@bongos/core 1.19.411 → 1.19.412

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.411",
-  "core_contract": "1.19.411",
-  "source_commit": "82d0745903a411db2837e92a8f8fac0a25024fbd",
+  "core_version": "1.19.412",
+  "core_contract": "1.19.412",
+  "source_commit": "049b8f5c6bb893589c47e9e6e3855fc3da1bec06",
   "source_ref": "HEAD",
-  "built_at": "2026-08-28T22:50:38.276Z",
+  "built_at": "2026-08-29T15:07:18.728Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 354,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2044,
-  "tree_sha256": "60b3e50594b84fae8251421e6d1632b4597d941a99cba38344c43aeb3e4e3fb1",
+  "tree_sha256": "d71641215ed53df26d8573408c98ba6afad6b1a95232f3dc1b8055688a98eb08",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1867,7 +1867,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2da385cc79958922b0714f47a7f2c58535cd0e9db516924a6bb61f8ce01e1142"
+      "sha256": "251455d2e8adfcad824b3ce55ba08418109cfb6e386990f3d9acfb551a992884"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5367,12 +5367,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e1ac444053590084d84aa27194b817d8e7f649ef172b63a2b0d6a4a5b51b83d0"
+      "sha256": "07258342132575cf206c98c5c145423c12a5b16f96c3ecf9c8a5c4c4265bcafa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bfea05054d8eb816a33710f43d4b078238ef470615c5768645ee0d30aa547a0c"
+      "sha256": "79513e9d85183a56152ef6bb5a75f61548efc663860f89c1b55df41d3ced73b2"
     },
     {
       "path": "public-docs/index.html",
@@ -7387,7 +7387,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "06547b5cc63cc9ed1f50e49738d437beb1ffa8bf2ca81e396a4a0a795864a7f1"
+      "sha256": "b182b43409b6311ab968db425b6064378cc2842d9abc1f4628f18a3ea7cde9dc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9382,7 +9382,7 @@
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "3b3045a6143d67c963516ed5703b5dabb9b8945a392118721e6a0a56258f1732"
+      "sha256": "5af720ee7c18d4b47630fbbed7cb08901acfbf773960699e312496b8196c9fdc"
     },
     {
       "path": "tests/profile_ui_cross_project.mjs",

package/docs/module-api-changelog.md

@@ -1259,5 +1259,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.409 with no explicit bump. run 33217599338. (task 1002620)
   1.19.411 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.410 with no explicit bump. run 33218290583. (task 1002620)
+  1.19.412 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.411 with no explicit bump. run 33259357678. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.411",
+  "version": "1.19.412",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.411",
+      "version": "1.19.412",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.411",
+  "version": "1.19.412",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.411'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.412'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/profile_route.mjs

@@ -11,14 +11,38 @@
 // Stub auth + db + the lifecycle/reward ports (no network, no Postgres) exactly
 // as tests/onboarding_route_signals.mjs does for the sibling public route.
 //
+// R06 (task 1002282) extends it with the consent PROOF — the five claims goal
+// 1000045's C2 rests on, all DB-free so the `unit` gate actually runs them:
+//   1. a two-project builder's COMBINED record is served to another account
+//      (the route is unauthenticated and viewer-independent, ADR 0171 D4);
+//   2. flipping hide_stats removes it on the IMMEDIATE next load, and the
+//      response is `Cache-Control: no-store` — the old `public, max-age=60`
+//      would keep serving the pre-hide body for a minute (ADR 0171 D5);
+//   3. `/scouting` (the endpoint the hall's /people page renders) drops the
+//      hidden builder too — enforcement is on every read path, not the profile;
+//   4. the leak guard BITES: planting a private field turns the key-list and
+//      sentinel assertions red (a leak test that cannot fail is not a test);
+//   5. no PARTIAL numbers survive a hide — a count beside a hidden total is a
+//      leak by subtraction.
+//
+// RESIDUAL, stated honestly (goal 1000045 C2): hide removes the hub's
+// AGGREGATED view, not the per-instance public numbers it is derived from.
+// Every instance's own public surfaces (its /public/leaderboard) stay public by
+// design, so a determined reader can still reconstruct a sum the hard way.
+//
 // Run:  node tests/profile_route.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const sourceOf = (rel) => readFileSync(join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
 
 let passed = 0;
 let failed = 0;
@@ -90,7 +114,7 @@ const CROSS_PROJECT_ROWS = [
 // shape — named projects only where the catalog row is public; the rest counted.
 function stubPublicProfileExtras() {
   const named = CROSS_PROJECT_ROWS.filter((r) => r.is_public)
-    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held }));
+    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held, recent_ships: [] }));
   return {
     totals: { projects: 2, credits: 150, works_shipped: 7, karma: 4 },
     disciplines: ['engineer', 'ui'],
@@ -101,7 +125,28 @@ function stubPublicProfileExtras() {
 }
 // The key contract for the cross_project object + its project rows.
 const CP_PUBLIC_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
-const CP_PROJECT_ROW_KEYS = ['name', 'origin', 'rank_held'];
+// recent_ships rides the project row (task 1002803) and is ALWAYS present —
+// getRollupForBuilder defaults it to [] — so it belongs in the exact key list.
+const CP_PROJECT_ROW_KEYS = ['name', 'origin', 'rank_held', 'recent_ships'];
+// Every module-internal value that must never reach a public body.
+const CP_SENTINELS = [SECRET_CLIENT_ID, SECRET_PROJECT_NAME, SECRET_EMAIL, SECRET_USER, SECRET_REASON];
+
+// The cross_project whitelist contract, in ONE place — the positive tests and
+// the R06 negative control (task 1002282) run the SAME guard, which is what
+// makes "planting a private field turns it red" a proof rather than a claim.
+// Asserts the exact key list on the object and on every project row, and that
+// no sentinel (nor the literal `client_id` key) survives in the raw body.
+function assertCrossProjectContract(cp, text) {
+  assert.deepEqual(Object.keys(cp).sort(), [...CP_PUBLIC_KEYS].sort(), 'cross_project keys are exactly the contract');
+  assert.deepEqual(Object.keys(cp.totals).sort(), ['credits', 'karma', 'projects', 'works_shipped']);
+  for (const row of cp.projects) {
+    assert.deepEqual(Object.keys(row).sort(), [...CP_PROJECT_ROW_KEYS].sort(), 'project rows carry only the whitelisted keys');
+  }
+  for (const secret of CP_SENTINELS) {
+    assert.ok(!text.includes(secret), `response body must not contain "${secret}"`);
+  }
+  assert.ok(!text.includes('client_id'), 'no client_id key may cross the port');
+}
 
 // ---- stubs ----------------------------------------------------------------
 
@@ -161,9 +206,9 @@ function listen(app) {
   });
 }
 
-function get(port, path) {
+function get(port, path, headers) {
   return new Promise((resolve, reject) => {
-    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path }, (res) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path, headers: headers || {} }, (res) => {
       const chunks = [];
       res.on('data', (c) => chunks.push(c));
       res.on('end', () => {
@@ -235,8 +280,12 @@ await t('hub port ABSENT → no cross_project key + the cacheable posture stays'
 });
 
 let hubExtras = stubPublicProfileExtras();
+// The port's public read sits behind a swappable reference: a port is
+// single-provider by design (registerProvider throws on a duplicate), and the
+// R06 proofs below repoint this at the REAL module read over a fake engine.
+let hubPublicRead = async () => hubExtras;
 seams.registerProvider('platform-identity.hub', {
-  getPublicProfileExtras: async () => hubExtras,
+  getPublicProfileExtras: async (githubId) => hubPublicRead(githubId),
   getOwnProfileExtras: async () => stubPublicProfileExtras(),
 });
 
@@ -245,11 +294,7 @@ await t('hub port present → cross_project carries exactly the whitelist shape'
   assert.equal(r.status, 200);
   const cp = r.json.cross_project;
   assert.ok(cp, 'cross_project attached when the port resolves');
-  assert.deepEqual(Object.keys(cp).sort(), [...CP_PUBLIC_KEYS].sort(), 'cross_project keys are exactly the contract');
-  assert.deepEqual(Object.keys(cp.totals).sort(), ['credits', 'karma', 'projects', 'works_shipped']);
-  for (const row of cp.projects) {
-    assert.deepEqual(Object.keys(row).sort(), [...CP_PROJECT_ROW_KEYS].sort(), 'project rows carry only name/origin/rank_held');
-  }
+  assertCrossProjectContract(cp, r.text);
   assert.equal(cp.projects.length, 1, 'only the public catalog row is named');
   assert.equal(cp.more_projects, 1, 'the non-public project is counted, never named');
 });
@@ -277,6 +322,241 @@ await t('hub port returns null (hidden/provisional/none) → cross_project: null
   assert.equal(r.headers['cache-control'], 'no-store');
 });
 
+// ---- R06 PROOF: hide is honored on every read path (task 1002282) ---------
+//
+// Deps R03 (task 1002279 — the hide_stats flag) and R04 (task 1002280 — the
+// profile UI section) shipped; this pins their behaviour so it cannot rot. The
+// proofs below run the REAL module reads (getPublicProfileExtras,
+// setAccountHideStats, listScoutingRollup) and the REAL routes over a fake
+// engine, so what is proven is the COMPOSITION — route → port → module read →
+// query — not a stub of the answer.
+
+// A deliberately literal-minded stand-in for Postgres. It holds the fixture
+// rows and applies ONLY the consent predicates the query it is handed actually
+// declares. That is what makes the scouting proof real rather than circular:
+// delete `NOT pa.hide_stats` from listScoutingRollup and the hidden builder
+// walks straight into the response, turning these tests red. The SQL semantics
+// themselves (the un-fanned sums) are proven against a live Postgres by
+// tests/profile_rollup_consent.mjs and tests/scouting_rollup_fanout.mjs.
+const HUB_GITHUB_ID = FULL_ROW.github_id;
+const HIDDEN_LOGIN = 'hidden-DO-NOT-LEAK-r06';
+const PROV_LOGIN = 'provisional-DO-NOT-LEAK-r06';
+
+// TWO projects — one publicly catalogued, one not. Distinctive digits so the
+// "no partial numbers" scan below cannot pass by coincidence.
+const PROOF_PROJECTS = [
+  { name: 'R06 Public Proj', origin: 'https://r06-pub.example', rank_held: 'metic',
+    credits: 60271, tasks_shipped: 4103, karma: 9021, is_public: true },
+  { name: SECRET_PROJECT_NAME, origin: 'https://r06-priv.example', rank_held: 'archon',
+    credits: 40129, tasks_shipped: 2011, karma: 3007, is_public: false },
+];
+const sumOf = (k) => PROOF_PROJECTS.reduce((n, p) => n + p[k], 0);
+
+// The one account row the reads consult. setAccountHideStats mutates it.
+const hubAccount = { profile_state: 'active', hide_stats: false, handle: 'r06-handle' };
+
+// The scouting "table": one visible builder plus the two that consent excludes.
+const SCOUTING_TABLE = [
+  { profile_state: 'active', hide_stats: false,
+    row: { github_id: '11', github_login: 'r06-visible', display_name: 'Visible', avatar_url: null,
+      project_count: 2, total_credits: 5, total_tasks_shipped: 1, total_karma: 0,
+      last_active: '2026-08-01T00:00:00.000Z', disciplines: ['engineer'] } },
+  { profile_state: 'active', hide_stats: true,
+    row: { github_id: '12', github_login: HIDDEN_LOGIN, display_name: 'Hidden', avatar_url: null,
+      project_count: 7, total_credits: 88817, total_tasks_shipped: 6613, total_karma: 5519,
+      last_active: '2026-08-02T00:00:00.000Z', disciplines: ['ui'] } },
+  { profile_state: 'provisional', hide_stats: false,
+    row: { github_id: '13', github_login: PROV_LOGIN, display_name: 'Provisional', avatar_url: null,
+      project_count: 1, total_credits: 71713, total_tasks_shipped: 1, total_karma: 0,
+      last_active: '2026-08-03T00:00:00.000Z', disciplines: [] } },
+];
+
+const engine = {
+  calls: [],
+  query: async (text, params = []) => {
+    const sql = String(text);
+    engine.calls.push({ sql, params });
+
+    // listScoutingRollup — the ONE read behind GET /scouting and the hall's
+    // /people page. Honors exactly the predicates the query declares.
+    if (/AS project_count/.test(sql)) {
+      let rows = SCOUTING_TABLE;
+      if (/pa\.profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
+      if (/NOT pa\.hide_stats/.test(sql)) rows = rows.filter((r) => !r.hide_stats);
+      return { rows: rows.map((r) => ({ ...r.row })) };
+    }
+    // setAccountHideStats — the own-scoped write behind PATCH /me/cross-project.
+    if (/INSERT INTO platform_identity_accounts/.test(sql)) {
+      hubAccount.hide_stats = !!params[4];
+      return { rows: [{ github_id: String(HUB_GITHUB_ID), github_login: 'jaxri', ...hubAccount }] };
+    }
+    // getPublicProfileExtras' consent read.
+    if (/SELECT profile_state, hide_stats/.test(sql)) {
+      return { rows: [{ profile_state: hubAccount.profile_state, hide_stats: hubAccount.hide_stats }] };
+    }
+    // getRollupForBuilder's per-project rows (the client_id → origin two-hop).
+    if (/platform_identity_sso_clients/.test(sql)) {
+      return { rows: PROOF_PROJECTS.map((p) => ({ name: p.name, origin: p.origin, rank_held: p.rank_held, is_public: p.is_public, recent_ships: [] })) };
+    }
+    // getRollupForBuilder's un-fanned aggregate — summed ACROSS both projects.
+    if (/AS works_shipped/.test(sql)) {
+      return { rows: [{ projects: PROOF_PROJECTS.length, credits: sumOf('credits'),
+        works_shipped: sumOf('tasks_shipped'), karma: sumOf('karma'),
+        last_active: '2026-08-02T00:00:00.000Z', disciplines: ['engineer', 'ui'] }] };
+    }
+    throw new Error(`fake engine: unexpected query ${sql.slice(0, 60)}`);
+  },
+};
+
+// Pin the module doorway (ADR 0083) BEFORE platform-identity loads, so the
+// module's default pool — destructured at require time — is the fake engine.
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool: engine,
+    requireBuilder: (_req, _res, next) => next(),
+    requirePermission: () => (_req, _res, next) => next(),
+    parsePagination: () => ({ limit: 100, offset: 0 }),
+    corsPublicGet: () => (_req, _res, next) => next(),
+  },
+};
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildScoutingRoutes = require('../modules/platform-identity/routes/scouting.js');
+
+// From here the port serves the REAL public read over the fake engine.
+hubPublicRead = (githubId) => pi.getPublicProfileExtras(githubId, { pool: engine });
+
+await t('R06.1 a two-project builder\'s COMBINED record shows to another account', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  const cp = r.json.cross_project;
+  assert.ok(cp, 'the record is served');
+  assertCrossProjectContract(cp, r.text);
+  assert.equal(cp.totals.projects, 2, 'both projects count');
+  assert.equal(cp.totals.credits, sumOf('credits'), 'credits are the sum across BOTH projects');
+  assert.equal(cp.totals.works_shipped, sumOf('tasks_shipped'), 'ships are summed across both');
+  assert.equal(cp.totals.karma, sumOf('karma'), 'karma is summed across both');
+  assert.deepEqual(cp.disciplines, ['engineer', 'ui'], 'the disciplines union spans both projects');
+  assert.equal(cp.projects.length, 1, 'only the publicly-catalogued project is NAMED');
+  assert.equal(cp.projects[0].name, PROOF_PROJECTS[0].name);
+  assert.equal(cp.more_projects, 1, 'the other is counted, never named');
+});
+
+await t('R06.1 the record is viewer-INDEPENDENT — another account sees the same body', async () => {
+  const anon = await get(port, '/api/gds/builders/95/profile');
+  const other = await get(port, '/api/gds/builders/95/profile', { Cookie: 'gds_session=some-other-builder' });
+  assert.equal(other.status, 200);
+  assert.equal(other.text, anon.text, 'one response shape for every reader (ADR 0171 D4)');
+});
+
+await t('R06.1 the profile read takes NO auth middleware — the portfolio is shareable', () => {
+  // A future PR walling this behind requireBuilder would break "another account
+  // can see it" while every assertion above still passed, so pin the shape.
+  const line = sourceOf('src/bongos/routes/builders.js').split('\n')
+    .find((l) => l.includes("router.get('/builders/:id/profile'"));
+  assert.ok(line, 'the profile route registration is findable');
+  assert.match(line, /router\.get\('\/builders\/:id\/profile', async \(req, res\) => \{/,
+    'nothing may sit between the path and the handler — that is what makes the record public');
+});
+
+await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is planted', async () => {
+  const realRead = hubPublicRead;
+  const rollup = async () => pi.getPublicProfileExtras(HUB_GITHUB_ID, { pool: engine });
+  try {
+    // (a) a module-internal key on the object itself.
+    hubPublicRead = async () => ({ ...(await rollup()), client_id: SECRET_CLIENT_ID });
+    let r = await get(port, '/api/gds/builders/95/profile');
+    assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
+      /cross_project keys are exactly the contract/, 'an extra top-level key must turn the guard red');
+
+    // (b) a module-internal key on a project ROW (the is_public discriminator).
+    hubPublicRead = async () => {
+      const cp = await rollup();
+      return { ...cp, projects: cp.projects.map((p) => ({ ...p, is_public: true })) };
+    };
+    r = await get(port, '/api/gds/builders/95/profile');
+    assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
+      /project rows carry only the whitelisted keys/, 'an extra project-row key must turn the guard red');
+
+    // (c) a sentinel smuggled inside an ALLOWED field — key lists stay legal, so
+    // this isolates the raw-body scan. This is the leak the shape check cannot see.
+    hubPublicRead = async () => {
+      const cp = await rollup();
+      return { ...cp, projects: [{ ...cp.projects[0], name: SECRET_PROJECT_NAME }] };
+    };
+    r = await get(port, '/api/gds/builders/95/profile');
+    assert.deepEqual(Object.keys(r.json.cross_project).sort(), [...CP_PUBLIC_KEYS].sort(),
+      'the planted leak is shape-legal — only the sentinel scan can catch it');
+    assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
+      /must not contain/, 'a sentinel in an allowed field must turn the guard red');
+  } finally {
+    hubPublicRead = realRead;
+  }
+});
+
+await t('R06.2 hide_stats removes the record on the IMMEDIATE next load', async () => {
+  const before = await get(port, '/api/gds/builders/95/profile');
+  assert.ok(before.json.cross_project, 'public before the flip');
+  assert.equal(before.headers['cache-control'], 'no-store');
+
+  // Flip it through the REAL write the own-scoped PATCH /me/cross-project uses.
+  const row = await pi.setAccountHideStats(
+    { githubId: HUB_GITHUB_ID, githubLogin: 'jaxri', hide: true }, { pool: engine });
+  assert.equal(row.hide_stats, true, 'the write path set the flag');
+
+  // No sleep, no second server, no cache warm-up: the very next load.
+  const after = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(after.status, 200);
+  assert.equal(after.json.cross_project, null, 'gone on the next load');
+  assert.equal(after.headers['cache-control'], 'no-store', 'hide must beat the cache (ADR 0171 D5)');
+  assert.ok(!/max-age/.test(after.headers['cache-control'] || ''),
+    'any max-age would let a cache keep serving the pre-hide body — the old public, max-age=60 failed exactly here');
+});
+
+await t('R06.5 no PARTIAL numbers survive the hide (a count beside a hidden total leaks by subtraction)', async () => {
+  // Set the flag here too, so this proof stands on its own rather than on
+  // whatever R06.2 left behind.
+  await pi.setAccountHideStats({ githubId: HUB_GITHUB_ID, githubLogin: 'jaxri', hide: true }, { pool: engine });
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.json.cross_project, null);
+  for (const key of ['totals', 'works_shipped', 'more_projects', 'last_active', 'rank_held']) {
+    assert.ok(!r.text.includes(key), `nothing derived from the rollup may survive — found "${key}"`);
+  }
+  const digits = [sumOf('credits'), sumOf('tasks_shipped'), sumOf('karma'),
+    ...PROOF_PROJECTS.map((p) => p.credits)].map(String);
+  for (const v of [...digits, ...PROOF_PROJECTS.map((p) => p.name), ...PROOF_PROJECTS.map((p) => p.origin)]) {
+    assert.ok(!r.text.includes(v), `no rollup value may survive a hide — found "${v}"`);
+  }
+});
+
+// ---- R06.3: the OTHER read paths honor hide too ---------------------------
+
+const scoutApp = express();
+scoutApp.use(attachFail);
+scoutApp.use('/api/gds', buildScoutingRoutes());
+const scout = await listen(scoutApp);
+
+await t('R06.3 GET /scouting drops the hidden AND the provisional builder', async () => {
+  engine.calls.length = 0;
+  const r = await get(scout.port, '/api/gds/scouting');
+  assert.equal(r.status, 200);
+  const logins = r.json.builders.map((b) => b.github_login);
+  assert.deepEqual(logins, ['r06-visible'], 'only the consented, non-hidden builder is listed');
+  assert.equal(engine.calls.length, 1, 'exactly ONE read — nothing can re-enter via a second, unfiltered query');
+  for (const s of [HIDDEN_LOGIN, PROV_LOGIN, '88817', '6613', '5519', '71713']) {
+    assert.ok(!r.text.includes(s), `the excluded builder leaks nothing — found "${s}"`);
+  }
+});
+
+await t('R06.3 the /people page reads /scouting and nothing else', async () => {
+  // /people is the hall's render of the same endpoint, so whatever /scouting
+  // drops, /people drops. Pin that it has no second data source.
+  const endpoints = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/fetch\(\s*'([^']+)'/g)].map((m) => m[1]);
+  assert.deepEqual(endpoints, ['/api/gds/scouting?limit=500'], '/people has exactly one data source');
+});
+
+scout.server.close();
 server.close();
 
 console.log(`\n${passed} passed, ${failed} failed`);