@bongos/core 1.19.173 → 1.19.175

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.173",
-  "core_contract": "1.19.173",
-  "source_commit": "dfc63944c504d88bf4ebb93b033c06b7b3b472a7",
+  "core_version": "1.19.175",
+  "core_contract": "1.19.175",
+  "source_commit": "93e75e5bd9554037be1ec34ec0a428d9eec8db0c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T19:48:53.327Z",
+  "built_at": "2026-08-16T20:19:55.300Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1272,
+    "functional_verbatim": 1273,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1598,
-  "tree_sha256": "ac7b1f942e74709cb79d331fe15d21c4fcfdb8c30c8f0d88fd199404d06462b1",
+  "file_count": 1599,
+  "tree_sha256": "e99154c282f827663b8bf2628c82b2ea12e0285235bc7d46844f88d25a8f2fd7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1332,7 +1332,7 @@
     {
       "path": "docs/adr/0171-profile-rollup-join-and-consent.md",
       "mode": "0000644",
-      "sha256": "85e5261934dffea5c36fea620a1cef2c472381ba650d45dcf5f005ab6abf554e"
+      "sha256": "93a7a996a52b1305e2247fb4b2cf0444ce973712837862b2ecba397e6f2adc71"
     },
     {
       "path": "docs/adr/0172-editable-rank-roles-substrate-axis.md",
@@ -4222,12 +4222,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6c8e9ca33aba6a1b42addf6f862daad54f2e0ba87a43090129a2afe23edc53e6"
+      "sha256": "76f039bc2d79508787cf452ae0d84cafde39f3b43e492af622baf67f64b881a6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1c163fb61de2b5c9024266f6b1bd494687307421fb05370874842e67639e0311"
+      "sha256": "9628ea87ea7a532bfb4776e9587bb916e4b9249b91cf72da1d28d0b7d3589ad2"
     },
     {
       "path": "public-docs/index.html",
@@ -5832,7 +5832,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "479f80926d0dfcd56bfb6b47dfe8fac208ce8ce3c873e6a016c4af0e5f015edd"
+      "sha256": "1a5f88144d3ee5bcd4729388f02e9d5bc62541740df4ef256914c9aa8434d1e6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6944,6 +6944,11 @@
       "mode": "0000644",
       "sha256": "7d384cd84cdc93b8e7b57df291a4600a40f43346fd2a52168324ecde219f1388"
     },
+    {
+      "path": "tests/hub_profile_leak.mjs",
+      "mode": "0000644",
+      "sha256": "f0934fad2cd869a0955b9b087cab449932e921032ca94fc356a952e88f528d82"
+    },
     {
       "path": "tests/idea_completeness.mjs",
       "mode": "0000644",

package/docs/adr/0171-profile-rollup-join-and-consent.md

@@ -27,6 +27,8 @@ Five facts found during this spike shape the decisions:
 
 **3. Consent is a fail-closed `profile_state` on `platform_identity_accounts`, with one discriminator.** Migration `<redacted>.sql` (lands with R02) adds `profile_state text NOT NULL DEFAULT 'provisional' CHECK (profile_state IN ('provisional','active'))` and `hide_stats boolean NOT NULL DEFAULT false`. The single rule: **an account is `active` iff it was touched by a hub-session `/sso/authorize`** — the one path where a human is demonstrably at the hub (and where T&C acceptance can later be captured, task 1002913). Device-poll and check-in create `provisional`; the rollup endpoint creates nothing (orphan activity rows are never publicly addressable). Backfill: **all existing accounts start `provisional`** and lazily upgrade on their next hub-session authorize — no join to core `builders` (that join is type-unsafe against `system:*` text ids and would put a core-table read inside a module migration; the price is that existing hub builders' profiles publish on their next sign-in rather than immediately). Public surfaces read only `active` accounts. **R02 ships this fail-closed default without waiting on P03**, because the asymmetry only runs one way: P03 can then only ever *widen* exposure, never claw back something already published. This deliberately narrows the Phase-4 interview's "no extra consent gate" to the accounts whose consent premise actually holds; P03 is the owner either ratifying that boundary (recommended) or reverting to the interview decision verbatim — and the revert branch has a named precondition: check-in/device-created identities have **no self-serve hide path** (no hub builder session exists for them; hub admission is invite-gated), so rejecting P03 first requires an assertion-authenticated hide path or open hub enrollment. Task 1002799 carries this full decision payload.
 
+> **P03 outcome — RATIFIED (owner, 2026-08-16, task 1002799).** The fail-closed boundary stands: check-in/device-created accounts stay `provisional` (not publicly listed, not at `/u/<handle>`, not in the sitemap or hub search) until their human signs in at the hub at least once. The owner's rationale: in the intended product flow a builder passes through cloudbongos.com at least once anyway — to find or create the projects they join — so the activation gate is satisfied naturally and costs nothing; the cloudbongos builders hall predating the hub flow is a one-time bootstrap exception, and those accounts lazily activate on their next hub sign-in exactly as the backfill rule above already provides (no backfill activation). Tasks 1002913 (T&C artifact) and 1002914 (criterion text amendments) unblock on this ship.
+
 **4. The C2 hide flag is account-global and lives on `platform_identity_accounts.hide_stats` — not in `behavior_prefs`.** Three reasons: the data it guards is account-global hub data, so a per-instance jsonb key would fork the flag per instance; the public profile route must not grow a core→`builder-settings` read dependency that doesn't exist today; and enforcement belongs in the module's read functions (Decision 2), next to the data, where no caller can forget it. (C2's "(builder-settings)" parenthetical is therefore one of the criterion texts task 1002914 amends — the control is still self-serve in hall Settings; only its storage moves.) The write path is an own-scoped `PATCH` route in `platform-identity` (keyed by `req.builder.github_id`, `validateOrRespond`-validated so it needs no `WRITE_VALIDATION_EXEMPT` entry). Public profile responses stay **viewer-independent** — the surviving justification, with edge caching gone (Decision 5), is that a single response shape is the only thing the mirror leak test can actually pin — so the profile page renders the self-toggle client-side by comparing the already-available `/me` identity, and a builder whose stats are hidden inspects their own numbers in Settings via the own-scoped read (the C1 amendment in task 1002914 confirms Settings as the self-view home). Hidden → the track-record section renders the "keeps their track record private" line and **nothing** derived from the rollup ("no partial numbers; a count plus a hidden total is a leak by subtraction"); the local-instance profile keeps its local data (C2's fallback clause applies to the instance render path — the hub has no local data to fall back to). One residual stated honestly: hide removes the hub's *aggregated* view, not the per-instance public numbers it is derived from — every instance's `/public/leaderboard` stays public by design, so a determined reader can still reconstruct a sum the hard way. The C2 amendment text carries that caveat.
 
 **5. Hide must beat the cache: when the port resolves (hub), profile responses are `Cache-Control: no-store`.** The route's current `public, max-age=60` would keep serving a builder's stats for up to 60s after they hide — failing C2's "takes effect immediately" and the R06 proof as literally specified (a browser-cached copy survives a reload). On plain instances the existing `max-age=60` stays. The server-rendered `/u` page inherits the same rule for hide-sensitive content (its caching posture is otherwise goal 1000048's call). Cost: hub profile API responses aren't edge-cached — acceptable at current scale (the rollup read is one indexed aggregate per view).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.173",
+  "version": "1.19.175",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.173",
+      "version": "1.19.175",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.173",
+  "version": "1.19.175",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -773,8 +773,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.171 with no explicit bump. run 31968188738. (task 1002620)
 //   1.19.173 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.172 with no explicit bump. run 31968656001. (task 1002620)
+//   1.19.174 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.173 with no explicit bump. run 31969032984. (task 1002620)
+//   1.19.175 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.174 with no explicit bump. run 31970199477. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.173'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.175'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_profile_leak.mjs

@@ -0,0 +1,220 @@
+// tests/hub_profile_leak.mjs — P05, task 1002801 (goal 1000045; real DB).
+//
+// The mirror of tests/profile_route.mjs for the HUB profile surface (spec
+// Constraints §1: "the whitelist is the pattern, not the exception" — the new
+// cross-project read needs its OWN sentinel leak test over the account + rollup
+// projection before it is public). Where profile_route.mjs stubs the hub port,
+// this runs the REAL module projection over real SQL and the REAL public route
+// (GET /profiles/:handle, R05), with sentinel strings planted on every
+// module-internal value that must never serialize:
+//
+//   - client_id + secret_hash on both reporting sso_clients,
+//   - a non-public project's name (counted in more_projects, never named),
+//   - the account's previous_handle (the 301 window key — resolvable as a URL,
+//     never a response value),
+//   - and the consent/join machinery itself: profile_state, hide_stats,
+//     github_id must not appear anywhere in a 200 body.
+//
+// Plus the behaviour edges: 404 on unknown / invalid / provisional
+// (indistinguishable, fail-closed D3), hidden → cross_project null with no
+// partial numbers, previous handle → 301 to the current one, no-store.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/hub_profile_leak.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+const require = createRequire(import.meta.url);
+const express = require('express');
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`hub_profile_leak.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// The real route over the real domain — only the doorway is pinned so the
+// route's pool IS the fixture DB (the profile_route.mjs require.cache pattern).
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: { pool, corsPublicGet: () => (_req, _res, next) => next() },
+};
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildPublicProfileRoutes = require('../modules/platform-identity/routes/public-profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// ---- fixtures (sentinels on everything that must never serialize) ---------
+
+const ACTIVE = 9002801001, HIDDEN = 9002801002, PROV = 9002801003;
+const ALL_IDS = [ACTIVE, HIDDEN, PROV];
+const SECRET_CLIENT_PUB = 'cli-DO-NOT-LEAK-p05-pub';
+const SECRET_CLIENT_PRIV = 'cli-DO-NOT-LEAK-p05-priv';
+const SECRET_HASH = 'HASH-DO-NOT-LEAK-p05';
+const SECRET_PROJECT = 'P05-PRIVATE-DO-NOT-LEAK';
+const SECRET_PREV = 'p05-prev-sentinel';
+const PUB_ORIGIN = 'https://p05-pub.example', PRIV_ORIGIN = 'https://p05-priv.example';
+const CP_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since'];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_projects WHERE origin = ANY($1::text[])`, [[PUB_ORIGIN, PRIV_ORIGIN]]).catch(() => {});
+  await q(`DELETE FROM platform_identity_sso_clients WHERE client_id = ANY($1::text[])`, [[SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV]]).catch(() => {});
+}
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+function get(port, path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch (_) {}
+        resolve({ status: res.statusCode, json, text, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const NEVER_IN_A_BODY = [
+  SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, SECRET_PROJECT, SECRET_PREV,
+  'profile_state', 'hide_stats', 'github_id',
+];
+function assertNoSentinels(text, where) {
+  for (const s of NEVER_IN_A_BODY) {
+    assert.ok(!text.includes(s), `"${s}" leaked in ${where}`);
+  }
+}
+
+let server = null;
+try {
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_004_projects.sql'));
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await q(migrationSql('platform_identity_008_handle.sql'));
+  await cleanup();
+
+  await q(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle)
+     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4),
+            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL),
+            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL)`,
+    [ACTIVE, HIDDEN, PROV, SECRET_PREV],
+  );
+  await q(
+    `INSERT INTO platform_identity_sso_clients (client_id, secret_hash, name, origin)
+     VALUES ($1, $3, 'P05 Pub Proj', $4), ($2, $3, $5, $6)`,
+    [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, PUB_ORIGIN, SECRET_PROJECT, PRIV_ORIGIN],
+  );
+  await q(
+    `INSERT INTO platform_identity_projects (origin, name, featured, status)
+     VALUES ($1, 'P05 Pub Proj', true, 'active'), ($2, $3, false, 'active')`,
+    [PUB_ORIGIN, PRIV_ORIGIN, SECRET_PROJECT],
+  );
+  await q(
+    `INSERT INTO platform_identity_builder_project_activity
+       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active)
+     VALUES ($1, $3, 100, 5, 3, 'metic',  '{engineer}', '2026-08-01T00:00:00Z'),
+            ($2, $3,  50, 2, 1, 'archon', '{ui}',       '2026-08-02T00:00:00Z'),
+            ($1, $4,  10, 1, 0, 'metic',  '{engineer}', '2026-08-03T00:00:00Z')`,
+    [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, ACTIVE, HIDDEN],
+  );
+
+  const app = express();
+  app.use(attachFail);
+  app.use('/api/bongos', buildPublicProfileRoutes());
+  const port = await new Promise((resolve) => {
+    server = app.listen(0, '127.0.0.1', () => resolve(server.address().port));
+  });
+
+  await t('active handle → 200: identity-band whitelist, exact cross_project contract, no sentinels', async () => {
+    const r = await get(port, '/api/bongos/profiles/p05-active');
+    assert.equal(r.status, 200);
+    assert.equal(r.headers['cache-control'], 'no-store', 'hide must beat the cache (D5)');
+    assert.deepEqual(Object.keys(r.json.account).sort(), [...ACCOUNT_KEYS].sort());
+    assert.deepEqual(Object.keys(r.json.cross_project).sort(), [...CP_KEYS].sort());
+    assert.equal(r.json.cross_project.totals.projects, 2, 'both projects count');
+    assert.equal(r.json.cross_project.projects.length, 1, 'only the publicly listed project is named');
+    assert.equal(r.json.cross_project.projects[0].name, 'P05 Pub Proj');
+    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held'].sort());
+    assert.equal(r.json.cross_project.more_projects, 1, 'the non-public project is counted, never named');
+    assertNoSentinels(r.text, 'the 200 body');
+  });
+
+  await t('lookup is case-insensitive', async () => {
+    const r = await get(port, '/api/bongos/profiles/P05-ACTIVE');
+    assert.equal(r.status, 200);
+    assert.equal(r.json.account.handle, 'p05-active');
+  });
+
+  await t('hidden builder → 200 with cross_project null — no partial numbers', async () => {
+    const r = await get(port, '/api/bongos/profiles/p05-hidden');
+    assert.equal(r.status, 200);
+    assert.equal(r.json.cross_project, null);
+    assert.ok(!r.text.includes('totals'), 'nothing derived from the rollup serializes');
+    assertNoSentinels(r.text, 'the hidden body');
+  });
+
+  await t('provisional → 404, indistinguishable from unknown (fail-closed D3)', async () => {
+    const prov = await get(port, '/api/bongos/profiles/p05-prov');
+    const ghost = await get(port, '/api/bongos/profiles/p05-no-such-handle');
+    assert.equal(prov.status, 404);
+    assert.equal(ghost.status, 404);
+    assert.equal(prov.json.error.code, ghost.json.error.code, 'same envelope for both');
+    assertNoSentinels(prov.text, 'the provisional 404 body');
+  });
+
+  await t('an invalid handle → 404, not a 500', async () => {
+    const r = await get(port, '/api/bongos/profiles/not%20a%20handle!');
+    assert.equal(r.status, 404);
+  });
+
+  await t('a previous handle → 301 to the current one; the old handle never echoes', async () => {
+    const r = await get(port, `/api/bongos/profiles/${SECRET_PREV}`);
+    assert.equal(r.status, 301);
+    assert.ok(r.headers.location.endsWith('/profiles/p05-active'), `Location points at the current handle (got ${r.headers.location})`);
+    assert.deepEqual(r.json, { moved_to: 'p05-active' });
+    assert.ok(!r.text.includes(SECRET_PREV), 'the requested old handle is not echoed');
+  });
+
+  await t('domain projection is clean even off-route (the port surface)', async () => {
+    const extras = await pi.getPublicProfileExtras(ACTIVE, { pool });
+    assertNoSentinels(JSON.stringify(extras), 'getPublicProfileExtras');
+    const page = await pi.getPublicProfileByHandle('p05-active', { pool });
+    assertNoSentinels(JSON.stringify(page), 'getPublicProfileByHandle');
+  });
+
+  console.log(`\nhub_profile_leak: ${passed} passed, ${failed} failed`);
+  if (failed > 0) process.exitCode = 1;
+} finally {
+  if (server) server.close();
+  await cleanup();
+  await pool.end().catch(() => {});
+}