@bongos/core 1.19.408 → 1.19.410

package/modules/lifecycle/db.js

@@ -90,6 +90,7 @@ const {
   setGoalMembershipKind,
   setGoalStatus,
   setGoalSuccessor,
+  setGoalAcceptingRequests,
   setGoalVisibility,
   transferGoalOwnership,
 } = require('./db-goals.js');
@@ -227,8 +228,10 @@ module.exports = {
   rescopeTaskTouches,
   addGoalScopeModules,
   setGoalSuccessor,
-  // Private goals: visibility + the invite/join-request queue (task 1951 / ADR 0112).
+  // Private goals: visibility + the invite/join-request queue (task 1951 / ADR 0112),
+  // plus the D6 open-/closed-to-requests flag (task 1002971).
   setGoalVisibility,
+  setGoalAcceptingRequests,
   createMembershipRequest,
   getMembershipRequest,
   resolveMembershipRequest,

package/modules/lifecycle/goal-edits.js

@@ -289,8 +289,48 @@ function goalVisibilityHandler({ db, authorizeGoalManagement, validateOrRespond,
   };
 }
 
+// goalAcceptingRequestsHandler — PATCH /goals/:id/accepting-requests (task
+// 1002971, spec docs/specs/bongos-v1-privacy-and-invites.md D6): a goal's own
+// authority opens or closes the goal to new join-requests. Lives beside
+// goalVisibilityHandler for the same reason that one does — a write to the goal's
+// own row behind the IDENTICAL gate (authorizeGoalManagement) — and here rather
+// than in routes/goals.js because that file is over the fitness oversize
+// threshold and the ratchet is shrink-only.
+//
+// A SEPARATE route from PATCH /goals/:id/visibility on purpose: they are two
+// different statements a lead makes ("who may see the door" vs "is the door
+// taking knocks"), a lead flips the second far more often than the first, and
+// folding them would make one careless request able to un-privatise a goal. The
+// server does NOT refuse the write on a public goal — the flag is simply
+// meaningless there (self-join needs no request) and the refusal gate is what
+// reads visibility; that also means a goal can be pre-closed before going
+// private without a two-step dance.
+function goalAcceptingRequestsHandler({ db, authorizeGoalManagement, validateOrRespond, parseId }) {
+  return async function patchGoalAcceptingRequests(req, res) {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    if (validateOrRespond(req, res, { accepting_requests: { required: true, type: 'boolean' } })) return;
+    try {
+      const goal = await db.getGoal(id);
+      const actorMembership = goal
+        ? await db.getGoalMember({ goalId: id, builderId: req.builder.id })
+        : null;
+      const decision = authorizeGoalManagement({
+        goal, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
+      });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+      const updated = await db.setGoalAcceptingRequests({ goalId: id, acceptingRequests: req.body.accepting_requests });
+      return res.json({ ok: true, goal: updated });
+    } catch (err) {
+      proseLog().error({ err: err && err.message }, 'PATCH /goals/:id/accepting-requests failed');
+      return res.fail('accepting_requests_update_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
 module.exports = {
   criterionProseRefusal,
+  goalAcceptingRequestsHandler,
   logProseEdit,
   recordProseEdit,
   goalProseHandler,

package/modules/lifecycle/routes/goal-route-authz.js

@@ -236,9 +236,20 @@ function protectedScopeAdmissionBlock({ scopeProtected, actorRank, targetRank })
 // POST /goals/:id/requests (task 1952): a builder asks to join. A request only
 // makes sense where self-join is gated — a PUBLIC, NON-protected goal is open-join,
 // so a request there is refused with a "just join" hint. Ordering:
-// goal_not_found → goal_not_open → already_a_member → goal_is_open (public+unprotected).
+// goal_not_found → goal_not_open → already_a_member → goal_is_open (public+unprotected)
+// → not_accepting_requests (private + closed to applications).
 // isMember is the caller's own membership; scopeProtected is scopeIncludesProtected(goal).
 // PURE + exported (the authorizeGoalTaskCreate precedent).
+//
+// THE CLOSED-TO-REQUESTS ARM (task 1002971, spec D6): a private goal whose lead
+// set accepting_requests=false is not taking applications, so the ask is refused
+// with honest copy rather than queued where nobody will answer it. Deliberately
+// narrowed to visibility='private' — D6 calls the flag meaningless on a public
+// goal (self-join needs no request), so a PUBLIC protected-scope goal keeps
+// today's Archon-mediated request door open whatever the column says. And it is
+// checked HERE, not on the invite paths: closing applications is about
+// unsolicited inbound, and a lead reaching out to a named builder is the
+// deliberate act the flag exists to protect.
 function authorizeCreateJoinRequest({ goal, isMember, scopeProtected }) {
   if (!goal) return { ok: false, status: 404, body: { error: 'goal_not_found' } };
   if (goal.status !== 'open') {
@@ -258,6 +269,12 @@ function authorizeCreateJoinRequest({ goal, isMember, scopeProtected }) {
       message: 'This goal is open — just join it (POST /goals/:id/join); no request needed.',
     } };
   }
+  if (goal.visibility === 'private' && goal.accepting_requests === false) {
+    return { ok: false, status: 409, body: {
+      error: 'not_accepting_requests',
+      message: "This goal isn't taking requests right now.",
+    } };
+  }
   return { ok: true };
 }
 
@@ -374,6 +391,38 @@ function authorizeWithdrawJoinRequest({ request, goalId, actorId }) {
   return { ok: true };
 }
 
+// authorizeRescindInvitation — the gate for POST /goals/:id/invitations/:reqId/rescind
+// (task 1002971): an owner|manager|Archon takes back an invitation the goal SENT
+// but nobody has answered yet. This is the MISSING HALF of core_188's 'cancelled'
+// state, which that migration defined as "withdrawn/rescinded by the opener" —
+// only the requester-withdraw half (authorizeWithdrawJoinRequest) was ever built,
+// so a mis-addressed or regretted invite could only be un-sent by asking the
+// invitee to decline it. The opener is a MANAGER here, not the row's builder_id,
+// which is why the authority prefix is authorizeGoalManagement VERBATIM (the
+// authorizeJoinRequestResponse shape) rather than the "is this your row" identity
+// check its withdraw mirror uses — and it runs BEFORE the request lookup so an
+// unauthorized actor never learns whether an invitation exists (the O1 no-leak
+// ordering). Then request containment + state: request_not_found → wrong_goal →
+// not_an_invitation → not_pending, so this route can never touch a join-request
+// row. Resolving an already-resolved invite is refused (409 not_pending) rather
+// than silently re-cancelled: db.resolveMembershipRequest moves only from
+// status='pending', so a repeat rescind changes no state either way. PURE + exported.
+function authorizeRescindInvitation({ goal, actorId, actorRank, actorMembership, request, goalId }) {
+  const mgmt = authorizeGoalManagement({ goal, actorId, actorRank, actorMembership });
+  if (!mgmt.ok) return mgmt;
+  if (!request) return { ok: false, status: 404, body: { error: 'request_not_found' } };
+  if (String(request.goal_id) !== String(goalId)) {
+    return { ok: false, status: 404, body: { error: 'request_not_found', message: 'No such invitation on this goal.' } };
+  }
+  if (request.kind !== 'invite') {
+    return { ok: false, status: 400, body: { error: 'not_an_invitation', message: 'That row is a join-request, not an invitation.' } };
+  }
+  if (request.status !== 'pending') {
+    return { ok: false, status: 409, body: { error: 'not_pending', status: request.status } };
+  }
+  return { ok: true };
+}
+
 // decorateGoalScope — additive, derived scope_protected flag on goal payloads
 // (task 1002689). A protected-scope goal is join-gated like a private one
 // (Archon-mediated membership, ADR 0086 §3), but the hall cannot re-derive the
@@ -393,6 +442,7 @@ module.exports = {
   authorizeJoinRequestResponse,
   authorizeMembershipKindChange,
   authorizeOwnershipTransfer,
+  authorizeRescindInvitation,
   authorizeWithdrawJoinRequest,
   decorateGoalScope,
   isMemberOrArchon,

package/modules/lifecycle/routes/goals.js

@@ -63,7 +63,7 @@ const JOIN_REQUEST_RESPONSE_ACTIONS = ['approve', 'deny']; // an owner/manager/A
 // proceed; a false result means "not a member" → the route should 403. This is the
 // membership half of the wall; the protected-module rank check is enforced per-route
 // (scope is never self-granted).
-const { authorizeCreateJoinRequest, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
+const { authorizeCreateJoinRequest, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 module.exports = function buildGoalsRouter() {
@@ -334,6 +334,15 @@ module.exports = function buildGoalsRouter() {
   // Pinned in route-rank-check.MODULE_EXPECTED_RANKS['lifecycle'].
   router.patch('/goals/:id/visibility', auth.requireBuilder, goalEdits.goalVisibilityHandler({ db, authorizeGoalManagement, validateOrRespond, parseId, VALID_VISIBILITIES }));
 
+  // PATCH /goals/:id/accepting-requests { accepting_requests } — a private goal's
+  // lead closes or re-opens it to join-requests (task 1002971, spec D6). Closed
+  // refuses new asks with honest copy; INVITATIONS ARE UNAFFECTED, so a lead can
+  // still reach out. Handler in goal-edits.js beside the visibility toggle (the
+  // same gate, the same kind of write); only the registration lives here so
+  // route-rank-check still classifies it.
+  // rank: any-builder (requireBuilder) + the in-handler owner|manager|Archon gate.
+  router.patch('/goals/:id/accepting-requests', auth.requireBuilder, goalEdits.goalAcceptingRequestsHandler({ db, authorizeGoalManagement, validateOrRespond, parseId }));
+
   // ---- the ADVISORY human category (task 1003275, criterion legibility-categories) ----
   // A category ORIENTS a person and steers Claude; it authorises nothing. Nothing
   // in this file, in claim eligibility, or in the claimable feed may branch on it —
@@ -605,6 +614,39 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // POST /goals/:id/invitations/:reqId/rescind — an owner|manager|Archon takes
+  // back a PENDING invitation the goal sent (task 1002971): the manager-side
+  // mirror of the requester's withdraw, and the missing half of core_188's
+  // 'cancelled' state ("withdrawn/rescinded by the opener" — only the requester
+  // half existed). Sets status='cancelled', kept as the audit trail like a deny's
+  // 'rejected'; never touches a join-request row.
+  // rank: any-builder (requireBuilder) + the in-handler authorizeRescindInvitation.
+  router.post('/goals/:id/invitations/:reqId/rescind', auth.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    const reqId = parseId(req, res, { param: 'reqId', code: 'bad_request_id', positiveInt: true });
+    if (reqId === null) return;
+    try {
+      const goal = await db.getGoal(id);
+      const [actorMembership, request] = goal
+        ? await Promise.all([
+            db.getGoalMember({ goalId: id, builderId: req.builder.id }),
+            db.getMembershipRequest(reqId),
+          ])
+        : [null, null];
+      const decision = authorizeRescindInvitation({
+        goal, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership, request, goalId: id,
+      });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+      const resolved = await db.resolveMembershipRequest({ id: reqId, status: 'cancelled', resolvedBy: req.builder.id });
+      if (!resolved) return res.fail('not_pending', { status: 409, message: 'The invitation changed underneath this rescind — re-read and retry.' });
+      return res.json({ ok: true, request: resolved });
+    } catch (err) {
+      log.error('[gds] POST /goals/:id/invitations/:reqId/rescind', err);
+      return res.fail('rescind_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // POST /goals/:id/members — the goal's own authority (owner | manager | Archon)
   // invites a builder to the goal (task 1762: widened from Archon-only so a
   // manager doesn't need an Archon in the loop for a normal goal). This stays the
@@ -1237,6 +1279,9 @@ module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
 // task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
 // same precedent as its siblings above.
 module.exports.authorizeWithdrawJoinRequest = authorizeWithdrawJoinRequest;
+// task 1002971: the manager-side rescind gate — the missing half of core_188's
+// 'cancelled' state; exported for tests/goal_membership_requests.mjs, same precedent.
+module.exports.authorizeRescindInvitation = authorizeRescindInvitation;
 // task 1002689: the derived scope_protected payload decorator — exported for
 // tests/goal_membership_requests.mjs (DB-free), same precedent.
 module.exports.decorateGoalScope = decorateGoalScope;

package/modules/platform-identity/migrations/platform_identity_012_recent_ships.sql

@@ -0,0 +1,40 @@
+-- platform_identity_012_recent_ships.sql — the hub's "recent works" store
+-- (BV1 goal 1000045 P07, task 1002803; profile-page spec "The page spec" row 4 +
+-- ADR 0171 D7).
+--
+-- WHY A COLUMN AND NOT A TABLE. The hub has no `tasks` table for other projects,
+-- so a builder's last few shipped works can only reach it as data the project
+-- PUSHES. The existing pull pattern (modules/platform-identity/project-stats.js)
+-- fans out to each project's public API — fine for a builder count on a catalog
+-- page, wrong once per profile view, and useless for a CLI-only project that
+-- serves no public API at all. The push already exists: POST /sso/activity/rollup
+-- upserts exactly one row per (client_id, github_id), refreshed on every federated
+-- sign-in AND (task 1002803) on every ship. A capped list of at most 3 works
+-- belongs ON that row: it is written and read as one unit, it is never queried
+-- across rows, and a child table would add a join and a delete-orphan path to
+-- store nine values.
+--
+-- WHAT IS IN IT. At most 3 objects, each `{ id, title, shipped_at, url }` —
+-- sanitized in upsertActivity BEFORE the write (the rank/disciplines precedent,
+-- ADR 0171 D7: a reporting instance is third-party self-report and is never
+-- trusted to respect its own cap). `url` may only point back into the reporting
+-- client's own registered origin, so a ship link on a public portfolio can never
+-- be turned into a phishing hop. `'[]'` — never NULL — so every reader gets a
+-- list without a coalesce.
+--
+-- DESCRIPTIVE ANALYTICS ONLY (ADR 0016 / 0141): a ship link is a label, never an
+-- access grant. Reading it confers nothing on the instance it points at.
+--
+-- Additive + `platform_identity_`-namespaced (ADR 0083 §5). Forward-safe: ADD
+-- COLUMN with a DEFAULT, so the previous code release still runs against this
+-- schema (it simply never writes the column). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_builder_project_activity
+  ADD COLUMN IF NOT EXISTS recent_ships jsonb NOT NULL DEFAULT '[]'::jsonb;
+
+COMMENT ON COLUMN platform_identity_builder_project_activity.recent_ships IS
+  'Up to 3 recently shipped works this project reported for this builder, pushed on POST /sso/activity/rollup (task 1002803): [{id, title, shipped_at, url}]. Third-party self-report — capped, type-checked and same-origin-checked in upsertActivity, never trusted as written. Surfaced only on a project the catalog names publicly (getRollupForBuilder), so a non-public project''s work titles stay counted-but-unnamed like its name does.';
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -532,25 +532,96 @@ async function setClientStatus(clientId, status, { pool = defaultPool } = {}) {
 const MAX_ROLLUP_DISCIPLINES = 8;
 const MAX_DISCIPLINE_LENGTH = 32;
 
+// "Recent works" caps (task 1002803). The hub has no tasks table for other
+// projects, so a builder's last few shipped works arrive on the rollup push
+// instead of being fanned out for at read time. THREE PER PROJECT, hard-capped
+// HERE and not only at the sender: the cap is a property of what the hub will
+// store, and a reporting instance is third-party self-report that may be old,
+// buggy or hostile.
+const MAX_RECENT_SHIPS = 3;
+const MAX_SHIP_TITLE_LENGTH = 200;
+const MAX_SHIP_URL_LENGTH = 500;
+// How far into a pushed array the hub will even LOOK. Validating first and
+// capping second is what stops a few malformed entries from crowding the good
+// ones out of the three slots; bounding the scan is what stops an unbounded
+// array from buying unbounded work with one request.
+const MAX_RECENT_SHIPS_SCANNED = 20;
+
+// May this ship link be stored? A ship link is the ONLY free-text URL on a public
+// builder portfolio, which makes it the one place a client-secret holder could
+// plant a phishing hop under someone else's name. So it must point AT OR BELOW
+// the instance that reported it: the client's own REGISTERED origin host, or a
+// subdomain of it (an instance's hall may live at builders.<domain> while its
+// registered origin is <domain>). Anything else — another site, a non-http
+// scheme, embedded credentials — stores no link rather than a wrong one.
+//
+// DOWNWARD ONLY, deliberately. The mirror rule ("the link host is an ANCESTOR of
+// the registered origin") looks symmetric and is not: on a shared multi-tenant
+// apex it would let a client registered at foo.github.io publish links on bare
+// github.io, which it does not control. Nothing needs the upward direction — a
+// registered origin is the instance's own public origin — so it is not offered.
+function shipUrlWithinClientOrigin(raw, clientOrigin) {
+  if (typeof raw !== 'string' || !raw || raw.length > MAX_SHIP_URL_LENGTH) return null;
+  let u, o;
+  try { u = new URL(raw); o = new URL(String(clientOrigin || '')); } catch { return null; }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;
+  if (u.username || u.password) return null;
+  const host = u.hostname.toLowerCase(), registered = o.hostname.toLowerCase();
+  if (host !== registered && !host.endsWith(`.${registered}`)) return null;
+  return raw;
+}
+
+// Shape and bound the pushed recent_ships[] before it is stored (the
+// upsertActivity rank/disciplines precedent, ADR 0171 D7 — validation lives next
+// to the data where no route can forget it). Returns AT MOST MAX_RECENT_SHIPS
+// entries of exactly `{ id, title, shipped_at, url }`; a row with no usable id or
+// title is dropped entirely rather than stored half-empty, and a bad date or an
+// off-origin link becomes null on an otherwise good row. Always an array, never
+// null — every reader gets a list without a coalesce.
+function sanitizeRecentShips(raw, clientOrigin) {
+  return (Array.isArray(raw) ? raw : [])
+    .slice(0, MAX_RECENT_SHIPS_SCANNED)
+    .filter((s) => s && typeof s === 'object' && !Array.isArray(s))
+    .map((s) => {
+      const id = Number(s.id);
+      const at = typeof s.shipped_at === 'string' ? Date.parse(s.shipped_at) : NaN;
+      return {
+        id: Number.isSafeInteger(id) && id > 0 ? id : null,
+        title: typeof s.title === 'string' && s.title.trim() ? s.title.slice(0, MAX_SHIP_TITLE_LENGTH) : null,
+        shipped_at: Number.isFinite(at) ? new Date(at).toISOString() : null,
+        url: shipUrlWithinClientOrigin(s.url, clientOrigin),
+      };
+    })
+    .filter((s) => s.id !== null && s.title !== null)
+    .slice(0, MAX_RECENT_SHIPS);
+}
+
 // Upsert one project's rollup for one builder (keyed by client_id + github_id).
 // Descriptive analytics — never authority. Refreshes last_active on each report.
-async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [] }, { pool = defaultPool } = {}) {
+// `clientOrigin` is the AUTHENTICATED client's registered origin (never a
+// caller-named one) and exists only to bound the ship links — see
+// shipUrlWithinClientOrigin.
+async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [], recentShips = [], clientOrigin = null }, { pool = defaultPool } = {}) {
   // api.LIVE_RANK_LADDER is a published doorway export (src/module-api.js, a
   // lazy getter over db-kernel's canonical four-rank ladder).
   const safeRank = api.LIVE_RANK_LADDER.includes(rank) ? rank : null;
   const disc = (Array.isArray(disciplines) ? disciplines : [])
     .filter((d) => typeof d === 'string' && d.length > 0 && d.length <= MAX_DISCIPLINE_LENGTH)
     .slice(0, MAX_ROLLUP_DISCIPLINES);
+  const ships = sanitizeRecentShips(recentShips, clientOrigin);
   const { rows } = await pool.query(
     `INSERT INTO platform_identity_builder_project_activity
-       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, last_active, updated_at)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, now(), now())
+       (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, recent_ships, last_active, updated_at)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, now(), now())
      ON CONFLICT (client_id, github_id) DO UPDATE SET
        credits = EXCLUDED.credits, tasks_shipped = EXCLUDED.tasks_shipped, karma = EXCLUDED.karma,
        rank_held = EXCLUDED.rank_held, disciplines = EXCLUDED.disciplines,
+       recent_ships = EXCLUDED.recent_ships,
        last_active = now(), updated_at = now()
      RETURNING id, client_id, github_id`,
-    [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc],
+    // jsonb is bound as a JSON STRING: node-postgres serializes a JS array as a
+    // Postgres ARRAY literal, which the jsonb column would reject.
+    [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships)],
   );
   return rows[0];
 }
@@ -653,7 +724,7 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
   );
   const agg = aggRows[0];
   const { rows: projRows } = await pool.query(
-    `SELECT p.name, p.origin, a.rank_held,
+    `SELECT p.name, p.origin, a.rank_held, a.recent_ships,
             (p.id IS NOT NULL AND p.featured AND p.status = 'active') AS is_public
        FROM platform_identity_builder_project_activity a
        LEFT JOIN platform_identity_sso_clients c ON c.client_id = a.client_id
@@ -662,9 +733,19 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
       ORDER BY a.last_active DESC`,
     [githubId],
   );
+  // recent_ships rides the project row it belongs to (task 1002803) — which is
+  // also what keeps it honest: a work title is at least as identifying as the
+  // project name it came from, so it may only appear where the name already
+  // may. A non-public project stays counted in more_projects and its work
+  // titles never leave the hub, exactly as its name doesn't.
   const named = projRows
     .filter((r) => r.is_public)
-    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held }));
+    .map((r) => ({
+      name: r.name,
+      origin: r.origin,
+      rank_held: r.rank_held,
+      recent_ships: Array.isArray(r.recent_ships) ? r.recent_ships : [],
+    }));
   return {
     totals: {
       projects: agg.projects,

package/modules/platform-identity/routes/sso.js

@@ -426,6 +426,11 @@ module.exports = function ssoRoutes() {
       karma: { type: 'number' },
       rank: { type: 'string', maxLength: 32 },
       disciplines: {},
+      // "Recent works" (task 1002803): up to 3 of this builder's latest shipped
+      // works on THIS project — [{ id, title, shipped_at, url }]. Left untyped
+      // here, like disciplines: the shape is checked and hard-capped in
+      // upsertActivity, next to the data, so no route can forget it.
+      recent_ships: {},
     })) return;
     const b = req.body || {};
     try {
@@ -456,6 +461,11 @@ module.exports = function ssoRoutes() {
         karma: b.karma,
         rank: b.rank || null,
         disciplines: Array.isArray(b.disciplines) ? b.disciplines : [],
+        recentShips: b.recent_ships,
+        // The AUTHENTICATED client's registered origin — the bound every pushed
+        // ship link must fall inside (task 1002803). Taken from the client row,
+        // never from the body, for the same reason client_id is.
+        clientOrigin: client.origin,
       }, { pool });
       res.json({ ok: true });
     } catch (err) {

package/modules/platform-identity/tests/platform-identity.mjs

@@ -494,7 +494,10 @@ await ta('upsertActivity upserts per (client_id, github_id) with the talent snap
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_builder_project_activity/);
   assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE/);
-  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer']]);
+  // recent_ships (task 1002803) rides the same row as a jsonb STRING param —
+  // an empty list when the sender reported none, never NULL. Its own cap,
+  // shape and link bound are covered by tests/hub_recent_ships.mjs.
+  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]']);
 });
 
 await ta('upsertActivity sanitizes third-party self-report (ADR 0171 D7): off-ladder rank → null, disciplines validated + capped', async () => {
@@ -597,7 +600,9 @@ await ta('getRollupForBuilder aggregates un-fanned + names only publicly-catalog
   assert.deepEqual(out.totals, { projects: 2, credits: 150, works_shipped: 7, karma: 4 });
   assert.deepEqual(out.disciplines, ['engineer', 'ui']);
   assert.equal(out.projects.length, 1, 'only the public catalog row is named');
-  assert.deepEqual(out.projects[0], { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic' });
+  // recent_ships rides the project row it belongs to (task 1002803), so a work
+  // title can only surface where the project name already may.
+  assert.deepEqual(out.projects[0], { name: 'Public Proj', origin: 'https://pub.example', rank_held: 'metic', recent_ships: [] });
   assert.equal(out.more_projects, 1, 'the non-public project is counted, never named');
   // The whitelist holds structurally: client_id never appears in the shape.
   assert.ok(!JSON.stringify(out).includes('client_id'), 'client_id must not cross the port');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.408",
+  "version": "1.19.410",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.408",
+      "version": "1.19.410",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.408",
+  "version": "1.19.410",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth-admission.js

@@ -77,36 +77,98 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
   }
 }
 
+// How many recently shipped works ride the rollup (task 1002803). The hub caps
+// this again on arrival — a sender is never trusted to respect its own cap — so
+// this constant is the polite half of the contract, not the enforcement.
+const ROLLUP_RECENT_SHIPS = 3;
+
+// A public deep link to one task in THIS instance's builders' hall, for the
+// "recent works" list on the builder's cross-project profile (task 1002803). It
+// is built from branding's STABLE public hall origin, never an env API base: the
+// link is stored on another host and rendered to strangers, so a local dev
+// override must never end up on a public portfolio. No origin (an instance that
+// never declared one) → no link, and the work still reports with its title.
+function hallTaskUrl(taskId) {
+  try {
+    const d = (branding().domains) || {};
+    const origin = String(d.buildersOrigin || d.publicOrigin || '').replace(/\/+$/, '');
+    return origin ? `${origin}/builders#/task/${taskId}` : null;
+  } catch {
+    return null;
+  }
+}
+
+// This builder's most recent shipped works, for the rollup's recent_ships[]
+// (task 1002803). The predicate is deliberately IDENTICAL to the lifecycle
+// module's recentShippedTasksByBuilder — the read behind this instance's own
+// unauthenticated GET /builders/:id/profile — so the push can never publish a
+// work the instance does not already publish itself. (Neither surface filters by
+// goal visibility today: ADR 0112's secrecy covers a private goal's OWN title,
+// not the titles of tasks inside it. Widening or narrowing that is a policy
+// change for the profile route, not something to fork here.) Kernel file, so it
+// reads `pool` directly rather than importing the lifecycle module (ADR 0091 §1).
+// Covered by core_228's idx_tasks_shipped_by_shipped_at — (shipped_by,
+// shipped_at DESC) partial on status='shipped', which is this predicate exactly.
+async function recentShipsForRollup(builderId) {
+  const { rows } = await pool.query(
+    `SELECT id, title, shipped_at
+       FROM tasks
+      WHERE shipped_by = $1
+        AND status = 'shipped'
+        AND title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
+      ORDER BY shipped_at DESC NULLS LAST
+      LIMIT $2`,
+    [builderId, ROLLUP_RECENT_SHIPS],
+  );
+  return rows.map((r) => ({
+    id: Number(r.id),
+    title: r.title,
+    shipped_at: r.shipped_at ? new Date(r.shipped_at).toISOString() : null,
+    url: hallTaskUrl(r.id),
+  }));
+}
+
 // Best-effort cross-project activity rollup to the hub (ADR 0141 §4): report this
-// builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines)
-// for the internal scouting directory. Fires on every federated sign-in ("on key
-// events"); true periodic reporting is a follow-up. Fully swallowed + no-op when
-// not federated — never fails a sign-in.
-async function reportActivityRollup({ builderId, githubId }) {
+// builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines,
+// and since task 1002803 their last few shipped works) for the cross-project
+// profile + scouting directory. Fires on every federated sign-in AND on every
+// ship (reportActivityRollupForShippedTask). Fully swallowed + no-op when not
+// federated — never fails a sign-in or a ship.
+//
+// `githubId` is OPTIONAL: a sign-in already holds the hub-supplied id, while the
+// ship path holds only a builder id, and the snapshot SELECT below can answer
+// both — so the ship path costs one query, not two. A non-numeric principal (a
+// `system:*` machine id) is dropped here rather than sent for the hub to reject:
+// it has no public profile and never will.
+async function reportActivityRollup({ builderId, githubId = null }) {
   const idp = loadIdpConfig();
   if (!idp) return;
   try {
     // Snapshot the builder's talent signals directly from the DB (auth.js is a
     // kernel file — it uses pool, never a non-kernel domain module like metrics.js).
     const b = await pool.query(
-      'SELECT total_credits, karma, rank, preferred_disciplines FROM builders WHERE id = $1',
+      'SELECT github_id, total_credits, karma, rank, preferred_disciplines FROM builders WHERE id = $1',
       [builderId],
     );
     if (!b.rows[0]) return;
-    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
     const row = b.rows[0];
+    const ghId = githubId ?? row.github_id;
+    if (!/^\d+$/.test(String(ghId ?? ''))) return;
+    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
+    const recentShips = await recentShipsForRollup(builderId);
     await fetch(`${idp.origin}/api/gds/sso/activity/rollup`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
         client_id: idp.clientId,
         client_secret: idp.clientSecret,
-        github_id: githubId,
+        github_id: ghId,
         credits: Number(row.total_credits) || 0,
         tasks_shipped: shipped.rows[0] ? shipped.rows[0].n : 0,
         karma: Number(row.karma) || 0,
         rank: row.rank || null,
         disciplines: Array.isArray(row.preferred_disciplines) ? row.preferred_disciplines : [],
+        recent_ships: recentShips,
       }),
     });
   } catch (err) {
@@ -114,6 +176,24 @@ async function reportActivityRollup({ builderId, githubId }) {
   }
 }
 
+// The SHIP-TIME rollup push (task 1002803, ADR 0171 amendment R01). Until now the
+// rollup fired only on a federated sign-in, so a builder who signs in once a month
+// had a cross-project profile up to a month stale — showing old credit and ship
+// counts with nothing on the page saying so. A ship is the event that CHANGES
+// those numbers, so it re-reports them; nothing else about the push differs.
+//
+// Wired as a `task.shipped` listener in src/bongos/routes/auth.js, so it runs
+// once per ship whichever path won the confirmed→shipped flip. Best-effort in the
+// same sense as the sign-in push: it resolves nothing the caller waits on, and a
+// hub outage can never fail a ship. The builder's github_id is resolved by the
+// rollup's own snapshot SELECT (which now returns it), so this adds no lookup of
+// its own — and a machine principal is dropped there, not sent to the hub.
+async function reportActivityRollupForShippedTask(task) {
+  const builderId = task && task.shipped_by;
+  if (!builderId) return;
+  await reportActivityRollup({ builderId });
+}
+
 // Admission posture (SR-19 / task #1000). BOTH enrollment paths — the web hall
 // sign-in (completeWebFlow) and the CLI device flow (pollDeviceFlow) — are
 // "invite-gated by default": a FIRST-TIME GitHub account is admitted only if an
@@ -329,6 +409,7 @@ module.exports = {
   membershipKind,
   openEnrollmentEnabled,
   reportActivityRollup,
+  reportActivityRollupForShippedTask,
   reportMembershipCheckIn,
   safeSyncRankRole,
   webAdmissionStatus,

package/src/bongos/route-rank-check.js

@@ -391,6 +391,12 @@ const MODULE_EXPECTED_RANKS = {
     // (authorizeWithdrawJoinRequest).
     'GET /goals/:id/requests': 'any-builder',
     'POST /goals/:id/requests/:reqId/withdraw': 'any-builder',
+    // task 1002971 (spec D6): the private-goal open/closed-to-requests toggle and
+    // the manager-side rescind of a pending invitation. Both walls are in-handler
+    // (authorizeGoalManagement / authorizeRescindInvitation), so both stay
+    // 'any-builder' — pinned so an accidental requireRank re-gate reds the build.
+    'PATCH /goals/:id/accepting-requests': 'any-builder',
+    'POST /goals/:id/invitations/:reqId/rescind': 'any-builder',
     // criterion confirmation + goal auto-achieve (ADR 0086 §6) — the planner's close loop.
     'POST /done-when/:criterionId/satisfy': 'metic+archon',
     // runtime criterion create (ADR 0105 gap fix, task 1874) — re-ranked Archon→Metic+