@bongos/core 1.19.411 → 1.19.413

package/tests/account_privacy_flags.mjs

@@ -0,0 +1,299 @@
+// tests/account_privacy_flags.mjs — account_visibility + recruiter_discoverable
+// (task 1002966, goal 1000045; docs/specs/bongos-v1-privacy-and-invites.md D1/D3).
+//
+// These two flags are the keystone of the privacy model — task 1002967 (the
+// shared effective-visibility predicate), task 1002968 (recruiter-sliver
+// gating), task 1002806 (the private-profile 404 proof) and task 1002290
+// (opt out of recruiting) all read them — so the MODEL is what this pins, not
+// the plumbing:
+//
+//   1. the migration's stored shape: visibility NOT NULL DEFAULT 'public' with a
+//      two-value CHECK, discoverable NULLABLE (the tri-state is deliberate);
+//   2. isRecruiterDiscoverable() — the ONE predicate, the JS twin of
+//      COALESCE(recruiter_discoverable, account_visibility = 'public'): a fresh
+//      account is public + discoverable, private flips the effective answer
+//      while the column stays NULL, and an explicit boolean beats both (the
+//      spec's D2 "private · discoverable" row is allowed, not refused);
+//   3. the own-scoped write: only the flags sent are written, never identity,
+//      never consent, never hide_stats — and the account is always the SESSION's
+//      (a body can neither name nor reach another one);
+//   4. the leak rule: neither column may appear in a public response body.
+//
+// Pure — a recording fake pool, no Postgres, no network. Runs in the DB-free
+// unit gate.
+//
+// Run:  node tests/account_privacy_flags.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const MIGRATION = readFileSync(
+  join(ROOT, 'modules/platform-identity/migrations/platform_identity_012_account_privacy.sql'), 'utf8');
+
+// ---- the recording fake pool ----------------------------------------------
+//
+// One shared pool object so the route's `pool` (pinned into module-api below,
+// resolved once at require time) and each test's queue are the same thing.
+let queued = [];
+let calls = [];
+const pool = {
+  query: async (text, params) => {
+    calls.push({ text: String(text), params: params || [] });
+    return queued.shift() || { rows: [], rowCount: 0 };
+  },
+};
+function expect(...responses) { queued = responses; calls = []; }
+
+// ---- the route over the real domain, with core pinned ----------------------
+
+const SESSION = { github_id: 4242, github_login: 'octo', display_name: 'Octo', avatar_url: 'https://a.example/o.png' };
+const OTHER_ACCOUNT = 9999;
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    // The own-scope stub: a live session, exactly as requireBuilder leaves it.
+    requireBuilder: (req, _res, next) => { req.builder = { ...SESSION }; next(); },
+  },
+};
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildProfileRoutes = require('../modules/platform-identity/routes/profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildProfileRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// A stored row as the module's RETURNING clause hands it back.
+const row = (over = {}) => ({
+  github_id: String(SESSION.github_id), github_login: 'octo', profile_state: 'active',
+  hide_stats: false, account_visibility: 'public', recruiter_discoverable: null,
+  handle: 'octo', ...over,
+});
+
+// ---- 1. the stored shape ---------------------------------------------------
+
+test('migration 012 stores visibility NOT NULL DEFAULT public and discoverable NULLABLE', () => {
+  assert.match(MIGRATION, /ADD COLUMN IF NOT EXISTS account_visibility text NOT NULL DEFAULT 'public'/,
+    "public is the default, and the DEFAULT clause IS the backfill — no existing profile changes state");
+  assert.match(MIGRATION, /ADD COLUMN IF NOT EXISTS recruiter_discoverable boolean;/,
+    'recruiter_discoverable is a bare nullable boolean');
+  assert.doesNotMatch(MIGRATION, /recruiter_discoverable boolean NOT NULL/,
+    'NOT NULL would destroy the tri-state: NULL is what "follow visibility" is made of');
+  assert.match(MIGRATION, /CHECK \(account_visibility IN \('public', 'private'\)\)/,
+    'the engine refuses a third visibility value');
+  assert.match(MIGRATION, /ALTER TABLE platform_identity_accounts/, 'the flags live on the hub account (ADR 0171 D4 precedent)');
+});
+
+// ---- 2. the ONE predicate --------------------------------------------------
+
+test('a fresh account is public AND discoverable — the opt-out half of D1', () => {
+  assert.equal(pi.isRecruiterDiscoverable(row()), true);
+  assert.equal(pi.isRecruiterDiscoverable(row({ recruiter_discoverable: false })), false,
+    'a public account can leave recruiting and stay public');
+});
+
+test('private flips the effective answer to false while the column stays NULL', () => {
+  const acct = row({ account_visibility: 'private' });
+  assert.equal(acct.recruiter_discoverable, null, 'the stored flag is untouched — only the derived answer moves');
+  assert.equal(pi.isRecruiterDiscoverable(acct), false, 'recruiting is opt-IN for a private account');
+});
+
+test('an explicit true on a private account WINS (the spec D2 private-discoverable row)', () => {
+  assert.equal(pi.isRecruiterDiscoverable(row({ account_visibility: 'private', recruiter_discoverable: true })), true,
+    'the spec allows this state — it is exactly what the D3 recruiter sliver serves');
+});
+
+test('isRecruiterDiscoverable is fail-closed on a missing account or a missing column', () => {
+  assert.equal(pi.isRecruiterDiscoverable(null), false);
+  assert.equal(pi.isRecruiterDiscoverable({}), false, 'no visibility column read → not discoverable');
+  assert.deepEqual(pi.ACCOUNT_VISIBILITY, ['public', 'private']);
+});
+
+// ---- 3. the own-scoped write -----------------------------------------------
+
+test('setAccountPrivacy writes ONLY the flags sent — never identity, consent, or hide_stats', async () => {
+  expect({ rows: [row({ account_visibility: 'private' })] });
+  const out = await pi.setAccountPrivacy(
+    { githubId: SESSION.github_id, githubLogin: 'octo', fields: { account_visibility: 'private' } }, { pool });
+  assert.equal(out.account_visibility, 'private');
+  const sql = calls[0].text;
+  const updateBranch = sql.slice(sql.indexOf('DO UPDATE'), sql.indexOf('RETURNING'));
+  assert.match(updateBranch, /account_visibility\s+= CASE WHEN \$7::boolean THEN EXCLUDED\.account_visibility/);
+  assert.match(updateBranch, /recruiter_discoverable = CASE WHEN \$8::boolean THEN EXCLUDED\.recruiter_discoverable/);
+  assert.doesNotMatch(updateBranch, /github_login|display_name|avatar_url|profile_state|hide_stats/,
+    'a privacy toggle is not an identity refresh, a consent grant, or a hide');
+  assert.equal(calls[0].params[6], true, 'visibility was sent');
+  assert.equal(calls[0].params[7], false, 'discoverable was not — its CASE arm keeps the stored value');
+});
+
+test('setAccountPrivacy accepts an explicit null discoverable — the reset to "follow visibility"', async () => {
+  expect({ rows: [row()] });
+  await pi.setAccountPrivacy(
+    { githubId: SESSION.github_id, fields: { recruiter_discoverable: null } }, { pool });
+  assert.equal(calls[0].params[5], null, 'null is written, not skipped');
+  assert.equal(calls[0].params[7], true, 'and it counts as sent');
+});
+
+test('setAccountPrivacy refuses a value outside the model, before any query', async () => {
+  expect();
+  assert.equal((await pi.setAccountPrivacy(
+    { githubId: SESSION.github_id, fields: { account_visibility: 'stealth' } }, { pool })).error,
+  'invalid_account_visibility');
+  assert.equal((await pi.setAccountPrivacy(
+    { githubId: SESSION.github_id, fields: { recruiter_discoverable: 'yes' } }, { pool })).error,
+  'invalid_recruiter_discoverable');
+  assert.equal((await pi.setAccountPrivacy({ githubId: SESSION.github_id, fields: {} }, { pool })).error, 'no_fields');
+  assert.equal((await pi.setAccountPrivacy(
+    { githubId: 'system:bfg', fields: { account_visibility: 'private' } }, { pool })).error, 'no_account');
+  assert.equal(calls.length, 0, 'a rejected write never reaches the database');
+});
+
+test('PATCH keys the write on the SESSION account — a body can neither name nor reach another one', async () => {
+  expect({ rows: [row({ account_visibility: 'private' })] });
+  const res = await call('PATCH', '/api/bongos/me/cross-project', { account_visibility: 'private' });
+  assert.equal(res.status, 200);
+  assert.equal(calls[0].params[0], SESSION.github_id, 'the write is keyed on the authenticated github_id');
+  assert.ok(!JSON.stringify(calls[0].params).includes(String(OTHER_ACCOUNT)));
+
+  expect({ rows: [row()] });
+  const named = await call('PATCH', '/api/bongos/me/cross-project',
+    { account_visibility: 'private', github_id: OTHER_ACCOUNT });
+  assert.equal(named.status, 400, 'a body that names an account is rejected outright (strict validation)');
+  assert.equal(named.json.error.code, 'validation_failed');
+  assert.equal(calls.length, 0, 'and nothing was written');
+});
+
+test('PATCH refuses a visibility outside the model and an empty body', async () => {
+  expect();
+  const bad = await call('PATCH', '/api/bongos/me/cross-project', { account_visibility: 'stealth' });
+  assert.equal(bad.status, 400);
+  assert.equal(bad.json.error.code, 'validation_failed');
+  const empty = await call('PATCH', '/api/bongos/me/cross-project', {});
+  assert.equal(empty.status, 400);
+  assert.equal(empty.json.error.code, 'no_fields');
+  assert.equal(calls.length, 0);
+});
+
+test('PATCH answers with the stored flags plus the ONE derived effective answer', async () => {
+  expect({ rows: [row({ account_visibility: 'private', recruiter_discoverable: true })] });
+  const res = await call('PATCH', '/api/bongos/me/cross-project', { recruiter_discoverable: true });
+  assert.deepEqual(res.json, {
+    hide_stats: false, account_visibility: 'private',
+    recruiter_discoverable: true, recruiter_discoverable_effective: true,
+  });
+});
+
+test('PATCH { hide_stats } alone still works and carries the privacy flags back', async () => {
+  expect({ rows: [row({ hide_stats: true })] });
+  const res = await call('PATCH', '/api/bongos/me/cross-project', { hide_stats: true });
+  assert.equal(res.status, 200);
+  assert.equal(res.json.hide_stats, true);
+  assert.equal(res.json.account_visibility, 'public');
+  assert.equal(res.json.recruiter_discoverable_effective, true);
+  assert.match(calls[0].text, /hide_stats/, 'the hide flag keeps its own writer (ADR 0171 D4)');
+});
+
+test('GET serves the own-scope view: both flags plus the effective answer', async () => {
+  expect(
+    { rows: [row({ account_visibility: 'private' })] },
+    { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
+    { rows: [] },
+  );
+  const res = await call('GET', '/api/bongos/me/cross-project');
+  assert.equal(res.status, 200);
+  assert.equal(res.json.account_visibility, 'private');
+  assert.equal(res.json.recruiter_discoverable, null);
+  assert.equal(res.json.recruiter_discoverable_effective, false, 'derived server-side, so no client re-derives it');
+});
+
+// ---- 4. the leak rule ------------------------------------------------------
+
+test('neither flag crosses a PUBLIC response — the /u/<handle> read stays a whitelist', async () => {
+  // The stored row carries both flags AND a sentinel private value; the public
+  // shape must be built from the whitelist, not spread from the row.
+  expect(
+    { rows: [{
+      github_id: '4242', github_login: 'octo', display_name: 'Octo', avatar_url: null,
+      handle: 'octo', bio: null, links: null, created_at: 'T', is_current: true,
+      account_visibility: 'private', recruiter_discoverable: true, profile_state: 'active', hide_stats: false,
+    }] },
+    { rows: [{ profile_state: 'active', hide_stats: false }] },
+    { rows: [{ projects: 1, credits: 10, works_shipped: 1, karma: 0, last_active: 'T', disciplines: null }] },
+    { rows: [] },
+  );
+  const out = await pi.getPublicProfileByHandle('octo', { pool });
+  const text = JSON.stringify(out);
+  for (const leak of ['account_visibility', 'recruiter_discoverable', 'profile_state', 'hide_stats', 'github_id']) {
+    assert.ok(!text.includes(leak), `${leak} must never serialize into a public body`);
+  }
+  assert.deepEqual(Object.keys(out.account).sort(),
+    ['avatar_url', 'bio', 'display_name', 'github_login', 'handle', 'links', 'member_since']);
+});
+
+// ---- 5. the settings copy states the grant ---------------------------------
+
+test('the discoverable toggle names EXACTLY what it grants — the D3 sliver, name-only when hidden', () => {
+  const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
+  const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  assert.match(js, /your name, your disciplines, and whether you have been active in the last 30 days/,
+    'the sliver is name + disciplines + a coarse activity signal — spelled out, not implied');
+  assert.match(js, /never your credits, works shipped, karma, or the projects you build on/,
+    'and the copy says what it does NOT grant');
+  assert.match(js, /cross-project record is hidden, they will see your name and nothing else/,
+    'hide_stats shrinks the grant to name-only, because the rest is rollup-derived');
+  assert.match(html, /<section[^>]*id="privacy-scroll"[^>]*hidden>/,
+    'the section ships hidden — it reveals only where the hub module answers');
+});
+
+test('no toggle claims a protection this task has not built — the read paths are still open', () => {
+  const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
+  const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  // Storing a flag is not enforcing it (task 1002967 wires the read paths). A
+  // builder flipping this for personal safety must not be told they are hidden
+  // while GET /profiles/:handle still serves the page.
+  assert.match(html, /saved to your account now\. They start applying as[\s\S]*nothing is hidden yet/,
+    'the section states plainly that the choice is recorded, not yet in force');
+  assert.doesNotMatch(js, /Private hides the page|is private — hidden from everyone/,
+    'no present-tense promise that the page is already hidden');
+  assert.match(js, /Private will hide the page from everyone but you/,
+    'the row says what the choice WILL do');
+});

package/tests/profile_route.mjs

@@ -11,14 +11,38 @@
 // Stub auth + db + the lifecycle/reward ports (no network, no Postgres) exactly
 // as tests/onboarding_route_signals.mjs does for the sibling public route.
 //
+// R06 (task 1002282) extends it with the consent PROOF — the five claims goal
+// 1000045's C2 rests on, all DB-free so the `unit` gate actually runs them:
+//   1. a two-project builder's COMBINED record is served to another account
+//      (the route is unauthenticated and viewer-independent, ADR 0171 D4);
+//   2. flipping hide_stats removes it on the IMMEDIATE next load, and the
+//      response is `Cache-Control: no-store` — the old `public, max-age=60`
+//      would keep serving the pre-hide body for a minute (ADR 0171 D5);
+//   3. `/scouting` (the endpoint the hall's /people page renders) drops the
+//      hidden builder too — enforcement is on every read path, not the profile;
+//   4. the leak guard BITES: planting a private field turns the key-list and
+//      sentinel assertions red (a leak test that cannot fail is not a test);
+//   5. no PARTIAL numbers survive a hide — a count beside a hidden total is a
+//      leak by subtraction.
+//
+// RESIDUAL, stated honestly (goal 1000045 C2): hide removes the hub's
+// AGGREGATED view, not the per-instance public numbers it is derived from.
+// Every instance's own public surfaces (its /public/leaderboard) stay public by
+// design, so a determined reader can still reconstruct a sum the hard way.
+//
 // Run:  node tests/profile_route.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const sourceOf = (rel) => readFileSync(join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
 
 let passed = 0;
 let failed = 0;
@@ -90,7 +114,7 @@ const CROSS_PROJECT_ROWS = [
 // shape — named projects only where the catalog row is public; the rest counted.
 function stubPublicProfileExtras() {
   const named = CROSS_PROJECT_ROWS.filter((r) => r.is_public)
-    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held }));
+    .map((r) => ({ name: r.name, origin: r.origin, rank_held: r.rank_held, recent_ships: [] }));
   return {
     totals: { projects: 2, credits: 150, works_shipped: 7, karma: 4 },
     disciplines: ['engineer', 'ui'],
@@ -101,7 +125,28 @@ function stubPublicProfileExtras() {
 }
 // The key contract for the cross_project object + its project rows.
 const CP_PUBLIC_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
-const CP_PROJECT_ROW_KEYS = ['name', 'origin', 'rank_held'];
+// recent_ships rides the project row (task 1002803) and is ALWAYS present —
+// getRollupForBuilder defaults it to [] — so it belongs in the exact key list.
+const CP_PROJECT_ROW_KEYS = ['name', 'origin', 'rank_held', 'recent_ships'];
+// Every module-internal value that must never reach a public body.
+const CP_SENTINELS = [SECRET_CLIENT_ID, SECRET_PROJECT_NAME, SECRET_EMAIL, SECRET_USER, SECRET_REASON];
+
+// The cross_project whitelist contract, in ONE place — the positive tests and
+// the R06 negative control (task 1002282) run the SAME guard, which is what
+// makes "planting a private field turns it red" a proof rather than a claim.
+// Asserts the exact key list on the object and on every project row, and that
+// no sentinel (nor the literal `client_id` key) survives in the raw body.
+function assertCrossProjectContract(cp, text) {
+  assert.deepEqual(Object.keys(cp).sort(), [...CP_PUBLIC_KEYS].sort(), 'cross_project keys are exactly the contract');
+  assert.deepEqual(Object.keys(cp.totals).sort(), ['credits', 'karma', 'projects', 'works_shipped']);
+  for (const row of cp.projects) {
+    assert.deepEqual(Object.keys(row).sort(), [...CP_PROJECT_ROW_KEYS].sort(), 'project rows carry only the whitelisted keys');
+  }
+  for (const secret of CP_SENTINELS) {
+    assert.ok(!text.includes(secret), `response body must not contain "${secret}"`);
+  }
+  assert.ok(!text.includes('client_id'), 'no client_id key may cross the port');
+}
 
 // ---- stubs ----------------------------------------------------------------
 
@@ -161,9 +206,9 @@ function listen(app) {
   });
 }
 
-function get(port, path) {
+function get(port, path, headers) {
   return new Promise((resolve, reject) => {
-    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path }, (res) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path, headers: headers || {} }, (res) => {
       const chunks = [];
       res.on('data', (c) => chunks.push(c));
       res.on('end', () => {
@@ -235,8 +280,12 @@ await t('hub port ABSENT → no cross_project key + the cacheable posture stays'
 });
 
 let hubExtras = stubPublicProfileExtras();
+// The port's public read sits behind a swappable reference: a port is
+// single-provider by design (registerProvider throws on a duplicate), and the
+// R06 proofs below repoint this at the REAL module read over a fake engine.
+let hubPublicRead = async () => hubExtras;
 seams.registerProvider('platform-identity.hub', {
-  getPublicProfileExtras: async () => hubExtras,
+  getPublicProfileExtras: async (githubId) => hubPublicRead(githubId),
   getOwnProfileExtras: async () => stubPublicProfileExtras(),
 });
 
@@ -245,11 +294,7 @@ await t('hub port present → cross_project carries exactly the whitelist shape'
   assert.equal(r.status, 200);
   const cp = r.json.cross_project;
   assert.ok(cp, 'cross_project attached when the port resolves');
-  assert.deepEqual(Object.keys(cp).sort(), [...CP_PUBLIC_KEYS].sort(), 'cross_project keys are exactly the contract');
-  assert.deepEqual(Object.keys(cp.totals).sort(), ['credits', 'karma', 'projects', 'works_shipped']);
-  for (const row of cp.projects) {
-    assert.deepEqual(Object.keys(row).sort(), [...CP_PROJECT_ROW_KEYS].sort(), 'project rows carry only name/origin/rank_held');
-  }
+  assertCrossProjectContract(cp, r.text);
   assert.equal(cp.projects.length, 1, 'only the public catalog row is named');
   assert.equal(cp.more_projects, 1, 'the non-public project is counted, never named');
 });
@@ -277,6 +322,241 @@ await t('hub port returns null (hidden/provisional/none) → cross_project: null
   assert.equal(r.headers['cache-control'], 'no-store');
 });
 
+// ---- R06 PROOF: hide is honored on every read path (task 1002282) ---------
+//
+// Deps R03 (task 1002279 — the hide_stats flag) and R04 (task 1002280 — the
+// profile UI section) shipped; this pins their behaviour so it cannot rot. The
+// proofs below run the REAL module reads (getPublicProfileExtras,
+// setAccountHideStats, listScoutingRollup) and the REAL routes over a fake
+// engine, so what is proven is the COMPOSITION — route → port → module read →
+// query — not a stub of the answer.
+
+// A deliberately literal-minded stand-in for Postgres. It holds the fixture
+// rows and applies ONLY the consent predicates the query it is handed actually
+// declares. That is what makes the scouting proof real rather than circular:
+// delete `NOT pa.hide_stats` from listScoutingRollup and the hidden builder
+// walks straight into the response, turning these tests red. The SQL semantics
+// themselves (the un-fanned sums) are proven against a live Postgres by
+// tests/profile_rollup_consent.mjs and tests/scouting_rollup_fanout.mjs.
+const HUB_GITHUB_ID = FULL_ROW.github_id;
+const HIDDEN_LOGIN = 'hidden-DO-NOT-LEAK-r06';
+const PROV_LOGIN = 'provisional-DO-NOT-LEAK-r06';
+
+// TWO projects — one publicly catalogued, one not. Distinctive digits so the
+// "no partial numbers" scan below cannot pass by coincidence.
+const PROOF_PROJECTS = [
+  { name: 'R06 Public Proj', origin: 'https://r06-pub.example', rank_held: 'metic',
+    credits: 60271, tasks_shipped: 4103, karma: 9021, is_public: true },
+  { name: SECRET_PROJECT_NAME, origin: 'https://r06-priv.example', rank_held: 'archon',
+    credits: 40129, tasks_shipped: 2011, karma: 3007, is_public: false },
+];
+const sumOf = (k) => PROOF_PROJECTS.reduce((n, p) => n + p[k], 0);
+
+// The one account row the reads consult. setAccountHideStats mutates it.
+const hubAccount = { profile_state: 'active', hide_stats: false, handle: 'r06-handle' };
+
+// The scouting "table": one visible builder plus the two that consent excludes.
+const SCOUTING_TABLE = [
+  { profile_state: 'active', hide_stats: false,
+    row: { github_id: '11', github_login: 'r06-visible', display_name: 'Visible', avatar_url: null,
+      project_count: 2, total_credits: 5, total_tasks_shipped: 1, total_karma: 0,
+      last_active: '2026-08-01T00:00:00.000Z', disciplines: ['engineer'] } },
+  { profile_state: 'active', hide_stats: true,
+    row: { github_id: '12', github_login: HIDDEN_LOGIN, display_name: 'Hidden', avatar_url: null,
+      project_count: 7, total_credits: 88817, total_tasks_shipped: 6613, total_karma: 5519,
+      last_active: '2026-08-02T00:00:00.000Z', disciplines: ['ui'] } },
+  { profile_state: 'provisional', hide_stats: false,
+    row: { github_id: '13', github_login: PROV_LOGIN, display_name: 'Provisional', avatar_url: null,
+      project_count: 1, total_credits: 71713, total_tasks_shipped: 1, total_karma: 0,
+      last_active: '2026-08-03T00:00:00.000Z', disciplines: [] } },
+];
+
+const engine = {
+  calls: [],
+  query: async (text, params = []) => {
+    const sql = String(text);
+    engine.calls.push({ sql, params });
+
+    // listScoutingRollup — the ONE read behind GET /scouting and the hall's
+    // /people page. Honors exactly the predicates the query declares.
+    if (/AS project_count/.test(sql)) {
+      let rows = SCOUTING_TABLE;
+      if (/pa\.profile_state = 'active'/.test(sql)) rows = rows.filter((r) => r.profile_state === 'active');
+      if (/NOT pa\.hide_stats/.test(sql)) rows = rows.filter((r) => !r.hide_stats);
+      return { rows: rows.map((r) => ({ ...r.row })) };
+    }
+    // setAccountHideStats — the own-scoped write behind PATCH /me/cross-project.
+    if (/INSERT INTO platform_identity_accounts/.test(sql)) {
+      hubAccount.hide_stats = !!params[4];
+      return { rows: [{ github_id: String(HUB_GITHUB_ID), github_login: 'jaxri', ...hubAccount }] };
+    }
+    // getPublicProfileExtras' consent read.
+    if (/SELECT profile_state, hide_stats/.test(sql)) {
+      return { rows: [{ profile_state: hubAccount.profile_state, hide_stats: hubAccount.hide_stats }] };
+    }
+    // getRollupForBuilder's per-project rows (the client_id → origin two-hop).
+    if (/platform_identity_sso_clients/.test(sql)) {
+      return { rows: PROOF_PROJECTS.map((p) => ({ name: p.name, origin: p.origin, rank_held: p.rank_held, is_public: p.is_public, recent_ships: [] })) };
+    }
+    // getRollupForBuilder's un-fanned aggregate — summed ACROSS both projects.
+    if (/AS works_shipped/.test(sql)) {
+      return { rows: [{ projects: PROOF_PROJECTS.length, credits: sumOf('credits'),
+        works_shipped: sumOf('tasks_shipped'), karma: sumOf('karma'),
+        last_active: '2026-08-02T00:00:00.000Z', disciplines: ['engineer', 'ui'] }] };
+    }
+    throw new Error(`fake engine: unexpected query ${sql.slice(0, 60)}`);
+  },
+};
+
+// Pin the module doorway (ADR 0083) BEFORE platform-identity loads, so the
+// module's default pool — destructured at require time — is the fake engine.
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool: engine,
+    requireBuilder: (_req, _res, next) => next(),
+    requirePermission: () => (_req, _res, next) => next(),
+    parsePagination: () => ({ limit: 100, offset: 0 }),
+    corsPublicGet: () => (_req, _res, next) => next(),
+  },
+};
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildScoutingRoutes = require('../modules/platform-identity/routes/scouting.js');
+
+// From here the port serves the REAL public read over the fake engine.
+hubPublicRead = (githubId) => pi.getPublicProfileExtras(githubId, { pool: engine });
+
+await t('R06.1 a two-project builder\'s COMBINED record shows to another account', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  const cp = r.json.cross_project;
+  assert.ok(cp, 'the record is served');
+  assertCrossProjectContract(cp, r.text);
+  assert.equal(cp.totals.projects, 2, 'both projects count');
+  assert.equal(cp.totals.credits, sumOf('credits'), 'credits are the sum across BOTH projects');
+  assert.equal(cp.totals.works_shipped, sumOf('tasks_shipped'), 'ships are summed across both');
+  assert.equal(cp.totals.karma, sumOf('karma'), 'karma is summed across both');
+  assert.deepEqual(cp.disciplines, ['engineer', 'ui'], 'the disciplines union spans both projects');
+  assert.equal(cp.projects.length, 1, 'only the publicly-catalogued project is NAMED');
+  assert.equal(cp.projects[0].name, PROOF_PROJECTS[0].name);
+  assert.equal(cp.more_projects, 1, 'the other is counted, never named');
+});
+
+await t('R06.1 the record is viewer-INDEPENDENT — another account sees the same body', async () => {
+  const anon = await get(port, '/api/gds/builders/95/profile');
+  const other = await get(port, '/api/gds/builders/95/profile', { Cookie: 'gds_session=some-other-builder' });
+  assert.equal(other.status, 200);
+  assert.equal(other.text, anon.text, 'one response shape for every reader (ADR 0171 D4)');
+});
+
+await t('R06.1 the profile read takes NO auth middleware — the portfolio is shareable', () => {
+  // A future PR walling this behind requireBuilder would break "another account
+  // can see it" while every assertion above still passed, so pin the shape.
+  const line = sourceOf('src/bongos/routes/builders.js').split('\n')
+    .find((l) => l.includes("router.get('/builders/:id/profile'"));
+  assert.ok(line, 'the profile route registration is findable');
+  assert.match(line, /router\.get\('\/builders\/:id\/profile', async \(req, res\) => \{/,
+    'nothing may sit between the path and the handler — that is what makes the record public');
+});
+
+await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is planted', async () => {
+  const realRead = hubPublicRead;
+  const rollup = async () => pi.getPublicProfileExtras(HUB_GITHUB_ID, { pool: engine });
+  try {
+    // (a) a module-internal key on the object itself.
+    hubPublicRead = async () => ({ ...(await rollup()), client_id: SECRET_CLIENT_ID });
+    let r = await get(port, '/api/gds/builders/95/profile');
+    assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
+      /cross_project keys are exactly the contract/, 'an extra top-level key must turn the guard red');
+
+    // (b) a module-internal key on a project ROW (the is_public discriminator).
+    hubPublicRead = async () => {
+      const cp = await rollup();
+      return { ...cp, projects: cp.projects.map((p) => ({ ...p, is_public: true })) };
+    };
+    r = await get(port, '/api/gds/builders/95/profile');
+    assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
+      /project rows carry only the whitelisted keys/, 'an extra project-row key must turn the guard red');
+
+    // (c) a sentinel smuggled inside an ALLOWED field — key lists stay legal, so
+    // this isolates the raw-body scan. This is the leak the shape check cannot see.
+    hubPublicRead = async () => {
+      const cp = await rollup();
+      return { ...cp, projects: [{ ...cp.projects[0], name: SECRET_PROJECT_NAME }] };
+    };
+    r = await get(port, '/api/gds/builders/95/profile');
+    assert.deepEqual(Object.keys(r.json.cross_project).sort(), [...CP_PUBLIC_KEYS].sort(),
+      'the planted leak is shape-legal — only the sentinel scan can catch it');
+    assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
+      /must not contain/, 'a sentinel in an allowed field must turn the guard red');
+  } finally {
+    hubPublicRead = realRead;
+  }
+});
+
+await t('R06.2 hide_stats removes the record on the IMMEDIATE next load', async () => {
+  const before = await get(port, '/api/gds/builders/95/profile');
+  assert.ok(before.json.cross_project, 'public before the flip');
+  assert.equal(before.headers['cache-control'], 'no-store');
+
+  // Flip it through the REAL write the own-scoped PATCH /me/cross-project uses.
+  const row = await pi.setAccountHideStats(
+    { githubId: HUB_GITHUB_ID, githubLogin: 'jaxri', hide: true }, { pool: engine });
+  assert.equal(row.hide_stats, true, 'the write path set the flag');
+
+  // No sleep, no second server, no cache warm-up: the very next load.
+  const after = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(after.status, 200);
+  assert.equal(after.json.cross_project, null, 'gone on the next load');
+  assert.equal(after.headers['cache-control'], 'no-store', 'hide must beat the cache (ADR 0171 D5)');
+  assert.ok(!/max-age/.test(after.headers['cache-control'] || ''),
+    'any max-age would let a cache keep serving the pre-hide body — the old public, max-age=60 failed exactly here');
+});
+
+await t('R06.5 no PARTIAL numbers survive the hide (a count beside a hidden total leaks by subtraction)', async () => {
+  // Set the flag here too, so this proof stands on its own rather than on
+  // whatever R06.2 left behind.
+  await pi.setAccountHideStats({ githubId: HUB_GITHUB_ID, githubLogin: 'jaxri', hide: true }, { pool: engine });
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.json.cross_project, null);
+  for (const key of ['totals', 'works_shipped', 'more_projects', 'last_active', 'rank_held']) {
+    assert.ok(!r.text.includes(key), `nothing derived from the rollup may survive — found "${key}"`);
+  }
+  const digits = [sumOf('credits'), sumOf('tasks_shipped'), sumOf('karma'),
+    ...PROOF_PROJECTS.map((p) => p.credits)].map(String);
+  for (const v of [...digits, ...PROOF_PROJECTS.map((p) => p.name), ...PROOF_PROJECTS.map((p) => p.origin)]) {
+    assert.ok(!r.text.includes(v), `no rollup value may survive a hide — found "${v}"`);
+  }
+});
+
+// ---- R06.3: the OTHER read paths honor hide too ---------------------------
+
+const scoutApp = express();
+scoutApp.use(attachFail);
+scoutApp.use('/api/gds', buildScoutingRoutes());
+const scout = await listen(scoutApp);
+
+await t('R06.3 GET /scouting drops the hidden AND the provisional builder', async () => {
+  engine.calls.length = 0;
+  const r = await get(scout.port, '/api/gds/scouting');
+  assert.equal(r.status, 200);
+  const logins = r.json.builders.map((b) => b.github_login);
+  assert.deepEqual(logins, ['r06-visible'], 'only the consented, non-hidden builder is listed');
+  assert.equal(engine.calls.length, 1, 'exactly ONE read — nothing can re-enter via a second, unfiltered query');
+  for (const s of [HIDDEN_LOGIN, PROV_LOGIN, '88817', '6613', '5519', '71713']) {
+    assert.ok(!r.text.includes(s), `the excluded builder leaks nothing — found "${s}"`);
+  }
+});
+
+await t('R06.3 the /people page reads /scouting and nothing else', async () => {
+  // /people is the hall's render of the same endpoint, so whatever /scouting
+  // drops, /people drops. Pin that it has no second data source.
+  const endpoints = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/fetch\(\s*'([^']+)'/g)].map((m) => m[1]);
+  assert.deepEqual(endpoints, ['/api/gds/scouting?limit=500'], '/people has exactly one data source');
+});
+
+scout.server.close();
 server.close();
 
 console.log(`\n${passed} passed, ${failed} failed`);