@bongos/core 1.19.407 → 1.19.409

package/src/bongos/auth-admission.js

@@ -77,36 +77,98 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
   }
 }
 
+// How many recently shipped works ride the rollup (task 1002803). The hub caps
+// this again on arrival — a sender is never trusted to respect its own cap — so
+// this constant is the polite half of the contract, not the enforcement.
+const ROLLUP_RECENT_SHIPS = 3;
+
+// A public deep link to one task in THIS instance's builders' hall, for the
+// "recent works" list on the builder's cross-project profile (task 1002803). It
+// is built from branding's STABLE public hall origin, never an env API base: the
+// link is stored on another host and rendered to strangers, so a local dev
+// override must never end up on a public portfolio. No origin (an instance that
+// never declared one) → no link, and the work still reports with its title.
+function hallTaskUrl(taskId) {
+  try {
+    const d = (branding().domains) || {};
+    const origin = String(d.buildersOrigin || d.publicOrigin || '').replace(/\/+$/, '');
+    return origin ? `${origin}/builders#/task/${taskId}` : null;
+  } catch {
+    return null;
+  }
+}
+
+// This builder's most recent shipped works, for the rollup's recent_ships[]
+// (task 1002803). The predicate is deliberately IDENTICAL to the lifecycle
+// module's recentShippedTasksByBuilder — the read behind this instance's own
+// unauthenticated GET /builders/:id/profile — so the push can never publish a
+// work the instance does not already publish itself. (Neither surface filters by
+// goal visibility today: ADR 0112's secrecy covers a private goal's OWN title,
+// not the titles of tasks inside it. Widening or narrowing that is a policy
+// change for the profile route, not something to fork here.) Kernel file, so it
+// reads `pool` directly rather than importing the lifecycle module (ADR 0091 §1).
+// Covered by core_228's idx_tasks_shipped_by_shipped_at — (shipped_by,
+// shipped_at DESC) partial on status='shipped', which is this predicate exactly.
+async function recentShipsForRollup(builderId) {
+  const { rows } = await pool.query(
+    `SELECT id, title, shipped_at
+       FROM tasks
+      WHERE shipped_by = $1
+        AND status = 'shipped'
+        AND title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
+      ORDER BY shipped_at DESC NULLS LAST
+      LIMIT $2`,
+    [builderId, ROLLUP_RECENT_SHIPS],
+  );
+  return rows.map((r) => ({
+    id: Number(r.id),
+    title: r.title,
+    shipped_at: r.shipped_at ? new Date(r.shipped_at).toISOString() : null,
+    url: hallTaskUrl(r.id),
+  }));
+}
+
 // Best-effort cross-project activity rollup to the hub (ADR 0141 §4): report this
-// builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines)
-// for the internal scouting directory. Fires on every federated sign-in ("on key
-// events"); true periodic reporting is a follow-up. Fully swallowed + no-op when
-// not federated — never fails a sign-in.
-async function reportActivityRollup({ builderId, githubId }) {
+// builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines,
+// and since task 1002803 their last few shipped works) for the cross-project
+// profile + scouting directory. Fires on every federated sign-in AND on every
+// ship (reportActivityRollupForShippedTask). Fully swallowed + no-op when not
+// federated — never fails a sign-in or a ship.
+//
+// `githubId` is OPTIONAL: a sign-in already holds the hub-supplied id, while the
+// ship path holds only a builder id, and the snapshot SELECT below can answer
+// both — so the ship path costs one query, not two. A non-numeric principal (a
+// `system:*` machine id) is dropped here rather than sent for the hub to reject:
+// it has no public profile and never will.
+async function reportActivityRollup({ builderId, githubId = null }) {
   const idp = loadIdpConfig();
   if (!idp) return;
   try {
     // Snapshot the builder's talent signals directly from the DB (auth.js is a
     // kernel file — it uses pool, never a non-kernel domain module like metrics.js).
     const b = await pool.query(
-      'SELECT total_credits, karma, rank, preferred_disciplines FROM builders WHERE id = $1',
+      'SELECT github_id, total_credits, karma, rank, preferred_disciplines FROM builders WHERE id = $1',
       [builderId],
     );
     if (!b.rows[0]) return;
-    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
     const row = b.rows[0];
+    const ghId = githubId ?? row.github_id;
+    if (!/^\d+$/.test(String(ghId ?? ''))) return;
+    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
+    const recentShips = await recentShipsForRollup(builderId);
     await fetch(`${idp.origin}/api/gds/sso/activity/rollup`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
         client_id: idp.clientId,
         client_secret: idp.clientSecret,
-        github_id: githubId,
+        github_id: ghId,
         credits: Number(row.total_credits) || 0,
         tasks_shipped: shipped.rows[0] ? shipped.rows[0].n : 0,
         karma: Number(row.karma) || 0,
         rank: row.rank || null,
         disciplines: Array.isArray(row.preferred_disciplines) ? row.preferred_disciplines : [],
+        recent_ships: recentShips,
       }),
     });
   } catch (err) {
@@ -114,6 +176,24 @@ async function reportActivityRollup({ builderId, githubId }) {
   }
 }
 
+// The SHIP-TIME rollup push (task 1002803, ADR 0171 amendment R01). Until now the
+// rollup fired only on a federated sign-in, so a builder who signs in once a month
+// had a cross-project profile up to a month stale — showing old credit and ship
+// counts with nothing on the page saying so. A ship is the event that CHANGES
+// those numbers, so it re-reports them; nothing else about the push differs.
+//
+// Wired as a `task.shipped` listener in src/bongos/routes/auth.js, so it runs
+// once per ship whichever path won the confirmed→shipped flip. Best-effort in the
+// same sense as the sign-in push: it resolves nothing the caller waits on, and a
+// hub outage can never fail a ship. The builder's github_id is resolved by the
+// rollup's own snapshot SELECT (which now returns it), so this adds no lookup of
+// its own — and a machine principal is dropped there, not sent to the hub.
+async function reportActivityRollupForShippedTask(task) {
+  const builderId = task && task.shipped_by;
+  if (!builderId) return;
+  await reportActivityRollup({ builderId });
+}
+
 // Admission posture (SR-19 / task #1000). BOTH enrollment paths — the web hall
 // sign-in (completeWebFlow) and the CLI device flow (pollDeviceFlow) — are
 // "invite-gated by default": a FIRST-TIME GitHub account is admitted only if an
@@ -329,6 +409,7 @@ module.exports = {
   membershipKind,
   openEnrollmentEnabled,
   reportActivityRollup,
+  reportActivityRollupForShippedTask,
   reportMembershipCheckIn,
   safeSyncRankRole,
   webAdmissionStatus,

package/src/bongos/routes/auth.js

@@ -30,6 +30,7 @@ const express = require('express');
 const crypto = require('node:crypto');
 
 const auth = require('../auth');
+const { reportActivityRollupForShippedTask } = require('../auth-admission.js');
 const db = require('../db');
 const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
@@ -376,7 +377,27 @@ const DISCORD_REDIRECT_URI = `${DISCORD_REDIRECT_ORIGIN}/api/gds/auth/discord/ca
 // sign-in started on a builders.* subdomain must still use the apex.
 const WEB_REDIRECT_ORIGIN = process.env.GDS_PUBLIC_ORIGIN || configuredOAuthOrigin();
 
+// The ship-time hub push (task 1002803, ADR 0171 amendment R01) lives here
+// because this file already owns the OTHER trigger: the federated sign-in flows
+// below are what fire the check-in + rollup today, and the reporter they call is
+// this router's own auth-admission sibling. `task.shipped` is an EVENT, not a
+// port — many listeners may react to a ship and none of them returns anything
+// (the discord/sessions listener precedent). off→on guarded so a test that
+// re-instantiates the router never stacks duplicate listeners.
+let _shipRollupListenerOff = null;
+function registerSeams() {
+  if (_shipRollupListenerOff) _shipRollupListenerOff();
+  // Fire-and-forget: reportActivityRollupForShippedTask swallows every error and
+  // no-ops on an unfederated instance, so the .catch is belt-and-braces against a
+  // future edit letting one escape into an unhandledRejection (the sign-in
+  // chain's reasoning, auth-idp.js).
+  _shipRollupListenerOff = seams.on('task.shipped', (task) => {
+    reportActivityRollupForShippedTask(task).catch(() => {});
+  });
+}
+
 module.exports = function buildAuthRouter() {
+  registerSeams();
   const router = express.Router();
 
   // /auth/device — CLI flow

package/src/module-api.js

@@ -1,22 +1,13 @@
 // src/module-api.js — THE PUBLISHED, SEMVER'D DOORWAY (ADR 0083 / design 01§3).
-//
-// This is the ONLY core file a module may `require`. It re-exports the kernel
-// capabilities a module legitimately needs; everything else in the core is
-// off-limits to modules. The one-way rule (enforced by the fitness checks in
-// BV1.R40 once modules exist):
-//
-//     module  ──require──▶  src/module-api.js  ──▶  kernel
-//     core    ──✗──────────────────────────────▶  module   (forbidden)
-//     module  ──✗──────────────────────────────▶  module   (forbidden; use a seam)
-//
-// Adding to this surface is a MINOR semver bump (safe — existing modules keep
-// working). Changing or removing an export is a MAJOR bump (breaking). Each
-// module declares the `coreVersion` it supports; `bongos upgrade` (BV1.R50)
-// pre-checks every enabled module against CORE_VERSION below.
-//
-// Introduced by the doorway task (BV1.R37 / task 1406). The seam registry is in
-// src/module-seams.js (hardened in BV1.R39 / task 1408); the loader that mounts
-// modules behind kernel-composed auth is BV1.R41 / task 1410.
+// The ONLY core file a module may `require`: it re-exports the kernel capabilities a
+// module legitimately needs; everything else in the core is off-limits. The one-way
+// rule (fitness-enforced, BV1.R40): module ──require──▶ src/module-api.js ──▶ kernel;
+// core ──✗──▶ module and module ──✗──▶ module are forbidden (use a seam).
+// Adding an export is a MINOR semver bump (safe); changing or removing one is MAJOR.
+// Each module declares the `coreVersion` it supports; `bongos upgrade` (BV1.R50)
+// pre-checks every enabled module against CORE_VERSION below. Introduced by BV1.R37
+// (task 1406); seams in src/module-seams.js (BV1.R39 / task 1408); the loader that
+// mounts modules behind kernel-composed auth is BV1.R41 / task 1410.
 
 const auth = require('./bongos/auth');
 const util = require('node:util');
@@ -1254,8 +1245,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.405 with no explicit bump. run 33213981964. (task 1002620)
 //   1.19.407 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.406 with no explicit bump. run 33214451873. (task 1002620)
+//   1.19.408 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.407 with no explicit bump. run 33216756796. (task 1002620)
+//   1.19.409 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.408 with no explicit bump. run 33217065997. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.407'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.409'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_recent_ships.mjs

@@ -0,0 +1,373 @@
+// tests/hub_recent_ships.mjs — task 1002803 (P07, goal 1000045 "public builder
+// profiles"; profile-page spec "The page spec" row 4 + ADR 0171 amendment R01).
+//
+// "Recent works" reaches the hub by PUSH, not pull: the hub has no `tasks` table
+// for other projects, so each project reports at most 3 of a builder's latest
+// shipped works on POST /sso/activity/rollup. Three deliverables, and each one
+// has a failure mode that a code read does not catch:
+//
+//   1. THE CAP IS THE HUB'S, NOT THE SENDER'S. A reporting instance is
+//      third-party self-report (ADR 0171 D7). If the cap lived only in the
+//      sender, an old, buggy or hostile client would set the size of a public
+//      profile section. So the cap, the field shape and the link bound are all
+//      asserted against what upsertActivity BINDS, not against what was passed.
+//   2. A SHIP LINK IS THE ONE FREE-TEXT URL ON A PUBLIC PORTFOLIO. It may only
+//      point back into the reporting client's own registered origin, or it is a
+//      phishing hop published under someone else's name.
+//   3. THE ORDERING IS THE WHOLE POINT OF THE SEQUENCING FIX. The hub refuses a
+//      rollup without a membership row, and the check-in is what creates it —
+//      so asserting "both fired" would still pass while a first sign-in raced
+//      itself. This asserts the rollup has NOT fired while the check-in is still
+//      in flight, which is the only shape that fails when the chain is broken.
+//
+// Plus the privacy edges the goal turns on: a work title is at least as
+// identifying as the project name it came from, so it may only surface where
+// that name may (a non-public project stays counted-but-unnamed, ships and all),
+// and hide_stats suppresses the whole cross-project read including recent_ships.
+//
+// DB-free: every DB function takes an injectable pool and is driven by a
+// recording fake (the modules/platform-identity/tests/platform-identity.mjs
+// idiom); the core halves pin require.cache (the tests/profile_route.mjs idiom)
+// so the REAL handlers and the REAL chain run against spies.
+//
+// Run:  node tests/hub_recent_ships.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+// A recording fake pool: answers by SQL shape and records every call, so a test
+// asserts the params the real query actually bound.
+function mockPool(answer = () => ({ rows: [] })) {
+  const calls = [];
+  return {
+    calls,
+    query: async (text, params = []) => {
+      calls.push({ text: String(text), params });
+      return answer(String(text), params) || { rows: [] };
+    },
+    find: (re) => calls.find((c) => re.test(c.text)),
+  };
+}
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const ORIGIN = 'https://p07.example';
+const ship = (over = {}) => ({
+  id: 1002803, title: 'A shipped work', shipped_at: '2026-08-28T10:00:00.000Z',
+  url: `${ORIGIN}/builders#/task/1002803`, ...over,
+});
+// What upsertActivity BOUND as recent_ships — the jsonb param, parsed back.
+async function storedShips(recentShips, clientOrigin = ORIGIN) {
+  const pool = mockPool(() => ({ rows: [{ id: 1 }] }));
+  await pi.upsertActivity({ clientId: 'c1', githubId: 42, recentShips, clientOrigin }, { pool });
+  const call = pool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  assert.ok(call, 'the activity upsert ran');
+  const raw = call.params[7];
+  assert.equal(typeof raw, 'string', 'jsonb is bound as a JSON string, not a JS array (pg would emit a Postgres array literal)');
+  return JSON.parse(raw);
+}
+
+console.log('\n1. the cap and the shape are the HUB\'s, not the sender\'s:');
+
+await t('a client reporting 5 works stores exactly 3', async () => {
+  const five = [1, 2, 3, 4, 5].map((n) => ship({ id: n, title: `work ${n}` }));
+  const out = await storedShips(five);
+  assert.equal(out.length, 3);
+  assert.deepEqual(out.map((s) => s.id), [1, 2, 3], 'the first three, in reported order');
+});
+
+await t('no works stores an empty list, never null and never a stray shape', async () => {
+  for (const nothing of [[], undefined, null, 'nope', { id: 1 }]) {
+    const out = await storedShips(nothing);
+    assert.deepEqual(out, [], `${JSON.stringify(nothing) ?? 'undefined'} → []`);
+  }
+});
+
+await t('a stored work carries exactly id + title + shipped_at + url', async () => {
+  const [s] = await storedShips([ship({ extra: 'DO-NOT-STORE' })]);
+  assert.deepEqual(Object.keys(s).sort(), ['id', 'shipped_at', 'title', 'url']);
+  assert.equal(s.id, 1002803);
+  assert.equal(s.title, 'A shipped work');
+  assert.equal(s.shipped_at, '2026-08-28T10:00:00.000Z');
+});
+
+await t('a work with no usable id or title is dropped, not stored half-empty', async () => {
+  const out = await storedShips([
+    ship({ id: 'not-a-number' }),
+    ship({ id: 7, title: '   ' }),
+    ship({ id: -1 }),
+    ship({ id: 9, title: 'kept' }),
+  ]);
+  assert.deepEqual(out.map((s) => s.id), [9]);
+});
+
+await t('an unparseable date nulls only the date, never the work', async () => {
+  const [s] = await storedShips([ship({ shipped_at: 'yesterday-ish' })]);
+  assert.equal(s.shipped_at, null);
+  assert.equal(s.id, 1002803, 'the work still publishes without a date');
+});
+
+await t('a title longer than the cap is truncated, not rejected', async () => {
+  const [s] = await storedShips([ship({ title: 'x'.repeat(400) })]);
+  assert.equal(s.title.length, 200);
+});
+
+console.log('\n2. a ship link may only point back into the reporting instance:');
+
+for (const [label, url] of [
+  ['another site', 'https://evil.example/phish'],
+  ['a javascript: scheme', 'javascript:alert(1)'],
+  ['embedded credentials', 'https://user:pw@p07.example/x'],
+  ['a lookalike suffix', 'https://notp07.example/x'],
+  ['a non-string', 12345],
+  // The mirror of the subdomain rule is NOT offered: on a shared multi-tenant
+  // apex it would let a client registered at foo.github.io publish links on bare
+  // github.io. The bound is downward only.
+  ['an ancestor of the registered origin', 'https://example/x'],
+]) {
+  await t(`${label} stores no link (the work still publishes)`, async () => {
+    const [s] = await storedShips([ship({ url })]);
+    assert.equal(s.url, null);
+    assert.equal(s.id, 1002803);
+  });
+}
+
+await t('the client\'s own origin and a subdomain of it are kept', async () => {
+  const same = await storedShips([ship({ url: `${ORIGIN}/builders#/task/1` })]);
+  assert.equal(same[0].url, `${ORIGIN}/builders#/task/1`);
+  const sub = await storedShips([ship({ url: 'https://builders.p07.example/builders#/task/1' })]);
+  assert.equal(sub[0].url, 'https://builders.p07.example/builders#/task/1', 'an instance hall on a subdomain of its registered origin');
+  // …but never UP. A client registered on a subdomain may not publish links on
+  // the apex above it — that apex may be shared (the github.io shape).
+  const up = await storedShips([ship({ url: 'https://p07.example/x' })], 'https://builders.p07.example');
+  assert.equal(up[0].url, null, 'the bound is downward only');
+});
+
+console.log('\n3. POST /sso/activity/rollup accepts the field and hands the hub the trusted origin:');
+
+await t('the route passes recent_ships through and takes the origin from the CLIENT row', async () => {
+  const SECRET = 'p07-secret';
+  const rollupPool = mockPool((sql) => {
+    if (/FROM platform_identity_sso_clients/.test(sql)) {
+      return { rows: [{ client_id: 'c1', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: ORIGIN }] };
+    }
+    if (/FROM platform_identity_project_memberships/.test(sql)) {
+      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member' }] };
+    }
+    return { rows: [{ id: 1 }] };
+  });
+  const helpers = require('../src/bongos/routes/_helpers.js');
+  const moduleApiPath = require.resolve('../src/module-api.js');
+  const realApi = require('../src/module-api.js');
+  require.cache[moduleApiPath] = {
+    id: moduleApiPath, filename: moduleApiPath, loaded: true,
+    exports: {
+      pool: rollupPool,
+      validateOrRespond: helpers.validateOrRespond,
+      resolveSession: async () => null,
+      logger: () => ({ info() {}, warn() {}, error() {} }),
+      LIVE_RANK_LADDER: realApi.LIVE_RANK_LADDER,
+      corsPublicGet: () => (_q, _s, next) => next(),
+      on: () => () => {},
+      hasProvider: () => false,
+      registerProvider: () => {},
+    },
+  };
+  const ssoRoutes = require('../modules/platform-identity/routes/sso.js');
+  const router = ssoRoutes();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/sso/activity/rollup');
+  assert.ok(layer, 'the rollup route is mounted');
+
+  const res = { body: null, failure: null };
+  res.json = (b) => { res.body = b; return res; };
+  res.fail = (code, ...rest) => { res.failure = { code, rest }; return res; };
+  const req = {
+    body: {
+      client_id: 'c1', client_secret: SECRET, github_id: 42,
+      credits: 10, tasks_shipped: 2, karma: 1, rank: 'metic', disciplines: ['engineer'],
+      // Five, so the HUB's cap is what decides — a sender that ignores its own
+      // cap must not widen the section.
+      recent_ships: [1, 2, 3, 4, 5].map((n) => ship({ id: n, title: `work ${n}`, url: `${ORIGIN}/builders#/task/${n}` })),
+    },
+  };
+  await layer.route.stack[0].handle(req, res, () => {});
+  assert.equal(res.failure, null, `no failure (validateOrRespond runs in STRICT mode, so an unknown recent_ships would 400 here): ${JSON.stringify(res.failure)}`);
+  assert.deepEqual(res.body, { ok: true });
+
+  const insert = rollupPool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  const stored = JSON.parse(insert.params[7]);
+  assert.equal(stored.length, 3, 'the hub capped what the sender did not');
+  assert.equal(stored[0].url, `${ORIGIN}/builders#/task/1`, 'links pass the origin bound taken from the authenticated client row');
+});
+
+console.log('\n4. a work title surfaces only where the project name may:');
+
+await t('getRollupForBuilder attaches recent_ships to publicly-named projects only', async () => {
+  const pool = mockPool((sql) => {
+    if (/WITH agg AS/.test(sql)) {
+      return { rows: [{ projects: 2, credits: 5, works_shipped: 2, karma: 0, last_active: null, disciplines: ['engineer'] }] };
+    }
+    return {
+      rows: [
+        { name: 'Public Project', origin: ORIGIN, rank_held: 'metic', is_public: true, recent_ships: [ship()] },
+        { name: 'SECRET-PROJECT', origin: 'https://priv.example', rank_held: 'thetes', is_public: false, recent_ships: [ship({ id: 5, title: 'SECRET-WORK' })] },
+      ],
+    };
+  });
+  const out = await pi.getRollupForBuilder(42, { pool });
+  assert.equal(out.projects.length, 1);
+  assert.equal(out.more_projects, 1);
+  assert.deepEqual(out.projects[0].recent_ships, [ship()]);
+  const serialized = JSON.stringify(out);
+  assert.ok(!serialized.includes('SECRET-WORK'), 'a non-public project\'s work titles never leave the hub');
+  assert.ok(!serialized.includes('SECRET-PROJECT'), 'nor does its name (the pre-existing rule this one follows)');
+});
+
+await t('a project that reported no works reads as an empty list, not null', async () => {
+  const pool = mockPool((sql) => {
+    if (/WITH agg AS/.test(sql)) return { rows: [{ projects: 1, credits: 0, works_shipped: 0, karma: 0, last_active: null, disciplines: null }] };
+    return { rows: [{ name: 'P', origin: ORIGIN, rank_held: null, is_public: true, recent_ships: null }] };
+  });
+  const out = await pi.getRollupForBuilder(42, { pool });
+  assert.deepEqual(out.projects[0].recent_ships, []);
+});
+
+await t('hide_stats suppresses the whole cross-project read, recent_ships included', async () => {
+  for (const acct of [
+    { profile_state: 'active', hide_stats: true },
+    { profile_state: 'provisional', hide_stats: false },
+  ]) {
+    const pool = mockPool(() => ({ rows: [acct] }));
+    assert.equal(await pi.getPublicProfileExtras(42, { pool }), null, JSON.stringify(acct));
+    assert.ok(!pool.find(/WITH agg AS/), 'the rollup query never even runs — no partial numbers, no leak by subtraction');
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The core halves. Everything below pins require.cache BEFORE the core files
+// load, so the REAL handlers run against spies.
+// ---------------------------------------------------------------------------
+
+const admissionPath = require.resolve('../src/bongos/auth-admission.js');
+const realAdmission = require('../src/bongos/auth-admission.js');
+const spy = { shipPushes: [], order: [] };
+// A mutable exports object: section 6 re-points the two reporters at spies
+// after section 5 has used the real ones.
+const admissionExports = {
+  ...realAdmission,
+  reportActivityRollupForShippedTask: async (task) => { spy.shipPushes.push(task); },
+};
+require.cache[admissionPath] = {
+  id: admissionPath, filename: admissionPath, loaded: true, exports: admissionExports,
+};
+
+console.log('\n5. the ship-time push — hub numbers stop being as stale as the last sign-in:');
+
+await t('a task reaching shipped fires the rollup push exactly once', async () => {
+  const seams = require('../src/module-seams.js');
+  const buildAuthRouter = require('../src/bongos/routes/auth.js');
+  buildAuthRouter();
+  spy.shipPushes.length = 0;
+  const invoked = await seams.emitAsync('task.shipped', { id: 1002803, shipped_by: 7 });
+  assert.ok(invoked >= 1, 'the core auth router registered a task.shipped listener');
+  assert.equal(spy.shipPushes.length, 1, 'the ship push fired once');
+  assert.equal(spy.shipPushes[0].shipped_by, 7);
+});
+
+await t('re-instantiating the router does not stack a second listener', async () => {
+  const seams = require('../src/module-seams.js');
+  const buildAuthRouter = require('../src/bongos/routes/auth.js');
+  buildAuthRouter();
+  buildAuthRouter();
+  spy.shipPushes.length = 0;
+  await seams.emitAsync('task.shipped', { id: 1, shipped_by: 7 });
+  assert.equal(spy.shipPushes.length, 1, 'off→on guarded — a ship is pushed once, not once per router build');
+});
+
+console.log('\n6. the check-in is AWAITED before the rollup (ADR 0171 D7 sequencing):');
+
+await t('a federated sign-in does not report activity until its membership check-in has resolved', async () => {
+  // Re-point the reporters at ordering spies, then load a FRESH auth-idp so it
+  // destructures these rather than the real ones section 5 left in place.
+  let releaseCheckIn;
+  const checkInLanded = new Promise((r) => { releaseCheckIn = r; });
+  admissionExports.reportMembershipCheckIn = async () => {
+    spy.order.push('check-in:start');
+    await checkInLanded;
+    spy.order.push('check-in:done');
+  };
+  admissionExports.reportActivityRollup = async () => { spy.order.push('rollup'); };
+  admissionExports.openEnrollmentEnabled = () => true;
+  admissionExports.maybeSeatFirstAdmin = async (b) => b;
+  admissionExports.safeSyncRankRole = async () => {};
+
+  const pin = (rel, exports) => {
+    const p = require.resolve(rel);
+    require.cache[p] = { id: p, filename: p, loaded: true, exports };
+    return p;
+  };
+  pin('../src/bongos/db-kernel.js', {
+    RANKS: ['xenos', 'thetes', 'metic', 'archon'],
+    upsertBuilder: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    getBuilderByGithubId: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    getBuilderById: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    createSession: async () => ({}),
+    lookupSession: async () => null,
+    seatFirstAdminIfUnclaimed: async () => null,
+    hasInvitedAccessRequest: async () => true,
+    accessStateByLogin: async () => ({}),
+  });
+  pin('../src/bongos/pool.js', { pool: { query: async () => ({ rows: [] }) } });
+  pin('../src/bongos/auth-config.js', {
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'c1', clientSecret: 's' }),
+  });
+  pin('../src/bongos/auth-github.js', { newSessionToken: () => 'tok' });
+  delete require.cache[require.resolve('../src/bongos/auth-idp.js')];
+
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({
+    ok: true,
+    json: async () => ({ github_id: 42, github_login: 'p07', display_name: 'P07', avatar_url: null }),
+    text: async () => '',
+  });
+  try {
+    const idp = require('../src/bongos/auth-idp.js');
+    await idp.completeIdpFlow({ code: 'x', redirectUri: 'https://p07.example/cb' });
+    // The sign-in has RETURNED and the check-in is still in flight. If the two
+    // pushes were fired side by side, the rollup would already be in `order`
+    // here — and on a first sign-in it would reach a hub with no membership row.
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(spy.order, ['check-in:start'], `rollup must not have fired yet, saw ${JSON.stringify(spy.order)}`);
+    releaseCheckIn();
+    await new Promise((r) => setImmediate(r));
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(spy.order, ['check-in:start', 'check-in:done', 'rollup'], 'the rollup runs only after the check-in resolved');
+  } finally {
+    globalThis.fetch = realFetch;
+  }
+});
+
+await t('the CLI device exchange chains the same way (both federated sign-ins, one rule)', async () => {
+  // completeDeviceExchange needs a hub-signed Ed25519 assertion to reach its
+  // chain, which is a different test's subject — so this half is pinned at the
+  // source, normalised to LF first (this checkout reads back CRLF, and an
+  // anchored multi-line match silently finds nothing otherwise).
+  const fs = require('node:fs');
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth-idp.js'), 'utf8').replace(/\r\n/g, '\n');
+  const chains = src.match(/reportMembershipCheckIn\([\s\S]{0,400}?\n\s*\.then\(\(\) => reportActivityRollup\(/g) || [];
+  assert.equal(chains.length, 2, 'both the web flow and the device exchange chain the rollup after the check-in');
+});
+
+console.log(`\nhub_recent_ships.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);