@bongos/core 1.19.172 → 1.19.174

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.172",
-  "core_contract": "1.19.172",
-  "source_commit": "d488f4a69b30ec2fe81f95cc1ec652c25af8fc68",
+  "core_version": "1.19.174",
+  "core_contract": "1.19.174",
+  "source_commit": "01b7a9adb8720d04035ce515c8ed16155486b694",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T19:39:18.102Z",
+  "built_at": "2026-08-16T19:56:25.262Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1271,
+    "functional_verbatim": 1273,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1597,
-  "tree_sha256": "c7aad1a023cefa6bce6c0403ed5d0bf9c1e5a28b4e38e14a85f1cfc697d5edb3",
+  "file_count": 1599,
+  "tree_sha256": "8bdaa736f97566f66d4afb3f53a7a779eaf343a244651e18831cbf3629c05957",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "a13c27a7d671408579dedf417b7f28486bebc52b7a685ba3900cd4eca843957c"
+      "sha256": "6b865314ad2d5e2e3e0e017a6bed7ae435ecfbca3859bdf763b59411a1d3d9f8"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "7b6abb75150b8fdc9fba1e0d765c049979da7cdd1d6a20eeeb6f3d5e3886ebc7"
+      "sha256": "c137a0e79a5e9065b071f87150639bff98cbda8f0d50a27027b42fa48ae200f6"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "a4a864366450b849bafc096807f37cd16c8ed624470473aaf4907b24ab104778"
+      "sha256": "2fef3ad1be5b853de1d6df155bb5717b581cf8b6afa3851add9ea81032c159a6"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c032e9796a9feeee86929323992511d5ed1cb448975481f98f86cee1b3790d50"
+      "sha256": "52dbea93e7039796ebf579e816bd3ed54727077e5383d27a348d36572a85b90d"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "cc177720f5f3b0971edac3f03464e3dd5930b48d12811cd9ab39a7b6ceaaeb9c"
+      "sha256": "b2d21163a9fb149a98051dfde08e1cee81969194e74d3e272bb7779da9461c1b"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1347,12 +1347,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d1595faad24aafba420199b3115b11ee5387de7c97c7f4fe7fe4f138f43dd79a"
+      "sha256": "74ee845dae6f2757b564c1a760042391f3eb3af21dd3abe4a8590b3c3f88c4b3"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "1435287ef26983d7088555abc9f18df97ceb4a8676be091ff49076e54a4366ab"
+      "sha256": "1c8b42344fa248bd6e38d370cc117c5017fdd58071ba9cb2ca6e55a1678c5e56"
     },
     {
       "path": "docs/architecture.md",
@@ -2662,7 +2662,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "a4a864366450b849bafc096807f37cd16c8ed624470473aaf4907b24ab104778"
+      "sha256": "2fef3ad1be5b853de1d6df155bb5717b581cf8b6afa3851add9ea81032c159a6"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3797,12 +3797,12 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "e993fb26e61249bf89c0b0a5977c60e9d974810ffe1b67e94d909e8b52e00d5e"
+      "sha256": "c4c02577f7318e994301bbe700e20dfb24519e411fee04539755f7374a73590b"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "115be49e667716d760610f8a9b167eeea4e0e6b61c40c7b9a439703847b61dcd"
+      "sha256": "59d9ef7d052890fdf09fd0a9f04432ab1baddc7c8dfe49950893b9dd67b89d66"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3829,6 +3829,11 @@
       "mode": "0000644",
       "sha256": "a3e25369ad9edc6aed1a8a6997d6b6cb794dce14abb3605954d535525af1a93a"
     },
+    {
+      "path": "modules/platform-identity/routes/public-profile.js",
+      "mode": "0000644",
+      "sha256": "9032ff152e6440187f0f9bd2b1a3bb9ea24167c9f6d79ae3345a26a0e2fdc356"
+    },
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
@@ -3842,7 +3847,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "4b7f13effc33d5d16a5f87d0915ed31e107f138ef135822745774f90192ad327"
+      "sha256": "53b5bdd5c9eb4a14695289dd1396231d29e0f53c8709bd591dc328362da88072"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4217,12 +4222,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3da96cec73d1af6c4f1470d29cc26187cc949eba5b6fb7291b89da3da4c7eae7"
+      "sha256": "3218421cd172f2d2201d5ea5573d36a5534f08a47e82eca9940eb3084275ef52"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "dbf95e145339c9e8d52b1e532e452eb2d344c0c0f06a28f58c6e19366e256dd6"
+      "sha256": "907133ee8dd8cab837d620480df2af2d001825a2a9094ef528cf37a7e93a58da"
     },
     {
       "path": "public-docs/index.html",
@@ -5827,7 +5832,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bc1f9966a0040b5239664c1a5d993c302b1fa9c56d2080c97b168115a4da847a"
+      "sha256": "c4c789739d3759c20717b498e03783b14b3d8db3e53995415616885fa99d2cfc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6912,7 +6917,7 @@
     {
       "path": "tests/handle_machinery.mjs",
       "mode": "0000644",
-      "sha256": "755f49404e97c60c8c264f5f4c9d563a7c4ee4f51b43afe96fd10acce52ebe7b"
+      "sha256": "a86e615af8b148572abf562b3c7b0d556076286e76e2d8d576f782a90ba3d457"
     },
     {
       "path": "tests/helpers.mjs",
@@ -6939,6 +6944,11 @@
       "mode": "0000644",
       "sha256": "7d384cd84cdc93b8e7b57df291a4600a40f43346fd2a52168324ecde219f1388"
     },
+    {
+      "path": "tests/hub_profile_leak.mjs",
+      "mode": "0000644",
+      "sha256": "f0934fad2cd869a0955b9b087cab449932e921032ca94fc356a952e88f528d82"
+    },
     {
       "path": "tests/idea_completeness.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 274 operations across 45 resource groups
+- 275 operations across 46 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -502,6 +502,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -501,6 +501,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -68,6 +68,7 @@ export interface GetModulesSubmissionsResponse { submissions: unknown }
 export interface GetMyProjectsInvitesResponse { invites: unknown }
 export interface GetMyProjectsResponse { owned: unknown; building: unknown }
 export interface GetOverrideRequestsResponse { requests: unknown }
+export interface GetProfilesHandleResponse { account: unknown; cross_project: unknown }
 export interface GetProjectsFeaturedResponse { projects: unknown }
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown }
@@ -743,6 +744,10 @@ export interface BongosClient {
     /** POST /override-requests/{id}/decide — rank: metic+archon */
     postOverrideRequestsIdDecide(args: RequestArgs & { body: PostOverrideRequestsIdDecideRequest }): Promise<ApiResponse>;
   };
+  "profiles": {
+    /** GET /profiles/{handle} — rank: public */
+    getProfilesHandle(args?: RequestArgs): Promise<GetProfilesHandleResponse>;
+  };
   "projects": {
     /** GET /projects — rank: metic+archon */
     getProjects(args?: RequestArgs): Promise<GetProjectsResponse>;

package/clients/bongos-client/index.mjs

@@ -498,6 +498,10 @@ export function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/docs/api/openapi.json

@@ -157,6 +157,10 @@
       "name": "override-requests",
       "description": "Endpoints under `/api/bongos/override-requests`."
     },
+    {
+      "name": "profiles",
+      "description": "Endpoints under `/api/bongos/profiles`."
+    },
     {
       "name": "projects",
       "description": "Endpoints under `/api/bongos/projects`."
@@ -8163,6 +8167,48 @@
         ]
       }
     },
+    "/profiles/{handle}": {
+      "get": {
+        "operationId": "get_profiles_handle",
+        "tags": [
+          "profiles"
+        ],
+        "summary": "GET /profiles/:handle",
+        "description": "a handle-addressed public profile. Every field is already world-readable on the numeric profile route + the leaderboard; the handle is just the rename-proof address (spec Decision 3). Whitelisting happens inside the module (getPublicProfileByHandle); no-store because the payload embeds cross_project and hide must beat the cache (ADR 0171 D5).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/public-profile.js",
+        "parameters": [
+          {
+            "name": "handle",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `handle`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProfilesHandleResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": []
+      }
+    },
     "/projects": {
       "get": {
         "operationId": "get_projects",
@@ -13253,6 +13299,17 @@
           "requests"
         ]
       },
+      "GetProfilesHandleResponse": {
+        "type": "object",
+        "properties": {
+          "account": {},
+          "cross_project": {}
+        },
+        "required": [
+          "account",
+          "cross_project"
+        ]
+      },
       "GetProjectsFeaturedResponse": {
         "type": "object",
         "properties": {
@@ -17298,9 +17355,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 274,
-  "x-schema-count": 308,
+  "x-endpoint-count": 275,
+  "x-schema-count": 309,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 208,
+  "x-response-schemas": 209,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 274 endpoints across 45 route files.
+> **Generated from the live route files** — the route file is authoritative. 275 endpoints across 46 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -352,6 +352,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/override-requests` | `metic+archon` | — | GET /override-requests?status=open — Archon queue. |
 | POST | `/api/bongos/override-requests/:id/decide` | `metic+archon` | `decision`, `note` | POST /override-requests/:id/decide — body: { decision: 'approve'\|'deny', note? } On approve, atomically flips the task completed→confirme… |
 
+## `profiles` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/profiles/:handle` | `public` | — | a handle-addressed public profile. |
+
 ## `projects` (5)
 
 | Method | Path | Rank | Body | Description |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -501,6 +501,10 @@ function createClient(opts = {}) {
       // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "profiles": {
+      // GET /profiles/{handle} — rank: public — GET /profiles/:handle
+      getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),
+    },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),

package/modules/platform-identity/module.json

@@ -10,7 +10,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting", "profile"],
+    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile"],
     "migrations": true,
     "pollers": ["code-sweep"]
   },

package/modules/platform-identity/platform-identity.js

@@ -748,6 +748,60 @@ async function setAccountHandle({ githubId, handle }, { pool = defaultPool } = {
   }
 }
 
+// Resolve a public handle → its account (R05, task 1002281 — the /u/<handle>
+// resolution). Case-insensitive. An exact current-handle match always wins;
+// otherwise the single-slot previous_handle matches and answers a move to the
+// current handle (the 301 window from P01). Only publicly addressable accounts
+// resolve (profile_state = 'active', ADR 0171 D3) — provisional and unknown are
+// the same null (the 404, indistinguishable by design). hide_stats deliberately
+// does NOT gate resolution: hiding removes the rollup, not the page (D2 —
+// addressability and hide are different invariants).
+// Returns null | { moved_to } | { account: { github_id, github_login,
+// display_name, avatar_url, handle, created_at } }.
+async function resolveHandle(handle, { pool = defaultPool } = {}) {
+  const norm = normalizeHandle(handle);
+  if (!norm) return null;
+  const { rows } = await pool.query(
+    `SELECT github_id, github_login, display_name, avatar_url, handle, created_at,
+            (lower(handle) = $1) AS is_current
+       FROM platform_identity_accounts
+      WHERE profile_state = 'active'
+        AND (lower(handle) = $1 OR lower(previous_handle) = $1)
+      ORDER BY (lower(handle) = $1) DESC
+      LIMIT 1`,
+    [norm],
+  );
+  const row = rows[0];
+  if (!row) return null;
+  if (!row.is_current) return { moved_to: row.handle };
+  const { is_current, ...account } = row;
+  return { account };
+}
+
+// The one public read the canonical /u/<handle> page consumes (R05; the page
+// itself is goal 1000048 R14, task 1002365 — exactly one page gets built, this
+// is its read). Whitelist-shaped INSIDE the module: the identity-band fields
+// plus the same cross_project payload the numeric instance profile route serves
+// (null = hidden / none, indistinguishable — D4). profile_state and github_id
+// never cross — a 200 IS the addressability signal, and the join key stays
+// internal.
+async function getPublicProfileByHandle(handle, { pool = defaultPool } = {}) {
+  const hit = await resolveHandle(handle, { pool });
+  if (!hit) return null;
+  if (hit.moved_to) return { moved_to: hit.moved_to };
+  const a = hit.account;
+  return {
+    account: {
+      handle: a.handle,
+      github_login: a.github_login,
+      display_name: a.display_name,
+      avatar_url: a.avatar_url,
+      member_since: a.created_at,
+    },
+    cross_project: await getPublicProfileExtras(a.github_id, { pool }),
+  };
+}
+
 // -------------------------------------------------------------------------
 // Authorization codes (single-use, short-lived, bound)
 // -------------------------------------------------------------------------
@@ -856,6 +910,8 @@ module.exports = {
   handleSeedBase,
   ensureHandle,
   setAccountHandle,
+  resolveHandle,
+  getPublicProfileByHandle,
   // codes
   mintAuthCode,
   redeemAuthCode,

package/modules/platform-identity/routes/public-profile.js

@@ -0,0 +1,49 @@
+// modules/platform-identity/routes/public-profile.js — the public handle-based
+// profile read (R05, task 1002281; profile-page spec Decisions 1/3, ADR 0171 D8).
+//
+//   GET /profiles/:handle — resolve a handle to the public profile payload the
+//   canonical /u/<handle> page consumes (goal 1000048 R14 / task 1002365 builds
+//   the PAGE; this is its read — exactly one page gets built). Answers:
+//     404 — unknown handle, or a provisional account (indistinguishable by
+//           design: fail-closed consent, ADR 0171 D3)
+//     301 — the request named a previous handle inside P01's single-slot
+//           window; Location + body point at the current handle
+//     200 — { account: identity-band fields, cross_project: … | null }
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+
+const { pool, corsPublicGet } = api;
+
+module.exports = function publicProfileRoutes() {
+  const router = express.Router();
+
+  router.use('/profiles/:handle', corsPublicGet('/profiles/:handle'));
+
+  // rank: public — a handle-addressed public profile. Every field is already
+  // world-readable on the numeric profile route + the leaderboard; the handle is
+  // just the rename-proof address (spec Decision 3). Whitelisting happens inside
+  // the module (getPublicProfileByHandle); no-store because the payload embeds
+  // cross_project and hide must beat the cache (ADR 0171 D5).
+  router.get('/profiles/:handle', async (req, res) => {
+    try {
+      const out = await pi.getPublicProfileByHandle(req.params.handle, { pool });
+      res.set('Cache-Control', 'no-store');
+      if (!out) return res.fail('profile_not_found', 404);
+      if (out.moved_to) {
+        res.set('Location', req.originalUrl.replace(/\/profiles\/[^/?]+/, `/profiles/${encodeURIComponent(out.moved_to)}`));
+        return res.status(301).json({ moved_to: out.moved_to });
+      }
+      res.json({ account: out.account, cross_project: out.cross_project });
+    } catch (err) {
+      console.error('[platform-identity] GET /profiles/:handle', err);
+      res.fail('profile_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/platform-identity/tests/platform-identity.mjs

@@ -719,5 +719,58 @@ await ta('setAccountHandle: a taken handle → handle_taken', async () => {
   assert.deepEqual(out, { error: 'handle_taken' });
 });
 
+console.log('\nhandle resolution (R05, task 1002281):');
+
+await ta('resolveHandle: active-only, current-beats-previous, lowercased lookup', async () => {
+  const row = { github_id: '7', github_login: 'x', display_name: 'X', avatar_url: null, handle: 'x', created_at: 'T', is_current: true };
+  const pool = mockPool([{ rows: [row], rowCount: 1 }]);
+  const out = await P.resolveHandle('X', { pool });
+  const c = pool.calls[0];
+  assert.match(c.text, /profile_state = 'active'/, 'provisional accounts are not addressable (ADR 0171 D3)');
+  assert.match(c.text, /ORDER BY \(lower\(handle\) = \$1\) DESC/, 'an exact current-handle match always wins over a previous one');
+  assert.doesNotMatch(c.text, /hide_stats/, 'hide gates the rollup, never addressability (D2)');
+  assert.equal(c.params[0], 'x', 'the lookup is lowercased');
+  assert.equal(out.account.handle, 'x');
+  assert.ok(!('is_current' in out.account), 'the SQL flag stays internal');
+});
+
+await ta('resolveHandle: a previous-handle hit answers the move to the current handle', async () => {
+  const row = { github_id: '7', github_login: 'x', display_name: 'X', avatar_url: null, handle: 'newname', created_at: 'T', is_current: false };
+  const pool = mockPool([{ rows: [row], rowCount: 1 }]);
+  assert.deepEqual(await P.resolveHandle('oldname', { pool }), { moved_to: 'newname' });
+});
+
+await ta('resolveHandle: an invalid handle → null without touching the DB', async () => {
+  const pool = mockPool([]);
+  assert.equal(await P.resolveHandle('not a handle!', { pool }), null);
+  assert.equal(await P.resolveHandle('', { pool }), null);
+  assert.equal(pool.calls.length, 0);
+});
+
+await ta('getPublicProfileByHandle: identity-band whitelist — github_id/profile_state never cross', async () => {
+  const row = { github_id: '7', github_login: 'x', display_name: 'X', avatar_url: 'a', handle: 'x', created_at: 'T', is_current: true };
+  const pool = mockPool([
+    { rows: [row], rowCount: 1 },
+    // getPublicProfileExtras' flags read: hidden → the extras stay null and no
+    // rollup query fires.
+    { rows: [{ profile_state: 'active', hide_stats: true }], rowCount: 1 },
+  ]);
+  const out = await P.getPublicProfileByHandle('x', { pool });
+  assert.deepEqual(Object.keys(out.account).sort(), ['avatar_url', 'display_name', 'github_login', 'handle', 'member_since'].sort());
+  assert.equal(out.cross_project, null, 'hidden → null, indistinguishable from none');
+  const text = JSON.stringify(out);
+  assert.doesNotMatch(text, /github_id/, 'the join key stays internal');
+  assert.doesNotMatch(text, /profile_state/, 'a 200 IS the addressability signal');
+  assert.doesNotMatch(text, /hide_stats/);
+});
+
+await ta('getPublicProfileByHandle: unknown → null; moved passes through', async () => {
+  const pool1 = mockPool([{ rows: [], rowCount: 0 }]);
+  assert.equal(await P.getPublicProfileByHandle('ghost', { pool: pool1 }), null);
+  const moved = { github_id: '7', github_login: 'x', display_name: 'X', avatar_url: null, handle: 'now', created_at: 'T', is_current: false };
+  const pool2 = mockPool([{ rows: [moved], rowCount: 1 }]);
+  assert.deepEqual(await P.getPublicProfileByHandle('then', { pool: pool2 }), { moved_to: 'now' });
+});
+
 console.log(`\nplatform-identity: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.172",
+  "version": "1.19.174",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.172",
+      "version": "1.19.174",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.172",
+  "version": "1.19.174",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -771,8 +771,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.170 with no explicit bump. run 31967255167. (task 1002620)
 //   1.19.172 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.171 with no explicit bump. run 31968188738. (task 1002620)
+//   1.19.173 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.172 with no explicit bump. run 31968656001. (task 1002620)
+//   1.19.174 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.173 with no explicit bump. run 31969032984. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.172'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.174'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/handle_machinery.mjs

@@ -57,6 +57,8 @@ try {
   // rows exist so its seeding loop has NULL handles to seed — exactly the
   // legacy-rows-at-deploy shape.
   await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_004_projects.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
   // On a DB where 008 already ran the columns exist and the raw inserts below
   // simply land with handle NULL — the re-run seeds only those. Idempotence is
@@ -108,6 +110,32 @@ try {
   const r5 = await pi.setAccountHandle({ githubId: FRESH, handle: 'u' }, { pool });
   ok(r5.error === 'reserved_handle', 'reserved words are refused on rename');
 
+  // --- 5. resolution (R05, task 1002281) ------------------------------------
+  // FRESH is 'p01-again' with previous 'p01-renamed'; everything is still
+  // provisional (fail-closed) at this point.
+  const prov = await pi.resolveHandle('p01-again', { pool });
+  ok(prov === null, 'a provisional account is not addressable — even by its current handle');
+
+  await q(`UPDATE platform_identity_accounts SET profile_state = 'active' WHERE github_id = ANY($1::bigint[])`, [[FRESH, TWIN_A]]);
+
+  const cur = await pi.resolveHandle('P01-Again', { pool });
+  ok(cur && cur.account && cur.account.handle === 'p01-again', 'the current handle resolves case-insensitively');
+
+  const moved = await pi.resolveHandle('p01-renamed', { pool });
+  ok(moved && moved.moved_to === 'p01-again', 'the previous handle answers a move to the current one');
+
+  const page = await pi.getPublicProfileByHandle('p01-again', { pool });
+  ok(page && page.account && page.account.member_since && !('github_id' in page.account),
+    'the public read carries the identity band, never the join key');
+  ok('cross_project' in page, 'the cross_project key is always present on a 200 (null = hidden/none)');
+
+  // Another active account claims the freed previous handle → the exact
+  // current-handle match beats the stale 301 (documented squat-forward rule).
+  await q(`UPDATE platform_identity_accounts SET handle = 'p01-renamed' WHERE github_id = $1`, [TWIN_A]);
+  const claimed = await pi.resolveHandle('p01-renamed', { pool });
+  ok(claimed && claimed.account && Number(claimed.account.github_id) === TWIN_A,
+    'an exact current-handle match wins over another account previous-handle claim');
+
   console.log(`\nhandle_machinery: ${pass} assertions passed`);
 } finally {
   await cleanup();

package/tests/hub_profile_leak.mjs

@@ -0,0 +1,220 @@
+// tests/hub_profile_leak.mjs — P05, task 1002801 (goal 1000045; real DB).
+//
+// The mirror of tests/profile_route.mjs for the HUB profile surface (spec
+// Constraints §1: "the whitelist is the pattern, not the exception" — the new
+// cross-project read needs its OWN sentinel leak test over the account + rollup
+// projection before it is public). Where profile_route.mjs stubs the hub port,
+// this runs the REAL module projection over real SQL and the REAL public route
+// (GET /profiles/:handle, R05), with sentinel strings planted on every
+// module-internal value that must never serialize:
+//
+//   - client_id + secret_hash on both reporting sso_clients,
+//   - a non-public project's name (counted in more_projects, never named),
+//   - the account's previous_handle (the 301 window key — resolvable as a URL,
+//     never a response value),
+//   - and the consent/join machinery itself: profile_state, hide_stats,
+//     github_id must not appear anywhere in a 200 body.
+//
+// Plus the behaviour edges: 404 on unknown / invalid / provisional
+// (indistinguishable, fail-closed D3), hidden → cross_project null with no
+// partial numbers, previous handle → 301 to the current one, no-store.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/hub_profile_leak.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+const require = createRequire(import.meta.url);
+const express = require('express');
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`hub_profile_leak.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// The real route over the real domain — only the doorway is pinned so the
+// route's pool IS the fixture DB (the profile_route.mjs require.cache pattern).
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: { pool, corsPublicGet: () => (_req, _res, next) => next() },
+};
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildPublicProfileRoutes = require('../modules/platform-identity/routes/public-profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// ---- fixtures (sentinels on everything that must never serialize) ---------
+
+const ACTIVE = 9002801001, HIDDEN = 9002801002, PROV = 9002801003;
+const ALL_IDS = [ACTIVE, HIDDEN, PROV];
+const SECRET_CLIENT_PUB = 'cli-DO-NOT-LEAK-p05-pub';
+const SECRET_CLIENT_PRIV = 'cli-DO-NOT-LEAK-p05-priv';
+const SECRET_HASH = 'HASH-DO-NOT-LEAK-p05';
+const SECRET_PROJECT = 'P05-PRIVATE-DO-NOT-LEAK';
+const SECRET_PREV = 'p05-prev-sentinel';
+const PUB_ORIGIN = 'https://p05-pub.example', PRIV_ORIGIN = 'https://p05-priv.example';
+const CP_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since'];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [[PUB_ORIGIN, PRIV_ORIGIN]]).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE client_id = ANY($1::text[])`, [[SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV]]).catch(() => {});
+}
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+function get(port, path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch (_) {}
+        resolve({ status: res.statusCode, json, text, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const NEVER_IN_A_BODY = [
+  SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, SECRET_PROJECT, SECRET_PREV,
+  'profile_state', 'hide_stats', 'github_id',
+];
+function assertNoSentinels(text, where) {
+  for (const s of NEVER_IN_A_BODY) {
+    assert.ok(!text.includes(s), `"${s}" leaked in ${where}`);
+  }
+}
+
+let server = null;
+try {
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_004_projects.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await q(migrationSql('platform_identity_008_handle.sql'));
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle)
+     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4),
+            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL),
+            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL)`,
+    [ACTIVE, HIDDEN, PROV, SECRET_PREV],
+  );
+  await q(
+    `INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin)
+     VALUES ($1, $3, 'P05 Pub Proj', $4), ($2, $3, $5, $6)`,
+    [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, PUB_ORIGIN, SECRET_PROJECT, PRIV_ORIGIN],
+  );
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, featured, status)
+     VALUES ($1, 'P05 Pub Proj', true, 'active'), ($2, $3, false, 'active')`,
+    [PUB_ORIGIN, PRIV_ORIGIN, SECRET_PROJECT],
+  );
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity
+       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active)
+     VALUES ($1, $3, 100, 5, 3, 'metic',  '{engineer}', '2026-08-01T00:00:00Z'),
+            ($2, $3,  50, 2, 1, 'archon', '{ui}',       '2026-08-02T00:00:00Z'),
+            ($1, $4,  10, 1, 0, 'metic',  '{engineer}', '2026-08-03T00:00:00Z')`,
+    [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, ACTIVE, HIDDEN],
+  );
+
+  const app = express();
+  app.use(attachFail);
+  app.use('/api/bongos', buildPublicProfileRoutes());
+  const port = await new Promise((resolve) => {
+    server = app.listen(0, '127.0.0.1', () => resolve(server.address().port));
+  });
+
+  await t('active handle → 200: identity-band whitelist, exact cross_project contract, no sentinels', async () => {
+    const r = await get(port, '/api/bongos/profiles/p05-active');
+    assert.equal(r.status, 200);
+    assert.equal(r.headers['cache-control'], 'no-store', 'hide must beat the cache (D5)');
+    assert.deepEqual(Object.keys(r.json.account).sort(), [...ACCOUNT_KEYS].sort());
+    assert.deepEqual(Object.keys(r.json.cross_project).sort(), [...CP_KEYS].sort());
+    assert.equal(r.json.cross_project.totals.projects, 2, 'both projects count');
+    assert.equal(r.json.cross_project.projects.length, 1, 'only the publicly listed project is named');
+    assert.equal(r.json.cross_project.projects[0].name, 'P05 Pub Proj');
+    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held'].sort());
+    assert.equal(r.json.cross_project.more_projects, 1, 'the non-public project is counted, never named');
+    assertNoSentinels(r.text, 'the 200 body');
+  });
+
+  await t('lookup is case-insensitive', async () => {
+    const r = await get(port, '/api/bongos/profiles/P05-ACTIVE');
+    assert.equal(r.status, 200);
+    assert.equal(r.json.account.handle, 'p05-active');
+  });
+
+  await t('hidden builder → 200 with cross_project null — no partial numbers', async () => {
+    const r = await get(port, '/api/bongos/profiles/p05-hidden');
+    assert.equal(r.status, 200);
+    assert.equal(r.json.cross_project, null);
+    assert.ok(!r.text.includes('totals'), 'nothing derived from the rollup serializes');
+    assertNoSentinels(r.text, 'the hidden body');
+  });
+
+  await t('provisional → 404, indistinguishable from unknown (fail-closed D3)', async () => {
+    const prov = await get(port, '/api/bongos/profiles/p05-prov');
+    const ghost = await get(port, '/api/bongos/profiles/p05-no-such-handle');
+    assert.equal(prov.status, 404);
+    assert.equal(ghost.status, 404);
+    assert.equal(prov.json.error.code, ghost.json.error.code, 'same envelope for both');
+    assertNoSentinels(prov.text, 'the provisional 404 body');
+  });
+
+  await t('an invalid handle → 404, not a 500', async () => {
+    const r = await get(port, '/api/bongos/profiles/not%20a%20handle!');
+    assert.equal(r.status, 404);
+  });
+
+  await t('a previous handle → 301 to the current one; the old handle never echoes', async () => {
+    const r = await get(port, `/api/bongos/profiles/${SECRET_PREV}`);
+    assert.equal(r.status, 301);
+    assert.ok(r.headers.location.endsWith('/profiles/p05-active'), `Location points at the current handle (got ${r.headers.location})`);
+    assert.deepEqual(r.json, { moved_to: 'p05-active' });
+    assert.ok(!r.text.includes(SECRET_PREV), 'the requested old handle is not echoed');
+  });
+
+  await t('domain projection is clean even off-route (the port surface)', async () => {
+    const extras = await pi.getPublicProfileExtras(ACTIVE, { pool });
+    assertNoSentinels(JSON.stringify(extras), 'getPublicProfileExtras');
+    const page = await pi.getPublicProfileByHandle('p05-active', { pool });
+    assertNoSentinels(JSON.stringify(page), 'getPublicProfileByHandle');
+  });
+
+  console.log(`\nhub_profile_leak: ${passed} passed, ${failed} failed`);
+  if (failed > 0) process.exitCode = 1;
+} finally {
+  if (server) server.close();
+  await cleanup();
+  await pool.end().catch(() => {});
+}