@bongos/core 1.19.181 → 1.19.182

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.181",
-  "core_contract": "1.19.181",
-  "source_commit": "3335e6696cc6d8b3c0a4d800860f76287c1fcc03",
+  "core_version": "1.19.182",
+  "core_contract": "1.19.182",
+  "source_commit": "e5417ea88504c51b0cc9af06d143ec9b3d37c0ed",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T21:10:51.840Z",
+  "built_at": "2026-08-16T21:13:59.751Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 308,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1277,
+    "functional_verbatim": 1279,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1606,
-  "tree_sha256": "411dfd39dd80ffce17841372dfaf756045f842fb17380c1caca33aa10251bc42",
+  "file_count": 1608,
+  "tree_sha256": "101a4745dd8d3b2a32eb0658b962706986782e31b92eb968862d929b7e5e05b7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "6b865314ad2d5e2e3e0e017a6bed7ae435ecfbca3859bdf763b59411a1d3d9f8"
+      "sha256": "4801db32c6f4ba6220bce8e664be063f8d8483bc22a57df08205b0fc36788b8b"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "c137a0e79a5e9065b071f87150639bff98cbda8f0d50a27027b42fa48ae200f6"
+      "sha256": "0d3fc054ed48e1e9398366c75e526e52c3b9ecf96b70888d98607e8aa0e68949"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "2fef3ad1be5b853de1d6df155bb5717b581cf8b6afa3851add9ea81032c159a6"
+      "sha256": "53dc2ac9322bdc1827fae124789e0cd8b09751c5359e1ae0266b65951a90126a"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "52dbea93e7039796ebf579e816bd3ed54727077e5383d27a348d36572a85b90d"
+      "sha256": "a775432136dc7ba0093a989991adf3f639793a287919dccc002eeaf026dacf6b"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "b2d21163a9fb149a98051dfde08e1cee81969194e74d3e272bb7779da9461c1b"
+      "sha256": "3588010536522ef306ab7e822bdb68dcc40ef42754d5b298384dac443f9ae0c6"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1362,12 +1362,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "74ee845dae6f2757b564c1a760042391f3eb3af21dd3abe4a8590b3c3f88c4b3"
+      "sha256": "b311208b348d4e94ca20536ae095098007f855ef1861169a15e534dbb2cf6ab4"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "1c8b42344fa248bd6e38d370cc117c5017fdd58071ba9cb2ca6e55a1678c5e56"
+      "sha256": "c414eadf025db00d4e87b2cadd5a7c6b18a55780ac2af6bfe0cafc9897ae4512"
     },
     {
       "path": "docs/architecture.md",
@@ -2677,7 +2677,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "2fef3ad1be5b853de1d6df155bb5717b581cf8b6afa3851add9ea81032c159a6"
+      "sha256": "53dc2ac9322bdc1827fae124789e0cd8b09751c5359e1ae0266b65951a90126a"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3337,7 +3337,7 @@
     {
       "path": "modules/hall-ui/public/profile.js",
       "mode": "0000644",
-      "sha256": "a4cf0c4c2d088fd1fb84c41c93cc28e2acd2b656b0bc995cd46043881b3611fa"
+      "sha256": "ddd95350fa5c3696452996d4c79bb7e9c5d4d2b1034ed31a082dd568195b6543"
     },
     {
       "path": "modules/hall-ui/public/ranks.html",
@@ -3814,6 +3814,11 @@
       "mode": "0000644",
       "sha256": "f78eb8f7b6ee1ea3ddd789d6019b9715ae193ff0cb7890aeb24d8473033a911a"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_009_profile_fields.sql",
+      "mode": "0000644",
+      "sha256": "00e2e9feccc56bdb30a5e4f0c6abbe610382fe425222419963a04ae022d3c58a"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -3822,7 +3827,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "59d9ef7d052890fdf09fd0a9f04432ab1baddc7c8dfe49950893b9dd67b89d66"
+      "sha256": "423afc175f0e1024d39fc20b561e24b423e2d9b6e5c16ddcd8e4a3329bcfa97b"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3842,7 +3847,7 @@
     {
       "path": "modules/platform-identity/routes/profile.js",
       "mode": "0000644",
-      "sha256": "29e7f6304b4215fd79c35662c48370a04a5a9ffa2c3c4ae3d1fabf277d407eb2"
+      "sha256": "2e158331e7cae0535ae81d63b6b7e8d471330c0f3d732f7e3092e45ad8255916"
     },
     {
       "path": "modules/platform-identity/routes/projects.js",
@@ -3852,7 +3857,7 @@
     {
       "path": "modules/platform-identity/routes/public-profile.js",
       "mode": "0000644",
-      "sha256": "9032ff152e6440187f0f9bd2b1a3bb9ea24167c9f6d79ae3345a26a0e2fdc356"
+      "sha256": "e59f99d6f323e70611a08fa2c8299af815e350dbb81bd7cc79e9d96bd93cdbba"
     },
     {
       "path": "modules/platform-identity/routes/scouting.js",
@@ -3867,7 +3872,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "53b5bdd5c9eb4a14695289dd1396231d29e0f53c8709bd591dc328362da88072"
+      "sha256": "514adcaae952190d418888ffb778d541a632e3040664ce53f7a55ba9a297292b"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4242,12 +4247,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "eb81d3478ad0a0cf69bc7595c726032d4e815e3a63c4c3c4a62ff56c5a8e5e0f"
+      "sha256": "1817517e0566226b12320fb61a3a216cbb08c4536cd0e5b959567438b81f9993"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c1255deacb68b9b3ea77218a7d5a9072b8203d1b0c4549d25f62eda4a12626a6"
+      "sha256": "090d46542c940a8327bb953057f47a8e51e56c9ecc86755af99a7e941eea4247"
     },
     {
       "path": "public-docs/index.html",
@@ -5852,7 +5857,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4d1b546ca70ac1b708cab0aec7a1933bf2e877e3d4ce6f170fdb9c5702df5ce9"
+      "sha256": "bcbce9e29c6f05fc39ad8e52b4aa13b170962a06dbd3b6b5befba810a48e29d8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6967,7 +6972,7 @@
     {
       "path": "tests/hub_profile_leak.mjs",
       "mode": "0000644",
-      "sha256": "f0934fad2cd869a0955b9b087cab449932e921032ca94fc356a952e88f528d82"
+      "sha256": "ea992d1ab2ddedc27aaa5348a397356bef91a4c1ad9b295eb1a0ed1c4fc707e9"
     },
     {
       "path": "tests/idea_completeness.mjs",
@@ -7434,6 +7439,11 @@
       "mode": "0000644",
       "sha256": "3c85d28ecc55e375988f3e55aee993c8c84220889678262d8207146c2772f3f5"
     },
+    {
+      "path": "tests/profile_fields.mjs",
+      "mode": "0000644",
+      "sha256": "ff73579dd2416a81648d85dcd5d1a77cb776c32047bd0cc7897dff132cbae5b7"
+    },
     {
       "path": "tests/profile_rollup_consent.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 275 operations across 46 resource groups
+- 276 operations across 46 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -433,6 +433,8 @@ function createClient(opts = {}) {
       getMeModelAllocation: (args) => request("GET", "/me/model-allocation", { hasBody: false }, args),
       // PATCH /me/model-allocation — rank: any-builder — PATCH /me/model-allocation
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
+      // PATCH /me/profile — rank: any-builder — PATCH /me/profile
+      patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
       // GET /me/recent-ships — rank: any-builder — GET /me/recent-ships
       getMeRecentShips: (args) => request("GET", "/me/recent-ships", { hasBody: false }, args),
       // GET /me/render — rank: any-builder — GET /me/render

package/clients/bongos-client/index.cjs

@@ -432,6 +432,8 @@ function createClient(opts = {}) {
       getMeModelAllocation: (args) => request("GET", "/me/model-allocation", { hasBody: false }, args),
       // PATCH /me/model-allocation — rank: any-builder — PATCH /me/model-allocation
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
+      // PATCH /me/profile — rank: any-builder — PATCH /me/profile
+      patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
       // GET /me/recent-ships — rank: any-builder — GET /me/recent-ships
       getMeRecentShips: (args) => request("GET", "/me/recent-ships", { hasBody: false }, args),
       // GET /me/render — rank: any-builder — GET /me/render

package/clients/bongos-client/index.d.ts

@@ -51,7 +51,7 @@ export interface GetInboxResponse { ideas: unknown; open_count: unknown }
 export interface GetLeaderboardResponse { leaderboard: unknown; page: unknown }
 export interface GetLearningsResponse { learnings: unknown }
 export interface GetMeAchievementsResponse { unlocked: unknown }
-export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; handle: unknown; cross_project: unknown }
+export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; handle: unknown; display_name: unknown; bio: unknown; links: unknown; cross_project: unknown }
 export interface GetMeDisplayNameResponse { display_name: unknown; max_length: unknown }
 export interface GetMeEventSoundPrefsResponse { prefs: unknown; effective: unknown; effective_wav: unknown; events: unknown }
 export interface GetMeRecentShipsResponse { ships: unknown }
@@ -134,6 +134,8 @@ export interface PatchMeDisplayNameResponse { display_name: unknown; max_length:
 export interface PatchMeEventSoundPrefsResponse { prefs: unknown; effective: unknown; effective_wav: unknown; events: unknown }
 export interface PatchMeHandleRequest { handle: string }
 export interface PatchMeHandleResponse { handle: unknown; previous_handle: unknown }
+export interface PatchMeProfileRequest { display_name?: unknown; bio?: unknown; links?: unknown }
+export interface PatchMeProfileResponse { display_name: unknown; bio: unknown; links: unknown }
 export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown; defaults: unknown; known_skills: unknown; allowed_models: unknown }
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
@@ -675,6 +677,8 @@ export interface BongosClient {
     getMeModelAllocation(args?: RequestArgs): Promise<ApiResponse>;
     /** PATCH /me/model-allocation — rank: any-builder */
     patchMeModelAllocation(args?: RequestArgs): Promise<ApiResponse>;
+    /** PATCH /me/profile — rank: any-builder */
+    patchMeProfile(args?: RequestArgs & { body?: PatchMeProfileRequest }): Promise<PatchMeProfileResponse>;
     /** GET /me/recent-ships — rank: any-builder */
     getMeRecentShips(args?: RequestArgs): Promise<GetMeRecentShipsResponse>;
     /** GET /me/render — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -429,6 +429,8 @@ export function createClient(opts = {}) {
       getMeModelAllocation: (args) => request("GET", "/me/model-allocation", { hasBody: false }, args),
       // PATCH /me/model-allocation — rank: any-builder — PATCH /me/model-allocation
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
+      // PATCH /me/profile — rank: any-builder — PATCH /me/profile
+      patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
       // GET /me/recent-ships — rank: any-builder — GET /me/recent-ships
       getMeRecentShips: (args) => request("GET", "/me/recent-ships", { hasBody: false }, args),
       // GET /me/render — rank: any-builder — GET /me/render

package/docs/api/openapi.json

@@ -6774,6 +6774,55 @@
         ]
       }
     },
+    "/me/profile": {
+      "patch": {
+        "operationId": "patch_me_profile",
+        "tags": [
+          "me"
+        ],
+        "summary": "PATCH /me/profile",
+        "description": "the caller's OWN profile fields (P02, task 1002798; spec Decision 4): bio, typed links, account display name. Own data, keyed on the authenticated github_id. The schema declares the keys for strict mode; the REAL validation (bio length/charset, https-only + host-pinned links, name length) lives in the domain, next to the data, and each field is nullable (null clears), which validateOrRespond's typed rules can't express.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/profile.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchMeProfileRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchMeProfileResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/recent-ships": {
       "get": {
         "operationId": "get_me_recent_ships",
@@ -8174,7 +8223,7 @@
           "profiles"
         ],
         "summary": "GET /profiles/:handle",
-        "description": "a handle-addressed public profile. Every field is already world-readable on the numeric profile route + the leaderboard; the handle is just the rename-proof address (spec Decision 3). Whitelisting happens inside the module (getPublicProfileByHandle); no-store because the payload embeds cross_project and hide must beat the cache (ADR 0171 D5).\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "a handle-addressed public profile. Every field is already world-readable on the numeric profile route + the leaderboard; the handle is just the rename-proof address (spec Decision 3). Whitelisting happens inside the module (getPublicProfileByHandle); no-store because the payload embeds cross_project and hide must beat the cache (ADR 0171 D5). Rate-limited like /public/* (per-IP read limiter) so the handle→identity mapping can't be scripted-enumerated at line rate (R05 grade advisory, task 1002798).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/platform-identity/routes/public-profile.js",
         "parameters": [
@@ -13038,12 +13087,18 @@
           },
           "profile_state": {},
           "handle": {},
+          "display_name": {},
+          "bio": {},
+          "links": {},
           "cross_project": {}
         },
         "required": [
           "hide_stats",
           "profile_state",
           "handle",
+          "display_name",
+          "bio",
+          "links",
           "cross_project"
         ]
       },
@@ -14117,6 +14172,28 @@
           "previous_handle"
         ]
       },
+      "PatchMeProfileRequest": {
+        "type": "object",
+        "properties": {
+          "display_name": {},
+          "bio": {},
+          "links": {}
+        },
+        "additionalProperties": false
+      },
+      "PatchMeProfileResponse": {
+        "type": "object",
+        "properties": {
+          "display_name": {},
+          "bio": {},
+          "links": {}
+        },
+        "required": [
+          "display_name",
+          "bio",
+          "links"
+        ]
+      },
       "PatchMeSkillPrefsResponse": {
         "type": "object",
         "properties": {
@@ -17355,9 +17432,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 275,
-  "x-schema-count": 309,
+  "x-endpoint-count": 276,
+  "x-schema-count": 311,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 209,
+  "x-response-schemas": 210,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 275 endpoints across 46 route files.
+> **Generated from the live route files** — the route file is authoritative. 276 endpoints across 46 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -282,7 +282,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (24)
+## `me` (25)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -301,6 +301,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | PATCH | `/api/bongos/me/interaction` | `any-builder` | _undocumented_ | PATCH the interaction profile. |
 | GET | `/api/bongos/me/model-allocation` | `any-builder` | — |  |
 | PATCH | `/api/bongos/me/model-allocation` | `any-builder` | _undocumented_ | PATCH the model allocation. |
+| PATCH | `/api/bongos/me/profile` | `any-builder` | `display_name`, `bio`, `links` | the caller's OWN profile fields (P02, task 1002798; spec Decision 4): bio, typed links, account display name. |
 | GET | `/api/bongos/me/recent-ships` | `any-builder` | — | Tasks this builder has shipped, most recent first. |
 | GET | `/api/bongos/me/render` | `any-builder` | — | Per-builder "render widgets" knob (task 1279, shares the behavior_prefs jsonb / migration 119). |
 | PATCH | `/api/bongos/me/render` | `any-builder` | _undocumented_ | PATCH the render knob. |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -432,6 +432,8 @@ function createClient(opts = {}) {
       getMeModelAllocation: (args) => request("GET", "/me/model-allocation", { hasBody: false }, args),
       // PATCH /me/model-allocation — rank: any-builder — PATCH /me/model-allocation
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
+      // PATCH /me/profile — rank: any-builder — PATCH /me/profile
+      patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
       // GET /me/recent-ships — rank: any-builder — GET /me/recent-ships
       getMeRecentShips: (args) => request("GET", "/me/recent-ships", { hasBody: false }, args),
       // GET /me/render — rank: any-builder — GET /me/render

package/modules/hall-ui/public/profile.js

@@ -177,7 +177,7 @@
     const name = escapeHtml(p.name || 'Project');
     // origin is third-party-reported; link only a well-formed https URL.
     const origin = typeof p.origin === 'string' && /^https:\/\//.test(p.origin) ? p.origin : null;
-    const nameCell = origin ? `<a href="${escapeHtml(origin)}" rel="noopener">${name}</a>` : name;
+    const nameCell = origin ? `<a href="${escapeHtml(origin)}" rel="noopener noreferrer">${name}</a>` : name;
     // rank_held is THAT project's standing as it reported it — plain text, never
     // the local rank badge or the instance's own rank labels (spec Decision 1).
     const held = typeof p.rank_held === 'string' && p.rank_held

package/modules/platform-identity/migrations/platform_identity_009_profile_fields.sql

@@ -0,0 +1,38 @@
+-- platform_identity_009_profile_fields.sql — bio + typed links + the
+-- display-name source bit (P02, task 1002798 / goal 1000045; profile-page spec
+-- Decision 4, ADR 0171 amendments R01).
+--
+--   bio   — plain text, ~280 chars, NO markdown and no auto-linking. The length
+--           cap + charset live in the domain validator (validateProfileBio in
+--           platform-identity.js — the only writer); nullable = never set.
+--   links — a TYPED, capped set as a jsonb object whose only keys are
+--           website | x | linkedin | discord, each an https URL (max 4 by
+--           construction — one per type). Typed-and-capped rather than a
+--           free-form list because a public, indexable page with
+--           user-controlled links is an SEO-spam magnet (spec Decision 4).
+--           Validation (https-only, no userinfo, per-type host pinning) lives
+--           in validateProfileLinks — the single write path; nullable = never set.
+--   display_name_source — the ADR 0156 mirror for the HUB account: 'github'
+--           (default; upsertAccount keeps re-syncing the name on every
+--           check-in/authorize) or 'user' (set by setAccountProfileFields; the
+--           upsertAccount conflict branch then never overwrites the name).
+--           Module-owned here — unlike core_197 the guard reads it inside this
+--           module's own upsertAccount, so it belongs on the module's table
+--           (ADR 0083 §5).
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent: the
+-- inline CHECK rides the ADD COLUMN IF NOT EXISTS, so a re-run is a no-op.
+
+BEGIN;
+
+ALTER TABLE platform_identity_accounts
+  ADD COLUMN IF NOT EXISTS bio text,
+  ADD COLUMN IF NOT EXISTS links jsonb,
+  ADD COLUMN IF NOT EXISTS display_name_source text NOT NULL DEFAULT 'github'
+    CHECK (display_name_source IN ('github', 'user'));
+
+-- 'github' is correct for every pre-existing row: before this change there was
+-- no user-set account display name, so whatever is stored IS GitHub-derived
+-- (the ADR 0156 backfill argument, unchanged).
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -107,13 +107,21 @@ function redirectUriAllowed(client, redirectUri) {
 // where a human is demonstrably at the hub. Every other caller (device-poll,
 // membership check-in) leaves the fail-closed 'provisional' default; activation
 // is one-way (a later non-activating upsert never demotes an active account).
+//
+// display_name is source-guarded (the ADR 0156 mirror, P02/task 1002798): once
+// a builder sets the account name themselves (setAccountProfileFields stamps
+// display_name_source='user'), no check-in/authorize re-sync overwrites it; a
+// never-renamed account keeps following GitHub. github_login and avatar_url
+// re-sync unconditionally — neither is user-editable (spec Decision 4).
 async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
      VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END)
      ON CONFLICT (github_id) DO UPDATE SET
        github_login = EXCLUDED.github_login,
-       display_name = EXCLUDED.display_name,
+       display_name = CASE WHEN platform_identity_accounts.display_name_source = 'user'
+                           THEN platform_identity_accounts.display_name
+                           ELSE EXCLUDED.display_name END,
        avatar_url   = EXCLUDED.avatar_url,
        profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END,
        updated_at   = now()
@@ -142,7 +150,8 @@ async function getAccountByLogin(githubLogin, { pool = defaultPool } = {}) {
 async function getAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, profile_state, hide_stats,
-            handle, previous_handle, handle_changed_at, created_at, updated_at
+            handle, previous_handle, handle_changed_at, bio, links, display_name_source,
+            created_at, updated_at
        FROM platform_identity_accounts WHERE github_id = $1`,
     [githubId],
   );
@@ -762,7 +771,7 @@ async function resolveHandle(handle, { pool = defaultPool } = {}) {
   const norm = normalizeHandle(handle);
   if (!norm) return null;
   const { rows } = await pool.query(
-    `SELECT github_id, github_login, display_name, avatar_url, handle, created_at,
+    `SELECT github_id, github_login, display_name, avatar_url, handle, bio, links, created_at,
             (lower(handle) = $1) AS is_current
        FROM platform_identity_accounts
       WHERE profile_state = 'active'
@@ -797,11 +806,189 @@ async function getPublicProfileByHandle(handle, { pool = defaultPool } = {}) {
       display_name: a.display_name,
       avatar_url: a.avatar_url,
       member_since: a.created_at,
+      // P02 (spec Decision 4): plain-text bio + the typed link set. RENDER
+      // CONTRACT for any consumer: escape the bio, never linkify it, and emit
+      // links with rel="nofollow ugc noopener" (validated at write, but the
+      // page must still treat them as user content).
+      bio: a.bio ?? null,
+      links: a.links ?? null,
     },
     cross_project: await getPublicProfileExtras(a.github_id, { pool }),
   };
 }
 
+// -------------------------------------------------------------------------
+// Profile fields: bio + typed links + account display name (P02, task 1002798
+// — profile-page spec Decision 4, ADR 0171 amendments R01)
+// -------------------------------------------------------------------------
+//
+// The typed-and-capped shape is the anti-spam design: a public, indexable page
+// with user-controlled links is an SEO-spam magnet, and a fixed set of four
+// typed slots rendered rel="nofollow ugc noopener" removes the incentive
+// without a moderation queue. Validation lives HERE, next to the data, where
+// no route can forget it (the upsertActivity precedent) — the client is never
+// relied on.
+
+// ~280 chars, Twitter-bio-sized (spec Decision 4). Counted in code points so a
+// 280-emoji bio is exactly at the cap, not over it (the display-name precedent).
+const BIO_MAX_CHARS = 280;
+
+// Mirrors modules/builder-settings/display-name.js MAX_LENGTH — boundary-forced
+// duplication (the ADR 0091 §2 pattern): the module may not import another
+// module's validator, and the two caps should not drift apart silently.
+const DISPLAY_NAME_MAX_CHARS = 60;
+
+// The closed link vocabulary. One slot per type ⇒ max 4 by construction.
+const PROFILE_LINK_TYPES = ['website', 'x', 'linkedin', 'discord'];
+
+// Typed slots are host-pinned: a link labelled "LinkedIn" that resolves
+// anywhere else is a phishing shape, not a profile link. `website` is the one
+// free slot (any https host). Subdomains of a pinned host are allowed.
+const PROFILE_LINK_HOSTS = {
+  x: ['x.com', 'twitter.com'],
+  linkedin: ['linkedin.com'],
+  discord: ['discord.gg', 'discord.com'],
+};
+
+const PROFILE_LINK_MAX_CHARS = 300;
+
+const codePointLength = (s) => Array.from(s).length;
+
+// Bio: plain text only — NO markdown, no auto-linking (that is a RENDER
+// contract: consumers escape + never linkify). Trimmed; empty/null clears.
+// Newlines and tabs are fine; other control characters are not text.
+// Returns { value } (value null = clear) or { error, ... }.
+function validateProfileBio(raw) {
+  if (raw == null) return { value: null };
+  if (typeof raw !== 'string') return { error: 'invalid_bio', reason: 'not_a_string' };
+  const trimmed = raw.trim();
+  if (!trimmed) return { value: null };
+  if (/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/.test(trimmed)) {
+    return { error: 'invalid_bio', reason: 'control_characters' };
+  }
+  const length = codePointLength(trimmed);
+  if (length > BIO_MAX_CHARS) return { error: 'bio_too_long', max: BIO_MAX_CHARS, length };
+  return { value: trimmed };
+}
+
+function hostAllowed(hostname, allowed) {
+  return allowed.some((h) => hostname === h || hostname.endsWith('.' + h));
+}
+
+// One link slot: https only — rejecting every other scheme (javascript:,
+// data:, http:, …) — with the userinfo/host tricks closed: credentials in the
+// URL (https://linkedin.com@evil.com parses linkedin.com as USERNAME) are
+// refused outright, and typed slots must land on their pinned host. Returns
+// the WHATWG-normalized href (lowercased host, canonical escaping) or an error.
+function validateProfileLink(type, raw) {
+  if (typeof raw !== 'string' || !raw.trim()) return { error: 'invalid_link', link_type: type, reason: 'not_a_url' };
+  const trimmed = raw.trim();
+  if (trimmed.length > PROFILE_LINK_MAX_CHARS) return { error: 'invalid_link', link_type: type, reason: 'too_long' };
+  let u;
+  try { u = new URL(trimmed); } catch { return { error: 'invalid_link', link_type: type, reason: 'not_a_url' }; }
+  if (u.protocol !== 'https:') return { error: 'invalid_link', link_type: type, reason: 'https_only' };
+  if (u.username || u.password) return { error: 'invalid_link', link_type: type, reason: 'userinfo_not_allowed' };
+  if (!u.hostname || !u.hostname.includes('.')) return { error: 'invalid_link', link_type: type, reason: 'bad_host' };
+  const pinned = PROFILE_LINK_HOSTS[type];
+  if (pinned && !hostAllowed(u.hostname, pinned)) {
+    return { error: 'invalid_link', link_type: type, reason: 'wrong_host', expected_hosts: pinned };
+  }
+  return { value: u.href };
+}
+
+// The full links object — REPLACES the stored set wholesale (a PATCH sends the
+// set it wants, omitting a key drops that link; null/{} clears everything).
+// Only the closed vocabulary is accepted; a null/empty slot value is treated
+// as "drop this slot". Returns { value } (null = clear) or the first error.
+function validateProfileLinks(raw) {
+  if (raw == null) return { value: null };
+  if (typeof raw !== 'object' || Array.isArray(raw)) return { error: 'invalid_links', reason: 'not_an_object' };
+  const out = {};
+  for (const [type, val] of Object.entries(raw)) {
+    if (!PROFILE_LINK_TYPES.includes(type)) return { error: 'invalid_links', reason: 'unknown_link_type', link_type: type };
+    if (val == null || val === '') continue;
+    const one = validateProfileLink(type, val);
+    if (one.error) return one;
+    out[type] = one.value;
+  }
+  return { value: Object.keys(out).length ? out : null };
+}
+
+// Account display name (spec Decision 4: the hub gets its OWN copy — hub value
+// wins on hub surfaces, instance value on instance surfaces, no sync engine).
+function validateAccountDisplayName(raw) {
+  if (typeof raw !== 'string') return { error: 'invalid_display_name', reason: 'not_a_string' };
+  const trimmed = raw.trim();
+  if (!trimmed) return { error: 'invalid_display_name', reason: 'empty' };
+  if (/[\u0000-\u001F\u007F]/.test(trimmed)) return { error: 'invalid_display_name', reason: 'control_characters' };
+  const length = codePointLength(trimmed);
+  if (length > DISPLAY_NAME_MAX_CHARS) return { error: 'display_name_too_long', max: DISPLAY_NAME_MAX_CHARS, length };
+  return { value: trimmed };
+}
+
+// The own-scoped profile-fields WRITE (P02) — callers key this by the
+// AUTHENTICATED session's github_id, never a caller-named one. Validates here,
+// then upserts on the setAccountHideStats pattern: the INSERT branch creates a
+// fail-closed provisional account (a hub builder who never federated can still
+// fill their profile ahead of time); the UPDATE branch touches ONLY the fields
+// the caller sent — never identity re-sync, never profile_state (activation
+// stays /sso/authorize's alone, D3), never hide_stats. Setting display_name
+// stamps display_name_source='user' — from then on upsertAccount's re-sync
+// keeps its hands off the name (the ADR 0156 mirror).
+async function setAccountProfileFields({ githubId, githubLogin, displayName, avatarUrl, fields = {} }, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return { error: 'no_account' };
+  const setName = 'display_name' in fields;
+  const setBio = 'bio' in fields;
+  const setLinks = 'links' in fields;
+  if (!setName && !setBio && !setLinks) return { error: 'no_fields' };
+  let nameValue = null;
+  if (setName) {
+    const v = validateAccountDisplayName(fields.display_name);
+    if (v.error) return v;
+    nameValue = v.value;
+  }
+  let bioValue = null;
+  if (setBio) {
+    const v = validateProfileBio(fields.bio);
+    if (v.error) return v;
+    bioValue = v.value;
+  }
+  let linksValue = null;
+  if (setLinks) {
+    const v = validateProfileLinks(fields.links);
+    if (v.error) return v;
+    linksValue = v.value;
+  }
+  const { rows } = await pool.query(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, display_name, avatar_url, bio, links, display_name_source)
+     VALUES ($1, $2, $3, $4, $5, $6, CASE WHEN $7::boolean THEN 'user' ELSE 'github' END)
+     ON CONFLICT (github_id) DO UPDATE SET
+       display_name = CASE WHEN $7::boolean THEN EXCLUDED.display_name ELSE platform_identity_accounts.display_name END,
+       display_name_source = CASE WHEN $7::boolean THEN 'user' ELSE platform_identity_accounts.display_name_source END,
+       bio          = CASE WHEN $8::boolean THEN EXCLUDED.bio ELSE platform_identity_accounts.bio END,
+       links        = CASE WHEN $9::boolean THEN EXCLUDED.links ELSE platform_identity_accounts.links END,
+       updated_at   = now()
+     RETURNING github_id, display_name, bio, links, handle`,
+    [
+      githubId,
+      githubLogin,
+      setName ? nameValue : (displayName ?? null),
+      avatarUrl ?? null,
+      bioValue,
+      linksValue == null ? null : JSON.stringify(linksValue),
+      setName,
+      setBio,
+      setLinks,
+    ],
+  );
+  const row = rows[0];
+  // This upsert can CREATE the account row — seed the handle then, same as
+  // upsertAccount / setAccountHideStats.
+  if (row && !row.handle) row.handle = await ensureHandle({ githubId, githubLogin }, { pool });
+  return row;
+}
+
 // -------------------------------------------------------------------------
 // Authorization codes (single-use, short-lived, bound)
 // -------------------------------------------------------------------------
@@ -912,6 +1099,17 @@ module.exports = {
   setAccountHandle,
   resolveHandle,
   getPublicProfileByHandle,
+  // profile fields: bio + typed links + account display name (P02)
+  BIO_MAX_CHARS,
+  DISPLAY_NAME_MAX_CHARS,
+  PROFILE_LINK_TYPES,
+  PROFILE_LINK_HOSTS,
+  PROFILE_LINK_MAX_CHARS,
+  validateProfileBio,
+  validateProfileLink,
+  validateProfileLinks,
+  validateAccountDisplayName,
+  setAccountProfileFields,
   // codes
   mintAuthCode,
   redeemAuthCode,

package/modules/platform-identity/routes/profile.js

@@ -16,6 +16,13 @@
 //   PATCH /me/handle        — rename the caller's own handle (P01, task 1002797;
 //                             spec Decision 3). Low rate limit, previous handle
 //                             kept for the 301 window.
+//   PATCH /me/profile       — the profile-fields write (P02, task 1002798; spec
+//                             Decision 4): bio + typed links + the account
+//                             display name. Validation lives in the domain
+//                             (https-only typed links, host pinning, 280-char
+//                             plain-text bio); setting display_name stamps
+//                             display_name_source='user' so federated re-syncs
+//                             stop overwriting it (the ADR 0156 mirror).
 //
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
@@ -35,7 +42,7 @@ module.exports = function profileRoutes() {
       // Core builders include system:* principals whose github_id is not numeric;
       // they have no platform identity — answer the empty shape, not a 500.
       if (!pi.isNumericGithubId(req.builder.github_id)) {
-        return res.json({ hide_stats: false, profile_state: null, handle: null, cross_project: null });
+        return res.json({ hide_stats: false, profile_state: null, handle: null, display_name: null, bio: null, links: null, cross_project: null });
       }
       const [acct, extras] = await Promise.all([
         pi.getAccount(req.builder.github_id, { pool }),
@@ -45,6 +52,10 @@ module.exports = function profileRoutes() {
         hide_stats: !!(acct && acct.hide_stats),
         profile_state: acct ? acct.profile_state : null,
         handle: (acct && acct.handle) || null,
+        // P02: the account-global profile fields, for the Settings form (P04).
+        display_name: (acct && acct.display_name) || null,
+        bio: (acct && acct.bio) || null,
+        links: (acct && acct.links) || null,
         cross_project: extras,
       });
     } catch (err) {
@@ -119,5 +130,56 @@ module.exports = function profileRoutes() {
     }
   });
 
+  // rank: any-builder — the caller's OWN profile fields (P02, task 1002798; spec
+  // Decision 4): bio, typed links, account display name. Own data, keyed on the
+  // authenticated github_id. The schema declares the keys for strict mode; the
+  // REAL validation (bio length/charset, https-only + host-pinned links, name
+  // length) lives in the domain, next to the data, and each field is nullable
+  // (null clears), which validateOrRespond's typed rules can't express.
+  router.patch('/me/profile', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { display_name: {}, bio: {}, links: {} })) return;
+    try {
+      if (!pi.isNumericGithubId(req.builder.github_id)) {
+        return res.fail('no_platform_identity', 400);
+      }
+      const fields = {};
+      for (const k of ['display_name', 'bio', 'links']) {
+        if (k in req.body) fields[k] = req.body[k];
+      }
+      const out = await pi.setAccountProfileFields({
+        githubId: req.builder.github_id,
+        githubLogin: req.builder.github_login,
+        displayName: req.builder.display_name,
+        avatarUrl: req.builder.avatar_url,
+        fields,
+      }, { pool });
+      if (out.error === 'no_fields') {
+        return res.fail('no_fields', { status: 400, message: 'send at least one of display_name, bio, links' });
+      }
+      if (out.error === 'bio_too_long') {
+        return res.fail('bio_too_long', { status: 400, message: `a bio is at most ${pi.BIO_MAX_CHARS} characters of plain text` });
+      }
+      if (out.error === 'invalid_bio') {
+        return res.fail('invalid_bio', { status: 400, message: 'a bio is plain text (no control characters)' });
+      }
+      if (out.error === 'invalid_link' || out.error === 'invalid_links') {
+        return res.fail(out.error, { status: 400, message: `links are a typed set (${pi.PROFILE_LINK_TYPES.join(', ')}), https URLs only${out.link_type ? ` — problem with '${out.link_type}'` : ''}` });
+      }
+      if (out.error === 'display_name_too_long') {
+        return res.fail('display_name_too_long', { status: 400, message: `a display name is at most ${pi.DISPLAY_NAME_MAX_CHARS} characters` });
+      }
+      if (out.error === 'invalid_display_name') {
+        return res.fail('invalid_display_name', { status: 400, message: 'a display name must be non-empty plain text' });
+      }
+      if (out.error) {
+        return res.fail('profile_write_failed', { status: 500, message: 'internal error' });
+      }
+      res.json({ display_name: out.display_name, bio: out.bio, links: out.links });
+    } catch (err) {
+      console.error('[platform-identity] PATCH /me/profile', err);
+      res.fail('profile_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/platform-identity/routes/public-profile.js

@@ -19,6 +19,43 @@ const pi = require('../platform-identity');
 
 const { pool, corsPublicGet } = api;
 
+// Per-IP read cap for this UNAUTHENTICATED route (R05 grade advisory, task
+// 1002798): the global limiter only meters writes, so an uncapped scraper could
+// enumerate the handle→identity mapping at line rate. Vendored sliding window —
+// the modules/memory readRateLimit pattern (the core /public/* limiter is not
+// on the doorway; a kernel file may not import it). 120/60s mirrors the
+// /public/* posture; req.ip honors 'trust proxy' so it is the end user.
+const READ_RATE_WINDOW_MS = 60 * 1000;
+const READ_RATE_LIMIT = 120;
+const buckets = new Map(); // ip -> timestamp[]
+
+const sweepTimer = setInterval(() => {
+  const cutoff = Date.now() - READ_RATE_WINDOW_MS;
+  for (const [k, arr] of buckets) {
+    while (arr.length && arr[0] < cutoff) arr.shift();
+    if (arr.length === 0) buckets.delete(k);
+  }
+}, 5 * 60 * 1000);
+if (typeof sweepTimer.unref === 'function') sweepTimer.unref();
+
+function profileReadRateLimit(req, res, next) {
+  const now = Date.now();
+  const key = req.ip || req.socket?.remoteAddress || 'unknown';
+  let bucket = buckets.get(key);
+  if (!bucket) { bucket = []; buckets.set(key, bucket); }
+  const cutoff = now - READ_RATE_WINDOW_MS;
+  while (bucket.length && bucket[0] < cutoff) bucket.shift();
+  if (bucket.length >= READ_RATE_LIMIT) {
+    const retryAfter = Math.max(1, Math.ceil((bucket[0] + READ_RATE_WINDOW_MS - now) / 1000));
+    res.set('Retry-After', String(retryAfter));
+    res.set('X-RateLimit-Scope', 'public-profile-read');
+    res.set('X-RateLimit-Limit', String(READ_RATE_LIMIT));
+    return res.fail('rate_limited', 429, { scope: 'public-profile-read', retry_after_seconds: retryAfter });
+  }
+  bucket.push(now);
+  return next();
+}
+
 module.exports = function publicProfileRoutes() {
   const router = express.Router();
 
@@ -28,8 +65,10 @@ module.exports = function publicProfileRoutes() {
   // world-readable on the numeric profile route + the leaderboard; the handle is
   // just the rename-proof address (spec Decision 3). Whitelisting happens inside
   // the module (getPublicProfileByHandle); no-store because the payload embeds
-  // cross_project and hide must beat the cache (ADR 0171 D5).
-  router.get('/profiles/:handle', async (req, res) => {
+  // cross_project and hide must beat the cache (ADR 0171 D5). Rate-limited like
+  // /public/* (per-IP read limiter) so the handle→identity mapping can't be
+  // scripted-enumerated at line rate (R05 grade advisory, task 1002798).
+  router.get('/profiles/:handle', profileReadRateLimit, async (req, res) => {
     try {
       const out = await pi.getPublicProfileByHandle(req.params.handle, { pool });
       res.set('Cache-Control', 'no-store');

package/modules/platform-identity/tests/platform-identity.mjs

@@ -756,7 +756,7 @@ await ta('getPublicProfileByHandle: identity-band whitelist — github_id/profil
     { rows: [{ profile_state: 'active', hide_stats: true }], rowCount: 1 },
   ]);
   const out = await P.getPublicProfileByHandle('x', { pool });
-  assert.deepEqual(Object.keys(out.account).sort(), ['avatar_url', 'display_name', 'github_login', 'handle', 'member_since'].sort());
+  assert.deepEqual(Object.keys(out.account).sort(), ['avatar_url', 'bio', 'display_name', 'github_login', 'handle', 'links', 'member_since'].sort());
   assert.equal(out.cross_project, null, 'hidden → null, indistinguishable from none');
   const text = JSON.stringify(out);
   assert.doesNotMatch(text, /github_id/, 'the join key stays internal');
@@ -772,5 +772,94 @@ await ta('getPublicProfileByHandle: unknown → null; moved passes through', asy
   assert.deepEqual(await P.getPublicProfileByHandle('then', { pool: pool2 }), { moved_to: 'now' });
 });
 
+console.log('\nprofile fields (P02, task 1002798):');
+
+t('validateProfileBio: trims, clears on empty/null, caps at 280 code points, plain text only', () => {
+  assert.deepEqual(P.validateProfileBio(null), { value: null });
+  assert.deepEqual(P.validateProfileBio('   '), { value: null });
+  assert.deepEqual(P.validateProfileBio(' hi '), { value: 'hi' });
+  assert.equal(P.validateProfileBio('🔥'.repeat(P.BIO_MAX_CHARS)).error, undefined, 'code points, not UTF-16 units');
+  assert.equal(P.validateProfileBio('x'.repeat(P.BIO_MAX_CHARS + 1)).error, 'bio_too_long');
+  assert.equal(P.validateProfileBio('a\nb\tc').value, 'a\nb\tc', 'newlines and tabs are text');
+  assert.equal(P.validateProfileBio('a\u0007b').error, 'invalid_bio', 'other control chars are not');
+  assert.equal(P.validateProfileBio(42).error, 'invalid_bio');
+});
+
+t('validateProfileLink: https only — every other scheme refused', () => {
+  assert.equal(P.validateProfileLink('website', 'https://me.example/x').value, 'https://me.example/x');
+  assert.equal(P.validateProfileLink('website', 'HTTPS://Me.EXAMPLE/x').value, 'https://me.example/x', 'scheme+host normalize');
+  for (const bad of ['http://me.example', 'javascript:alert(1)', 'data:text/html,x', 'ftp://me.example', '//me.example', 'me.example']) {
+    assert.ok(P.validateProfileLink('website', bad).error, `refused: ${bad}`);
+  }
+});
+
+t('validateProfileLink: userinfo + host tricks refused', () => {
+  assert.equal(P.validateProfileLink('website', 'https://linkedin.com@evil.example/x').error, 'invalid_link');
+  assert.equal(P.validateProfileLink('website', 'https://a:b@evil.example/x').error, 'invalid_link');
+  assert.equal(P.validateProfileLink('website', 'https://localhost/x').error, 'invalid_link', 'dotless hosts refused');
+  assert.equal(P.validateProfileLink('x', 'https://x.com.evil.example/u').reason, 'wrong_host', 'suffix lookalike refused');
+});
+
+t('validateProfileLink: typed slots are host-pinned; website is free', () => {
+  assert.ok(P.validateProfileLink('x', 'https://x.com/jaxri').value);
+  assert.ok(P.validateProfileLink('x', 'https://www.twitter.com/jaxri').value, 'subdomains of a pinned host allowed');
+  assert.equal(P.validateProfileLink('x', 'https://evil.example/u').reason, 'wrong_host');
+  assert.ok(P.validateProfileLink('linkedin', 'https://www.linkedin.com/in/jaxri').value);
+  assert.ok(P.validateProfileLink('discord', 'https://discord.gg/bongos').value);
+  assert.equal(P.validateProfileLink('discord', 'https://discord.example/x').reason, 'wrong_host');
+  assert.ok(P.validateProfileLink('website', 'https://anything.example/at-all').value);
+});
+
+t('validateProfileLinks: closed vocabulary, object only, empty → clear', () => {
+  assert.deepEqual(P.validateProfileLinks(null), { value: null });
+  assert.deepEqual(P.validateProfileLinks({}), { value: null });
+  assert.deepEqual(P.validateProfileLinks({ website: '' }), { value: null }, 'empty slot values drop');
+  assert.equal(P.validateProfileLinks([]).error, 'invalid_links');
+  assert.equal(P.validateProfileLinks('https://x.com').error, 'invalid_links');
+  assert.equal(P.validateProfileLinks({ github: 'https://github.com/x' }).reason, 'unknown_link_type');
+  const full = P.validateProfileLinks({ website: 'https://me.example', x: 'https://x.com/j', linkedin: 'https://linkedin.com/in/j', discord: 'https://discord.gg/j' });
+  assert.deepEqual(Object.keys(full.value).sort(), [...P.PROFILE_LINK_TYPES].sort(), 'max 4 by construction — one slot per type');
+});
+
+t('validateAccountDisplayName: trimmed, non-empty, ≤60 code points, single line', () => {
+  assert.equal(P.validateAccountDisplayName('  Percy J  ').value, 'Percy J');
+  assert.equal(P.validateAccountDisplayName('').error, 'invalid_display_name');
+  assert.equal(P.validateAccountDisplayName('x'.repeat(P.DISPLAY_NAME_MAX_CHARS + 1)).error, 'display_name_too_long');
+  assert.equal(P.validateAccountDisplayName('a\nb').error, 'invalid_display_name');
+  assert.equal(P.validateAccountDisplayName(42).error, 'invalid_display_name');
+});
+
+await ta('upsertAccount SQL carries the ADR 0156 guard: a user-set name is never overwritten', async () => {
+  const pool = mockPool([{ rows: [{ handle: 'x' }], rowCount: 1 }]);
+  await P.upsertAccount({ githubId: '7', githubLogin: 'x' }, { pool });
+  const sql = pool.calls[0].text;
+  assert.match(sql, /display_name\s*=\s*CASE WHEN platform_identity_accounts\.display_name_source = 'user'/,
+    'the conflict branch guards display_name on display_name_source');
+  assert.match(sql, /github_login\s*=\s*EXCLUDED\.github_login/, 'github_login still re-syncs unconditionally');
+  assert.match(sql, /avatar_url\s*=\s*EXCLUDED\.avatar_url/, 'avatar_url still re-syncs unconditionally');
+});
+
+await ta('setAccountProfileFields: validates before any query; refuses empty + non-numeric ids', async () => {
+  const pool = mockPool();
+  assert.deepEqual(await P.setAccountProfileFields({ githubId: 'system:bfg', githubLogin: 'x', fields: { bio: 'b' } }, { pool }), { error: 'no_account' });
+  assert.deepEqual(await P.setAccountProfileFields({ githubId: '7', githubLogin: 'x', fields: {} }, { pool }), { error: 'no_fields' });
+  const bad = await P.setAccountProfileFields({ githubId: '7', githubLogin: 'x', fields: { links: { x: 'https://evil.example/u' } } }, { pool });
+  assert.equal(bad.error, 'invalid_link');
+  assert.equal(pool.calls.length, 0, 'nothing reached the DB');
+});
+
+await ta('setAccountProfileFields SQL: flag-guarded UPDATE that never touches consent or identity re-sync', async () => {
+  const pool = mockPool([{ rows: [{ github_id: '7', display_name: 'N', bio: 'b', links: null, handle: 'h' }], rowCount: 1 }]);
+  await P.setAccountProfileFields({ githubId: '7', githubLogin: 'x', fields: { display_name: 'N', bio: 'b' } }, { pool });
+  const { text, params } = pool.calls[0];
+  const updateBranch = text.slice(text.indexOf('DO UPDATE SET'));
+  assert.match(updateBranch, /display_name_source = CASE WHEN \$7::boolean THEN 'user'/, 'setting the name stamps source=user');
+  assert.doesNotMatch(updateBranch, /profile_state/, 'consent never moves here (activation is /sso/authorize alone)');
+  assert.doesNotMatch(updateBranch, /hide_stats/, 'the C2 flag never moves here');
+  assert.doesNotMatch(updateBranch, /github_login\s*=/, 'no identity re-sync on the profile write');
+  assert.doesNotMatch(updateBranch, /avatar_url\s*=/, 'no identity re-sync on the profile write');
+  assert.deepEqual(params.slice(6, 9), [true, true, false], 'flags: name+bio sent, links not');
+});
+
 console.log(`\nplatform-identity: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.181",
+  "version": "1.19.182",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.181",
+      "version": "1.19.182",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.181",
+  "version": "1.19.182",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -789,8 +789,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.179 with no explicit bump. run 31972568511. (task 1002620)
 //   1.19.181 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.180 with no explicit bump. run 31972686846. (task 1002620)
+//   1.19.182 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.181 with no explicit bump. run 31972846686. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.181'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.182'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_profile_leak.mjs

@@ -69,7 +69,7 @@ const SECRET_PROJECT = 'P05-PRIVATE-DO-NOT-LEAK';
 const SECRET_PREV = 'p05-prev-sentinel';
 const PUB_ORIGIN = 'https://p05-pub.example', PRIV_ORIGIN = 'https://p05-priv.example';
 const CP_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
-const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since'];
+const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since', 'bio', 'links'];
 
 const q = (sql, params) => pool.query(sql, params);
 async function cleanup() {
@@ -103,7 +103,7 @@ function get(port, path) {
 
 const NEVER_IN_A_BODY = [
   SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, SECRET_PROJECT, SECRET_PREV,
-  'profile_state', 'hide_stats', 'github_id',
+  'profile_state', 'hide_stats', 'github_id', 'display_name_source',
 ];
 function assertNoSentinels(text, where) {
   for (const s of NEVER_IN_A_BODY) {
@@ -118,14 +118,17 @@ try {
   await q(migrationSql('platform_identity_005_builder_activity.sql'));
   await q(migrationSql('platform_identity_007_profile_consent.sql'));
   await q(migrationSql('platform_identity_008_handle.sql'));
+  await q(migrationSql('platform_identity_009_profile_fields.sql'));
   await cleanup();
 
+  // The active account carries the P02 fields + a user-set name source, so the
+  // 200 proves bio/links serialize while display_name_source never does.
   await q(
     `INSERT INTO platform_identity_accounts
-       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle)
-     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4),
-            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL),
-            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL)`,
+       (github_id, github_login, display_name, avatar_url, profile_state, hide_stats, handle, previous_handle, bio, links, display_name_source)
+     VALUES ($1, 'p05-active-login', 'P05 Active', 'https://a.example/a.png', 'active', false, 'p05-active', $4, 'Builds things.', '{"website":"https://p05.example/"}', 'user'),
+            ($2, 'p05-hidden-login', 'P05 Hidden', NULL, 'active', true,  'p05-hidden', NULL, NULL, NULL, 'github'),
+            ($3, 'p05-prov-login',   'P05 Prov',   NULL, 'provisional', false, 'p05-prov', NULL, NULL, NULL, 'github')`,
     [ACTIVE, HIDDEN, PROV, SECRET_PREV],
   );
   await q(
@@ -165,6 +168,8 @@ try {
     assert.equal(r.json.cross_project.projects[0].name, 'P05 Pub Proj');
     assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held'].sort());
     assert.equal(r.json.cross_project.more_projects, 1, 'the non-public project is counted, never named');
+    assert.equal(r.json.account.bio, 'Builds things.', 'bio serializes (P02)');
+    assert.deepEqual(r.json.account.links, { website: 'https://p05.example/' }, 'links serialize (P02)');
     assertNoSentinels(r.text, 'the 200 body');
   });
 

package/tests/profile_fields.mjs

@@ -0,0 +1,133 @@
+// tests/profile_fields.mjs — P02, task 1002798 (goal 1000045; real DB).
+//
+// Proves migration 009 + the profile-fields machinery against real SQL (the
+// handle_machinery.mjs precedent):
+//   1. setAccountProfileFields on an UNSEEN builder creates a fail-closed
+//      provisional account, seeds the handle, stores bio + links
+//   2. the ADR 0156 mirror: setting display_name stamps source='user', and a
+//      later upsertAccount re-sync (the check-in shape) keeps its hands off the
+//      name while github_login/avatar_url still re-sync; a never-renamed
+//      account still follows GitHub renames
+//   3. the UPDATE branch touches ONLY the fields sent — bio alone leaves
+//      links/display_name alone, and never demotes profile_state or flips
+//      hide_stats
+//   4. links REPLACE wholesale; null clears; a rejected link writes nothing
+//   5. the public read (getPublicProfileByHandle) carries bio + links
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/profile_fields.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`profile_fields.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const FRESH = 9002798001, SYNCED = 9002798002;
+const ALL_IDS = [FRESH, SYNCED];
+
+const q = (sql, params) => pool.query(sql, params);
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_accounts WHERE github_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const acctOf = (id) => pi.getAccount(id, { pool });
+
+try {
+  await q(migrationSql('platform_identity_001_tables.sql'));
+  await q(migrationSql('platform_identity_007_profile_consent.sql'));
+  await q(migrationSql('platform_identity_008_handle.sql'));
+  await q(migrationSql('platform_identity_009_profile_fields.sql'));
+  // Idempotence is part of what this proves.
+  await q(migrationSql('platform_identity_009_profile_fields.sql'));
+  await cleanup();
+
+  // --- 1. INSERT branch: unseen builder fills their profile ahead of time ---
+  const first = await pi.setAccountProfileFields({
+    githubId: FRESH, githubLogin: 'P02Fresh', displayName: 'GH Fresh', avatarUrl: 'https://a.example/f.png',
+    fields: { bio: '  Builds bongos in the cloud.  ', links: { website: 'https://fresh.example', x: 'https://x.com/fresh' } },
+  }, { pool });
+  ok(first.bio === 'Builds bongos in the cloud.', 'INSERT branch stores the trimmed bio');
+  ok(first.links.website === 'https://fresh.example/' && first.links.x === 'https://x.com/fresh', 'INSERT branch stores normalized links');
+  ok(first.handle === 'p02fresh', 'the create path seeds the handle, like every other account-creating upsert');
+  let a = await acctOf(FRESH);
+  ok(a.profile_state === 'provisional', 'a profile-fields write never grants consent — fail-closed provisional');
+  ok(a.display_name === 'GH Fresh' && a.display_name_source === 'github', 'no display_name sent → GitHub-derived name, source stays github');
+
+  // --- 2. the ADR 0156 mirror ----------------------------------------------
+  const named = await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'P02Fresh', fields: { display_name: 'Fresh, Renamed' } }, { pool });
+  ok(named.display_name === 'Fresh, Renamed', 'setting display_name writes it');
+  a = await acctOf(FRESH);
+  ok(a.display_name_source === 'user', 'and stamps display_name_source=user');
+
+  await pi.upsertAccount({ githubId: FRESH, githubLogin: 'p02fresh-renamed', displayName: 'GH Clobber', avatarUrl: 'https://a.example/new.png' }, { pool });
+  a = await acctOf(FRESH);
+  ok(a.display_name === 'Fresh, Renamed', 'a check-in re-sync does NOT clobber a user-set name');
+  ok(a.github_login === 'p02fresh-renamed' && a.avatar_url === 'https://a.example/new.png', 'github_login + avatar_url still re-sync unconditionally');
+
+  await pi.upsertAccount({ githubId: SYNCED, githubLogin: 'p02synced', displayName: 'GH Old' }, { pool });
+  await pi.upsertAccount({ githubId: SYNCED, githubLogin: 'p02synced', displayName: 'GH New' }, { pool });
+  a = await acctOf(SYNCED);
+  ok(a.display_name === 'GH New', 'a never-renamed account still follows GitHub renames');
+
+  // --- 3. the UPDATE branch touches only what was sent ----------------------
+  await q(`UPDATE platform_identity_accounts SET profile_state = 'active', hide_stats = true WHERE github_id = $1`, [FRESH]);
+  await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: 'Just the bio.' } }, { pool });
+  a = await acctOf(FRESH);
+  ok(a.bio === 'Just the bio.', 'bio alone updates');
+  ok(a.links.website === 'https://fresh.example/', 'links untouched by a bio-only write');
+  ok(a.display_name === 'Fresh, Renamed', 'display_name untouched by a bio-only write');
+  ok(a.profile_state === 'active' && a.hide_stats === true, 'profile_state + hide_stats never move on a profile-fields write');
+
+  // --- 4. links replace wholesale; null clears; rejects write nothing -------
+  await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { links: { discord: 'https://discord.gg/bongos' } } }, { pool });
+  a = await acctOf(FRESH);
+  ok(a.links.discord === 'https://discord.gg/bongos' && !a.links.website && !a.links.x, 'a links write replaces the whole set');
+
+  const bad = await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: 'never lands', links: { linkedin: 'https://evil.example/in' } } }, { pool });
+  ok(bad.error === 'invalid_link' && bad.reason === 'wrong_host', 'a host-pinned type refuses a foreign host');
+  a = await acctOf(FRESH);
+  ok(a.bio === 'Just the bio.' && a.links.discord === 'https://discord.gg/bongos', 'a rejected write writes NOTHING — not even the valid fields beside it');
+
+  const none = await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: {} }, { pool });
+  ok(none.error === 'no_fields', 'an empty fields object is refused, not a silent no-op');
+
+  await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: null, links: null } }, { pool });
+  a = await acctOf(FRESH);
+  ok(a.bio === null && a.links === null, 'null clears bio and links');
+
+  // --- 5. the public read carries the fields --------------------------------
+  await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: 'Public bio.', links: { website: 'https://fresh.example' } } }, { pool });
+  const page = await pi.getPublicProfileByHandle('p02fresh', { pool });
+  ok(page.account.bio === 'Public bio.' && page.account.links.website === 'https://fresh.example/', 'getPublicProfileByHandle serves bio + links');
+  ok(!('display_name_source' in page.account), 'display_name_source never crosses the public whitelist');
+
+  console.log(`\nprofile_fields: ${pass} checks passed`);
+} catch (e) {
+  console.error(`\nFAIL after ${pass} checks: ${e.message}`);
+  process.exitCode = 1;
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}