@bongos/core 1.19.240 → 1.19.241

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.240",
-  "core_contract": "1.19.240",
-  "source_commit": "fd0201e6b50f0e354cea9a97c215730c16357ee3",
+  "core_version": "1.19.241",
+  "core_contract": "1.19.241",
+  "source_commit": "3be9d3e72426f99e05a9842dcb5cc9c85cfc75a0",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T20:26:47.249Z",
+  "built_at": "2026-08-18T20:51:17.253Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 312,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1325,
+    "functional_verbatim": 1327,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1658,
-  "tree_sha256": "a6ef1676edb20a115c4942ab09c2689af96309917e65340533f47d7cd18c6e7c",
+  "file_count": 1660,
+  "tree_sha256": "d8e9cb0898ebdea8fca5a8bc8e94fd925e4725473943002abf4cbbc68e4ae963",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2006b6d2f061c266c79390839bca228df59753db2e3919f49946db07682ee207"
+      "sha256": "dee98bb9b25e4cf7b2f4644298caa77b1bb9f7ef29560228333131b107be01dd"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1367,7 +1367,7 @@
     {
       "path": "docs/adr/0177-goal-membership-kind.md",
       "mode": "0000644",
-      "sha256": "0c81340c845250107cd195dadce2740b8324b7777a44011b02b488827193a4de"
+      "sha256": "1bc4a0df32f8267b5fb3b274974fbcd15d680a161de4c502334dff62da494b17"
     },
     {
       "path": "docs/adr/README.md",
@@ -1377,12 +1377,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "791e8f83d023e77d3faa2e3abf3ec9099f3ffa9236183aad5092ef0792e510cc"
+      "sha256": "c0f20beba35a91ba5f06a1accf3b5df15832d719f14af729824295da60d33e30"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "901748f25425af336637858b48ec06ad0461d5d3dc2a6beaad8b2a6af0eb6161"
+      "sha256": "50e9b99155cd83e625f1e0289a4e8ab6a2817b2701dc3d62cfb3d902c3acf3bd"
     },
     {
       "path": "docs/architecture.md",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/hall-ui/public/my-projects.js",
       "mode": "0000644",
-      "sha256": "30d22956e21c9ac371d989d8b295631e7bd5df89647457e81a71e0dfffe07cce"
+      "sha256": "9b5604fd1d071bcb61c1ce77a8356fbce8060db09440ba5621646aa18b6f5b5f"
     },
     {
       "path": "modules/hall-ui/public/not-ready.html",
@@ -3904,6 +3904,11 @@
       "mode": "0000644",
       "sha256": "00e2e9feccc56bdb30a5e4f0c6abbe610382fe425222419963a04ae022d3c58a"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_010_membership_kind.sql",
+      "mode": "0000644",
+      "sha256": "8f03dc84d8fe3864aa5f933512df71259c266e8a16214a926cf89eaf01cc5668"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -3912,7 +3917,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "423afc175f0e1024d39fc20b561e24b423e2d9b6e5c16ddcd8e4a3329bcfa97b"
+      "sha256": "a563fb701e62d665d10baf25761f9341678264fa2c6c73f1efeb9eb20ba6a439"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3927,7 +3932,7 @@
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
-      "sha256": "7fdb5a107e1ad84214c0d07507a7fd14b9234c9907224fddc0f6a70c850f460a"
+      "sha256": "de5aa85aedf31834009ec0e1a3b4a7ceea2ff60bbb6586a3f231b59eb9549aaf"
     },
     {
       "path": "modules/platform-identity/routes/profile.js",
@@ -3952,12 +3957,12 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "72796558274b45faec2b1a63e332100061a6ab0c690dadc42a54f1f39cb0c68e"
+      "sha256": "e4cd3084c44b6ff3e3fdad141e530b098b330a25d609fd08f5ae2290fd251db0"
     },
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "514adcaae952190d418888ffb778d541a632e3040664ce53f7a55ba9a297292b"
+      "sha256": "6f442cd4ae9ebb770e3537ae82da30e555f7e6ce3a293a60fbd154eff6c1eaf1"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4342,12 +4347,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5016dfd9f9b3ee1b5141dc1d0a24a478637b449e39b8e82fa42dc8f5084356f5"
+      "sha256": "8f961bb896bdf312ad73752daa2342ce9ccf7db02b21ac9d2480694db28857d8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9e996de99c2422683685f66dc08b2b8a8663d4e5da4e71f00059c332acfa9b37"
+      "sha256": "ac7bd7958b32f4eee03a29fab16260eb489d49c0e40907691bdd9c3e447d6a5d"
     },
     {
       "path": "public-docs/index.html",
@@ -4972,7 +4977,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "f5059d035746d8ea967e127e8421213efede43c9ae50c50403fc8772c487db76"
+      "sha256": "add1ee5439ef3ddff171e7eb9a695c63a41b8323c5e8cc6c415b620b812bdfa8"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5722,7 +5727,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "8fd6f6ce798ebcde76cd2ac0ccf7129a60555506ce3d2fed818deb1eb331d42b"
+      "sha256": "803d4cc68847dda227c8581be493c2b4e799d1bf81acd40794efbf7b2b625a24"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5962,7 +5967,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4c133ea04355ccf4ac6b4f1530d612421ca5e5a99393a4ee102cee4949377611"
+      "sha256": "d2dd5e30bb7f44cd8a37cbf559bbcdf76aec973043f3db5deec8988b62a59eb6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7217,7 +7222,7 @@
     {
       "path": "tests/idp_federation.mjs",
       "mode": "0000644",
-      "sha256": "09a9ae4a726cec8d0e31bc50dc08db102745c6451fb64f105c2be1b623062986"
+      "sha256": "5130936408829e4e45742eda0124aac9df50865ece1812274354384f9da498fd"
     },
     {
       "path": "tests/infra_exec_paths.mjs",
@@ -7339,6 +7344,11 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
+    {
+      "path": "tests/membership_kind_lockstep.mjs",
+      "mode": "0000644",
+      "sha256": "7ebca67bf07f723f47a861eb530a0feee25967fe3c0f4a9e7d76703351dc8d84"
+    },
     {
       "path": "tests/memory_isolation.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -294,7 +294,7 @@ export interface PostSsoActivityRollupRequest { client_id: string; client_secret
 export interface PostSsoActivityRollupResponse { ok: boolean }
 export interface PostSsoDevicePollRequest { device_code: string }
 export interface PostSsoDeviceStartRequest { origin: string }
-export interface PostSsoMembershipCheckInRequest { client_id: string; client_secret: string; github_id: StringifiableId; github_login: string; display_name?: string; avatar_url?: string; role?: string }
+export interface PostSsoMembershipCheckInRequest { client_id: string; client_secret: string; github_id: StringifiableId; github_login: string; display_name?: string; avatar_url?: string; membership_kind?: string; role?: string }
 export interface PostSsoMembershipCheckInResponse { ok: boolean }
 export interface PostSsoTokenRequest { client_id: string; client_secret: string; code: string; redirect_uri: string }
 export interface PostSsoTokenResponse { github_id: unknown; github_login: unknown; display_name: unknown; avatar_url: unknown }

package/docs/adr/0177-goal-membership-kind.md

@@ -2,7 +2,7 @@
 
 - **Status:** Accepted
 - **Date:** 2026-08-18
-- **Task:** [#1003013](https://cloudbongos.com/builders#/task/1003013) (goal 1000068 — government terminology; unlinked from the goal's criteria on 2026-08-18 because it is a live-column migration, not a naming pass)
+- **Tasks:** [#1003013](https://cloudbongos.com/builders#/task/1003013) (goal 1000068 — government terminology; unlinked from the goal's criteria on 2026-08-18 because it is a live-column migration, not a naming pass)
 - **Extends:** [ADR 0174](<redacted>.md) — the reserved-word rule, applied to the fourth use it did not cover
 - **Related:** ADR 0016 (authority resolved server-side, per request, uncached), 0086 (goals + scope walls), 0154 (goal owner/manager authors criteria), 0137/0161 (land → release → deploy are three gates)
 
@@ -83,6 +83,62 @@ regression available — a membership query reaching for the old column — with
 only exemption is a line that CITES the rule (ADR 0174 / ADR 0177 / task 1003013); naming a ban has to
 be legal or the code cannot explain itself. R07 stays scoped to the government surface, unchanged.
 
+## Amendment, same day — the FIFTH use: project membership (task [#1003090](https://cloudbongos.com/builders#/task/1003090))
+
+The sweep for the fourth use turned up a fifth, and it is worse: the hub's
+`<redacted>.role` (`'owner' | 'builder' | 'visitor' |
+'pending'`, ADR 0141 §3) collides with the reserved word **twice** — the column is named
+`role`, and one of its VALUES is `'builder'`, a craft name pressed into meaning "a
+non-owner member of this project". The migration's own comment ("a COARSE role ONLY …
+the role is owner|builder|visitor, NEVER a rank") is the same qualifier tell ADR 0174
+diagnosed in "rank-role".
+
+Decisions 1, 2 and 4 above carry over unchanged: the column becomes `membership_kind`,
+the value becomes `'member'` (`owner` / `visitor` / `pending` untouched), the migration
+is expand-then-contract with a lockstep trigger (`<redacted>`), and the
+fitness wall's file list grows rather than the rule widening. **Decision 3 is the one
+that does NOT carry over.**
+
+**Decision 3′ — this rename keeps a compatibility window, and the sender writes BOTH
+spellings.** This is a deliberate, named divergence from decision 3 above *and* from the
+sequence task #1003090 itself prescribed ("the API field renamed with no alias"); the
+task wrote that sequence before anyone had looked at who calls the endpoint. Decision 3
+holds wherever every caller ships in one release, which is why it stays the default — and
+it does not hold here. The goal-membership rename could ship without an alias because every
+caller lived in the same release. This table's writer is `POST
+/sso/membership/check-in` — a **server-to-server call from other instances**, each on
+its own upgrade schedule (ADR 0137/0161: land, release and deploy are three separate
+gates *per instance*). So:
+
+- the **hub accepts both** fields, `membership_kind` winning when both arrive, and maps
+  a legacy `'builder'` to `'member'` on the way in;
+- the **sender sends both** (`src/bongos/auth.js`). This is the part worth writing down:
+  sending only the new field would make an un-upgraded hub silently default every
+  membership to non-owner — *dropping the owner flag* — while sending only the legacy
+  field would make an upgraded hub translate forever. Sending both is what makes the two
+  ends independent;
+- the trigger therefore maps **values as well as columns**, in both directions, which
+  `core_220`'s did not have to.
+
+**And a trap both triggers share, found by the grader on #1003090.** The INSERT branch has
+to tell "the caller wrote the new column" from "the column's DEFAULT filled it" — and it
+cannot, if the new column has a DEFAULT: **Postgres materializes a column default into
+`NEW` before any BEFORE ROW trigger fires.** With a default in place, an old-release
+`INSERT … (client_id, github_id, role) VALUES (…, 'pending')` — `inviteToProject`'s exact
+statement — took the "new code wrote it" branch and overwrote `role`, turning a pending
+INVITE into an active membership. So the new column stays **DEFAULT-less** while the legacy
+one is still written (NULL then means exactly "not written"), and `DEFAULT` + `NOT NULL`
+arrive together in step 2. `core_220` shipped with the defective form and is corrected
+under task [#1003093](https://cloudbongos.com/builders#/task/1003093) — where the same
+statement demotes a goal's first lead to `member` on a fresh install; the invariant is
+pinned statically by `tests/membership_kind_lockstep.mjs`, since the trigger only
+misbehaves against a live Postgres and CI has none.
+
+The window's removal is a filed task, and its condition is explicit: every federated
+instance past the window, not merely "one release later". A time-boxed shim still ships
+with the test of its absence (ADR 0174's Lineage lesson) — that test lands with the
+removal, because until then the legacy field is load-bearing, not vestigial.
+
 ## Consequences
 
 - The word `role` no longer names a goal membership in the API, the hall, or the docs, and in the DB it
@@ -93,4 +149,5 @@ be legal or the code cannot explain itself. R07 stays scoped to the government s
   the only new moving part on the write path, and it is the thing step 2 removes.
 - `docs/canonical-permissions.md` (the goal-management wall) now names `membership_kind`; the
   `authorizeGoalManagement` behaviour is untouched — this ADR changes no authority, floor, or grant.
-- The fifth use (`project_memberships.role`) is now catalogued and claimable, with this as its pattern.
+- The fifth use (`project_memberships.role`) shipped the same day under the amendment above — same shape, plus a cross-version window because its writer is another instance.
+- **No sixth use is known.** The remaining `role` spellings in the repo are the three legitimate ones ADR 0174 named: the crafts, `builders.system_role` (machine identity), and Discord's own noun — plus HTML's ARIA attribute, which every wall strips before matching.

package/docs/api/openapi.json

@@ -11117,7 +11117,7 @@
           "sso"
         ],
         "summary": "POST /sso/membership/check-in",
-        "description": "POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). Server-to-server, authed by client_id + client_secret (same constant-time check as /sso/token). Upserts the account (so a CLI-only builder still appears in My Projects) + the membership with a COARSE role. The client_id is taken from the AUTHENTICATED client — the caller cannot report membership for a project it doesn't hold the secret for. rank: public — authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). Server-to-server, authed by client_id + client_secret (same constant-time check as /sso/token). Upserts the account (so a CLI-only builder still appears in My Projects) + the membership with a COARSE membership_kind. The client_id is taken from the AUTHENTICATED client — the caller cannot report membership for a project it doesn't hold the secret for. THE FIELD IS `membership_kind`; `role` IS ACCEPTED FOR THE WINDOW (task 1003090, ADR 0177 §\"the fifth use\"). ADR 0174 reserves `role` for the three crafts, and the old value 'builder' was a craft name meaning \"non-owner member\" — so both the field and that value are renamed. Unlike the goal-membership rename, this is a CROSS-VERSION wire contract: the callers are other instances on their own upgrade schedule, so an un-upgraded instance still sends `role: 'builder'` and the hub must keep understanding it. `membership_kind` WINS when both arrive (a sender in the window sends both deliberately). rank: public — authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/platform-identity/routes/sso.js",
         "requestBody": {
@@ -17333,6 +17333,10 @@
             "type": "string",
             "maxLength": 2048
           },
+          "membership_kind": {
+            "type": "string",
+            "maxLength": 16
+          },
           "role": {
             "type": "string",
             "maxLength": 16

package/docs/api-reference.md

@@ -474,7 +474,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/sso/authorize` | `public` | — | GET /sso/authorize?client_id=&redirect_uri=&state= — the browser authorize leg. |
 | POST | `/api/bongos/sso/device/poll` | `public` | `device_code` | POST /sso/device/poll — poll the hub device flow. |
 | POST | `/api/bongos/sso/device/start` | `public` | `origin` | POST /sso/device/start — begin CLI federation. |
-| POST | `/api/bongos/sso/membership/check-in` | `public` | `client_id`, `client_secret`, `github_id`, `github_login`, `display_name`, `avatar_url`, `role` | POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). |
+| POST | `/api/bongos/sso/membership/check-in` | `public` | `client_id`, `client_secret`, `github_id`, `github_login`, `display_name`, `avatar_url`, `membership_kind`, `role` | POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). |
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 

package/modules/hall-ui/public/my-projects.js

@@ -40,7 +40,7 @@
         meta.appendChild(o);
       }
       row.appendChild(meta);
-      if (m.role === 'owner') {
+      if (m.membership_kind === 'owner') {
         var pill = el('span', 'owner-pill');
         pill.textContent = 'owner';
         row.appendChild(pill);

package/modules/platform-identity/migrations/platform_identity_010_membership_kind.sql

@@ -0,0 +1,106 @@
+-- platform_identity_010_membership_kind.sql — the FIFTH "role" leaves the schema
+-- (task 1003090; ADR 0174 reserves the word for the three crafts, ADR 0177 §"the
+-- fifth use" records this two-step).
+--
+-- `platform_identity_project_memberships.role` holds the hub's COARSE project
+-- membership — and it collided with the reserved word TWICE over:
+--   • the COLUMN is named `role`, which ADR 0174 reserves for Artist / Ideator /
+--     Builder;
+--   • one of its VALUES is literally 'builder', used to mean "a non-owner member
+--     of this project" — a craft name doing membership work.
+-- The column becomes `membership_kind` and that value becomes 'member'. 'owner',
+-- 'visitor' and 'pending' are unchanged.
+--
+-- ── EXPAND-THEN-CONTRACT, AND WHY THE WINDOW IS LONGER HERE ─────────────────
+-- Same reasoning as core_220 (ADR 0177): `bongos upgrade` auto-rollback reverts the
+-- code pin and NOT the DB, so a bare RENAME COLUMN plus a rolled-back deploy
+-- strands the previous release on a missing column. But this table has a second,
+-- stronger reason: it is written by POST /sso/membership/check-in, a
+-- SERVER-TO-SERVER call from OTHER INSTANCES (ADR 0141 §3) that upgrade on their
+-- own schedule. The legacy `role` column and the legacy request field therefore
+-- outlive one release by design — until every federated instance is past the
+-- window. The removal task carries that condition.
+--
+-- Idempotent, additive, platform_identity_-namespaced (ADR 0083 §5). Forward-safe:
+-- old code writing `role` still lands a complete row (the trigger below), and no
+-- NOT NULL is added to the new column while the old one is still written.
+
+BEGIN;
+
+ALTER TABLE platform_identity_project_memberships
+  ADD COLUMN IF NOT EXISTS membership_kind text;
+
+-- Backfill WITH the value rename: 'builder' → 'member', everything else verbatim.
+UPDATE platform_identity_project_memberships
+   SET membership_kind = CASE WHEN role = 'builder' THEN 'member' ELSE role END
+ WHERE membership_kind IS NULL;
+
+-- NO DEFAULT ON THE NEW COLUMN WHILE THE LEGACY ONE IS STILL WRITTEN. This is
+-- load-bearing, and it is subtle: Postgres materializes a column DEFAULT into NEW
+-- *before* any BEFORE ROW trigger fires, so a default here would make
+-- `NEW.membership_kind IS NULL`never true and the trigger could no longer tell
+-- "the caller wrote the new column" from "the default filled it". An old-release
+-- INSERT naming only `role` (inviteToProject's `role = 'pending'`, or an owner
+-- check-in) would then be silently rewritten to the default's mapping — turning a
+-- pending INVITE into an active membership. Leaving the column DEFAULT-less makes
+-- NULL mean exactly "not written", which is what the trigger branches on. The
+-- default (and NOT NULL) arrive in step 2, when `role` is dropped and nothing
+-- writes the old name any more.
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conrelid = 'platform_identity_project_memberships'::regclass
+       AND conname = 'platform_identity_project_memberships_membership_kind_check'
+  ) THEN
+    ALTER TABLE platform_identity_project_memberships
+      ADD CONSTRAINT platform_identity_project_memberships_membership_kind_check
+      CHECK (membership_kind IN ('owner', 'member', 'visitor', 'pending'));
+  END IF;
+END $$;
+
+-- The lockstep, with the value MAPPING in both directions — the difference from
+-- core_220's trigger, which only had to copy a value. Direction is decided by
+-- which side changed, so a check-in from an un-upgraded instance (writing `role`
+-- = 'builder') lands membership_kind = 'member', and new code writing
+-- membership_kind = 'member' keeps `role` = 'builder' readable by an old release.
+CREATE OR REPLACE FUNCTION platform_identity_membership_kind_lockstep() RETURNS trigger AS $$
+DECLARE
+  kind_from_role text;
+  role_from_kind text;
+BEGIN
+  kind_from_role := CASE WHEN NEW.role = 'builder' THEN 'member' ELSE NEW.role END;
+  role_from_kind := CASE WHEN NEW.membership_kind = 'member' THEN 'builder' ELSE NEW.membership_kind END;
+  IF TG_OP = 'INSERT' THEN
+    -- NULL means the caller did not write the new column (see the no-DEFAULT note
+    -- above): that is an old-release INSERT, so `role` is the source of truth and
+    -- the new column follows it. Otherwise the caller is new code and `role`
+    -- follows, mapped, so an older release can still read the row.
+    IF NEW.membership_kind IS NULL THEN
+      NEW.membership_kind := COALESCE(kind_from_role, 'member');
+      NEW.role := COALESCE(NEW.role, 'builder');
+    ELSE
+      NEW.role := role_from_kind;
+    END IF;
+  ELSE
+    IF NEW.membership_kind IS DISTINCT FROM OLD.membership_kind THEN
+      NEW.role := role_from_kind;
+    ELSIF NEW.role IS DISTINCT FROM OLD.role THEN
+      NEW.membership_kind := kind_from_role;
+    END IF;
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS platform_identity_membership_kind_lockstep
+  ON platform_identity_project_memberships;
+CREATE TRIGGER platform_identity_membership_kind_lockstep
+  BEFORE INSERT OR UPDATE ON platform_identity_project_memberships
+  FOR EACH ROW EXECUTE FUNCTION platform_identity_membership_kind_lockstep();
+
+INSERT INTO schema_migrations (version) VALUES ('platform_identity_010_membership_kind')
+  ON CONFLICT DO NOTHING;
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -307,31 +307,53 @@ async function setProjectFeatured(id, featured, { pool = defaultPool } = {}) {
 // Project memberships (the cross-project directory — ADR 0141 §3)
 // -------------------------------------------------------------------------
 
-const MEMBERSHIP_ROLES = ['owner', 'builder', 'visitor', 'pending'];
+// THE COARSE PROJECT MEMBERSHIP — 'membership_kind', never 'role' (task 1003090,
+// ADR 0177 §"the fifth use"; ADR 0174 reserves that word for the three crafts). The
+// old value 'builder' is now 'member': it meant "a non-owner member of this
+// project", which is membership work done by a craft name.
+//
+// THE LEGACY COLUMN AND FIELD SURVIVE THIS RELEASE ON PURPOSE. This table is
+// written by POST /sso/membership/check-in — a server-to-server call from OTHER
+// INSTANCES (ADR 0141 §3) that upgrade on their own schedule — so both spellings
+// are read on the way in and platform_identity_010's trigger keeps both columns
+// (and both value vocabularies) in lockstep. Write `membership_kind` here; the
+// removal task drops the pair once every federated instance is past the window.
+const MEMBERSHIP_KINDS = ['owner', 'member', 'visitor', 'pending'];
+
+// Map the legacy wire/column vocabulary onto the current one and back: the craft
+// name 'builder' ⇄ 'member'; every other value was already right. Exported so the
+// route, the sender and the migration's trigger all agree on one mapping. (task
+// 1003090 — the legacy spelling is named here by necessity: this IS the translator.)
+function membershipKindFromLegacy(legacyValue) {
+  return legacyValue === 'builder' ? 'member' : legacyValue;
+}
+function legacyRoleFromKind(kind) {
+  return kind === 'member' ? 'builder' : kind;
+}
 
 // Upsert a builder's membership in a project (keyed by the reporting client + the
-// builder's github_id). COARSE role only — never a rank. Refreshes last_active on
-// every check-in. Returns the row.
-async function upsertMembership({ clientId, githubId, role = 'builder' }, { pool = defaultPool } = {}) {
-  const r = MEMBERSHIP_ROLES.includes(role) ? role : 'builder';
+// builder's github_id). COARSE membership only — never a rank. Refreshes
+// last_active on every check-in. Returns the row.
+async function upsertMembership({ clientId, githubId, membershipKind = 'member' }, { pool = defaultPool } = {}) {
+  const k = MEMBERSHIP_KINDS.includes(membershipKind) ? membershipKind : 'member';
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_project_memberships (client_id, github_id, role)
+    `INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind)
      VALUES ($1, $2, $3)
      ON CONFLICT (client_id, github_id) DO UPDATE SET
-       role        = EXCLUDED.role,
+       membership_kind = EXCLUDED.membership_kind,
        last_active = now()
-     RETURNING id, client_id, github_id, role, joined_at, last_active`,
-    [clientId, githubId, r],
+     RETURNING id, client_id, github_id, membership_kind, joined_at, last_active`,
+    [clientId, githubId, k],
   );
   return rows[0];
 }
 
-// One membership row for (project, builder), any role — or null. Backs the
+// One membership row for (project, builder), any membership_kind — or null. Backs the
 // activity-rollup membership requirement (ADR 0171 D7): a client may only report
 // activity for a builder who actually has a membership on that project.
 async function getMembership(clientId, githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `SELECT id, client_id, github_id, role, joined_at, last_active
+    `SELECT id, client_id, github_id, membership_kind, joined_at, last_active
        FROM platform_identity_project_memberships
       WHERE client_id = $1 AND github_id = $2`,
     [clientId, githubId],
@@ -343,11 +365,11 @@ async function getMembership(clientId, githubId, { pool = defaultPool } = {}) {
 // display fields (name/origin from sso_clients). Powers "My Projects" (task #1002112).
 async function listMembershipsForAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `SELECT m.client_id, m.role, m.joined_at, m.last_active,
+    `SELECT m.client_id, m.membership_kind, m.joined_at, m.last_active,
             c.name AS project_name, c.origin AS project_origin, c.owner_github_id
        FROM platform_identity_project_memberships m
        LEFT JOIN platform_identity_sso_clients c ON c.client_id = m.client_id
-      WHERE m.github_id = $1 AND m.role <> 'pending'
+      WHERE m.github_id = $1 AND m.membership_kind <> 'pending'
       ORDER BY m.last_active DESC`,
     [githubId],
   );
@@ -364,10 +386,10 @@ async function listMembershipsForAccount(githubId, { pool = defaultPool } = {})
 // created, or { invited:false, alreadyMember:true } when a membership already existed.
 async function inviteToProject({ clientId, githubId }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_project_memberships (client_id, github_id, role)
+    `INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind)
      VALUES ($1, $2, 'pending')
      ON CONFLICT (client_id, github_id) DO NOTHING
-     RETURNING id, client_id, github_id, role`,
+     RETURNING id, client_id, github_id, membership_kind`,
     [clientId, githubId],
   );
   if (rows[0]) return { invited: true, row: rows[0] };
@@ -381,22 +403,22 @@ async function listPendingInvitesForAccount(githubId, { pool = defaultPool } = {
             c.name AS project_name, c.origin AS project_origin
        FROM platform_identity_project_memberships m
        LEFT JOIN platform_identity_sso_clients c ON c.client_id = m.client_id
-      WHERE m.github_id = $1 AND m.role = 'pending'
+      WHERE m.github_id = $1 AND m.membership_kind = 'pending'
       ORDER BY m.joined_at DESC`,
     [githubId],
   );
   return rows;
 }
 
-// Resolve a pending invite for (client, builder): accept → flip to 'builder' (the
+// Resolve a pending invite for (client, builder): accept → flip to 'member' (the
 // membership becomes real; the builder then signs into the project, whose own gate
 // still applies + whose check-in keeps it fresh); decline → delete the pending row.
 // Only ever touches a 'pending' row, so it can't downgrade or remove a real member.
 async function resolveInvite({ clientId, githubId, accept }, { pool = defaultPool } = {}) {
   if (accept) {
     const { rows } = await pool.query(
-      `UPDATE platform_identity_project_memberships SET role = 'builder', last_active = now()
-        WHERE client_id = $1 AND github_id = $2 AND role = 'pending'
+      `UPDATE platform_identity_project_memberships SET membership_kind = 'member', last_active = now()
+        WHERE client_id = $1 AND github_id = $2 AND membership_kind = 'pending'
         RETURNING id`,
       [clientId, githubId],
     );
@@ -404,7 +426,7 @@ async function resolveInvite({ clientId, githubId, accept }, { pool = defaultPoo
   }
   const { rowCount } = await pool.query(
     `DELETE FROM platform_identity_project_memberships
-      WHERE client_id = $1 AND github_id = $2 AND role = 'pending'`,
+      WHERE client_id = $1 AND github_id = $2 AND membership_kind = 'pending'`,
     [clientId, githubId],
   );
   return { resolved: rowCount > 0, accepted: false };
@@ -1072,7 +1094,9 @@ module.exports = {
   listAllProjects,
   setProjectFeatured,
   // memberships
-  MEMBERSHIP_ROLES,
+  MEMBERSHIP_KINDS,
+  membershipKindFromLegacy,
+  legacyRoleFromKind,
   upsertMembership,
   getMembership,
   listMembershipsForAccount,

package/modules/platform-identity/routes/my-projects.js

@@ -26,11 +26,11 @@ module.exports = function myProjectsRoutes() {
       const owned = [];
       const building = [];
       for (const m of rows) {
-        (m.role === 'owner' ? owned : building).push({
+        (m.membership_kind === 'owner' ? owned : building).push({
           client_id: m.client_id,
           name: m.project_name || m.project_origin || m.client_id,
           origin: m.project_origin || null,
-          role: m.role,
+          membership_kind: m.membership_kind,
           joined_at: m.joined_at,
           last_active: m.last_active,
         });

package/modules/platform-identity/routes/sso.js

@@ -358,8 +358,18 @@ module.exports = function ssoRoutes() {
   // that a builder builds on its project (ADR 0141 §3). Server-to-server, authed by
   // client_id + client_secret (same constant-time check as /sso/token). Upserts the
   // account (so a CLI-only builder still appears in My Projects) + the membership
-  // with a COARSE role. The client_id is taken from the AUTHENTICATED client — the
-  // caller cannot report membership for a project it doesn't hold the secret for.
+  // with a COARSE membership_kind. The client_id is taken from the AUTHENTICATED
+  // client — the caller cannot report membership for a project it doesn't hold the
+  // secret for.
+  //
+  // THE FIELD IS `membership_kind`; `role` IS ACCEPTED FOR THE WINDOW (task 1003090,
+  // ADR 0177 §"the fifth use"). ADR 0174 reserves `role` for the three crafts, and
+  // the old value 'builder' was a craft name meaning "non-owner member" — so both
+  // the field and that value are renamed. Unlike the goal-membership rename, this is
+  // a CROSS-VERSION wire contract: the callers are other instances on their own
+  // upgrade schedule, so an un-upgraded instance still sends `role: 'builder'` and
+  // the hub must keep understanding it. `membership_kind` WINS when both arrive
+  // (a sender in the window sends both deliberately).
   //
   // rank: public — authenticated by client_id + client_secret, not a builder rank.
   router.post('/sso/membership/check-in', async (req, res) => {
@@ -370,9 +380,14 @@ module.exports = function ssoRoutes() {
       github_login: { required: true, type: 'string', maxLength: 200 },
       display_name: { type: 'string', maxLength: 400 },
       avatar_url: { type: 'string', maxLength: 2048 },
+      membership_kind: { type: 'string', maxLength: 16 },
+      // LEGACY, accepted for the cross-version window (task 1003090).
       role: { type: 'string', maxLength: 16 },
     })) return;
-    const { client_id, client_secret, github_id, github_login, display_name, avatar_url, role } = req.body || {};
+    const { client_id, client_secret, github_id, github_login, display_name, avatar_url, membership_kind, role } = req.body || {};
+    const membershipKind = membership_kind
+      || (role ? pi.membershipKindFromLegacy(role) : null)
+      || 'member';
     try {
       const client = await pi.getClient(client_id, { pool });
       if (!client || client.status !== 'active' || !pi.clientSecretValid(client, client_secret)) {
@@ -381,7 +396,7 @@ module.exports = function ssoRoutes() {
       // Upsert the account first so a CLI-only builder is known to the hub, then the
       // membership — keyed to the AUTHENTICATED client_id, never a caller-named one.
       await pi.upsertAccount({ githubId: github_id, githubLogin: github_login, displayName: display_name, avatarUrl: avatar_url }, { pool });
-      await pi.upsertMembership({ clientId: client_id, githubId: github_id, role: role || 'builder' }, { pool });
+      await pi.upsertMembership({ clientId: client_id, githubId: github_id, membershipKind }, { pool });
       res.json({ ok: true });
     } catch (err) {
       console.error('[platform-identity] /sso/membership/check-in', err);
@@ -424,7 +439,7 @@ module.exports = function ssoRoutes() {
         return res.fail('invalid_github_id', 400);
       }
       const membership = await pi.getMembership(b.client_id, b.github_id, { pool });
-      if (!membership || membership.role === 'pending') {
+      if (!membership || membership.membership_kind === 'pending') {
         return res.fail('membership_required', 409);
       }
       await pi.upsertActivity({

package/modules/platform-identity/tests/platform-identity.mjs

@@ -262,9 +262,9 @@ await ta('registerClient auto-catalogues the project (2nd query) when an origin
 
 console.log('\nproject memberships (§3 check-in directory):');
 
-await ta('upsertMembership upserts on (client_id, github_id) with a coarse role', async () => {
-  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', role: 'owner' }] }]);
-  await P.upsertMembership({ clientId: 'c1', githubId: 42, role: 'owner' }, { pool });
+await ta('upsertMembership upserts on (client_id, github_id) with a coarse membership_kind', async () => {
+  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', membership_kind: 'owner' }] }]);
+  await P.upsertMembership({ clientId: 'c1', githubId: 42, membershipKind: 'owner' }, { pool });
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_project_memberships/);
   assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE/);
@@ -272,10 +272,23 @@ await ta('upsertMembership upserts on (client_id, github_id) with a coarse role'
   assert.deepEqual(c.params, ['c1', 42, 'owner']);
 });
 
-await ta('upsertMembership clamps an unknown role to builder (never trusts a caller role blindly)', async () => {
+await ta('upsertMembership clamps an unknown kind to member (never trusts a caller blindly)', async () => {
   const pool = mockPool([{ rows: [{}] }]);
-  await P.upsertMembership({ clientId: 'c1', githubId: 42, role: 'archon' }, { pool });
-  assert.equal(pool.calls[0].params[2], 'builder', 'a non-coarse role is clamped to builder');
+  await P.upsertMembership({ clientId: 'c1', githubId: 42, membershipKind: 'archon' }, { pool });
+  assert.equal(pool.calls[0].params[2], 'member', 'a non-coarse membership_kind is clamped to member');
+});
+
+await ta('the legacy wire vocabulary maps both ways (the cross-version window, task 1003090)', async () => {
+  // Other instances upgrade on their own schedule, so 'builder' keeps arriving on
+  // the wire for a while; 'member' is what the hub stores. Nothing else changes.
+  assert.equal(P.membershipKindFromLegacy('builder'), 'member');
+  assert.equal(P.legacyRoleFromKind('member'), 'builder');
+  for (const same of ['owner', 'visitor', 'pending']) {
+    assert.equal(P.membershipKindFromLegacy(same), same);
+    assert.equal(P.legacyRoleFromKind(same), same);
+  }
+  assert.deepEqual(P.MEMBERSHIP_KINDS, ['owner', 'member', 'visitor', 'pending'],
+    'the craft name is gone from the coarse vocabulary');
 });
 
 await ta('removeMembership deletes the (client_id, github_id) row (self-service leave)', async () => {
@@ -287,20 +300,20 @@ await ta('removeMembership deletes the (client_id, github_id) row (self-service
 });
 
 await ta('listMembershipsForAccount joins projects + excludes pending', async () => {
-  const pool = mockPool([{ rows: [{ client_id: 'c1', role: 'builder', project_name: 'Proj' }] }]);
+  const pool = mockPool([{ rows: [{ client_id: 'c1', membership_kind: 'member', project_name: 'Proj' }] }]);
   const out = await P.listMembershipsForAccount(42, { pool });
   assert.equal(out.length, 1);
   const c = pool.calls[0];
   assert.match(c.text, /FROM platform_identity_project_memberships m/);
   assert.match(c.text, /LEFT JOIN platform_identity_sso_clients c/);
-  assert.match(c.text, /role <> 'pending'/);
+  assert.match(c.text, /membership_kind <> 'pending'/);
   assert.deepEqual(c.params, [42]);
 });
 
 console.log('\ninvitations (§5 — pre-seed pending membership):');
 
 await ta('inviteToProject pre-seeds a pending row, never clobbering an existing member', async () => {
-  const pool = mockPool([{ rows: [{ id: '1', role: 'pending' }] }]);
+  const pool = mockPool([{ rows: [{ id: '1', membership_kind: 'pending' }] }]);
   const out = await P.inviteToProject({ clientId: 'c1', githubId: 42 }, { pool });
   assert.equal(out.invited, true);
   const c = pool.calls[0];
@@ -320,15 +333,15 @@ await ta('resolveInvite accept flips ONLY a pending row to builder', async () =>
   const out = await P.resolveInvite({ clientId: 'c1', githubId: 42, accept: true }, { pool });
   assert.deepEqual(out, { resolved: true, accepted: true });
   const c = pool.calls[0];
-  assert.match(c.text, /UPDATE platform_identity_project_memberships SET role = 'builder'/);
-  assert.match(c.text, /AND role = 'pending'/, 'only touches pending — never a real member');
+  assert.match(c.text, /UPDATE platform_identity_project_memberships SET membership_kind = 'member'/);
+  assert.match(c.text, /AND membership_kind = 'pending'/, 'only touches pending — never a real member');
 });
 
 await ta('resolveInvite decline deletes ONLY a pending row', async () => {
   const pool = mockPool([{ rowCount: 1 }]);
   const out = await P.resolveInvite({ clientId: 'c1', githubId: 42, accept: false }, { pool });
   assert.deepEqual(out, { resolved: true, accepted: false });
-  assert.match(pool.calls[0].text, /DELETE FROM platform_identity_project_memberships[\s\S]*AND role = 'pending'/);
+  assert.match(pool.calls[0].text, /DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/);
 });
 
 await ta('getAccountByLogin resolves case-insensitively, newest first', async () => {
@@ -376,7 +389,7 @@ await ta('upsertActivity keeps a legitimate core rank key', async () => {
 });
 
 await ta('getMembership reads one (client, builder) row — the rollup membership requirement', async () => {
-  const row = { id: '9', client_id: 'c1', github_id: '42', role: 'builder' };
+  const row = { id: '9', client_id: 'c1', github_id: '42', membership_kind: 'member' };
   const pool = mockPool([{ rows: [row] }]);
   const out = await P.getMembership('c1', 42, { pool });
   assert.deepEqual(out, row);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.240",
+  "version": "1.19.241",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.240",
+      "version": "1.19.241",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.240",
+  "version": "1.19.241",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1741,7 +1741,7 @@ function vocabFilesToScan() {
   return out;
 }
 
-// ── Check 19b — the FOURTH "role": a goal membership is not a craft either ──
+// ── Check 19b — the FOURTH and FIFTH "role": a membership is not a craft either ─
 //
 // task 1003013 / ADR 0177. ADR 0174 reserved `role` for the three crafts and R07
 // (checkVocabularyWall above) enforces it on the GOVERNMENT surface — deliberately
@@ -1751,10 +1751,16 @@ function vocabFilesToScan() {
 // exactly why it survived the rename: the rule was silent on it, as designed.
 //
 // So this is a SECOND narrow wall rather than a widened first one — same reason the
-// first was scoped: the honest unit is a SURFACE, not the repo. The surface here is
-// the goal-membership one: the routes and pure gate that decide it, the hall page
-// that renders it, and (line-scoped) the membership SQL in the module's db.js. The
-// noun on it is `membership_kind`.
+// first was scoped: the honest unit is a SURFACE, not the repo. Two surfaces carry
+// a membership, and both now say `membership_kind`:
+//   • GOAL membership (`goal_members`, task 1003013) — the routes and pure gate that
+//     decide it, the hall page that renders it, and (line-scoped) the membership SQL
+//     in modules/lifecycle/db.js;
+//   • PROJECT membership on the hub (`platform_identity_project_memberships`, task
+//     1003090) — whose old VALUE 'builder' was itself a craft name. Its check-in
+//     route keeps reading a legacy `role` field for the cross-version federation
+//     window (other instances upgrade on their own schedule), so the lines that
+//     handle that legacy field cite the task and are exempt like any other citation.
 //
 // Naming the rule stays legal — a line that cites ADR 0174 / ADR 0177 / task
 // 1003013 is meta-commentary about the ban, the same principle as
@@ -1767,14 +1773,23 @@ const GOAL_VOCAB_SURFACE = [
   'modules/hall-ui/public/goals-page.js',
   'modules/hall-ui/public/goals.html',
   'modules/hall-ui/public/goals.css',
+  // The FIFTH use (task 1003090): the hub's coarse project membership.
+  'modules/platform-identity/platform-identity.js',
+  'modules/platform-identity/routes/my-projects.js',
+  'modules/hall-ui/public/my-projects.js',
 ];
 // modules/lifecycle/db.js is 5k+ lines and legitimately says "role" about ranks
 // (the rank-sync port, builders.system_role). Scanning it whole would need an
 // allowlist longer than the rule; scanning the LINES THAT NAME THE TABLE catches
 // the only thing that can regress here — a membership query reaching for the old
 // column — with no false positives to excuse.
-const GOAL_VOCAB_LINE_SCOPED = [{ file: 'modules/lifecycle/db.js', mustMention: /goal_members/ }];
-const GOAL_VOCAB_CITATION = /ADR 017[47]|task 1003013/;
+const GOAL_VOCAB_LINE_SCOPED = [
+  { file: 'modules/lifecycle/db.js', mustMention: /goal_members/ },
+  // sso.js is the federation surface: only the lines that name the membership table
+  // or its upsert are in scope, so the file's other server-to-server prose stays out.
+  { file: 'modules/platform-identity/routes/sso.js', mustMention: /project_memberships|upsertMembership/ },
+];
+const GOAL_VOCAB_CITATION = /ADR 017[47]|task 1003013|task 1003090/;
 
 function checkGoalMembershipVocabulary() {
   const violations = [];
@@ -1789,19 +1804,19 @@ function checkGoalMembershipVocabulary() {
       const scanLine = line.replace(/\srole\s*=\s*("[^"]*"|'[^']*')/g, ' ');
       if (!/\brole/i.test(scanLine)) return;
       if (GOAL_VOCAB_CITATION.test(scanLine)) return;
-      violations.push(`${rel}:${i + 1}: "role" — a goal membership is 'membership_kind' (ADR 0174 reserves "role" for the crafts; ADR 0177).  →  ${line.trim().slice(0, 90)}`);
+      violations.push(`${rel}:${i + 1}: "role" — a membership is a 'membership_kind' (ADR 0174 reserves "role" for the crafts; ADR 0177).  →  ${line.trim().slice(0, 90)}`);
     });
   };
   for (const rel of GOAL_VOCAB_SURFACE) scanFile(rel);
   for (const { file, mustMention } of GOAL_VOCAB_LINE_SCOPED) scanFile(file, mustMention);
   return {
-    name: 'a goal membership is a "membership_kind", never a role (ADR 0177)',
+    name: 'a membership is a "membership_kind", never a role (ADR 0177)',
     ok: violations.length === 0,
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${scanned} goal-membership-surface file(s) scanned (${GOAL_VOCAB_SURFACE.length} whole + `
-        + `${GOAL_VOCAB_LINE_SCOPED.length} line-scoped to the lines naming goal_members); no allowlist — `
+    note: `${scanned} membership-surface file(s) scanned (${GOAL_VOCAB_SURFACE.length} whole — goal + project membership — plus `
+        + `${GOAL_VOCAB_LINE_SCOPED.length} line-scoped to the lines naming the membership tables); no allowlist — `
         + 'a line that CITES the rule is the only exemption.',
   };
 }

package/src/bongos/auth.js

@@ -173,15 +173,27 @@ function idpConfigured() {
 }
 
 // The COARSE membership role to report to the hub (ADR 0141 §3) — owner if this
-// builder is the instance's configured firstAdmin, else builder. NEVER a rank.
-function membershipRole({ githubLogin } = {}) {
+// builder is the instance's configured firstAdmin, else a plain member. NEVER a rank.
+//
+// 'member', not 'builder' (task 1003090, ADR 0177 §"the fifth use"): ADR 0174 reserves
+// `role` — and the craft name 'Builder' — for Artist / Ideator / Builder, so the coarse
+// project membership says what it means. The legacy spelling still goes on the wire for
+// the cross-version window; see reportMembershipCheckIn.
+function membershipKind({ githubLogin } = {}) {
   const fa = firstAdminLogin();
   if (fa && String(githubLogin || '').toLowerCase() === fa.toLowerCase()) return 'owner';
-  return 'builder';
+  return 'member';
 }
 
 // Best-effort server-to-server membership check-in to the hub (ADR 0141 §3): "this
-// github_id builds on project <client_id>, coarse role <role>". Runs on every
+// github_id builds on project <client_id>, coarse membership <membership_kind>".
+//
+// BOTH SPELLINGS GO ON THE WIRE FOR THE WINDOW (task 1003090). The receiver is the
+// HUB, a different instance on its own upgrade schedule: send only the new field and
+// an un-upgraded hub silently defaults every membership to non-owner (it would drop
+// the owner flag); send only the legacy field and an upgraded hub keeps translating
+// forever. Sending both is what makes the two ends independent — the removal task
+// drops `role` once the hub is past the window. Runs on every
 // FEDERATED sign-in (the only sign-ins a federated instance has) so a CLI-only
 // project still appears in the builder's My Projects with no hub browser session.
 // Fire-and-forget + fully swallowed: a hub outage must NEVER fail a sign-in (mirrors
@@ -189,6 +201,7 @@ function membershipRole({ githubLogin } = {}) {
 async function reportMembershipCheckIn({ githubId, githubLogin, displayName, avatarUrl }) {
   const idp = loadIdpConfig();
   if (!idp) return;
+  const kind = membershipKind({ githubLogin });
   try {
     await fetch(`${idp.origin}/api/gds/sso/membership/check-in`, {
       method: 'POST',
@@ -200,7 +213,9 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
         github_login: githubLogin,
         display_name: displayName ?? null,
         avatar_url: avatarUrl ?? null,
-        role: membershipRole({ githubLogin }),
+        membership_kind: kind,
+        // LEGACY (cross-version window): 'member' → 'builder' for an un-upgraded hub.
+        role: kind === 'member' ? 'builder' : kind,
       }),
     });
   } catch (err) {
@@ -1816,7 +1831,7 @@ module.exports = {
   verifyHubLogoutToken,
   logoutTokenJtiSeenAndRecord,
   completeDeviceExchange,
-  membershipRole,
+  membershipKind,
   extractTokens,
   resolveSession,
   allowBoxScope,

package/src/module-api.js

@@ -907,8 +907,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.238 with no explicit bump. run 32174983930. (task 1002620)
 //   1.19.240 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.239 with no explicit bump. run 32182178305. (task 1002620)
+//   1.19.241 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.240 with no explicit bump. run 32184475745. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.240'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.241'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idp_federation.mjs

@@ -80,16 +80,18 @@ t('buildIdpAuthorizeUrl throws when the IdP is not configured (never silently mi
   });
 });
 
-console.log('\nmembership check-in role (§3 — coarse, never a rank):');
+console.log('\nmembership check-in kind (§3 — coarse, never a rank, never a craft):');
 
-t('membershipRole is builder by default, owner for the configured firstAdmin', () => {
+t('membershipKind is member by default, owner for the configured firstAdmin', () => {
   const prev = process.env.CLOUDBONGOS_FIRST_ADMIN;
   process.env.CLOUDBONGOS_FIRST_ADMIN = 'ownerlogin';
   try {
-    assert.equal(auth.membershipRole({ githubLogin: 'ownerlogin' }), 'owner');
-    assert.equal(auth.membershipRole({ githubLogin: 'OwnerLogin' }), 'owner', 'case-insensitive');
-    assert.equal(auth.membershipRole({ githubLogin: 'someone-else' }), 'builder');
-    assert.equal(auth.membershipRole({}), 'builder');
+    assert.equal(auth.membershipKind({ githubLogin: 'ownerlogin' }), 'owner');
+    assert.equal(auth.membershipKind({ githubLogin: 'OwnerLogin' }), 'owner', 'case-insensitive');
+    // 'member', not 'builder' — the craft name left the coarse membership vocabulary
+    // with task 1003090 (ADR 0177 §"the fifth use").
+    assert.equal(auth.membershipKind({ githubLogin: 'someone-else' }), 'member');
+    assert.equal(auth.membershipKind({}), 'member');
   } finally {
     if (prev === undefined) delete process.env.CLOUDBONGOS_FIRST_ADMIN;
     else process.env.CLOUDBONGOS_FIRST_ADMIN = prev;

package/tests/membership_kind_lockstep.mjs

@@ -0,0 +1,99 @@
+// tests/membership_kind_lockstep.mjs — the expand-phase lockstep triggers, and the
+// Postgres semantic that makes their shape load-bearing (task 1003090, ADR 0177).
+//
+// Both membership renames keep the legacy column alive for one release, kept in step
+// by a BEFORE INSERT OR UPDATE trigger. The INSERT branch has to answer "did the
+// caller write the NEW column, or is this an old release writing the legacy one?" —
+// and there is exactly ONE way to answer it:
+//
+//   POSTGRES MATERIALIZES A COLUMN DEFAULT INTO `NEW` BEFORE ANY BEFORE ROW TRIGGER
+//   FIRES. So if the new column carries a DEFAULT, `NEW.<new> IS NULL` is never true
+//   and the trigger cannot distinguish "explicitly written" from "default filled".
+//
+// That is not theoretical. With a DEFAULT in place, an old-release
+// `INSERT … (client_id, github_id, role) VALUES (…, 'pending')` — inviteToProject's
+// exact statement — took the "new code wrote it" branch and overwrote `role` with the
+// default's mapping, turning a pending INVITE into an active membership. Caught by
+// the grader on task 1003090 and reproduced against a real Postgres:
+//
+//   A old-invite-pending | role=builder | membership_kind=member   ← WRONG (before)
+//   A old-invite-pending | role=pending | membership_kind=pending  ← after the fix
+//
+// The fix is the absence of a DEFAULT while the legacy column is still written, so
+// NULL means exactly "not written". The DEFAULT (and NOT NULL) belong to step 2,
+// when the legacy column is dropped. This file pins that invariant statically,
+// because the trigger only misbehaves against a live Postgres — which CI has none of.
+//
+// Run:  node --test tests/membership_kind_lockstep.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+// core_220 (goal membership) carries the SAME defect and is fixed under task
+// 1003093 — filed, not forgotten. It is deliberately absent from this list rather
+// than silently passing: a class guard that quietly excludes a known-broken member
+// of the class is worse than no guard.
+const EXPAND_MIGRATIONS = [
+  {
+    rel: 'modules/platform-identity/migrations/platform_identity_010_membership_kind.sql',
+    table: 'platform_identity_project_memberships',
+    legacy: 'role',
+  },
+];
+
+for (const m of EXPAND_MIGRATIONS) {
+  test(`${path.basename(m.rel)}: the new column has NO default while ${m.legacy} is still written`, () => {
+    const sql = read(m.rel);
+    assert.ok(/ADD COLUMN IF NOT EXISTS membership_kind text/.test(sql), 'the expand step adds the column');
+    assert.ok(!/ALTER COLUMN membership_kind SET DEFAULT/.test(sql),
+      'a DEFAULT here is materialized into NEW before the BEFORE trigger runs, so the trigger '
+      + 'could no longer tell an explicit write from a filled default — and an old-release INSERT '
+      + `naming only ${m.legacy} would be silently rewritten (task 1003090)`);
+    assert.ok(!/ALTER COLUMN membership_kind SET NOT NULL/.test(sql),
+      'NOT NULL belongs to step 2, once nothing writes the legacy column (and the forward-safety '
+      + 'linter flags it here for the same reason)');
+  });
+
+  test(`${path.basename(m.rel)}: the trigger's INSERT branch keys off NULL, not off truthiness`, () => {
+    const sql = read(m.rel);
+    const fn = sql.slice(sql.indexOf('RETURNS trigger AS'), sql.indexOf('$$ LANGUAGE plpgsql'));
+    const insertBranch = fn.slice(fn.indexOf("IF TG_OP = 'INSERT'"), fn.indexOf('ELSE', fn.indexOf('END IF')));
+    assert.match(insertBranch, /IF NEW\.membership_kind IS NULL THEN/,
+      'NULL is the only reliable signal that the caller did not write the new column');
+    assert.ok(!/IF NEW\.membership_kind IS NOT NULL THEN/.test(insertBranch),
+      'the inverted form is the task-1003090 bug: it treats a filled default as an explicit write');
+    // The UPDATE branch has OLD to compare against, so it may (and does) use IS DISTINCT FROM.
+    assert.match(fn, /NEW\.membership_kind IS DISTINCT FROM OLD\.membership_kind/,
+      'the UPDATE branch decides direction by which side actually changed');
+    assert.ok(/BEFORE INSERT OR UPDATE/.test(sql), 'a BEFORE trigger, so both columns are written by one statement');
+  });
+}
+
+test('the value mapping is one shared function, not repeated inline', () => {
+  // Route, sender and trigger must agree that 'builder' ⇄ 'member'; three copies of a
+  // ternary is how they would stop agreeing.
+  const pi = read('modules/platform-identity/platform-identity.js');
+  assert.match(pi, /function membershipKindFromLegacy\(/);
+  assert.match(pi, /function legacyRoleFromKind\(/);
+  const sso = read('modules/platform-identity/routes/sso.js');
+  assert.match(sso, /pi\.membershipKindFromLegacy\(role\)/,
+    'the check-in translates the legacy field through the shared mapping');
+  const sql = read('modules/platform-identity/migrations/platform_identity_010_membership_kind.sql');
+  assert.match(sql, /CASE WHEN NEW\.role = 'builder' THEN 'member'/, 'the trigger maps the same pair');
+  assert.match(sql, /CASE WHEN NEW\.membership_kind = 'member' THEN 'builder'/);
+});
+
+test('the sender writes BOTH spellings, computing the kind once (the cross-version window)', () => {
+  const auth = read('src/bongos/auth.js');
+  const body = auth.slice(auth.indexOf('async function reportMembershipCheckIn'), auth.indexOf('async function reportMembershipCheckIn') + 2400);
+  assert.match(body, /membership_kind: kind/, 'the new field goes on the wire');
+  assert.match(body, /role: kind === 'member' \? 'builder' : kind/,
+    'and the legacy field too — an un-upgraded hub would otherwise drop the owner flag');
+  assert.equal((body.match(/membershipKind\(\{ githubLogin \}\)/g) || []).length, 1,
+    'the kind is computed ONCE per check-in, not per field');
+});