@bongos/core 1.19.408 → 1.19.409

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.408",
-  "core_contract": "1.19.408",
-  "source_commit": "71369601472c7ae483a6ea2424d88b78bcb65cbb",
+  "core_version": "1.19.409",
+  "core_contract": "1.19.409",
+  "source_commit": "752e2e352e3d3819e05eabef5b09b20aeaeeb90b",
   "source_ref": "HEAD",
-  "built_at": "2026-08-28T22:26:12.724Z",
+  "built_at": "2026-08-28T22:31:01.892Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 352,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1664,
+    "functional_verbatim": 1666,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2039,
-  "tree_sha256": "0ea6ef5d0535e0aa9795fcebfdc4a776e146222d66075daed31f9eee36c3b9a9",
+  "file_count": 2041,
+  "tree_sha256": "4b1590fda72bea96890647cd43a22d83b6b988b39e9204eb1d0a29829611f473",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -372,7 +372,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "f695402b7bd5f2db12f1c2415f452a575312d41d7a0c7ea57750c50573941222"
+      "sha256": "edef54ed26867eacdde4fd852efdca9c5c97dcc046e68ffbcf205a037697155b"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1522,12 +1522,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "7c92e8f6e3c000dfd7620542606973cf25ce022ef9e5bfe124a7ff4912bc91d6"
+      "sha256": "6eb3ca8810c05c7ba1c8756b1694a45872b12ae873bc7ab007ab777405944cae"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "2fde31533808aeee53406bbbf9ee5c5bbf77947b6b2619eecf2b5f7608e30b6b"
+      "sha256": "72e10f3ed2ed7c3dca02d80aa6477752af7168548c53ed969aec7ec4a0467a81"
     },
     {
       "path": "docs/architecture.md",
@@ -4759,6 +4759,11 @@
       "mode": "0000644",
       "sha256": "48941621e5230a23785b832fa840e0c7f7b47f3dd1b01f7d254157482c4e3e6a"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_012_recent_ships.sql",
+      "mode": "0000644",
+      "sha256": "297c6a01f7de133dd9b97daa082ed64465c32349d90ef6ddc6cbfacfac034da3"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -4767,7 +4772,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "65edb9332915171309305bf610bdc2834a57913a1776cb5a9566a082115f82cd"
+      "sha256": "ca7996877566727335979bf55fc6157ae130be9c54cdbf0210d3b906a3ac5f53"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -4807,12 +4812,12 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "68f2b69706f30de35c94749e8733a00da2737ecad37e93ea4965c7a45a6d7e5b"
+      "sha256": "70e4d1d35964603ac40b459b9cb40a480bb9ec6aeb4cb6c0e93368fcc514f2dd"
     },
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "aeb251b84ee3c5cc789a540280bd8ecef0358d9384aac7e833dbe544b8008a54"
+      "sha256": "5f1f05910d01d4a83e2134149311a9333aef8d93561cb37bcee1566fb2cfc1c7"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -5347,12 +5352,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "63b7f6feace1305778d1fa21b32d2d33ae1ee88aebf183bedaf9f9679534ea0f"
+      "sha256": "86dacd8d1318040e57b9cdbaba495abd1bcfdac7cf834396d2f3e8d020eddfcc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b1a7bc13880d04b8cd9826e67923adf4c17401981de557fdbb65d514b5d80610"
+      "sha256": "ab3f6f59ed390c9463e9e3242542791067e7c881ef46cef351030b76a561f24a"
     },
     {
       "path": "public-docs/index.html",
@@ -7092,7 +7097,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "9978b10e2e675b6f7c1211dd74c8cf302395b2f47062eba5df376203ee77d341"
+      "sha256": "46dc4adc21f138b4d9fdfe06c85f71d591a81357050d48d72b6272ba86a09d3b"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -7257,7 +7262,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "d4dc490ccf82f56d66f4d17e64f514632171480f22175bfa682dea9eb0e2e44a"
+      "sha256": "ba9fbc7fb9d210d850578b81dd54bbbe777634988107e8d5791b37acd0fffa0d"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -7367,7 +7372,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "83a93bb955f0dfbd5c509b0d3285d9bbec9eb582217778564aa3e70805fc9316"
+      "sha256": "c29f8b33a65a1a7ecc1fbe105df9e97c7960be6c785546f32205f1fd612d14a2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8749,6 +8754,11 @@
       "mode": "0000644",
       "sha256": "ea992d1ab2ddedc27aaa5348a397356bef91a4c1ad9b295eb1a0ed1c4fc707e9"
     },
+    {
+      "path": "tests/hub_recent_ships.mjs",
+      "mode": "0000644",
+      "sha256": "9eff8102b1fce3f98ae2cc0f0fb7a640c3e13fba0d89814c2da3565445487f9e"
+    },
     {
       "path": "tests/idea_capture_grades.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -324,7 +324,7 @@ export interface PostSecurityScansResponse { ok: boolean; scan: unknown }
 export interface PostSessionOptimizeRequest { mode?: string; time_budget_min?: unknown; max_parallel?: unknown }
 export interface PostSessionsRequest { session_id: string; task_ids?: number[]; total_tokens?: number; duration_seconds?: number; started_at?: string; ended_at?: string; detail?: unknown[]; metrics?: Record<string, unknown>; model_usage?: Record<string, unknown> }
 export interface PostSessionsResponse { skipped?: boolean; reason?: unknown; session?: unknown; token_reward?: unknown }
-export interface PostSsoActivityRollupRequest { client_id: string; client_secret: string; github_id: StringifiableId; credits?: number; tasks_shipped?: number; karma?: number; rank?: string; disciplines?: unknown }
+export interface PostSsoActivityRollupRequest { client_id: string; client_secret: string; github_id: StringifiableId; credits?: number; tasks_shipped?: number; karma?: number; rank?: string; disciplines?: unknown; recent_ships?: unknown }
 export interface PostSsoActivityRollupResponse { ok: boolean }
 export interface PostSsoDevicePollRequest { device_code: string }
 export interface PostSsoDeviceStartRequest { origin: string }

package/docs/api/openapi.json

@@ -19660,7 +19660,8 @@
             "type": "string",
             "maxLength": 32
           },
-          "disciplines": {}
+          "disciplines": {},
+          "recent_ships": {}
         },
         "required": [
           "client_id",

package/docs/api-reference.md

@@ -515,7 +515,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| POST | `/api/bongos/sso/activity/rollup` | `public` | `client_id`, `client_secret`, `github_id`, `credits`, `tasks_shipped`, `karma`, `rank`, `disciplines` | POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). |
+| POST | `/api/bongos/sso/activity/rollup` | `public` | `client_id`, `client_secret`, `github_id`, `credits`, `tasks_shipped`, `karma`, `rank`, `disciplines`, `recent_ships` | POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). |
 | GET | `/api/bongos/sso/authorize` | `public` | — | GET /sso/authorize?client_id=&redirect_uri=&state= — the browser authorize leg. |
 | POST | `/api/bongos/sso/device/poll` | `public` | `device_code` | POST /sso/device/poll — poll the hub device flow. |
 | POST | `/api/bongos/sso/device/start` | `public` | `origin` | POST /sso/device/start — begin CLI federation. |

package/modules/platform-identity/migrations/platform_identity_012_recent_ships.sql

@@ -0,0 +1,40 @@
+-- platform_identity_012_recent_ships.sql — the hub's "recent works" store
+-- (BV1 goal 1000045 P07, task 1002803; profile-page spec "The page spec" row 4 +
+-- ADR 0171 D7).
+--
+-- WHY A COLUMN AND NOT A TABLE. The hub has no `tasks` table for other projects,
+-- so a builder's last few shipped works can only reach it as data the project
+-- PUSHES. The existing pull pattern (modules/platform-identity/project-stats.js)
+-- fans out to each project's public API — fine for a builder count on a catalog
+-- page, wrong once per profile view, and useless for a CLI-only project that
+-- serves no public API at all. The push already exists: POST /sso/activity/rollup
+-- upserts exactly one row per (client_id, github_id), refreshed on every federated
+-- sign-in AND (task 1002803) on every ship. A capped list of at most 3 works
+-- belongs ON that row: it is written and read as one unit, it is never queried
+-- across rows, and a child table would add a join and a delete-orphan path to
+-- store nine values.
+--
+-- WHAT IS IN IT. At most 3 objects, each `{ id, title, shipped_at, url }` —
+-- sanitized in upsertActivity BEFORE the write (the rank/disciplines precedent,
+-- ADR 0171 D7: a reporting instance is third-party self-report and is never
+-- trusted to respect its own cap). `url` may only point back into the reporting
+-- client's own registered origin, so a ship link on a public portfolio can never
+-- be turned into a phishing hop. `'[]'` — never NULL — so every reader gets a
+-- list without a coalesce.
+--
+-- DESCRIPTIVE ANALYTICS ONLY (ADR 0016 / 0141): a ship link is a label, never an
+-- access grant. Reading it confers nothing on the instance it points at.
+--
+-- Additive + `platform_identity_`-namespaced (ADR 0083 §5). Forward-safe: ADD
+-- COLUMN with a DEFAULT, so the previous code release still runs against this
+-- schema (it simply never writes the column). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_builder_project_activity
+  ADD COLUMN IF NOT EXISTS recent_ships jsonb NOT NULL DEFAULT '[]'::jsonb;
+
+COMMENT ON COLUMN platform_identity_builder_project_activity.recent_ships IS
+  'Up to 3 recently shipped works this project reported for this builder, pushed on POST /sso/activity/rollup (task 1002803): [{id, title, shipped_at, url}]. Third-party self-report — capped, type-checked and same-origin-checked in upsertActivity, never trusted as written. Surfaced only on a project the catalog names publicly (getRollupForBuilder), so a non-public project''s work titles stay counted-but-unnamed like its name does.';
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -532,25 +532,96 @@ async function setClientStatus(clientId, status, { pool = defaultPool } = {}) {
 const MAX_ROLLUP_DISCIPLINES = 8;
 const MAX_DISCIPLINE_LENGTH = 32;
 
+// "Recent works" caps (task 1002803). The hub has no tasks table for other
+// projects, so a builder's last few shipped works arrive on the rollup push
+// instead of being fanned out for at read time. THREE PER PROJECT, hard-capped
+// HERE and not only at the sender: the cap is a property of what the hub will
+// store, and a reporting instance is third-party self-report that may be old,
+// buggy or hostile.
+const MAX_RECENT_SHIPS = 3;
+const MAX_SHIP_TITLE_LENGTH = 200;
+const MAX_SHIP_URL_LENGTH = 500;
+// How far into a pushed array the hub will even LOOK. Validating first and
+// capping second is what stops a few malformed entries from crowding the good
+// ones out of the three slots; bounding the scan is what stops an unbounded
+// array from buying unbounded work with one request.
+const MAX_RECENT_SHIPS_SCANNED = 20;
+
+// May this ship link be stored? A ship link is the ONLY free-text URL on a public
+// builder portfolio, which makes it the one place a client-secret holder could
+// plant a phishing hop under someone else's name. So it must point AT OR BELOW
+// the instance that reported it: the client's own REGISTERED origin host, or a
+// subdomain of it (an instance's hall may live at builders.<domain> while its
+// registered origin is <domain>). Anything else — another site, a non-http
+// scheme, embedded credentials — stores no link rather than a wrong one.
+//
+// DOWNWARD ONLY, deliberately. The mirror rule ("the link host is an ANCESTOR of
+// the registered origin") looks symmetric and is not: on a shared multi-tenant
+// apex it would let a client registered at foo.github.io publish links on bare
+// github.io, which it does not control. Nothing needs the upward direction — a
+// registered origin is the instance's own public origin — so it is not offered.
+function shipUrlWithinClientOrigin(raw, clientOrigin) {
+  if (typeof raw !== 'string' || !raw || raw.length > MAX_SHIP_URL_LENGTH) return null;
+  let u, o;
+  try { u = new URL(raw); o = new URL(String(clientOrigin || '')); } catch { return null; }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;
+  if (u.username || u.password) return null;
+  const host = u.hostname.toLowerCase(), registered = o.hostname.toLowerCase();
+  if (host !== registered && !host.endsWith(`.${registered}`)) return null;
+  return raw;
+}
+
+// Shape and bound the pushed recent_ships[] before it is stored (the
+// upsertActivity rank/disciplines precedent, ADR 0171 D7 — validation lives next
+// to the data where no route can forget it). Returns AT MOST MAX_RECENT_SHIPS
+// entries of exactly `{ id, title, shipped_at, url }`; a row with no usable id or
+// title is dropped entirely rather than stored half-empty, and a bad date or an
+// off-origin link becomes null on an otherwise good row. Always an array, never
+// null — every reader gets a list without a coalesce.
+function sanitizeRecentShips(raw, clientOrigin) {
+  return (Array.isArray(raw) ? raw : [])
+    .slice(0, MAX_RECENT_SHIPS_SCANNED)
+    .filter((s) => s && typeof s === 'object' && !Array.isArray(s))
+    .map((s) => {
+      const id = Number(s.id);
+      const at = typeof s.shipped_at === 'string' ? Date.parse(s.shipped_at) : NaN;
+      return {
+        id: Number.isSafeInteger(id) && id > 0 ? id : null,
+        title: typeof s.title === 'string' && s.title.trim() ? s.title.slice(0, MAX_SHIP_TITLE_LENGTH) : null,
+        shipped_at: Number.isFinite(at) ? new Date(at).toISOString() : null,
+        url: shipUrlWithinClientOrigin(s.url, clientOrigin),
+      };
+    })
+    .filter((s) => s.id !== null && s.title !== null)
+    .slice(0, MAX_RECENT_SHIPS);
+}
+
 // Upsert one project's rollup for one builder (keyed by client_id + github_id).
 // Descriptive analytics — never authority. Refreshes last_active on each report.
-async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [] }, { pool = defaultPool } = {}) {
+// `clientOrigin` is the AUTHENTICATED client's registered origin (never a
+// caller-named one) and exists only to bound the ship links — see
+// shipUrlWithinClientOrigin.
+async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [], recentShips = [], clientOrigin = null }, { pool = defaultPool } = {}) {
   // api.LIVE_RANK_LADDER is a published doorway export (src/module-api.js, a
   // lazy getter over db-kernel's canonical four-rank ladder).
   const safeRank = api.LIVE_RANK_LADDER.includes(rank) ? rank : null;
   const disc = (Array.isArray(disciplines) ? disciplines : [])
     .filter((d) => typeof d === 'string' && d.length > 0 && d.length <= MAX_DISCIPLINE_LENGTH)
     .slice(0, MAX_ROLLUP_DISCIPLINES);
+  const ships = sanitizeRecentShips(recentShips, clientOrigin);
   const { rows } = await pool.query(
     `INSERT INTO platform_identity_builder_project_activity
-       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active, updated_at)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, now(), now())
+       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, recent_ships, last_active, updated_at)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, now(), now())
      ON CONFLICT (client_id, github_id) DO UPDATE SET
        credits = EXCLUDED.credits, tasks_shipped = EXCLUDED.tasks_shipped, karma = EXCLUDED.karma,
        rank_held = EXCLUDED.rank_held, disciplines = EXCLUDED.disciplines,
+       recent_ships = EXCLUDED.recent_ships,
        last_active = now(), updated_at = now()
      RETURNING id, client_id, github_id`,
-    [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc],
+    // jsonb is bound as a JSON STRING: node-postgres serializes a JS array as a
+    // Postgres ARRAY literal, which the jsonb column would reject.
+    [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships)],
   );
   return rows[0];
 }
@@ -653,7 +724,7 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
   );
   const agg = aggRows[0];
   const { rows: projRows } = await pool.query(
-    `SELECT p.name, p.origin, a.rank_held,
+    `SELECT p.name, p.origin, a.rank_held, a.recent_ships,
             (p.id IS NOT NULL AND p.featured AND p.status = 'active') AS is_public
        FROM platform_identity_builder_project_activity a
        LEFT JOIN platform_identity_sso_clients c ON c.client_id = a.client_id
@@ -662,9 +733,19 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
       ORDER BY a.last_active DESC`,
     [githubId],
   );
+  // recent_ships rides the project row it belongs to (task 1002803) — which is
+  // also what keeps it honest: a work title is at least as identifying as the
+  // project name it came from, so it may only appear where the name already
+  // may. A non-public project stays counted in more_projects and its work
+  // titles never leave the hub, exactly as its name doesn't.
   const named = projRows
     .filter((r) => r.is_public)
-    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held }));
+    .map((r) => ({
+      name: r.name,
+      origin: r.origin,
+      rank_held: r.rank_held,
+      recent_ships: Array.isArray(r.recent_ships) ? r.recent_ships : [],
+    }));
   return {
     totals: {
       projects: agg.projects,

package/modules/platform-identity/routes/sso.js

@@ -426,6 +426,11 @@ module.exports = function ssoRoutes() {
       karma: { type: 'number' },
       rank: { type: 'string', maxLength: 32 },
       disciplines: {},
+      // "Recent works" (task 1002803): up to 3 of this builder's latest shipped
+      // works on THIS project — [{ id, title, shipped_at, url }]. Left untyped
+      // here, like disciplines: the shape is checked and hard-capped in
+      // upsertActivity, next to the data, so no route can forget it.
+      recent_ships: {},
     })) return;
     const b = req.body || {};
     try {
@@ -456,6 +461,11 @@ module.exports = function ssoRoutes() {
         karma: b.karma,
         rank: b.rank || null,
         disciplines: Array.isArray(b.disciplines) ? b.disciplines : [],
+        recentShips: b.recent_ships,
+        // The AUTHENTICATED client's registered origin — the bound every pushed
+        // ship link must fall inside (task 1002803). Taken from the client row,
+        // never from the body, for the same reason client_id is.
+        clientOrigin: client.origin,
       }, { pool });
       res.json({ ok: true });
     } catch (err) {

package/modules/platform-identity/tests/platform-identity.mjs

@@ -494,7 +494,10 @@ await ta('upsertActivity upserts per (client_id, github_id) with the talent snap
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_builder_project_activity/);
   assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE/);
-  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer']]);
+  // recent_ships (task 1002803) rides the same row as a jsonb STRING param —
+  // an empty list when the sender reported none, never NULL. Its own cap,
+  // shape and link bound are covered by tests/hub_recent_ships.mjs.
+  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]']);
 });
 
 await ta('upsertActivity sanitizes third-party self-report (ADR 0171 D7): off-ladder rank → null, disciplines validated + capped', async () => {
@@ -597,7 +600,9 @@ await ta('getRollupForBuilder aggregates un-fanned + names only publicly-catalog
   assert.deepEqual(out.totals, { projects: 2, credits: 150, works_shipped: 7, karma: 4 });
   assert.deepEqual(out.disciplines, ['engineer', 'ui']);
   assert.equal(out.projects.length, 1, 'only the public catalog row is named');
-  assert.deepEqual(out.projects[0], { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic' });
+  // recent_ships rides the project row it belongs to (task 1002803), so a work
+  // title can only surface where the project name already may.
+  assert.deepEqual(out.projects[0], { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic', recent_ships: [] });
   assert.equal(out.more_projects, 1, 'the non-public project is counted, never named');
   // The whitelist holds structurally: client_id never appears in the shape.
   assert.ok(!JSON.stringify(out).includes('client_id'), 'client_id must not cross the port');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.408",
+  "version": "1.19.409",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.408",
+      "version": "1.19.409",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.408",
+  "version": "1.19.409",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth-admission.js

@@ -77,36 +77,98 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
   }
 }
 
+// How many recently shipped works ride the rollup (task 1002803). The hub caps
+// this again on arrival — a sender is never trusted to respect its own cap — so
+// this constant is the polite half of the contract, not the enforcement.
+const ROLLUP_RECENT_SHIPS = 3;
+
+// A public deep link to one task in THIS instance's builders' hall, for the
+// "recent works" list on the builder's cross-project profile (task 1002803). It
+// is built from branding's STABLE public hall origin, never an env API base: the
+// link is stored on another host and rendered to strangers, so a local dev
+// override must never end up on a public portfolio. No origin (an instance that
+// never declared one) → no link, and the work still reports with its title.
+function hallTaskUrl(taskId) {
+  try {
+    const d = (branding().domains) || {};
+    const origin = String(d.buildersOrigin || d.publicOrigin || '').replace(/\/+$/, '');
+    return origin ? `${origin}/builders#/task/${taskId}` : null;
+  } catch {
+    return null;
+  }
+}
+
+// This builder's most recent shipped works, for the rollup's recent_ships[]
+// (task 1002803). The predicate is deliberately IDENTICAL to the lifecycle
+// module's recentShippedTasksByBuilder — the read behind this instance's own
+// unauthenticated GET /builders/:id/profile — so the push can never publish a
+// work the instance does not already publish itself. (Neither surface filters by
+// goal visibility today: ADR 0112's secrecy covers a private goal's OWN title,
+// not the titles of tasks inside it. Widening or narrowing that is a policy
+// change for the profile route, not something to fork here.) Kernel file, so it
+// reads `pool` directly rather than importing the lifecycle module (ADR 0091 §1).
+// Covered by core_228's idx_tasks_shipped_by_shipped_at — (shipped_by,
+// shipped_at DESC) partial on status='shipped', which is this predicate exactly.
+async function recentShipsForRollup(builderId) {
+  const { rows } = await pool.query(
+    `SELECT id, title, shipped_at
+       FROM tasks
+      WHERE shipped_by = $1
+        AND status = 'shipped'
+        AND title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
+      ORDER BY shipped_at DESC NULLS LAST
+      LIMIT $2`,
+    [builderId, ROLLUP_RECENT_SHIPS],
+  );
+  return rows.map((r) => ({
+    id: Number(r.id),
+    title: r.title,
+    shipped_at: r.shipped_at ? new Date(r.shipped_at).toISOString() : null,
+    url: hallTaskUrl(r.id),
+  }));
+}
+
 // Best-effort cross-project activity rollup to the hub (ADR 0141 §4): report this
-// builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines)
-// for the internal scouting directory. Fires on every federated sign-in ("on key
-// events"); true periodic reporting is a follow-up. Fully swallowed + no-op when
-// not federated — never fails a sign-in.
-async function reportActivityRollup({ builderId, githubId }) {
+// builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines,
+// and since task 1002803 their last few shipped works) for the cross-project
+// profile + scouting directory. Fires on every federated sign-in AND on every
+// ship (reportActivityRollupForShippedTask). Fully swallowed + no-op when not
+// federated — never fails a sign-in or a ship.
+//
+// `githubId` is OPTIONAL: a sign-in already holds the hub-supplied id, while the
+// ship path holds only a builder id, and the snapshot SELECT below can answer
+// both — so the ship path costs one query, not two. A non-numeric principal (a
+// `system:*` machine id) is dropped here rather than sent for the hub to reject:
+// it has no public profile and never will.
+async function reportActivityRollup({ builderId, githubId = null }) {
   const idp = loadIdpConfig();
   if (!idp) return;
   try {
     // Snapshot the builder's talent signals directly from the DB (auth.js is a
     // kernel file — it uses pool, never a non-kernel domain module like metrics.js).
     const b = await pool.query(
-      'SELECT total_credits, karma, rank, preferred_disciplines FROM builders WHERE id = $1',
+      'SELECT github_id, total_credits, karma, rank, preferred_disciplines FROM builders WHERE id = $1',
       [builderId],
     );
     if (!b.rows[0]) return;
-    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
     const row = b.rows[0];
+    const ghId = githubId ?? row.github_id;
+    if (!/^\d+$/.test(String(ghId ?? ''))) return;
+    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
+    const recentShips = await recentShipsForRollup(builderId);
     await fetch(`${idp.origin}/api/gds/sso/activity/rollup`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
         client_id: idp.clientId,
         client_secret: idp.clientSecret,
-        github_id: githubId,
+        github_id: ghId,
         credits: Number(row.total_credits) || 0,
         tasks_shipped: shipped.rows[0] ? shipped.rows[0].n : 0,
         karma: Number(row.karma) || 0,
         rank: row.rank || null,
         disciplines: Array.isArray(row.preferred_disciplines) ? row.preferred_disciplines : [],
+        recent_ships: recentShips,
       }),
     });
   } catch (err) {
@@ -114,6 +176,24 @@ async function reportActivityRollup({ builderId, githubId }) {
   }
 }
 
+// The SHIP-TIME rollup push (task 1002803, ADR 0171 amendment R01). Until now the
+// rollup fired only on a federated sign-in, so a builder who signs in once a month
+// had a cross-project profile up to a month stale — showing old credit and ship
+// counts with nothing on the page saying so. A ship is the event that CHANGES
+// those numbers, so it re-reports them; nothing else about the push differs.
+//
+// Wired as a `task.shipped` listener in src/bongos/routes/auth.js, so it runs
+// once per ship whichever path won the confirmed→shipped flip. Best-effort in the
+// same sense as the sign-in push: it resolves nothing the caller waits on, and a
+// hub outage can never fail a ship. The builder's github_id is resolved by the
+// rollup's own snapshot SELECT (which now returns it), so this adds no lookup of
+// its own — and a machine principal is dropped there, not sent to the hub.
+async function reportActivityRollupForShippedTask(task) {
+  const builderId = task && task.shipped_by;
+  if (!builderId) return;
+  await reportActivityRollup({ builderId });
+}
+
 // Admission posture (SR-19 / task #1000). BOTH enrollment paths — the web hall
 // sign-in (completeWebFlow) and the CLI device flow (pollDeviceFlow) — are
 // "invite-gated by default": a FIRST-TIME GitHub account is admitted only if an
@@ -329,6 +409,7 @@ module.exports = {
   membershipKind,
   openEnrollmentEnabled,
   reportActivityRollup,
+  reportActivityRollupForShippedTask,
   reportMembershipCheckIn,
   safeSyncRankRole,
   webAdmissionStatus,

package/src/bongos/routes/auth.js

@@ -30,6 +30,7 @@ const express = require('express');
 const crypto = require('node:crypto');
 
 const auth = require('../auth');
+const { reportActivityRollupForShippedTask } = require('../auth-admission.js');
 const db = require('../db');
 const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
@@ -376,7 +377,27 @@ const DISCORD_REDIRECT_URI = `${DISCORD_REDIRECT_ORIGIN}/api/gds/auth/discord/ca
 // sign-in started on a builders.* subdomain must still use the apex.
 const WEB_REDIRECT_ORIGIN = process.env.GDS_PUBLIC_ORIGIN || configuredOAuthOrigin();
 
+// The ship-time hub push (task 1002803, ADR 0171 amendment R01) lives here
+// because this file already owns the OTHER trigger: the federated sign-in flows
+// below are what fire the check-in + rollup today, and the reporter they call is
+// this router's own auth-admission sibling. `task.shipped` is an EVENT, not a
+// port — many listeners may react to a ship and none of them returns anything
+// (the discord/sessions listener precedent). off→on guarded so a test that
+// re-instantiates the router never stacks duplicate listeners.
+let _shipRollupListenerOff = null;
+function registerSeams() {
+  if (_shipRollupListenerOff) _shipRollupListenerOff();
+  // Fire-and-forget: reportActivityRollupForShippedTask swallows every error and
+  // no-ops on an unfederated instance, so the .catch is belt-and-braces against a
+  // future edit letting one escape into an unhandledRejection (the sign-in
+  // chain's reasoning, auth-idp.js).
+  _shipRollupListenerOff = seams.on('task.shipped', (task) => {
+    reportActivityRollupForShippedTask(task).catch(() => {});
+  });
+}
+
 module.exports = function buildAuthRouter() {
+  registerSeams();
   const router = express.Router();
 
   // /auth/device — CLI flow

package/src/module-api.js

@@ -1247,8 +1247,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.406 with no explicit bump. run 33214451873. (task 1002620)
 //   1.19.408 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.407 with no explicit bump. run 33216756796. (task 1002620)
+//   1.19.409 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.408 with no explicit bump. run 33217065997. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.408'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.409'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_recent_ships.mjs

@@ -0,0 +1,373 @@
+// tests/hub_recent_ships.mjs — task 1002803 (P07, goal 1000045 "public builder
+// profiles"; profile-page spec "The page spec" row 4 + ADR 0171 amendment R01).
+//
+// "Recent works" reaches the hub by PUSH, not pull: the hub has no `tasks` table
+// for other projects, so each project reports at most 3 of a builder's latest
+// shipped works on POST /sso/activity/rollup. Three deliverables, and each one
+// has a failure mode that a code read does not catch:
+//
+//   1. THE CAP IS THE HUB'S, NOT THE SENDER'S. A reporting instance is
+//      third-party self-report (ADR 0171 D7). If the cap lived only in the
+//      sender, an old, buggy or hostile client would set the size of a public
+//      profile section. So the cap, the field shape and the link bound are all
+//      asserted against what upsertActivity BINDS, not against what was passed.
+//   2. A SHIP LINK IS THE ONE FREE-TEXT URL ON A PUBLIC PORTFOLIO. It may only
+//      point back into the reporting client's own registered origin, or it is a
+//      phishing hop published under someone else's name.
+//   3. THE ORDERING IS THE WHOLE POINT OF THE SEQUENCING FIX. The hub refuses a
+//      rollup without a membership row, and the check-in is what creates it —
+//      so asserting "both fired" would still pass while a first sign-in raced
+//      itself. This asserts the rollup has NOT fired while the check-in is still
+//      in flight, which is the only shape that fails when the chain is broken.
+//
+// Plus the privacy edges the goal turns on: a work title is at least as
+// identifying as the project name it came from, so it may only surface where
+// that name may (a non-public project stays counted-but-unnamed, ships and all),
+// and hide_stats suppresses the whole cross-project read including recent_ships.
+//
+// DB-free: every DB function takes an injectable pool and is driven by a
+// recording fake (the modules/platform-identity/tests/platform-identity.mjs
+// idiom); the core halves pin require.cache (the tests/profile_route.mjs idiom)
+// so the REAL handlers and the REAL chain run against spies.
+//
+// Run:  node tests/hub_recent_ships.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+// A recording fake pool: answers by SQL shape and records every call, so a test
+// asserts the params the real query actually bound.
+function mockPool(answer = () => ({ rows: [] })) {
+  const calls = [];
+  return {
+    calls,
+    query: async (text, params = []) => {
+      calls.push({ text: String(text), params });
+      return answer(String(text), params) || { rows: [] };
+    },
+    find: (re) => calls.find((c) => re.test(c.text)),
+  };
+}
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const ORIGIN = 'https://p07.example';
+const ship = (over = {}) => ({
+  id: 1002803, title: 'A shipped work', shipped_at: '2026-08-28T10:00:00.000Z',
+  url: `${ORIGIN}/builders#/task/1002803`, ...over,
+});
+// What upsertActivity BOUND as recent_ships — the jsonb param, parsed back.
+async function storedShips(recentShips, clientOrigin = ORIGIN) {
+  const pool = mockPool(() => ({ rows: [{ id: 1 }] }));
+  await pi.upsertActivity({ clientId: 'c1', githubId: 42, recentShips, clientOrigin }, { pool });
+  const call = pool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  assert.ok(call, 'the activity upsert ran');
+  const raw = call.params[7];
+  assert.equal(typeof raw, 'string', 'jsonb is bound as a JSON string, not a JS array (pg would emit a Postgres array literal)');
+  return JSON.parse(raw);
+}
+
+console.log('\n1. the cap and the shape are the HUB\'s, not the sender\'s:');
+
+await t('a client reporting 5 works stores exactly 3', async () => {
+  const five = [1, 2, 3, 4, 5].map((n) => ship({ id: n, title: `work ${n}` }));
+  const out = await storedShips(five);
+  assert.equal(out.length, 3);
+  assert.deepEqual(out.map((s) => s.id), [1, 2, 3], 'the first three, in reported order');
+});
+
+await t('no works stores an empty list, never null and never a stray shape', async () => {
+  for (const nothing of [[], undefined, null, 'nope', { id: 1 }]) {
+    const out = await storedShips(nothing);
+    assert.deepEqual(out, [], `${JSON.stringify(nothing) ?? 'undefined'} → []`);
+  }
+});
+
+await t('a stored work carries exactly id + title + shipped_at + url', async () => {
+  const [s] = await storedShips([ship({ extra: 'DO-NOT-STORE' })]);
+  assert.deepEqual(Object.keys(s).sort(), ['id', 'shipped_at', 'title', 'url']);
+  assert.equal(s.id, 1002803);
+  assert.equal(s.title, 'A shipped work');
+  assert.equal(s.shipped_at, '2026-08-28T10:00:00.000Z');
+});
+
+await t('a work with no usable id or title is dropped, not stored half-empty', async () => {
+  const out = await storedShips([
+    ship({ id: 'not-a-number' }),
+    ship({ id: 7, title: '   ' }),
+    ship({ id: -1 }),
+    ship({ id: 9, title: 'kept' }),
+  ]);
+  assert.deepEqual(out.map((s) => s.id), [9]);
+});
+
+await t('an unparseable date nulls only the date, never the work', async () => {
+  const [s] = await storedShips([ship({ shipped_at: 'yesterday-ish' })]);
+  assert.equal(s.shipped_at, null);
+  assert.equal(s.id, 1002803, 'the work still publishes without a date');
+});
+
+await t('a title longer than the cap is truncated, not rejected', async () => {
+  const [s] = await storedShips([ship({ title: 'x'.repeat(400) })]);
+  assert.equal(s.title.length, 200);
+});
+
+console.log('\n2. a ship link may only point back into the reporting instance:');
+
+for (const [label, url] of [
+  ['another site', 'https://evil.example/phish'],
+  ['a javascript: scheme', 'javascript:alert(1)'],
+  ['embedded credentials', 'https://user:pw@p07.example/x'],
+  ['a lookalike suffix', 'https://notp07.example/x'],
+  ['a non-string', 12345],
+  // The mirror of the subdomain rule is NOT offered: on a shared multi-tenant
+  // apex it would let a client registered at foo.github.io publish links on bare
+  // github.io. The bound is downward only.
+  ['an ancestor of the registered origin', 'https://example/x'],
+]) {
+  await t(`${label} stores no link (the work still publishes)`, async () => {
+    const [s] = await storedShips([ship({ url })]);
+    assert.equal(s.url, null);
+    assert.equal(s.id, 1002803);
+  });
+}
+
+await t('the client\'s own origin and a subdomain of it are kept', async () => {
+  const same = await storedShips([ship({ url: `${ORIGIN}/builders#/task/1` })]);
+  assert.equal(same[0].url, `${ORIGIN}/builders#/task/1`);
+  const sub = await storedShips([ship({ url: 'https://builders.p07.example/builders#/task/1' })]);
+  assert.equal(sub[0].url, 'https://builders.p07.example/builders#/task/1', 'an instance hall on a subdomain of its registered origin');
+  // …but never UP. A client registered on a subdomain may not publish links on
+  // the apex above it — that apex may be shared (the github.io shape).
+  const up = await storedShips([ship({ url: 'https://p07.example/x' })], 'https://builders.p07.example');
+  assert.equal(up[0].url, null, 'the bound is downward only');
+});
+
+console.log('\n3. POST /sso/activity/rollup accepts the field and hands the hub the trusted origin:');
+
+await t('the route passes recent_ships through and takes the origin from the CLIENT row', async () => {
+  const SECRET = 'p07-secret';
+  const rollupPool = mockPool((sql) => {
+    if (/FROM platform_identity_sso_clients/.test(sql)) {
+      return { rows: [{ client_id: 'c1', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: ORIGIN }] };
+    }
+    if (/FROM platform_identity_project_memberships/.test(sql)) {
+      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member' }] };
+    }
+    return { rows: [{ id: 1 }] };
+  });
+  const helpers = require('../src/bongos/routes/_helpers.js');
+  const moduleApiPath = require.resolve('../src/module-api.js');
+  const realApi = require('../src/module-api.js');
+  require.cache[moduleApiPath] = {
+    id: moduleApiPath, filename: moduleApiPath, loaded: true,
+    exports: {
+      pool: rollupPool,
+      validateOrRespond: helpers.validateOrRespond,
+      resolveSession: async () => null,
+      logger: () => ({ info() {}, warn() {}, error() {} }),
+      LIVE_RANK_LADDER: realApi.LIVE_RANK_LADDER,
+      corsPublicGet: () => (_q, _s, next) => next(),
+      on: () => () => {},
+      hasProvider: () => false,
+      registerProvider: () => {},
+    },
+  };
+  const ssoRoutes = require('../modules/platform-identity/routes/sso.js');
+  const router = ssoRoutes();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/sso/activity/rollup');
+  assert.ok(layer, 'the rollup route is mounted');
+
+  const res = { body: null, failure: null };
+  res.json = (b) => { res.body = b; return res; };
+  res.fail = (code, ...rest) => { res.failure = { code, rest }; return res; };
+  const req = {
+    body: {
+      client_id: 'c1', client_secret: SECRET, github_id: 42,
+      credits: 10, tasks_shipped: 2, karma: 1, rank: 'metic', disciplines: ['engineer'],
+      // Five, so the HUB's cap is what decides — a sender that ignores its own
+      // cap must not widen the section.
+      recent_ships: [1, 2, 3, 4, 5].map((n) => ship({ id: n, title: `work ${n}`, url: `${ORIGIN}/builders#/task/${n}` })),
+    },
+  };
+  await layer.route.stack[0].handle(req, res, () => {});
+  assert.equal(res.failure, null, `no failure (validateOrRespond runs in STRICT mode, so an unknown recent_ships would 400 here): ${JSON.stringify(res.failure)}`);
+  assert.deepEqual(res.body, { ok: true });
+
+  const insert = rollupPool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  const stored = JSON.parse(insert.params[7]);
+  assert.equal(stored.length, 3, 'the hub capped what the sender did not');
+  assert.equal(stored[0].url, `${ORIGIN}/builders#/task/1`, 'links pass the origin bound taken from the authenticated client row');
+});
+
+console.log('\n4. a work title surfaces only where the project name may:');
+
+await t('getRollupForBuilder attaches recent_ships to publicly-named projects only', async () => {
+  const pool = mockPool((sql) => {
+    if (/WITH agg AS/.test(sql)) {
+      return { rows: [{ projects: 2, credits: 5, works_shipped: 2, karma: 0, last_active: null, disciplines: ['engineer'] }] };
+    }
+    return {
+      rows: [
+        { name: 'Public Project', origin: ORIGIN, rank_held: 'metic', is_public: true, recent_ships: [ship()] },
+        { name: 'SECRET-PROJECT', origin: 'https://priv.example', rank_held: 'thetes', is_public: false, recent_ships: [ship({ id: 5, title: 'SECRET-WORK' })] },
+      ],
+    };
+  });
+  const out = await pi.getRollupForBuilder(42, { pool });
+  assert.equal(out.projects.length, 1);
+  assert.equal(out.more_projects, 1);
+  assert.deepEqual(out.projects[0].recent_ships, [ship()]);
+  const serialized = JSON.stringify(out);
+  assert.ok(!serialized.includes('SECRET-WORK'), 'a non-public project\'s work titles never leave the hub');
+  assert.ok(!serialized.includes('SECRET-PROJECT'), 'nor does its name (the pre-existing rule this one follows)');
+});
+
+await t('a project that reported no works reads as an empty list, not null', async () => {
+  const pool = mockPool((sql) => {
+    if (/WITH agg AS/.test(sql)) return { rows: [{ projects: 1, credits: 0, works_shipped: 0, karma: 0, last_active: null, disciplines: null }] };
+    return { rows: [{ name: 'P', origin: ORIGIN, rank_held: null, is_public: true, recent_ships: null }] };
+  });
+  const out = await pi.getRollupForBuilder(42, { pool });
+  assert.deepEqual(out.projects[0].recent_ships, []);
+});
+
+await t('hide_stats suppresses the whole cross-project read, recent_ships included', async () => {
+  for (const acct of [
+    { profile_state: 'active', hide_stats: true },
+    { profile_state: 'provisional', hide_stats: false },
+  ]) {
+    const pool = mockPool(() => ({ rows: [acct] }));
+    assert.equal(await pi.getPublicProfileExtras(42, { pool }), null, JSON.stringify(acct));
+    assert.ok(!pool.find(/WITH agg AS/), 'the rollup query never even runs — no partial numbers, no leak by subtraction');
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The core halves. Everything below pins require.cache BEFORE the core files
+// load, so the REAL handlers run against spies.
+// ---------------------------------------------------------------------------
+
+const admissionPath = require.resolve('../src/bongos/auth-admission.js');
+const realAdmission = require('../src/bongos/auth-admission.js');
+const spy = { shipPushes: [], order: [] };
+// A mutable exports object: section 6 re-points the two reporters at spies
+// after section 5 has used the real ones.
+const admissionExports = {
+  ...realAdmission,
+  reportActivityRollupForShippedTask: async (task) => { spy.shipPushes.push(task); },
+};
+require.cache[admissionPath] = {
+  id: admissionPath, filename: admissionPath, loaded: true, exports: admissionExports,
+};
+
+console.log('\n5. the ship-time push — hub numbers stop being as stale as the last sign-in:');
+
+await t('a task reaching shipped fires the rollup push exactly once', async () => {
+  const seams = require('../src/module-seams.js');
+  const buildAuthRouter = require('../src/bongos/routes/auth.js');
+  buildAuthRouter();
+  spy.shipPushes.length = 0;
+  const invoked = await seams.emitAsync('task.shipped', { id: 1002803, shipped_by: 7 });
+  assert.ok(invoked >= 1, 'the core auth router registered a task.shipped listener');
+  assert.equal(spy.shipPushes.length, 1, 'the ship push fired once');
+  assert.equal(spy.shipPushes[0].shipped_by, 7);
+});
+
+await t('re-instantiating the router does not stack a second listener', async () => {
+  const seams = require('../src/module-seams.js');
+  const buildAuthRouter = require('../src/bongos/routes/auth.js');
+  buildAuthRouter();
+  buildAuthRouter();
+  spy.shipPushes.length = 0;
+  await seams.emitAsync('task.shipped', { id: 1, shipped_by: 7 });
+  assert.equal(spy.shipPushes.length, 1, 'off→on guarded — a ship is pushed once, not once per router build');
+});
+
+console.log('\n6. the check-in is AWAITED before the rollup (ADR 0171 D7 sequencing):');
+
+await t('a federated sign-in does not report activity until its membership check-in has resolved', async () => {
+  // Re-point the reporters at ordering spies, then load a FRESH auth-idp so it
+  // destructures these rather than the real ones section 5 left in place.
+  let releaseCheckIn;
+  const checkInLanded = new Promise((r) => { releaseCheckIn = r; });
+  admissionExports.reportMembershipCheckIn = async () => {
+    spy.order.push('check-in:start');
+    await checkInLanded;
+    spy.order.push('check-in:done');
+  };
+  admissionExports.reportActivityRollup = async () => { spy.order.push('rollup'); };
+  admissionExports.openEnrollmentEnabled = () => true;
+  admissionExports.maybeSeatFirstAdmin = async (b) => b;
+  admissionExports.safeSyncRankRole = async () => {};
+
+  const pin = (rel, exports) => {
+    const p = require.resolve(rel);
+    require.cache[p] = { id: p, filename: p, loaded: true, exports };
+    return p;
+  };
+  pin('../src/bongos/db-kernel.js', {
+    RANKS: ['xenos', 'thetes', 'metic', 'archon'],
+    upsertBuilder: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    getBuilderByGithubId: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    getBuilderById: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    createSession: async () => ({}),
+    lookupSession: async () => null,
+    seatFirstAdminIfUnclaimed: async () => null,
+    hasInvitedAccessRequest: async () => true,
+    accessStateByLogin: async () => ({}),
+  });
+  pin('../src/bongos/pool.js', { pool: { query: async () => ({ rows: [] }) } });
+  pin('../src/bongos/auth-config.js', {
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'c1', clientSecret: 's' }),
+  });
+  pin('../src/bongos/auth-github.js', { newSessionToken: () => 'tok' });
+  delete require.cache[require.resolve('../src/bongos/auth-idp.js')];
+
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({
+    ok: true,
+    json: async () => ({ github_id: 42, github_login: 'p07', display_name: 'P07', avatar_url: null }),
+    text: async () => '',
+  });
+  try {
+    const idp = require('../src/bongos/auth-idp.js');
+    await idp.completeIdpFlow({ code: 'x', redirectUri: 'https://p07.example/cb' });
+    // The sign-in has RETURNED and the check-in is still in flight. If the two
+    // pushes were fired side by side, the rollup would already be in `order`
+    // here — and on a first sign-in it would reach a hub with no membership row.
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(spy.order, ['check-in:start'], `rollup must not have fired yet, saw ${JSON.stringify(spy.order)}`);
+    releaseCheckIn();
+    await new Promise((r) => setImmediate(r));
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(spy.order, ['check-in:start', 'check-in:done', 'rollup'], 'the rollup runs only after the check-in resolved');
+  } finally {
+    globalThis.fetch = realFetch;
+  }
+});
+
+await t('the CLI device exchange chains the same way (both federated sign-ins, one rule)', async () => {
+  // completeDeviceExchange needs a hub-signed Ed25519 assertion to reach its
+  // chain, which is a different test's subject — so this half is pinned at the
+  // source, normalised to LF first (this checkout reads back CRLF, and an
+  // anchored multi-line match silently finds nothing otherwise).
+  const fs = require('node:fs');
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth-idp.js'), 'utf8').replace(/\r\n/g, '\n');
+  const chains = src.match(/reportMembershipCheckIn\([\s\S]{0,400}?\n\s*\.then\(\(\) => reportActivityRollup\(/g) || [];
+  assert.equal(chains.length, 2, 'both the web flow and the device exchange chain the rollup after the check-in');
+});
+
+console.log(`\nhub_recent_ships.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);