6 +68,7 @@ export interface GetModulesSubmissionsResponse { submissions: unknown }
 export interface GetMyProjectsInvitesResponse { invites: unknown }
 export interface GetMyProjectsResponse { owned: unknown; building: unknown }
 export interface GetOverrideRequestsResponse { requests: unknown }
+export interface GetProfilesHandleResponse { account: unknown; cross_project: unknown }
 export interface GetProjectsFeaturedResponse { projects: unknown }
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown }
@@ -743,6 +744,10 @@ export interface BongosClient {
     /** POST /override-requests/{id}/decide — rank: metic+archon */
     postOverrideRequestsIdDecide(args: RequestArgs & { body: PostOverrideRequestsIdDecideRequest }): Promise<ApiResponse>;
   };
+  "profiles": {
+    /** GET /profiles/{handle} — rank: public */
+    getProfilesHandle(args?: RequestArgs): Promise<GetProfilesHandleResponse>;
+  };
   "projects": {
     /** GET /projects — rank: metic+archon */
     getProjects(args?: RequestArgs): Promise<GetProjectsResponse>;

package/clients/bongos-client/index.mjs

@@ -498,6 +498,10 @@ export function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/docs/api/openapi.json

@@ -157,6 +157,10 @@
       "name": "override-requests",
       "description": "Endpoints under `/api/bongos/override-requests`."
     },
+    {
+      "name": "profiles",
+      "description": "Endpoints under `/api/bongos/profiles`."
+    },
     {
       "name": "projects",
       "description": "Endpoints under `/api/bongos/projects`."
@@ -8163,6 +8167,48 @@
         ]
       }
     },
+    "/profiles/{handle}": {
+      "get": {
+        "operationId": "get_profiles_handle",
+        "tags": [
+          "profiles"
+        ],
+        "summary": "GET /profiles/:handle",
+        "description": "a handle-addressed public profile. Every field is already world-readable on the numeric profile route + the leaderboard; the handle is just the rename-proof address (spec Decision 3). Whitelisting happens inside the module (getPublicProfileByHandle); no-store because the payload embeds cross_project and hide must beat the cache (ADR 0171 D5).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/public-profile.js",
+        "parameters": [
+          {
+            "name": "handle",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `handle`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProfilesHandleResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": []
+      }
+    },
     "/projects": {
       "get": {
         "operationId": "get_projects",
@@ -13253,6 +13299,17 @@
           "requests"
         ]
       },
+      "GetProfilesHandleResponse": {
+        "type": "object",
+        "properties": {
+          "account": {},
+          "cross_project": {}
+        },
+        "required": [
+          "account",
+          "cross_project"
+        ]
+      },
       "GetProjectsFeaturedResponse": {
         "type": "object",
         "properties": {
@@ -17298,9 +17355,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 274,
-  "x-schema-count": 308,
+  "x-endpoint-count": 275,
+  "x-schema-count": 309,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 208,
+  "x-response-schemas": 209,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 274 endpoints across 45 route files.
+> **Generated from the live route files** — the route file is authoritative. 275 endpoints across 46 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -352,6 +352,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/override-requests` | `metic+archon` | — | GET /override-requests?status=open — Archon queue. |
 | POST | `/api/bongos/override-requests/:id/decide` | `metic+archon` | `decision`, `note` | POST /override-requests/:id/decide — body: { decision: 'approve'\|'deny', note? } On approve, atomically flips the task completed→confirme… |
 
+## `profiles` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/profiles/:handle` | `public` | — | a handle-addressed public profile. |
+
 ## `projects` (5)
 
 | Method | Path | Rank | Body | Description |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -501,6 +501,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/modules/platform-identity/module.json

@@ -10,7 +10,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting", "profile"],
+    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile"],
     "migrations": true,
     "pollers": ["code-sweep"]
   },

package/modules/platform-identity/platform-identity.js

@@ -748,6 +748,60 @@ async function setAccountHandle({ githubId, handle }, { pool = defaultPool } = {
   }
 }
 
+// Resolve a public handle → its account (R05, task 1002281 — the /u/<handle>
+// resolution). Case-insensitive. An exact current-handle match always wins;
+// otherwise the single-slot previous_handle matches and answers a move to the
+// current handle (the 301 window from P01). Only publicly addressable accounts
+// resolve (profile_state = 'active', ADR 0171 D3) — provisional and unknown are
+// the same null (the 404, indistinguishable by design). hide_stats deliberately
+// does NOT gate resolution: hiding removes the rollup, not the page (D2 —
+// addressability and hide are different invariants).
+// Returns null | { moved_to } | { account: { github_id, github_login,
+// display_name, avatar_url, handle, created_at } }.
+async function resolveHandle(handle, { pool = defaultPool } = {}) {
+  const norm = normalizeHandle(handle);
+  if (!norm) return null;
+  const { rows } = await pool.query(
+    `SELECT github_id, github_login, display_name, avatar_url, handle, created_at,
+            (lower(handle) = $1) AS is_current
+       FROM platform_identity_accounts
+      WHERE profile_state = 'active'
+        AND (lower(handle) = $1 OR lower(previous_handle) = $1)
+      ORDER BY (lower(handle) = $1) DESC
+      LIMIT 1`,
+    [norm],
+  );
+  const row = rows[0];
+  if (!row) return null;
+  if (!row.is_current) return { moved_to: row.handle };
+  const { is_current, ...account } = row;
+  return { account };
+}
+
+// The one public read the canonical /u/<handle> page consumes (R05; the page
+// itself is goal 1000048 R14, task 1002365 — exactly one page gets built, this
+// is its read). Whitelist-shaped INSIDE the module: the identity-band fields
+// plus the same cross_project payload the numeric instance profile route serves
+// (null = hidden / none, indistinguishable — D4). profile_state and github_id
+// never cross — a 200 IS the addressability signal, and the join key stays
+// internal.
+async function getPublicProfileByHandle(handle, { pool = defaultPool } = {}) {
+  const hit = await resolveHandle(handle, { pool });
+  if (!hit) return null;
+  if (hit.moved_to) return { moved_to: hit.moved_to };
+  const a = hit.account;
+  return {
+    account: {
+      handle: a.handle,
+      github_login: a.github_login,
+      display_name: a.display_name,
+      avatar_url: a.avatar_url,
+      member_since: a.created_at,
+    },
+    cross_project: await getPublicProfileExtras(a.github_id, { pool }),
+  };
+}
+
 // -------------------------------------------------------------------------
 // Authorization codes (single-use, short-lived, bound)
 // -------------------------------------------------------------------------
@@ -856,6 +910,8 @@ module.exports = {
   handleSeedBase,
   ensureHandle,
   setAccountHandle,
+  resolveHandle,
+  getPublicProfileByHandle,
   // codes
   mintAuthCode,
   redeemAuthCode,

package/modules/platform-identity/routes/public-profile.js

@@ -0,0 +1,49 @@
+// modules/platform-identity/routes/public-profile.js — the public handle-based
+// profile read (R05, task 1002281; profile-page spec Decisions 1/3, ADR 0171 D8).
+//
+//   GET /profiles/:handle — resolve a handle to the public profile payload the
+//   canonical /u/<handle> page consumes (goal 1000048 R14 / task 1002365 builds
+//   the PAGE; this is its read — exactly one page gets built). Answers:
+//     404 — unknown handle, or a provisional account (indistinguishable by
+//           design: fail-closed consent, ADR 0171 D3)
+//     301 — the request named a previous handle inside P01's single-slot
+//           window; Location + body point at the current handle
+//     200 — { account: identity-band fields, cross_project: … | null }
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+
+const { pool, corsPublicGet } = api;
+
+module.exports = function publicProfileRoutes() {
+  const router = express.Router();
+
+  router.use('/profiles/:handle', corsPublicGet('/profiles/:handle'));
+
+  // rank: public — a handle-addressed public profile. Every field is already
+  // world-readable on the numeric profile route + the leaderboard; the handle is
+  // just the rename-proof address (spec Decision 3). Whitelisting happens inside
+  // the module (getPublicProfileByHandle); no-store because the payload embeds
+  // cross_project and hide must beat the cache (ADR 0171 D5).
+  router.get('/profiles/:handle', async (req, res) => {
+    try {
+      const out = await pi.getPublicProfileByHandle(req.params.handle, { pool });
+      res.set('Cache-Control', 'no-store');
+      if (!out) return res.fail('profile_not_found', 404);
+      if (out.moved_to) {
+        res.set('Location', req.originalUrl.replace(/\/profiles\/[^/?]+/, `/profiles/${encodeURIComponent(out.moved_to)}`));
+        return res.status(301).json({ moved_to: out.moved_to });
+      }
+      res.json({ account: out.account, cross_project: out.cross_project });
+    } catch (err) {
+      console.error('[platform-identity] GET /profiles/:handle', err);
+      res.fail('profile_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/platform-identity/tests/platform-identity.mjs

@@ -719,5 +719,58 @@ await ta('setAccountHandle: a taken handle → handle_taken', async () => {
   assert.deepEqual(out, { error: 'handle_taken' });
 });
 
+console.log('\nhandle resolution (R05, task 1002281):');
+
+await ta('resolveHandle: active-only, current-beats-previous, lowercased lookup', async () => {
+  const row = { github_id: '7', github_login: 'x', display_name: 'X', avatar_url: null, handle: 'x', created_at: 'T', is_current: true };
+  const pool = mockPool([{ rows: [row], rowCount: 1 }]);
+  const out = await P.resolveHandle('X', { pool });
+  const c = pool.calls[0];
+  assert.match(c.text, /profile_state = 'active'/, 'provisional accounts are not addressable (ADR 0171 D3)');
+  assert.match(c.text, /ORDER BY \(lower\(handle\) = \$1\) DESC/, 'an exact current-handle match always wins over a previous one');
+  assert.doesNotMatch(c.text, /hide_stats/, 'hide gates the rollup, never addressability (D2)');
+  assert.equal(c.params[0], 'x', 'the lookup is lowercased');
+  assert.equal(out.account.handle, 'x');
+  assert.ok(!('is_current' in out.account), 'the SQL flag stays internal');
+});
+
+await ta('resolveHandle: a previous-handle hit answers the move to the current handle', async () => {
+  const row = { github_id: '7', github_login: 'x', display_name: 'X', avatar_url: null, handle: 'newname', created_at: 'T', is_current: false };
+  const pool = mockPool([{ rows: [row], rowCount: 1 }]);
+  assert.deepEqual(await P.resolveHandle('oldname', { pool }), { moved_to: 'newname' });
+});
+
+await ta('resolveHandle: an invalid handle → null without touching the DB', async () => {
+  const pool = mockPool([]);
+  assert.equal(await P.resolveHandle('not a handle!', { pool }), null);
+  assert.equal(await P.resolveHandle('', { pool }), null);
+  assert.equal(pool.calls.length, 0);
+});
+
+await ta('getPublicProfileByHandle: identity-band whitelist — github_id/profile_state never cross', async () => {
+  const row = { github_id: '7', github_login: 'x', display_name: 'X', avatar_url: 'a', handle: 'x', created_at: 'T', is_current: true };
+  const pool = mockPool([
+    { rows: [row], rowCount: 1 },
+    // getPublicProfileExtras' flags read: hidden → the extras stay null and no
+    // rollup query fires.
+    { rows: [{ profile_state: 'active', hide_stats: true }], rowCount: 1 },
+  ]);
+  const out = await P.getPublicProfileByHandle('x', { pool });
+  assert.deepEqual(Object.keys(out.account).sort(), ['avatar_url', 'display_name', 'github_login', 'handle', 'member_since'].sort());
+  assert.equal(out.cross_project, null, 'hidden → null, indistinguishable from none');
+  const text = JSON.stringify(out);
+  assert.doesNotMatch(text, /github_id/, 'the join key stays internal');
+  assert.doesNotMatch(text, /profile_state/, 'a 200 IS the addressability signal');
+  assert.doesNotMatch(text, /hide_stats/);
+});
+
+await ta('getPublicProfileByHandle: unknown → null; moved passes through', async () => {
+  const pool1 = mockPool([{ rows: [], rowCount: 0 }]);
+  assert.equal(await P.getPublicProfileByHandle('ghost', { pool: pool1 }), null);
+  const moved = { github_id: '7', github_login: 'x', display_name: 'X', avatar_url: null, handle: 'now', created_at: 'T', is_current: false };
+  const pool2 = mockPool([{ rows: [moved], rowCount: 1 }]);
+  assert.deepEqual(await P.getPublicProfileByHandle('then', { pool: pool2 }), { moved_to: 'now' });
+});
+
 console.log(`\nplatform-identity: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.172",
+  "version": "1.19.173",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.172",
+      "version": "1.19.173",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.172",
+  "version": "1.19.173",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -771,8 +771,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.170 with no explicit bump. run 31967255167. (task 1002620)
 //   1.19.172 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.171 with no explicit bump. run 31968188738. (task 1002620)
+//   1.19.173 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.172 with no explicit bump. run 31968656001. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.172'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.173'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/handle_machinery.mjs

@@ -57,6 +57,8 @@ try {
   // rows exist so its seeding loop has NULL handles to seed — exactly the
   // legacy-rows-at-deploy shape.
   await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_004_projects.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
   // On a DB where 008 already ran the columns exist and the raw inserts below
   // simply land with handle NULL — the re-run seeds only those. Idempotence is
@@ -108,6 +110,32 @@ try {
   const r5 = await pi.setAccountHandle({ githubId: FRESH, handle: 'u' }, { pool });
   ok(r5.error === 'reserved_handle', 'reserved words are refused on rename');
 
+  // --- 5. resolution (R05, task 1002281) ------------------------------------
+  // FRESH is 'p01-again' with previous 'p01-renamed'; everything is still
+  // provisional (fail-closed) at this point.
+  const prov = await pi.resolveHandle('p01-again', { pool });
+  ok(prov === null, 'a provisional account is not addressable — even by its current handle');
+
+  await q(`UPDATE platform_identity_accounts SET profile_state = 'active' WHERE github_id = ANY($1::bigint[])`, [[FRESH, TWIN_A]]);
+
+  const cur = await pi.resolveHandle('P01-Again', { pool });
+  ok(cur && cur.account && cur.account.handle === 'p01-again', 'the current handle resolves case-insensitively');
+
+  const moved = await pi.resolveHandle('p01-renamed', { pool });
+  ok(moved && moved.moved_to === 'p01-again', 'the previous handle answers a move to the current one');
+
+  const page = await pi.getPublicProfileByHandle('p01-again', { pool });
+  ok(page && page.account && page.account.member_since && !('github_id' in page.account),
+    'the public read carries the identity band, never the join key');
+  ok('cross_project' in page, 'the cross_project key is always present on a 200 (null = hidden/none)');
+
+  // Another active account claims the freed previous handle → the exact
+  // current-handle match beats the stale 301 (documented squat-forward rule).
+  await q(`UPDATE platform_identity_accounts SET handle = 'p01-renamed' WHERE github_id = $1`, [TWIN_A]);
+  const claimed = await pi.resolveHandle('p01-renamed', { pool });
+  ok(claimed && claimed.account && Number(claimed.account.github_id) === TWIN_A,
+    'an exact current-handle match wins over another account previous-handle claim');
+
   console.log(`\nhandle_machinery: ${pass} assertions passed`);
 } finally {
   await cleanup();