@bongos/core 1.19.408 → 1.19.410

package/src/bongos/routes/auth.js

@@ -30,6 +30,7 @@ const express = require('express');
 const crypto = require('node:crypto');
 
 const auth = require('../auth');
+const { reportActivityRollupForShippedTask } = require('../auth-admission.js');
 const db = require('../db');
 const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
@@ -376,7 +377,27 @@ const DISCORD_REDIRECT_URI = `${DISCORD_REDIRECT_ORIGIN}/api/gds/auth/discord/ca
 // sign-in started on a builders.* subdomain must still use the apex.
 const WEB_REDIRECT_ORIGIN = process.env.GDS_PUBLIC_ORIGIN || configuredOAuthOrigin();
 
+// The ship-time hub push (task 1002803, ADR 0171 amendment R01) lives here
+// because this file already owns the OTHER trigger: the federated sign-in flows
+// below are what fire the check-in + rollup today, and the reporter they call is
+// this router's own auth-admission sibling. `task.shipped` is an EVENT, not a
+// port — many listeners may react to a ship and none of them returns anything
+// (the discord/sessions listener precedent). off→on guarded so a test that
+// re-instantiates the router never stacks duplicate listeners.
+let _shipRollupListenerOff = null;
+function registerSeams() {
+  if (_shipRollupListenerOff) _shipRollupListenerOff();
+  // Fire-and-forget: reportActivityRollupForShippedTask swallows every error and
+  // no-ops on an unfederated instance, so the .catch is belt-and-braces against a
+  // future edit letting one escape into an unhandledRejection (the sign-in
+  // chain's reasoning, auth-idp.js).
+  _shipRollupListenerOff = seams.on('task.shipped', (task) => {
+    reportActivityRollupForShippedTask(task).catch(() => {});
+  });
+}
+
 module.exports = function buildAuthRouter() {
+  registerSeams();
   const router = express.Router();
 
   // /auth/device — CLI flow

package/src/module-api.js

@@ -1247,8 +1247,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.406 with no explicit bump. run 33214451873. (task 1002620)
 //   1.19.408 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.407 with no explicit bump. run 33216756796. (task 1002620)
+//   1.19.409 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.408 with no explicit bump. run 33217065997. (task 1002620)
+//   1.19.410 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.409 with no explicit bump. run 33217599338. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.408'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.410'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_membership_requests.mjs

@@ -19,6 +19,10 @@
 //     goal is still OPEN (a stale invite can't admit to an achieved/archived goal);
 //     declining stays allowed, so the route declines before ever reading the goal.
 //   • the migration is additive + private-safe (default 'public', partial unique).
+//   • setGoalAcceptingRequests + the D6 closed-to-requests gate (task 1002971) —
+//     a private goal can stop taking join-requests WITHOUT stopping invitations.
+//   • authorizeRescindInvitation (task 1002971) — the manager-side rescind, the
+//     missing half of core_188's 'cancelled' state.
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -32,6 +36,7 @@ process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
 const {
   setGoalVisibility,
+  setGoalAcceptingRequests,
   createMembershipRequest,
   getMembershipRequest,
   resolveMembershipRequest,
@@ -48,6 +53,8 @@ const {
   authorizeInvitationAccept,
   authorizeJoinRequestResponse,
   authorizeWithdrawJoinRequest,
+  authorizeRescindInvitation,
+  authorizeGoalManagement,
   decorateGoalScope,
 } = require('../modules/lifecycle/routes/goals.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
@@ -76,6 +83,27 @@ await test('setGoalVisibility: writes visibility + returns the goal row', async
   assert.deepEqual(q.params, [7, 'private']);
 });
 
+// =========================================================================
+// setGoalAcceptingRequests (task 1002971, spec D6) — the same shape as its
+// visibility sibling: the route owns WHO may call it, the helper just writes.
+// =========================================================================
+
+await test('setGoalAcceptingRequests: writes the flag + returns the goal row', async () => {
+  const GOAL = { id: 7, visibility: 'private', accepting_requests: false };
+  const pool = fakePool((s) => (/UPDATE goals SET accepting_requests = \$2/.test(s) ? { rows: [GOAL] } : null));
+  const g = await setGoalAcceptingRequests({ goalId: 7, acceptingRequests: false }, { pool });
+  assert.deepEqual(g, GOAL);
+  const q = find(pool.queries, /UPDATE goals SET accepting_requests/);
+  assert.deepEqual(q.params, [7, false]);
+  assert.ok(/RETURNING .*accepting_requests/.test(norm(q.sql)),
+    'the returned row carries the flag, so the hall can render the toggle state');
+});
+
+await test('setGoalAcceptingRequests: unknown goal → null', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await setGoalAcceptingRequests({ goalId: 999, acceptingRequests: true }, { pool }), null);
+});
+
 await test('setGoalVisibility: unknown goal → null', async () => {
   const pool = fakePool(() => ({ rows: [] }));
   assert.equal(await setGoalVisibility({ goalId: 999, visibility: 'public' }, { pool }), null);
@@ -302,6 +330,15 @@ await test('migration core_188: additive, defaults public, partial-unique pendin
     'migration is purely additive');
 });
 
+await test('migration core_229: accepting_requests is additive and defaults TRUE', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const sql = readFileSync(join(here, '..', 'migrations', 'core_229_goals_accepting_requests.sql'), 'utf8');
+  assert.ok(/ADD COLUMN IF NOT EXISTS accepting_requests boolean NOT NULL DEFAULT true/.test(sql),
+    'defaults true so every existing private goal keeps taking requests');
+  assert.ok(!/\bDROP\s+(TABLE|COLUMN|INDEX)\b|\bDELETE\s+FROM\b|\bTRUNCATE\b/i.test(sql),
+    'migration is purely additive');
+});
+
 // =========================================================================
 // The pure route gates (task 1952) — DB-free, ordering included.
 // =========================================================================
@@ -348,6 +385,45 @@ await test('authorizeCreateJoinRequest: public but PROTECTED scope → ALLOW (no
   assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'public' }, isMember: false, scopeProtected: true }), { ok: true });
 });
 
+// The D6 closed-to-requests arm (task 1002971). A private goal whose lead closed
+// applications refuses the ask with honest copy instead of queueing it.
+const CLOSED_PRIVATE = { id: 5, status: 'open', created_by: '1', visibility: 'private', accepting_requests: false };
+await test('authorizeCreateJoinRequest: private + closed → 409 not_accepting_requests, honest copy', () => {
+  const d = authorizeCreateJoinRequest({ goal: CLOSED_PRIVATE, isMember: false, scopeProtected: false });
+  assert.equal(d.status, 409);
+  assert.equal(d.body.error, 'not_accepting_requests');
+  assert.equal(d.body.message, "This goal isn't taking requests right now.",
+    'the spec D6 copy verbatim — the refusal says why, it does not pretend the goal is gone');
+});
+await test('authorizeCreateJoinRequest: private + explicitly accepting → ALLOW', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { ...CLOSED_PRIVATE, accepting_requests: true }, isMember: false, scopeProtected: false }), { ok: true });
+});
+// A goal row read before the migration (or by an older release) has no such key.
+// Only an explicit false closes the door — undefined must never read as closed.
+await test('authorizeCreateJoinRequest: private, flag absent → ALLOW (fails OPEN, not closed)', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'private' }, isMember: false, scopeProtected: false }), { ok: true });
+});
+// D6 calls the flag meaningless on a public goal, so a PUBLIC protected-scope goal
+// keeps its Archon-mediated request door open whatever the column says.
+await test('authorizeCreateJoinRequest: PUBLIC protected goal + closed flag → ALLOW (flag is private-only)', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'public', accepting_requests: false }, isMember: false, scopeProtected: true }), { ok: true });
+});
+// The whole point of D6: closing applications is about unsolicited inbound. The
+// invite path is gated by authorizeGoalManagement, which never reads the flag —
+// so a lead can still invite into a goal that is closed to requests.
+await test('closed to requests: INVITATIONS are unaffected — the invite gate still allows the owner', () => {
+  assert.deepEqual(authorizeGoalManagement({ goal: CLOSED_PRIVATE, actorId: '1', actorRank: 'metic', actorMembership: null }), { ok: true });
+});
+await test('routes: the invitation paths never read accepting_requests (only the request gate does)', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const authz = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goal-route-authz.js'), 'utf8');
+  const gates = authz.match(/^function authorize\w+[\s\S]*?^}/gm) || [];
+  const reading = gates.filter((g) => /goal\.accepting_requests/.test(g));
+  assert.equal(reading.length, 1, 'exactly one gate reads the flag');
+  assert.ok(/^function authorizeCreateJoinRequest/.test(reading[0]),
+    'and it is the JOIN-REQUEST gate — invitations must stay unaffected (spec D6)');
+});
+
 // authorizeInvitationResponse — only the invitee resolves their own pending invite.
 const INVITE = { id: 9, goal_id: '5', builder_id: '2', kind: 'invite', status: 'pending' };
 await test('authorizeInvitationResponse: unknown request → 404', () => {
@@ -480,6 +556,80 @@ await test('authorizeWithdrawJoinRequest: the requester (string vs number id)
   assert.deepEqual(authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: '5', actorId: 2 }), { ok: true });
 });
 
+// =========================================================================
+// authorizeRescindInvitation (task 1002971) — the manager-side mirror of
+// withdraw, and the missing half of core_188's 'cancelled' state. Authority is
+// authorizeGoalManagement (owner|manager|Archon), checked BEFORE the request
+// lookup so an unauthorized actor never learns an invitation exists.
+// =========================================================================
+
+const RESCIND_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
+const PENDING_INVITE = { id: 12, goal_id: '5', builder_id: '2', kind: 'invite', status: 'pending' };
+const rescind = (over = {}) => authorizeRescindInvitation({
+  goal: RESCIND_GOAL, actorId: '1', actorRank: 'metic', actorMembership: null,
+  request: PENDING_INVITE, goalId: 5, ...over,
+});
+
+await test('authorizeRescindInvitation: the goal OWNER → ALLOW', () => {
+  assert.deepEqual(rescind(), { ok: true });
+});
+await test('authorizeRescindInvitation: a manager (lead) → ALLOW', () => {
+  assert.deepEqual(rescind({ actorId: '3', actorMembership: mgr(3) }), { ok: true });
+});
+await test('authorizeRescindInvitation: an Archon → ALLOW (acts as owner anywhere)', () => {
+  assert.deepEqual(rescind({ actorId: '99', actorRank: 'archon' }), { ok: true });
+});
+await test('authorizeRescindInvitation: a non-owner/manager → 403 (before any request lookup — no leak)', () => {
+  const d = rescind({ actorId: '7' });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');
+  const blind = authorizeRescindInvitation({
+    goal: RESCIND_GOAL, actorId: '7', actorRank: 'metic', actorMembership: null, request: null, goalId: 5,
+  });
+  assert.deepEqual(blind, d, 'the answer is identical whether or not the invitation exists');
+});
+await test('authorizeRescindInvitation: the INVITEE cannot rescind their own invitation → 403', () => {
+  const d = rescind({ actorId: '2' });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');
+});
+await test('authorizeRescindInvitation: unknown request → 404', () => {
+  const d = rescind({ request: null });
+  assert.equal(d.status, 404); assert.equal(d.body.error, 'request_not_found');
+});
+await test('authorizeRescindInvitation: invitation on a different goal → 404 (containment)', () => {
+  assert.equal(rescind({ request: { ...PENDING_INVITE, goal_id: '99' } }).status, 404);
+});
+await test('authorizeRescindInvitation: row is a join-request, not an invitation → 400', () => {
+  const d = rescind({ request: { ...PENDING_INVITE, kind: 'request' } });
+  assert.equal(d.status, 400); assert.equal(d.body.error, 'not_an_invitation');
+});
+// Rescinding an invite that is already resolved changes nothing: the gate refuses
+// 409 not_pending, and db.resolveMembershipRequest moves only from 'pending', so a
+// repeat rescind can never re-cancel an accepted membership.
+await test('authorizeRescindInvitation: already resolved → 409 not_pending (no state change on a repeat)', () => {
+  for (const status of ['accepted', 'rejected', 'cancelled']) {
+    const d = rescind({ request: { ...PENDING_INVITE, status } });
+    assert.equal(d.status, 409); assert.equal(d.body.error, 'not_pending'); assert.equal(d.body.status, status);
+  }
+});
+await test('authorizeRescindInvitation: a closed goal cannot be managed → 409 goal_not_open', () => {
+  const d = rescind({ goal: { ...RESCIND_GOAL, status: 'archived' } });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'goal_not_open');
+});
+// The route must land the state core_188 already defined for "rescinded by the
+// opener" — not a second word for the same thing (source-pinned, the addGoalMember
+// resolvedBy precedent; the live route is exercised in goal_routes.mjs).
+await test('routes: the rescind route resolves to cancelled, attributed to the actor', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const handler = src.slice(src.indexOf("router.post('/goals/:id/invitations/:reqId/rescind'"));
+  assert.ok(handler.startsWith("router.post('/goals/:id/invitations/:reqId/rescind'"), 'the rescind route exists');
+  const body = handler.slice(0, handler.indexOf('\n  });'));
+  assert.ok(/db\.resolveMembershipRequest\(\{ id: reqId, status: 'cancelled', resolvedBy: req\.builder\.id \}\)/.test(body),
+    "cancelled — core_188's 'withdrawn/rescinded by the opener' state, attributed to the rescinder");
+  assert.ok(body.indexOf('authorizeRescindInvitation({') < body.indexOf('db.resolveMembershipRequest('),
+    'the gate runs before the write');
+});
+
 // =========================================================================
 // decorateGoalScope (task 1002689) — goal payloads carry a derived
 // scope_protected flag so the hall can render the join-gate on a
@@ -509,7 +659,7 @@ await test('decorateGoalScope: returns a copy, never mutates the row', () => {
 // stay 'any-builder'; an accidental requireRank re-gate must be a red build.
 // =========================================================================
 
-await test('route-rank pins: the eight private-goal routes are pinned any-builder', () => {
+await test('route-rank pins: the ten private-goal routes are pinned any-builder', () => {
   const pins = MODULE_EXPECTED_RANKS.lifecycle;
   for (const r of [
     'GET /goals/inbox',
@@ -520,6 +670,9 @@ await test('route-rank pins: the eight private-goal routes are pinned any-builde
     'POST /goals/:id/invitations/:reqId/respond',
     'GET /goals/:id/requests',
     'POST /goals/:id/requests/:reqId/withdraw',
+    // task 1002971 — the D6 toggle + the manager-side rescind.
+    'PATCH /goals/:id/accepting-requests',
+    'POST /goals/:id/invitations/:reqId/rescind',
   ]) {
     assert.equal(pins[r], 'any-builder', `${r} must be pinned any-builder (wall is in-handler)`);
   }

package/tests/hub_recent_ships.mjs

@@ -0,0 +1,373 @@
+// tests/hub_recent_ships.mjs — task 1002803 (P07, goal 1000045 "public builder
+// profiles"; profile-page spec "The page spec" row 4 + ADR 0171 amendment R01).
+//
+// "Recent works" reaches the hub by PUSH, not pull: the hub has no `tasks` table
+// for other projects, so each project reports at most 3 of a builder's latest
+// shipped works on POST /sso/activity/rollup. Three deliverables, and each one
+// has a failure mode that a code read does not catch:
+//
+//   1. THE CAP IS THE HUB'S, NOT THE SENDER'S. A reporting instance is
+//      third-party self-report (ADR 0171 D7). If the cap lived only in the
+//      sender, an old, buggy or hostile client would set the size of a public
+//      profile section. So the cap, the field shape and the link bound are all
+//      asserted against what upsertActivity BINDS, not against what was passed.
+//   2. A SHIP LINK IS THE ONE FREE-TEXT URL ON A PUBLIC PORTFOLIO. It may only
+//      point back into the reporting client's own registered origin, or it is a
+//      phishing hop published under someone else's name.
+//   3. THE ORDERING IS THE WHOLE POINT OF THE SEQUENCING FIX. The hub refuses a
+//      rollup without a membership row, and the check-in is what creates it —
+//      so asserting "both fired" would still pass while a first sign-in raced
+//      itself. This asserts the rollup has NOT fired while the check-in is still
+//      in flight, which is the only shape that fails when the chain is broken.
+//
+// Plus the privacy edges the goal turns on: a work title is at least as
+// identifying as the project name it came from, so it may only surface where
+// that name may (a non-public project stays counted-but-unnamed, ships and all),
+// and hide_stats suppresses the whole cross-project read including recent_ships.
+//
+// DB-free: every DB function takes an injectable pool and is driven by a
+// recording fake (the modules/platform-identity/tests/platform-identity.mjs
+// idiom); the core halves pin require.cache (the tests/profile_route.mjs idiom)
+// so the REAL handlers and the REAL chain run against spies.
+//
+// Run:  node tests/hub_recent_ships.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+// A recording fake pool: answers by SQL shape and records every call, so a test
+// asserts the params the real query actually bound.
+function mockPool(answer = () => ({ rows: [] })) {
+  const calls = [];
+  return {
+    calls,
+    query: async (text, params = []) => {
+      calls.push({ text: String(text), params });
+      return answer(String(text), params) || { rows: [] };
+    },
+    find: (re) => calls.find((c) => re.test(c.text)),
+  };
+}
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const ORIGIN = 'https://p07.example';
+const ship = (over = {}) => ({
+  id: 1002803, title: 'A shipped work', shipped_at: '2026-08-28T10:00:00.000Z',
+  url: `${ORIGIN}/builders#/task/1002803`, ...over,
+});
+// What upsertActivity BOUND as recent_ships — the jsonb param, parsed back.
+async function storedShips(recentShips, clientOrigin = ORIGIN) {
+  const pool = mockPool(() => ({ rows: [{ id: 1 }] }));
+  await pi.upsertActivity({ clientId: 'c1', githubId: 42, recentShips, clientOrigin }, { pool });
+  const call = pool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  assert.ok(call, 'the activity upsert ran');
+  const raw = call.params[7];
+  assert.equal(typeof raw, 'string', 'jsonb is bound as a JSON string, not a JS array (pg would emit a Postgres array literal)');
+  return JSON.parse(raw);
+}
+
+console.log('\n1. the cap and the shape are the HUB\'s, not the sender\'s:');
+
+await t('a client reporting 5 works stores exactly 3', async () => {
+  const five = [1, 2, 3, 4, 5].map((n) => ship({ id: n, title: `work ${n}` }));
+  const out = await storedShips(five);
+  assert.equal(out.length, 3);
+  assert.deepEqual(out.map((s) => s.id), [1, 2, 3], 'the first three, in reported order');
+});
+
+await t('no works stores an empty list, never null and never a stray shape', async () => {
+  for (const nothing of [[], undefined, null, 'nope', { id: 1 }]) {
+    const out = await storedShips(nothing);
+    assert.deepEqual(out, [], `${JSON.stringify(nothing) ?? 'undefined'} → []`);
+  }
+});
+
+await t('a stored work carries exactly id + title + shipped_at + url', async () => {
+  const [s] = await storedShips([ship({ extra: 'DO-NOT-STORE' })]);
+  assert.deepEqual(Object.keys(s).sort(), ['id', 'shipped_at', 'title', 'url']);
+  assert.equal(s.id, 1002803);
+  assert.equal(s.title, 'A shipped work');
+  assert.equal(s.shipped_at, '2026-08-28T10:00:00.000Z');
+});
+
+await t('a work with no usable id or title is dropped, not stored half-empty', async () => {
+  const out = await storedShips([
+    ship({ id: 'not-a-number' }),
+    ship({ id: 7, title: '   ' }),
+    ship({ id: -1 }),
+    ship({ id: 9, title: 'kept' }),
+  ]);
+  assert.deepEqual(out.map((s) => s.id), [9]);
+});
+
+await t('an unparseable date nulls only the date, never the work', async () => {
+  const [s] = await storedShips([ship({ shipped_at: 'yesterday-ish' })]);
+  assert.equal(s.shipped_at, null);
+  assert.equal(s.id, 1002803, 'the work still publishes without a date');
+});
+
+await t('a title longer than the cap is truncated, not rejected', async () => {
+  const [s] = await storedShips([ship({ title: 'x'.repeat(400) })]);
+  assert.equal(s.title.length, 200);
+});
+
+console.log('\n2. a ship link may only point back into the reporting instance:');
+
+for (const [label, url] of [
+  ['another site', 'https://evil.example/phish'],
+  ['a javascript: scheme', 'javascript:alert(1)'],
+  ['embedded credentials', 'https://user:pw@p07.example/x'],
+  ['a lookalike suffix', 'https://notp07.example/x'],
+  ['a non-string', 12345],
+  // The mirror of the subdomain rule is NOT offered: on a shared multi-tenant
+  // apex it would let a client registered at foo.github.io publish links on bare
+  // github.io. The bound is downward only.
+  ['an ancestor of the registered origin', 'https://example/x'],
+]) {
+  await t(`${label} stores no link (the work still publishes)`, async () => {
+    const [s] = await storedShips([ship({ url })]);
+    assert.equal(s.url, null);
+    assert.equal(s.id, 1002803);
+  });
+}
+
+await t('the client\'s own origin and a subdomain of it are kept', async () => {
+  const same = await storedShips([ship({ url: `${ORIGIN}/builders#/task/1` })]);
+  assert.equal(same[0].url, `${ORIGIN}/builders#/task/1`);
+  const sub = await storedShips([ship({ url: 'https://builders.p07.example/builders#/task/1' })]);
+  assert.equal(sub[0].url, 'https://builders.p07.example/builders#/task/1', 'an instance hall on a subdomain of its registered origin');
+  // …but never UP. A client registered on a subdomain may not publish links on
+  // the apex above it — that apex may be shared (the github.io shape).
+  const up = await storedShips([ship({ url: 'https://p07.example/x' })], 'https://builders.p07.example');
+  assert.equal(up[0].url, null, 'the bound is downward only');
+});
+
+console.log('\n3. POST /sso/activity/rollup accepts the field and hands the hub the trusted origin:');
+
+await t('the route passes recent_ships through and takes the origin from the CLIENT row', async () => {
+  const SECRET = 'p07-secret';
+  const rollupPool = mockPool((sql) => {
+    if (/FROM platform_identity_sso_clients/.test(sql)) {
+      return { rows: [{ client_id: 'c1', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: ORIGIN }] };
+    }
+    if (/FROM platform_identity_project_memberships/.test(sql)) {
+      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member' }] };
+    }
+    return { rows: [{ id: 1 }] };
+  });
+  const helpers = require('../src/bongos/routes/_helpers.js');
+  const moduleApiPath = require.resolve('../src/module-api.js');
+  const realApi = require('../src/module-api.js');
+  require.cache[moduleApiPath] = {
+    id: moduleApiPath, filename: moduleApiPath, loaded: true,
+    exports: {
+      pool: rollupPool,
+      validateOrRespond: helpers.validateOrRespond,
+      resolveSession: async () => null,
+      logger: () => ({ info() {}, warn() {}, error() {} }),
+      LIVE_RANK_LADDER: realApi.LIVE_RANK_LADDER,
+      corsPublicGet: () => (_q, _s, next) => next(),
+      on: () => () => {},
+      hasProvider: () => false,
+      registerProvider: () => {},
+    },
+  };
+  const ssoRoutes = require('../modules/platform-identity/routes/sso.js');
+  const router = ssoRoutes();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/sso/activity/rollup');
+  assert.ok(layer, 'the rollup route is mounted');
+
+  const res = { body: null, failure: null };
+  res.json = (b) => { res.body = b; return res; };
+  res.fail = (code, ...rest) => { res.failure = { code, rest }; return res; };
+  const req = {
+    body: {
+      client_id: 'c1', client_secret: SECRET, github_id: 42,
+      credits: 10, tasks_shipped: 2, karma: 1, rank: 'metic', disciplines: ['engineer'],
+      // Five, so the HUB's cap is what decides — a sender that ignores its own
+      // cap must not widen the section.
+      recent_ships: [1, 2, 3, 4, 5].map((n) => ship({ id: n, title: `work ${n}`, url: `${ORIGIN}/builders#/task/${n}` })),
+    },
+  };
+  await layer.route.stack[0].handle(req, res, () => {});
+  assert.equal(res.failure, null, `no failure (validateOrRespond runs in STRICT mode, so an unknown recent_ships would 400 here): ${JSON.stringify(res.failure)}`);
+  assert.deepEqual(res.body, { ok: true });
+
+  const insert = rollupPool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  const stored = JSON.parse(insert.params[7]);
+  assert.equal(stored.length, 3, 'the hub capped what the sender did not');
+  assert.equal(stored[0].url, `${ORIGIN}/builders#/task/1`, 'links pass the origin bound taken from the authenticated client row');
+});
+
+console.log('\n4. a work title surfaces only where the project name may:');
+
+await t('getRollupForBuilder attaches recent_ships to publicly-named projects only', async () => {
+  const pool = mockPool((sql) => {
+    if (/WITH agg AS/.test(sql)) {
+      return { rows: [{ projects: 2, credits: 5, works_shipped: 2, karma: 0, last_active: null, disciplines: ['engineer'] }] };
+    }
+    return {
+      rows: [
+        { name: 'Public Project', origin: ORIGIN, rank_held: 'metic', is_public: true, recent_ships: [ship()] },
+        { name: 'SECRET-PROJECT', origin: 'https://priv.example', rank_held: 'thetes', is_public: false, recent_ships: [ship({ id: 5, title: 'SECRET-WORK' })] },
+      ],
+    };
+  });
+  const out = await pi.getRollupForBuilder(42, { pool });
+  assert.equal(out.projects.length, 1);
+  assert.equal(out.more_projects, 1);
+  assert.deepEqual(out.projects[0].recent_ships, [ship()]);
+  const serialized = JSON.stringify(out);
+  assert.ok(!serialized.includes('SECRET-WORK'), 'a non-public project\'s work titles never leave the hub');
+  assert.ok(!serialized.includes('SECRET-PROJECT'), 'nor does its name (the pre-existing rule this one follows)');
+});
+
+await t('a project that reported no works reads as an empty list, not null', async () => {
+  const pool = mockPool((sql) => {
+    if (/WITH agg AS/.test(sql)) return { rows: [{ projects: 1, credits: 0, works_shipped: 0, karma: 0, last_active: null, disciplines: null }] };
+    return { rows: [{ name: 'P', origin: ORIGIN, rank_held: null, is_public: true, recent_ships: null }] };
+  });
+  const out = await pi.getRollupForBuilder(42, { pool });
+  assert.deepEqual(out.projects[0].recent_ships, []);
+});
+
+await t('hide_stats suppresses the whole cross-project read, recent_ships included', async () => {
+  for (const acct of [
+    { profile_state: 'active', hide_stats: true },
+    { profile_state: 'provisional', hide_stats: false },
+  ]) {
+    const pool = mockPool(() => ({ rows: [acct] }));
+    assert.equal(await pi.getPublicProfileExtras(42, { pool }), null, JSON.stringify(acct));
+    assert.ok(!pool.find(/WITH agg AS/), 'the rollup query never even runs — no partial numbers, no leak by subtraction');
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The core halves. Everything below pins require.cache BEFORE the core files
+// load, so the REAL handlers run against spies.
+// ---------------------------------------------------------------------------
+
+const admissionPath = require.resolve('../src/bongos/auth-admission.js');
+const realAdmission = require('../src/bongos/auth-admission.js');
+const spy = { shipPushes: [], order: [] };
+// A mutable exports object: section 6 re-points the two reporters at spies
+// after section 5 has used the real ones.
+const admissionExports = {
+  ...realAdmission,
+  reportActivityRollupForShippedTask: async (task) => { spy.shipPushes.push(task); },
+};
+require.cache[admissionPath] = {
+  id: admissionPath, filename: admissionPath, loaded: true, exports: admissionExports,
+};
+
+console.log('\n5. the ship-time push — hub numbers stop being as stale as the last sign-in:');
+
+await t('a task reaching shipped fires the rollup push exactly once', async () => {
+  const seams = require('../src/module-seams.js');
+  const buildAuthRouter = require('../src/bongos/routes/auth.js');
+  buildAuthRouter();
+  spy.shipPushes.length = 0;
+  const invoked = await seams.emitAsync('task.shipped', { id: 1002803, shipped_by: 7 });
+  assert.ok(invoked >= 1, 'the core auth router registered a task.shipped listener');
+  assert.equal(spy.shipPushes.length, 1, 'the ship push fired once');
+  assert.equal(spy.shipPushes[0].shipped_by, 7);
+});
+
+await t('re-instantiating the router does not stack a second listener', async () => {
+  const seams = require('../src/module-seams.js');
+  const buildAuthRouter = require('../src/bongos/routes/auth.js');
+  buildAuthRouter();
+  buildAuthRouter();
+  spy.shipPushes.length = 0;
+  await seams.emitAsync('task.shipped', { id: 1, shipped_by: 7 });
+  assert.equal(spy.shipPushes.length, 1, 'off→on guarded — a ship is pushed once, not once per router build');
+});
+
+console.log('\n6. the check-in is AWAITED before the rollup (ADR 0171 D7 sequencing):');
+
+await t('a federated sign-in does not report activity until its membership check-in has resolved', async () => {
+  // Re-point the reporters at ordering spies, then load a FRESH auth-idp so it
+  // destructures these rather than the real ones section 5 left in place.
+  let releaseCheckIn;
+  const checkInLanded = new Promise((r) => { releaseCheckIn = r; });
+  admissionExports.reportMembershipCheckIn = async () => {
+    spy.order.push('check-in:start');
+    await checkInLanded;
+    spy.order.push('check-in:done');
+  };
+  admissionExports.reportActivityRollup = async () => { spy.order.push('rollup'); };
+  admissionExports.openEnrollmentEnabled = () => true;
+  admissionExports.maybeSeatFirstAdmin = async (b) => b;
+  admissionExports.safeSyncRankRole = async () => {};
+
+  const pin = (rel, exports) => {
+    const p = require.resolve(rel);
+    require.cache[p] = { id: p, filename: p, loaded: true, exports };
+    return p;
+  };
+  pin('../src/bongos/db-kernel.js', {
+    RANKS: ['xenos', 'thetes', 'metic', 'archon'],
+    upsertBuilder: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    getBuilderByGithubId: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    getBuilderById: async () => ({ id: 7, github_id: 42, rank: 'metic' }),
+    createSession: async () => ({}),
+    lookupSession: async () => null,
+    seatFirstAdminIfUnclaimed: async () => null,
+    hasInvitedAccessRequest: async () => true,
+    accessStateByLogin: async () => ({}),
+  });
+  pin('../src/bongos/pool.js', { pool: { query: async () => ({ rows: [] }) } });
+  pin('../src/bongos/auth-config.js', {
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'c1', clientSecret: 's' }),
+  });
+  pin('../src/bongos/auth-github.js', { newSessionToken: () => 'tok' });
+  delete require.cache[require.resolve('../src/bongos/auth-idp.js')];
+
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({
+    ok: true,
+    json: async () => ({ github_id: 42, github_login: 'p07', display_name: 'P07', avatar_url: null }),
+    text: async () => '',
+  });
+  try {
+    const idp = require('../src/bongos/auth-idp.js');
+    await idp.completeIdpFlow({ code: 'x', redirectUri: 'https://p07.example/cb' });
+    // The sign-in has RETURNED and the check-in is still in flight. If the two
+    // pushes were fired side by side, the rollup would already be in `order`
+    // here — and on a first sign-in it would reach a hub with no membership row.
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(spy.order, ['check-in:start'], `rollup must not have fired yet, saw ${JSON.stringify(spy.order)}`);
+    releaseCheckIn();
+    await new Promise((r) => setImmediate(r));
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(spy.order, ['check-in:start', 'check-in:done', 'rollup'], 'the rollup runs only after the check-in resolved');
+  } finally {
+    globalThis.fetch = realFetch;
+  }
+});
+
+await t('the CLI device exchange chains the same way (both federated sign-ins, one rule)', async () => {
+  // completeDeviceExchange needs a hub-signed Ed25519 assertion to reach its
+  // chain, which is a different test's subject — so this half is pinned at the
+  // source, normalised to LF first (this checkout reads back CRLF, and an
+  // anchored multi-line match silently finds nothing otherwise).
+  const fs = require('node:fs');
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth-idp.js'), 'utf8').replace(/\r\n/g, '\n');
+  const chains = src.match(/reportMembershipCheckIn\([\s\S]{0,400}?\n\s*\.then\(\(\) => reportActivityRollup\(/g) || [];
+  assert.equal(chains.length, 2, 'both the web flow and the device exchange chain the rollup after the check-in');
+});
+
+console.log(`\nhub_recent_ships.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);