@bongos/core 1.19.174 → 1.19.175

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.174",
-  "core_contract": "1.19.174",
-  "source_commit": "01b7a9adb8720d04035ce515c8ed16155486b694",
+  "core_version": "1.19.175",
+  "core_contract": "1.19.175",
+  "source_commit": "93e75e5bd9554037be1ec34ec0a428d9eec8db0c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T19:56:25.262Z",
+  "built_at": "2026-08-16T20:19:55.300Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1599,
-  "tree_sha256": "8bdaa736f97566f66d4afb3f53a7a779eaf343a244651e18831cbf3629c05957",
+  "tree_sha256": "e99154c282f827663b8bf2628c82b2ea12e0285235bc7d46844f88d25a8f2fd7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1332,7 +1332,7 @@
     {
       "path": "docs/adr/0171-profile-rollup-join-and-consent.md",
       "mode": "0000644",
-      "sha256": "85e5261934dffea5c36fea620a1cef2c472381ba650d45dcf5f005ab6abf554e"
+      "sha256": "93a7a996a52b1305e2247fb4b2cf0444ce973712837862b2ecba397e6f2adc71"
     },
     {
       "path": "docs/adr/0172-editable-rank-roles-substrate-axis.md",
@@ -4222,12 +4222,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3218421cd172f2d2201d5ea5573d36a5534f08a47e82eca9940eb3084275ef52"
+      "sha256": "76f039bc2d79508787cf452ae0d84cafde39f3b43e492af622baf67f64b881a6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "907133ee8dd8cab837d620480df2af2d001825a2a9094ef528cf37a7e93a58da"
+      "sha256": "9628ea87ea7a532bfb4776e9587bb916e4b9249b91cf72da1d28d0b7d3589ad2"
     },
     {
       "path": "public-docs/index.html",
@@ -5832,7 +5832,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c4c789739d3759c20717b498e03783b14b3d8db3e53995415616885fa99d2cfc"
+      "sha256": "1a5f88144d3ee5bcd4729388f02e9d5bc62541740df4ef256914c9aa8434d1e6"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0171-profile-rollup-join-and-consent.md

@@ -27,6 +27,8 @@ Five facts found during this spike shape the decisions:
 
 **3. Consent is a fail-closed `profile_state` on `platform_identity_accounts`, with one discriminator.** Migration `<redacted>.sql` (lands with R02) adds `profile_state text NOT NULL DEFAULT 'provisional' CHECK (profile_state IN ('provisional','active'))` and `hide_stats boolean NOT NULL DEFAULT false`. The single rule: **an account is `active` iff it was touched by a hub-session `/sso/authorize`** — the one path where a human is demonstrably at the hub (and where T&C acceptance can later be captured, task 1002913). Device-poll and check-in create `provisional`; the rollup endpoint creates nothing (orphan activity rows are never publicly addressable). Backfill: **all existing accounts start `provisional`** and lazily upgrade on their next hub-session authorize — no join to core `builders` (that join is type-unsafe against `system:*` text ids and would put a core-table read inside a module migration; the price is that existing hub builders' profiles publish on their next sign-in rather than immediately). Public surfaces read only `active` accounts. **R02 ships this fail-closed default without waiting on P03**, because the asymmetry only runs one way: P03 can then only ever *widen* exposure, never claw back something already published. This deliberately narrows the Phase-4 interview's "no extra consent gate" to the accounts whose consent premise actually holds; P03 is the owner either ratifying that boundary (recommended) or reverting to the interview decision verbatim — and the revert branch has a named precondition: check-in/device-created identities have **no self-serve hide path** (no hub builder session exists for them; hub admission is invite-gated), so rejecting P03 first requires an assertion-authenticated hide path or open hub enrollment. Task 1002799 carries this full decision payload.
 
+> **P03 outcome — RATIFIED (owner, 2026-08-16, task 1002799).** The fail-closed boundary stands: check-in/device-created accounts stay `provisional` (not publicly listed, not at `/u/<handle>`, not in the sitemap or hub search) until their human signs in at the hub at least once. The owner's rationale: in the intended product flow a builder passes through cloudbongos.com at least once anyway — to find or create the projects they join — so the activation gate is satisfied naturally and costs nothing; the cloudbongos builders hall predating the hub flow is a one-time bootstrap exception, and those accounts lazily activate on their next hub sign-in exactly as the backfill rule above already provides (no backfill activation). Tasks 1002913 (T&C artifact) and 1002914 (criterion text amendments) unblock on this ship.
+
 **4. The C2 hide flag is account-global and lives on `platform_identity_accounts.hide_stats` — not in `behavior_prefs`.** Three reasons: the data it guards is account-global hub data, so a per-instance jsonb key would fork the flag per instance; the public profile route must not grow a core→`builder-settings` read dependency that doesn't exist today; and enforcement belongs in the module's read functions (Decision 2), next to the data, where no caller can forget it. (C2's "(builder-settings)" parenthetical is therefore one of the criterion texts task 1002914 amends — the control is still self-serve in hall Settings; only its storage moves.) The write path is an own-scoped `PATCH` route in `platform-identity` (keyed by `req.builder.github_id`, `validateOrRespond`-validated so it needs no `WRITE_VALIDATION_EXEMPT` entry). Public profile responses stay **viewer-independent** — the surviving justification, with edge caching gone (Decision 5), is that a single response shape is the only thing the mirror leak test can actually pin — so the profile page renders the self-toggle client-side by comparing the already-available `/me` identity, and a builder whose stats are hidden inspects their own numbers in Settings via the own-scoped read (the C1 amendment in task 1002914 confirms Settings as the self-view home). Hidden → the track-record section renders the "keeps their track record private" line and **nothing** derived from the rollup ("no partial numbers; a count plus a hidden total is a leak by subtraction"); the local-instance profile keeps its local data (C2's fallback clause applies to the instance render path — the hub has no local data to fall back to). One residual stated honestly: hide removes the hub's *aggregated* view, not the per-instance public numbers it is derived from — every instance's `/public/leaderboard` stays public by design, so a determined reader can still reconstruct a sum the hard way. The C2 amendment text carries that caveat.
 
 **5. Hide must beat the cache: when the port resolves (hub), profile responses are `Cache-Control: no-store`.** The route's current `public, max-age=60` would keep serving a builder's stats for up to 60s after they hide — failing C2's "takes effect immediately" and the R06 proof as literally specified (a browser-cached copy survives a reload). On plain instances the existing `max-age=60` stays. The server-rendered `/u` page inherits the same rule for hide-sensitive content (its caching posture is otherwise goal 1000048's call). Cost: hub profile API responses aren't edge-cached — acceptable at current scale (the rollup read is one indexed aggregate per view).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.174",
+  "version": "1.19.175",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.174",
+      "version": "1.19.175",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.174",
+  "version": "1.19.175",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -775,8 +775,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.172 with no explicit bump. run 31968656001. (task 1002620)
 //   1.19.174 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.173 with no explicit bump. run 31969032984. (task 1002620)
+//   1.19.175 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.174 with no explicit bump. run 31970199477. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.174'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.175'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');