@bongos/core 1.19.181 → 1.19.183

package/modules/platform-identity/platform-identity.js

@@ -107,13 +107,21 @@ function redirectUriAllowed(client, redirectUri) {
 // where a human is demonstrably at the hub. Every other caller (device-poll,
 // membership check-in) leaves the fail-closed 'provisional' default; activation
 // is one-way (a later non-activating upsert never demotes an active account).
+//
+// display_name is source-guarded (the ADR 0156 mirror, P02/task 1002798): once
+// a builder sets the account name themselves (setAccountProfileFields stamps
+// display_name_source='user'), no check-in/authorize re-sync overwrites it; a
+// never-renamed account keeps following GitHub. github_login and avatar_url
+// re-sync unconditionally — neither is user-editable (spec Decision 4).
 async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
      VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END)
      ON CONFLICT (github_id) DO UPDATE SET
        github_login = EXCLUDED.github_login,
-       display_name = EXCLUDED.display_name,
+       display_name = CASE WHEN platform_identity_accounts.display_name_source = 'user'
+                           THEN platform_identity_accounts.display_name
+                           ELSE EXCLUDED.display_name END,
        avatar_url   = EXCLUDED.avatar_url,
        profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END,
        updated_at   = now()
@@ -142,7 +150,8 @@ async function getAccountByLogin(githubLogin, { pool = defaultPool } = {}) {
 async function getAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, profile_state, hide_stats,
-            handle, previous_handle, handle_changed_at, created_at, updated_at
+            handle, previous_handle, handle_changed_at, bio, links, display_name_source,
+            created_at, updated_at
        FROM platform_identity_accounts WHERE github_id = $1`,
     [githubId],
   );
@@ -762,7 +771,7 @@ async function resolveHandle(handle, { pool = defaultPool } = {}) {
   const norm = normalizeHandle(handle);
   if (!norm) return null;
   const { rows } = await pool.query(
-    `SELECT github_id, github_login, display_name, avatar_url, handle, created_at,
+    `SELECT github_id, github_login, display_name, avatar_url, handle, bio, links, created_at,
             (lower(handle) = $1) AS is_current
        FROM platform_identity_accounts
       WHERE profile_state = 'active'
@@ -797,11 +806,189 @@ async function getPublicProfileByHandle(handle, { pool = defaultPool } = {}) {
       display_name: a.display_name,
       avatar_url: a.avatar_url,
       member_since: a.created_at,
+      // P02 (spec Decision 4): plain-text bio + the typed link set. RENDER
+      // CONTRACT for any consumer: escape the bio, never linkify it, and emit
+      // links with rel="nofollow ugc noopener" (validated at write, but the
+      // page must still treat them as user content).
+      bio: a.bio ?? null,
+      links: a.links ?? null,
     },
     cross_project: await getPublicProfileExtras(a.github_id, { pool }),
   };
 }
 
+// -------------------------------------------------------------------------
+// Profile fields: bio + typed links + account display name (P02, task 1002798
+// — profile-page spec Decision 4, ADR 0171 amendments R01)
+// -------------------------------------------------------------------------
+//
+// The typed-and-capped shape is the anti-spam design: a public, indexable page
+// with user-controlled links is an SEO-spam magnet, and a fixed set of four
+// typed slots rendered rel="nofollow ugc noopener" removes the incentive
+// without a moderation queue. Validation lives HERE, next to the data, where
+// no route can forget it (the upsertActivity precedent) — the client is never
+// relied on.
+
+// ~280 chars, Twitter-bio-sized (spec Decision 4). Counted in code points so a
+// 280-emoji bio is exactly at the cap, not over it (the display-name precedent).
+const BIO_MAX_CHARS = 280;
+
+// Mirrors modules/builder-settings/display-name.js MAX_LENGTH — boundary-forced
+// duplication (the ADR 0091 §2 pattern): the module may not import another
+// module's validator, and the two caps should not drift apart silently.
+const DISPLAY_NAME_MAX_CHARS = 60;
+
+// The closed link vocabulary. One slot per type ⇒ max 4 by construction.
+const PROFILE_LINK_TYPES = ['website', 'x', 'linkedin', 'discord'];
+
+// Typed slots are host-pinned: a link labelled "LinkedIn" that resolves
+// anywhere else is a phishing shape, not a profile link. `website` is the one
+// free slot (any https host). Subdomains of a pinned host are allowed.
+const PROFILE_LINK_HOSTS = {
+  x: ['x.com', 'twitter.com'],
+  linkedin: ['linkedin.com'],
+  discord: ['discord.gg', 'discord.com'],
+};
+
+const PROFILE_LINK_MAX_CHARS = 300;
+
+const codePointLength = (s) => Array.from(s).length;
+
+// Bio: plain text only — NO markdown, no auto-linking (that is a RENDER
+// contract: consumers escape + never linkify). Trimmed; empty/null clears.
+// Newlines and tabs are fine; other control characters are not text.
+// Returns { value } (value null = clear) or { error, ... }.
+function validateProfileBio(raw) {
+  if (raw == null) return { value: null };
+  if (typeof raw !== 'string') return { error: 'invalid_bio', reason: 'not_a_string' };
+  const trimmed = raw.trim();
+  if (!trimmed) return { value: null };
+  if (/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/.test(trimmed)) {
+    return { error: 'invalid_bio', reason: 'control_characters' };
+  }
+  const length = codePointLength(trimmed);
+  if (length > BIO_MAX_CHARS) return { error: 'bio_too_long', max: BIO_MAX_CHARS, length };
+  return { value: trimmed };
+}
+
+function hostAllowed(hostname, allowed) {
+  return allowed.some((h) => hostname === h || hostname.endsWith('.' + h));
+}
+
+// One link slot: https only — rejecting every other scheme (javascript:,
+// data:, http:, …) — with the userinfo/host tricks closed: credentials in the
+// URL (https://linkedin.com@evil.com parses linkedin.com as USERNAME) are
+// refused outright, and typed slots must land on their pinned host. Returns
+// the WHATWG-normalized href (lowercased host, canonical escaping) or an error.
+function validateProfileLink(type, raw) {
+  if (typeof raw !== 'string' || !raw.trim()) return { error: 'invalid_link', link_type: type, reason: 'not_a_url' };
+  const trimmed = raw.trim();
+  if (trimmed.length > PROFILE_LINK_MAX_CHARS) return { error: 'invalid_link', link_type: type, reason: 'too_long' };
+  let u;
+  try { u = new URL(trimmed); } catch { return { error: 'invalid_link', link_type: type, reason: 'not_a_url' }; }
+  if (u.protocol !== 'https:') return { error: 'invalid_link', link_type: type, reason: 'https_only' };
+  if (u.username || u.password) return { error: 'invalid_link', link_type: type, reason: 'userinfo_not_allowed' };
+  if (!u.hostname || !u.hostname.includes('.')) return { error: 'invalid_link', link_type: type, reason: 'bad_host' };
+  const pinned = PROFILE_LINK_HOSTS[type];
+  if (pinned && !hostAllowed(u.hostname, pinned)) {
+    return { error: 'invalid_link', link_type: type, reason: 'wrong_host', expected_hosts: pinned };
+  }
+  return { value: u.href };
+}
+
+// The full links object — REPLACES the stored set wholesale (a PATCH sends the
+// set it wants, omitting a key drops that link; null/{} clears everything).
+// Only the closed vocabulary is accepted; a null/empty slot value is treated
+// as "drop this slot". Returns { value } (null = clear) or the first error.
+function validateProfileLinks(raw) {
+  if (raw == null) return { value: null };
+  if (typeof raw !== 'object' || Array.isArray(raw)) return { error: 'invalid_links', reason: 'not_an_object' };
+  const out = {};
+  for (const [type, val] of Object.entries(raw)) {
+    if (!PROFILE_LINK_TYPES.includes(type)) return { error: 'invalid_links', reason: 'unknown_link_type', link_type: type };
+    if (val == null || val === '') continue;
+    const one = validateProfileLink(type, val);
+    if (one.error) return one;
+    out[type] = one.value;
+  }
+  return { value: Object.keys(out).length ? out : null };
+}
+
+// Account display name (spec Decision 4: the hub gets its OWN copy — hub value
+// wins on hub surfaces, instance value on instance surfaces, no sync engine).
+function validateAccountDisplayName(raw) {
+  if (typeof raw !== 'string') return { error: 'invalid_display_name', reason: 'not_a_string' };
+  const trimmed = raw.trim();
+  if (!trimmed) return { error: 'invalid_display_name', reason: 'empty' };
+  if (/[\u0000-\u001F\u007F]/.test(trimmed)) return { error: 'invalid_display_name', reason: 'control_characters' };
+  const length = codePointLength(trimmed);
+  if (length > DISPLAY_NAME_MAX_CHARS) return { error: 'display_name_too_long', max: DISPLAY_NAME_MAX_CHARS, length };
+  return { value: trimmed };
+}
+
+// The own-scoped profile-fields WRITE (P02) — callers key this by the
+// AUTHENTICATED session's github_id, never a caller-named one. Validates here,
+// then upserts on the setAccountHideStats pattern: the INSERT branch creates a
+// fail-closed provisional account (a hub builder who never federated can still
+// fill their profile ahead of time); the UPDATE branch touches ONLY the fields
+// the caller sent — never identity re-sync, never profile_state (activation
+// stays /sso/authorize's alone, D3), never hide_stats. Setting display_name
+// stamps display_name_source='user' — from then on upsertAccount's re-sync
+// keeps its hands off the name (the ADR 0156 mirror).
+async function setAccountProfileFields({ githubId, githubLogin, displayName, avatarUrl, fields = {} }, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return { error: 'no_account' };
+  const setName = 'display_name' in fields;
+  const setBio = 'bio' in fields;
+  const setLinks = 'links' in fields;
+  if (!setName && !setBio && !setLinks) return { error: 'no_fields' };
+  let nameValue = null;
+  if (setName) {
+    const v = validateAccountDisplayName(fields.display_name);
+    if (v.error) return v;
+    nameValue = v.value;
+  }
+  let bioValue = null;
+  if (setBio) {
+    const v = validateProfileBio(fields.bio);
+    if (v.error) return v;
+    bioValue = v.value;
+  }
+  let linksValue = null;
+  if (setLinks) {
+    const v = validateProfileLinks(fields.links);
+    if (v.error) return v;
+    linksValue = v.value;
+  }
+  const { rows } = await pool.query(
+    `INSERT INTO platform_identity_accounts
+       (github_id, github_login, display_name, avatar_url, bio, links, display_name_source)
+     VALUES ($1, $2, $3, $4, $5, $6, CASE WHEN $7::boolean THEN 'user' ELSE 'github' END)
+     ON CONFLICT (github_id) DO UPDATE SET
+       display_name = CASE WHEN $7::boolean THEN EXCLUDED.display_name ELSE platform_identity_accounts.display_name END,
+       display_name_source = CASE WHEN $7::boolean THEN 'user' ELSE platform_identity_accounts.display_name_source END,
+       bio          = CASE WHEN $8::boolean THEN EXCLUDED.bio ELSE platform_identity_accounts.bio END,
+       links        = CASE WHEN $9::boolean THEN EXCLUDED.links ELSE platform_identity_accounts.links END,
+       updated_at   = now()
+     RETURNING github_id, display_name, bio, links, handle`,
+    [
+      githubId,
+      githubLogin,
+      setName ? nameValue : (displayName ?? null),
+      avatarUrl ?? null,
+      bioValue,
+      linksValue == null ? null : JSON.stringify(linksValue),
+      setName,
+      setBio,
+      setLinks,
+    ],
+  );
+  const row = rows[0];
+  // This upsert can CREATE the account row — seed the handle then, same as
+  // upsertAccount / setAccountHideStats.
+  if (row && !row.handle) row.handle = await ensureHandle({ githubId, githubLogin }, { pool });
+  return row;
+}
+
 // -------------------------------------------------------------------------
 // Authorization codes (single-use, short-lived, bound)
 // -------------------------------------------------------------------------
@@ -912,6 +1099,17 @@ module.exports = {
   setAccountHandle,
   resolveHandle,
   getPublicProfileByHandle,
+  // profile fields: bio + typed links + account display name (P02)
+  BIO_MAX_CHARS,
+  DISPLAY_NAME_MAX_CHARS,
+  PROFILE_LINK_TYPES,
+  PROFILE_LINK_HOSTS,
+  PROFILE_LINK_MAX_CHARS,
+  validateProfileBio,
+  validateProfileLink,
+  validateProfileLinks,
+  validateAccountDisplayName,
+  setAccountProfileFields,
   // codes
   mintAuthCode,
   redeemAuthCode,

package/modules/platform-identity/routes/profile.js

@@ -16,6 +16,13 @@
 //   PATCH /me/handle        — rename the caller's own handle (P01, task 1002797;
 //                             spec Decision 3). Low rate limit, previous handle
 //                             kept for the 301 window.
+//   PATCH /me/profile       — the profile-fields write (P02, task 1002798; spec
+//                             Decision 4): bio + typed links + the account
+//                             display name. Validation lives in the domain
+//                             (https-only typed links, host pinning, 280-char
+//                             plain-text bio); setting display_name stamps
+//                             display_name_source='user' so federated re-syncs
+//                             stop overwriting it (the ADR 0156 mirror).
 //
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
@@ -35,7 +42,7 @@ module.exports = function profileRoutes() {
       // Core builders include system:* principals whose github_id is not numeric;
       // they have no platform identity — answer the empty shape, not a 500.
       if (!pi.isNumericGithubId(req.builder.github_id)) {
-        return res.json({ hide_stats: false, profile_state: null, handle: null, cross_project: null });
+        return res.json({ hide_stats: false, profile_state: null, handle: null, display_name: null, bio: null, links: null, cross_project: null });
       }
       const [acct, extras] = await Promise.all([
         pi.getAccount(req.builder.github_id, { pool }),
@@ -45,6 +52,10 @@ module.exports = function profileRoutes() {
         hide_stats: !!(acct && acct.hide_stats),
         profile_state: acct ? acct.profile_state : null,
         handle: (acct && acct.handle) || null,
+        // P02: the account-global profile fields, for the Settings form (P04).
+        display_name: (acct && acct.display_name) || null,
+        bio: (acct && acct.bio) || null,
+        links: (acct && acct.links) || null,
         cross_project: extras,
       });
     } catch (err) {
@@ -119,5 +130,56 @@ module.exports = function profileRoutes() {
     }
   });
 
+  // rank: any-builder — the caller's OWN profile fields (P02, task 1002798; spec
+  // Decision 4): bio, typed links, account display name. Own data, keyed on the
+  // authenticated github_id. The schema declares the keys for strict mode; the
+  // REAL validation (bio length/charset, https-only + host-pinned links, name
+  // length) lives in the domain, next to the data, and each field is nullable
+  // (null clears), which validateOrRespond's typed rules can't express.
+  router.patch('/me/profile', requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, { display_name: {}, bio: {}, links: {} })) return;
+    try {
+      if (!pi.isNumericGithubId(req.builder.github_id)) {
+        return res.fail('no_platform_identity', 400);
+      }
+      const fields = {};
+      for (const k of ['display_name', 'bio', 'links']) {
+        if (k in req.body) fields[k] = req.body[k];
+      }
+      const out = await pi.setAccountProfileFields({
+        githubId: req.builder.github_id,
+        githubLogin: req.builder.github_login,
+        displayName: req.builder.display_name,
+        avatarUrl: req.builder.avatar_url,
+        fields,
+      }, { pool });
+      if (out.error === 'no_fields') {
+        return res.fail('no_fields', { status: 400, message: 'send at least one of display_name, bio, links' });
+      }
+      if (out.error === 'bio_too_long') {
+        return res.fail('bio_too_long', { status: 400, message: `a bio is at most ${pi.BIO_MAX_CHARS} characters of plain text` });
+      }
+      if (out.error === 'invalid_bio') {
+        return res.fail('invalid_bio', { status: 400, message: 'a bio is plain text (no control characters)' });
+      }
+      if (out.error === 'invalid_link' || out.error === 'invalid_links') {
+        return res.fail(out.error, { status: 400, message: `links are a typed set (${pi.PROFILE_LINK_TYPES.join(', ')}), https URLs only${out.link_type ? ` — problem with '${out.link_type}'` : ''}` });
+      }
+      if (out.error === 'display_name_too_long') {
+        return res.fail('display_name_too_long', { status: 400, message: `a display name is at most ${pi.DISPLAY_NAME_MAX_CHARS} characters` });
+      }
+      if (out.error === 'invalid_display_name') {
+        return res.fail('invalid_display_name', { status: 400, message: 'a display name must be non-empty plain text' });
+      }
+      if (out.error) {
+        return res.fail('profile_write_failed', { status: 500, message: 'internal error' });
+      }
+      res.json({ display_name: out.display_name, bio: out.bio, links: out.links });
+    } catch (err) {
+      console.error('[platform-identity] PATCH /me/profile', err);
+      res.fail('profile_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/platform-identity/routes/public-profile.js

@@ -19,6 +19,43 @@ const pi = require('../platform-identity');
 
 const { pool, corsPublicGet } = api;
 
+// Per-IP read cap for this UNAUTHENTICATED route (R05 grade advisory, task
+// 1002798): the global limiter only meters writes, so an uncapped scraper could
+// enumerate the handle→identity mapping at line rate. Vendored sliding window —
+// the modules/memory readRateLimit pattern (the core /public/* limiter is not
+// on the doorway; a kernel file may not import it). 120/60s mirrors the
+// /public/* posture; req.ip honors 'trust proxy' so it is the end user.
+const READ_RATE_WINDOW_MS = 60 * 1000;
+const READ_RATE_LIMIT = 120;
+const buckets = new Map(); // ip -> timestamp[]
+
+const sweepTimer = setInterval(() => {
+  const cutoff = Date.now() - READ_RATE_WINDOW_MS;
+  for (const [k, arr] of buckets) {
+    while (arr.length && arr[0] < cutoff) arr.shift();
+    if (arr.length === 0) buckets.delete(k);
+  }
+}, 5 * 60 * 1000);
+if (typeof sweepTimer.unref === 'function') sweepTimer.unref();
+
+function profileReadRateLimit(req, res, next) {
+  const now = Date.now();
+  const key = req.ip || req.socket?.remoteAddress || 'unknown';
+  let bucket = buckets.get(key);
+  if (!bucket) { bucket = []; buckets.set(key, bucket); }
+  const cutoff = now - READ_RATE_WINDOW_MS;
+  while (bucket.length && bucket[0] < cutoff) bucket.shift();
+  if (bucket.length >= READ_RATE_LIMIT) {
+    const retryAfter = Math.max(1, Math.ceil((bucket[0] + READ_RATE_WINDOW_MS - now) / 1000));
+    res.set('Retry-After', String(retryAfter));
+    res.set('X-RateLimit-Scope', 'public-profile-read');
+    res.set('X-RateLimit-Limit', String(READ_RATE_LIMIT));
+    return res.fail('rate_limited', 429, { scope: 'public-profile-read', retry_after_seconds: retryAfter });
+  }
+  bucket.push(now);
+  return next();
+}
+
 module.exports = function publicProfileRoutes() {
   const router = express.Router();
 
@@ -28,8 +65,10 @@ module.exports = function publicProfileRoutes() {
   // world-readable on the numeric profile route + the leaderboard; the handle is
   // just the rename-proof address (spec Decision 3). Whitelisting happens inside
   // the module (getPublicProfileByHandle); no-store because the payload embeds
-  // cross_project and hide must beat the cache (ADR 0171 D5).
-  router.get('/profiles/:handle', async (req, res) => {
+  // cross_project and hide must beat the cache (ADR 0171 D5). Rate-limited like
+  // /public/* (per-IP read limiter) so the handle→identity mapping can't be
+  // scripted-enumerated at line rate (R05 grade advisory, task 1002798).
+  router.get('/profiles/:handle', profileReadRateLimit, async (req, res) => {
     try {
       const out = await pi.getPublicProfileByHandle(req.params.handle, { pool });
       res.set('Cache-Control', 'no-store');

package/modules/platform-identity/tests/platform-identity.mjs

@@ -756,7 +756,7 @@ await ta('getPublicProfileByHandle: identity-band whitelist — github_id/profil
     { rows: [{ profile_state: 'active', hide_stats: true }], rowCount: 1 },
   ]);
   const out = await P.getPublicProfileByHandle('x', { pool });
-  assert.deepEqual(Object.keys(out.account).sort(), ['avatar_url', 'display_name', 'github_login', 'handle', 'member_since'].sort());
+  assert.deepEqual(Object.keys(out.account).sort(), ['avatar_url', 'bio', 'display_name', 'github_login', 'handle', 'links', 'member_since'].sort());
   assert.equal(out.cross_project, null, 'hidden → null, indistinguishable from none');
   const text = JSON.stringify(out);
   assert.doesNotMatch(text, /github_id/, 'the join key stays internal');
@@ -772,5 +772,94 @@ await ta('getPublicProfileByHandle: unknown → null; moved passes through', asy
   assert.deepEqual(await P.getPublicProfileByHandle('then', { pool: pool2 }), { moved_to: 'now' });
 });
 
+console.log('\nprofile fields (P02, task 1002798):');
+
+t('validateProfileBio: trims, clears on empty/null, caps at 280 code points, plain text only', () => {
+  assert.deepEqual(P.validateProfileBio(null), { value: null });
+  assert.deepEqual(P.validateProfileBio('   '), { value: null });
+  assert.deepEqual(P.validateProfileBio(' hi '), { value: 'hi' });
+  assert.equal(P.validateProfileBio('🔥'.repeat(P.BIO_MAX_CHARS)).error, undefined, 'code points, not UTF-16 units');
+  assert.equal(P.validateProfileBio('x'.repeat(P.BIO_MAX_CHARS + 1)).error, 'bio_too_long');
+  assert.equal(P.validateProfileBio('a\nb\tc').value, 'a\nb\tc', 'newlines and tabs are text');
+  assert.equal(P.validateProfileBio('a\u0007b').error, 'invalid_bio', 'other control chars are not');
+  assert.equal(P.validateProfileBio(42).error, 'invalid_bio');
+});
+
+t('validateProfileLink: https only — every other scheme refused', () => {
+  assert.equal(P.validateProfileLink('website', 'https://me.example/x').value, 'https://me.example/x');
+  assert.equal(P.validateProfileLink('website', 'HTTPS://Me.EXAMPLE/x').value, 'https://me.example/x', 'scheme+host normalize');
+  for (const bad of ['http://me.example', 'javascript:alert(1)', 'data:text/html,x', 'ftp://me.example', '//me.example', 'me.example']) {
+    assert.ok(P.validateProfileLink('website', bad).error, `refused: ${bad}`);
+  }
+});
+
+t('validateProfileLink: userinfo + host tricks refused', () => {
+  assert.equal(P.validateProfileLink('website', 'https://linkedin.com@evil.example/x').error, 'invalid_link');
+  assert.equal(P.validateProfileLink('website', 'https://a:b@evil.example/x').error, 'invalid_link');
+  assert.equal(P.validateProfileLink('website', 'https://localhost/x').error, 'invalid_link', 'dotless hosts refused');
+  assert.equal(P.validateProfileLink('x', 'https://x.com.evil.example/u').reason, 'wrong_host', 'suffix lookalike refused');
+});
+
+t('validateProfileLink: typed slots are host-pinned; website is free', () => {
+  assert.ok(P.validateProfileLink('x', 'https://x.com/jaxri').value);
+  assert.ok(P.validateProfileLink('x', 'https://www.twitter.com/jaxri').value, 'subdomains of a pinned host allowed');
+  assert.equal(P.validateProfileLink('x', 'https://evil.example/u').reason, 'wrong_host');
+  assert.ok(P.validateProfileLink('linkedin', 'https://www.linkedin.com/in/jaxri').value);
+  assert.ok(P.validateProfileLink('discord', 'https://discord.gg/bongos').value);
+  assert.equal(P.validateProfileLink('discord', 'https://discord.example/x').reason, 'wrong_host');
+  assert.ok(P.validateProfileLink('website', 'https://anything.example/at-all').value);
+});
+
+t('validateProfileLinks: closed vocabulary, object only, empty → clear', () => {
+  assert.deepEqual(P.validateProfileLinks(null), { value: null });
+  assert.deepEqual(P.validateProfileLinks({}), { value: null });
+  assert.deepEqual(P.validateProfileLinks({ website: '' }), { value: null }, 'empty slot values drop');
+  assert.equal(P.validateProfileLinks([]).error, 'invalid_links');
+  assert.equal(P.validateProfileLinks('https://x.com').error, 'invalid_links');
+  assert.equal(P.validateProfileLinks({ github: 'https://github.com/x' }).reason, 'unknown_link_type');
+  const full = P.validateProfileLinks({ website: 'https://me.example', x: 'https://x.com/j', linkedin: 'https://linkedin.com/in/j', discord: 'https://discord.gg/j' });
+  assert.deepEqual(Object.keys(full.value).sort(), [...P.PROFILE_LINK_TYPES].sort(), 'max 4 by construction — one slot per type');
+});
+
+t('validateAccountDisplayName: trimmed, non-empty, ≤60 code points, single line', () => {
+  assert.equal(P.validateAccountDisplayName('  Percy J  ').value, 'Percy J');
+  assert.equal(P.validateAccountDisplayName('').error, 'invalid_display_name');
+  assert.equal(P.validateAccountDisplayName('x'.repeat(P.DISPLAY_NAME_MAX_CHARS + 1)).error, 'display_name_too_long');
+  assert.equal(P.validateAccountDisplayName('a\nb').error, 'invalid_display_name');
+  assert.equal(P.validateAccountDisplayName(42).error, 'invalid_display_name');
+});
+
+await ta('upsertAccount SQL carries the ADR 0156 guard: a user-set name is never overwritten', async () => {
+  const pool = mockPool([{ rows: [{ handle: 'x' }], rowCount: 1 }]);
+  await P.upsertAccount({ githubId: '7', githubLogin: 'x' }, { pool });
+  const sql = pool.calls[0].text;
+  assert.match(sql, /display_name\s*=\s*CASE WHEN platform_identity_accounts\.display_name_source = 'user'/,
+    'the conflict branch guards display_name on display_name_source');
+  assert.match(sql, /github_login\s*=\s*EXCLUDED\.github_login/, 'github_login still re-syncs unconditionally');
+  assert.match(sql, /avatar_url\s*=\s*EXCLUDED\.avatar_url/, 'avatar_url still re-syncs unconditionally');
+});
+
+await ta('setAccountProfileFields: validates before any query; refuses empty + non-numeric ids', async () => {
+  const pool = mockPool();
+  assert.deepEqual(await P.setAccountProfileFields({ githubId: 'system:bfg', githubLogin: 'x', fields: { bio: 'b' } }, { pool }), { error: 'no_account' });
+  assert.deepEqual(await P.setAccountProfileFields({ githubId: '7', githubLogin: 'x', fields: {} }, { pool }), { error: 'no_fields' });
+  const bad = await P.setAccountProfileFields({ githubId: '7', githubLogin: 'x', fields: { links: { x: 'https://evil.example/u' } } }, { pool });
+  assert.equal(bad.error, 'invalid_link');
+  assert.equal(pool.calls.length, 0, 'nothing reached the DB');
+});
+
+await ta('setAccountProfileFields SQL: flag-guarded UPDATE that never touches consent or identity re-sync', async () => {
+  const pool = mockPool([{ rows: [{ github_id: '7', display_name: 'N', bio: 'b', links: null, handle: 'h' }], rowCount: 1 }]);
+  await P.setAccountProfileFields({ githubId: '7', githubLogin: 'x', fields: { display_name: 'N', bio: 'b' } }, { pool });
+  const { text, params } = pool.calls[0];
+  const updateBranch = text.slice(text.indexOf('DO UPDATE SET'));
+  assert.match(updateBranch, /display_name_source = CASE WHEN \$7::boolean THEN 'user'/, 'setting the name stamps source=user');
+  assert.doesNotMatch(updateBranch, /profile_state/, 'consent never moves here (activation is /sso/authorize alone)');
+  assert.doesNotMatch(updateBranch, /hide_stats/, 'the C2 flag never moves here');
+  assert.doesNotMatch(updateBranch, /github_login\s*=/, 'no identity re-sync on the profile write');
+  assert.doesNotMatch(updateBranch, /avatar_url\s*=/, 'no identity re-sync on the profile write');
+  assert.deepEqual(params.slice(6, 9), [true, true, false], 'flags: name+bio sent, links not');
+});
+
 console.log(`\nplatform-identity: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.181",
+  "version": "1.19.183",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.181",
+      "version": "1.19.183",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.181",
+  "version": "1.19.183",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/publish-manifest.js

@@ -61,7 +61,8 @@ const PUBLISH_ALLOWLIST = [
   'modules/sessions/',
   'modules/autonomy/',
   'modules/security/',
-  'modules/governance/',     // configurable roles & permissions (BV1 goal 1000030, ADR 0151) — the rank/permission machinery publishes AS the open-source methodology (ADR 0065 §4 / ADR 0098); it is in PROTECTED_GLOBS for write-protection, NOT publish-exclusion. default:true.
+  'modules/governance/',     // configurable roles & permissions (BV1 goal 1000030, ADR 0151) — the rank/permission machinery publishes AS the open-source methodology (ADR 0065 §4 / ADR 0098); it is in PROTECTED_GLOBS for write-protection, NOT publish-exclusion. default:true. Renamed → modules/government/ (ADR 0174); dropped with the folder in goal 1000068 R04.
+  'modules/government/',     // the same machinery under its post-ADR-0174 name (goal 1000068, task 1003003). Added in lockstep with the protected-surfaces.json entry: publish_manifest asserts every PROTECTED_GLOB is either topology-excluded or publishable, so registering the glob as protected WITHOUT this line default-denies the module from the published core — the open-source methodology would silently lose its permission machinery at the next release.
   'modules/hall-ui/',
   'modules/status-ui/',
   'modules/dev-box/',

package/src/bongos/module-scope-map.js

@@ -174,8 +174,29 @@ const MODULE_GLOBS = {
   //     role templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
+  //     RENAMED governance → government (goal 1000068, task 1003003, ADR 0174).
+  //     Both keys live through the transition and BOTH carry BOTH sets of globs,
+  //     so the wall is identical whichever key a goal names and whichever name
+  //     the folder currently has on disk. The `government` key must land BEFORE
+  //     R04 moves the folder: goals carry scope_modules by KEY, so moving the
+  //     folder first would leave goal 1000068's own wall not matching the files
+  //     its remaining tasks need to touch, blocking the rename mid-goal.
+  //     `modules/government/` is registered in protected-surfaces.json in the
+  //     same change — `protected` DERIVES from that registry, so without it this
+  //     key would compute protected:false and silently drop the Archon gate.
+  government: [
+    'modules/government/', 'modules/governance/',
+    'config/government.json', 'config/government.neutral.json',
+    'config/governance.json', 'config/governance.neutral.json',
+  ],
+  //     DEPRECATED ALIAS — kept for one release so goals and tasks already
+  //     scoped to `governance` keep resolving. Removed by goal 1000068 R05
+  //     (task 1003006), the release that drops the /governance/* route aliases;
+  //     the two removals are the same compatibility window and should land
+  //     together.
   governance: [
-    'modules/governance/',
+    'modules/government/', 'modules/governance/',
+    'config/government.json', 'config/government.neutral.json',
     'config/governance.json', 'config/governance.neutral.json',
   ],
   // --- the two web surfaces ---

package/src/bongos/route-rank-check.js

@@ -231,6 +231,21 @@ const EXPECTED_RANKS = {
   'GET /security/adr': 'metic+archon',
 };
 
+// The authz-core route pins, referenced by BOTH the `governance` and the
+// `government` module keys below while goal 1000068's rename is in flight
+// (ADR 0174, task 1003003). One object, two keys — never two literals.
+const GOVERNMENT_PINS = {
+  'GET /governance/roles': 'perm:governance.manage',
+  'GET /governance/permissions': 'perm:governance.manage',
+  'GET /governance/assignments': 'perm:governance.manage',
+  'POST /governance/roles': 'perm:governance.manage',
+  'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
+  'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
+  'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
+  'POST /governance/assignments': 'perm:governance.manage',
+  'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
+};
+
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE
 // MODULE (modules/<key>/routes/…), pinned like EXPECTED_RANKS but verified ONLY
 // when that module is in scope (its routes were discovered in this scan). So an
@@ -400,24 +415,28 @@ const MODULE_EXPECTED_RANKS = {
     'POST /security/reports/:id/fix': 'perm:security.report.adjudicate',
     'POST /security/reports/:id/link-fix': 'perm:security.report.adjudicate',
   },
-  // The governance tab's server half (BV1.R110, ADR 0151) — the routes that EDIT
-  // the role/permission graph itself. Every route, the three reads included, is
-  // pinned to the `governance.manage` ATOM rather than a rank: on this surface
-  // the atom IS the authority (it is the catalog's meta-escalation key), and a
-  // downgrade here is the model's worst case — the routes that write authority
-  // drifting below the wall that guards authority. Reads are pinned too because
-  // the full role/grant/assignment map is the authority model's blueprint.
-  governance: {
-    'GET /governance/roles': 'perm:governance.manage',
-    'GET /governance/permissions': 'perm:governance.manage',
-    'GET /governance/assignments': 'perm:governance.manage',
-    'POST /governance/roles': 'perm:governance.manage',
-    'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-    'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-    'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
-    'POST /governance/assignments': 'perm:governance.manage',
-    'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
-  },
+  // The government tab's server half (BV1.R110, ADR 0151; renamed by ADR 0174) —
+  // the routes that EDIT the rank/permission graph itself. Every route, the three
+  // reads included, is pinned to the `governance.manage` ATOM rather than a rank:
+  // on this surface the atom IS the authority (it is the catalog's meta-escalation
+  // key), and a downgrade here is the model's worst case — the routes that write
+  // authority drifting below the wall that guards authority. Reads are pinned too
+  // because the full rank/grant/assignment map is the authority model's blueprint.
+  //
+  // The ROUTE PATHS and the `governance.manage` key are renamed by R05 (task
+  // 1003006), not here: R02 only makes the pins reachable under both module keys.
+  // Renaming the paths before the routes move would pin routes that do not exist
+  // and red the build for the whole window.
+  governance: GOVERNMENT_PINS,
+  // The same pins under the post-ADR-0174 module name (goal 1000068, task
+  // 1003003). Pins are applied only when the module directory is IN SCOPE — at
+  // least one route file was discovered under modules/<key>/ — so this entry is
+  // inert until R04 (task 1003005) moves the folder, and becomes load-bearing
+  // the moment it does, with no second edit needed. Both keys reference the SAME
+  // object rather than a copy: two literals here would be the "second list that
+  // drifts" failure mode this file exists to prevent, on the surface where a
+  // silent drift is worst.
+  government: GOVERNMENT_PINS,
 };
 
 // The rank a route's RANK middleware implies, or null when it carries none.