@bongos/core 1.19.416 → 1.19.418

package/modules/hall-ui/public/settings-sessions.js

@@ -0,0 +1,119 @@
+// modules/hall-ui/public/settings-sessions.js — the "Active sessions" panel on
+// /builders/settings (task 1003341, ADR 0206).
+//
+// WHY. A session refreshes for another 24 hours every time it is used, so one a
+// builder has forgotten about never expires; before this panel, killing a leaked
+// CLI token meant asking an Archon, because the only revoke endpoints were
+// admin-gated. This is the surface for the own-scoped remedy: see everywhere you
+// are signed in, end one, or end all of them.
+//
+// Its own file rather than more of settings.js — that file sits close to the
+// 1500-line size ratchet, and this panel is self-contained: it shares nothing
+// with the rest of the page but the `window.OTB` toolkit and the generated API
+// client, both of which are globals loaded before it.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const { escapeHtml, $, fmtDate } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg);
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+
+  const toAuth = () => window.location.assign(`${API}/auth/web/start`);
+
+  // The words a person recognises, not the column value. `source` is the same
+  // three-value set the session-scope registry declares.
+  const SOURCE_LABELS = { cli: 'Terminal', web: 'Browser', box: 'Dev box' };
+  const sourceLabel = (s) => SOURCE_LABELS[s] || 'Session';
+
+  // "3 minutes ago" beats a timestamp for the one question this panel exists to
+  // answer: is anything using this session that is not me, right now?
+  function ago(iso) {
+    const then = new Date(iso).getTime();
+    if (!Number.isFinite(then)) return 'unknown';
+    const mins = Math.max(0, Math.round((Date.now() - then) / 60000));
+    if (mins < 1) return 'just now';
+    if (mins < 60) return `${mins} minute${mins === 1 ? '' : 's'} ago`;
+    const hours = Math.round(mins / 60);
+    if (hours < 48) return `${hours} hour${hours === 1 ? '' : 's'} ago`;
+    return `${Math.round(hours / 24)} days ago`;
+  }
+
+  function rowHtml(s) {
+    const badge = s.current ? '<span class="sessions-row__badge">this session</span>' : '';
+    const agent = s.user_agent ? `<span class="sessions-row__agent">${escapeHtml(s.user_agent)}</span>` : '';
+    return `<div class="sessions-row" data-id="${escapeHtml(s.id)}">
+      <div class="sessions-row__main">
+        <strong>${escapeHtml(sourceLabel(s.source))}</strong>${badge}
+        ${agent}
+        <span class="sessions-row__when">last used ${escapeHtml(ago(s.last_used_at))} · signed in ${escapeHtml(fmtDate(s.created_at))}</span>
+      </div>
+      <button type="button" class="settings-btn settings-btn--quiet sessions-row__end">End session</button>
+    </div>`;
+  }
+
+  async function render() {
+    const list = $('#sessions-list');
+    const res = await api.request('GET', `${API}/me/sessions`);
+    if (res.status === 401) { toAuth(); return; }
+    if (!res.ok) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+    const sessions = (res.data && res.data.sessions) || [];
+    list.innerHTML = sessions.length
+      ? sessions.map(rowHtml).join('')
+      : '<p class="settings-card__hint">No other sessions.</p>';
+    for (const btn of list.querySelectorAll('.sessions-row__end')) {
+      btn.addEventListener('click', () => endOne(btn));
+    }
+  }
+
+  async function endOne(btn) {
+    const row = btn.closest('.sessions-row');
+    const id = row.getAttribute('data-id');
+    const isCurrent = !!row.querySelector('.sessions-row__badge');
+    if (isCurrent && !window.confirm('That is the session you are using right now. Ending it signs you out of this page.')) return;
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', `${API}/me/sessions/revoke`, { body: { session_id: id } });
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+      if (isCurrent) { toAuth(); return; }
+      toast('Session ended.');
+      await render();
+    } catch (err) {
+      btn.disabled = false;
+      toast(`Could not end that session: ${err.message}`);
+    }
+  }
+
+  // Sign out everywhere ends THIS browser session too — that is what "everywhere"
+  // means, and the whole point when a token has leaked — so it confirms first and
+  // then sends the builder back to sign-in rather than leaving a dead page up.
+  async function endAll() {
+    const btn = $('#sessions-revoke-all');
+    if (!window.confirm('End every session, including this one? You will need to sign in again, and any CLI token will need re-issuing.')) return;
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', `${API}/me/sessions/revoke-all`, { body: {} });
+      if (!res.ok && res.status !== 401) throw new Error((res.data && res.data.message) || `HTTP ${res.status}`);
+      toAuth();
+    } catch (err) {
+      btn.disabled = false;
+      toast(`Could not sign out everywhere: ${err.message}`);
+    }
+  }
+
+  async function setup() {
+    try {
+      await render();
+      $('#sessions-scroll').hidden = false;
+      $('#sessions-revoke-all').addEventListener('click', endAll);
+    } catch (err) {
+      // Its own try/catch, like every other section: a failing endpoint hides this
+      // panel rather than taking the settings page down with it.
+      toast(`Could not load your sessions: ${err.message}`);
+    }
+  }
+
+  setup();
+})();

package/modules/hall-ui/public/settings.css

@@ -319,6 +319,31 @@ input.display-name-input {
   margin: 6px 0;
 }
 
+/* ---- Active sessions (task 1003341) — one row per live session, the current
+   one badged so nobody ends the page they are reading. ---- */
+.sessions-row {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  padding: 10px 0;
+  border-bottom: 1px solid var(--border);
+}
+.sessions-row:last-child { border-bottom: 0; }
+.sessions-row__main { display: flex; flex-wrap: wrap; align-items: baseline; gap: 8px; min-width: 0; }
+.sessions-row__agent,
+.sessions-row__when { color: var(--ink-soft); font-size: 13px; }
+.sessions-row__agent { overflow-wrap: anywhere; }
+.sessions-row__when { flex-basis: 100%; }
+.sessions-row__badge {
+  font-size: 12px;
+  padding: 1px 7px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  color: var(--ink-soft);
+}
+
 /* ---- Image key (task 1013) — the "we cover it" / "action needed" banner
    uses the shared semantic status tokens. ---- */
 .artkey-banner {

package/modules/hall-ui/public/settings.html

@@ -145,6 +145,25 @@
               <p class="section-note">Tokens refresh on use; re-issuing never signs you out anywhere else.</p>
             </section>
 
+            <!-- ACTIVE SESSIONS — see and kill your own sessions without an
+                 Archon (task 1003341, ADR 0206). Rendered by settings-sessions.js
+                 against GET /api/bongos/me/sessions. -->
+            <section class="scroll" id="sessions-scroll" aria-labelledby="sessions-h" data-group="access" hidden>
+              <h2 id="sessions-h" class="scroll__h">Active sessions</h2>
+              <p class="scroll__lede">
+                Every place you are currently signed in — this browser, your terminal,
+                any dev box. A session refreshes for another 24 hours each time it is
+                used, so one you have forgotten about can stay alive indefinitely. If a
+                token has leaked, end it here.
+              </p>
+              <div id="sessions-list" class="sessions-list" aria-live="polite"></div>
+              <div class="settings-card">
+                <button type="button" class="settings-btn" id="sessions-revoke-all">Sign out everywhere</button>
+                <span class="settings-card__hint">ends every session including this one — you will be asked to sign in again.</span>
+              </div>
+              <p class="section-note">Ending a session takes effect immediately; the token stops working on its very next request.</p>
+            </section>
+
             <!-- IMAGE KEY — per-builder Gemini key (task 1013 / ADR 0073).
                  GET/PUT/DELETE /api/bongos/me/art-key/own. Write-only (set/replace/
                  remove); the full key is never shown again after save (masked,
@@ -342,5 +361,8 @@
 <!-- #807: shared dev-box panel — loaded before settings.js so OTBBoxPanel exists. -->
 <script src="/builders/box-panel.js?v=2026-06-14-domutils"></script>
 <script src="/builders/settings.js?v=2026-07-10-regroup"></script>
+<!-- task 1003341: the Active sessions panel. Its own file rather than more of
+     settings.js, which sits close to the 1500-line size ratchet. -->
+<script src="/builders/settings-sessions.js?v=2026-08-29-sessions"></script>
 </body>
 </html>

package/modules/platform-identity/migrations/platform_identity_014_membership_signin_proof.sql

@@ -0,0 +1,41 @@
+-- platform_identity_014_membership_signin_proof.sql — the hub's OWN witness that a
+-- federated sign-in really happened (security report 1000027, task 1003340, ADR 0205).
+--
+-- WHY. POST /sso/membership/check-in authenticates the CALLER (client_id +
+-- client_secret) and takes the SUBJECT (github_id) from the request body. Client
+-- credentials say "which project is calling", never "which person this is about", so
+-- any registered client could mint a membership row for anyone — and that row is
+-- exactly what the ADR 0171 D7 `membership_required` precheck at POST
+-- /sso/activity/rollup trusts before publishing credits/karma/rank onto a PUBLIC
+-- profile. The precheck was satisfiable by the very call it was meant to gate.
+--
+-- THE COLUMN. `signin_verified_at` is written ONLY by the hub itself, at the two
+-- moments the hub authenticates a human FOR a client and no request body can reach:
+--   • POST /sso/token      — redeeming a single-use code minted at /sso/authorize
+--                            under a LIVE HUB SESSION, bound to (client_id, github_id);
+--   • POST /sso/device/poll — a GitHub device approval, audience bound from the
+--                            registered origin (the CLI never names the client).
+-- Because no caller-supplied field feeds it, the column is proof the caller could not
+-- have written. Check-in may only UPDATE a row that already carries it; the rollup
+-- precheck requires it.
+--
+-- NO BACKFILL, DELIBERATELY. Existing rows carry no proof, and there is no predicate
+-- that separates a legitimate 2026 check-in row from a forged one — grandfathering
+-- them would preserve precisely the rows the report is about. Nothing breaks for a
+-- real builder: every federated sign-in stamps this column BEFORE the check-in and
+-- rollup that follow it (src/bongos/auth-idp.js sequences token/assertion →
+-- check-in → rollup), so the first sign-in after this deploys heals a real membership
+-- with no operator step. Already-published activity rows are untouched — a profile
+-- goes stale until the next sign-in, it never goes blank.
+--
+-- Additive, idempotent, platform_identity_-namespaced (ADR 0083 §5).
+
+BEGIN;
+
+ALTER TABLE platform_identity_project_memberships
+  ADD COLUMN IF NOT EXISTS signin_verified_at timestamptz;
+
+INSERT INTO schema_migrations (version) VALUES ('platform_identity_014_membership_signin_proof')
+  ON CONFLICT DO NOTHING;
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -99,6 +99,37 @@ function redirectUriAllowed(client, redirectUri) {
 // Accounts
 // -------------------------------------------------------------------------
 
+// The avatar a hub profile may render: an absolute **https** URL, else null — http,
+// data:, javascript:, relative and malformed all collapse (ADR 0205 D5). Validated
+// at the ONE write boundary, not at each render: the value is echoed into a public
+// page and an `<img src>` from several surfaces.
+function safeAvatarUrl(avatarUrl) {
+  if (avatarUrl == null || avatarUrl === '') return null;
+  try {
+    return new URL(String(avatarUrl)).protocol === 'https:' ? String(avatarUrl) : null;
+  } catch {
+    return null;
+  }
+}
+
+// Create the account shell for a GitHub identity IF ABSENT, never touching an
+// existing row's identity — THE VARIANT A FEDERATED CLIENT GETS (ADR 0205 D3,
+// security report 1000027). upsertAccount's conflict re-sync is right where the
+// HUB authenticated the human and catastrophic for /sso/membership/check-in,
+// whose subject github_id is an unproven body field: a client could rewrite
+// anyone's public login + avatar. Both hub paths still re-sync every sign-in.
+async function ensureAccount({ githubId, githubLogin, displayName, avatarUrl }, { pool = defaultPool } = {}) {
+  await pool.query(
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
+     VALUES ($1, $2, $3, $4, 'provisional')
+     ON CONFLICT (github_id) DO NOTHING`,
+    [githubId, githubLogin, displayName ?? null, safeAvatarUrl(avatarUrl)],
+  );
+  const row = await getAccount(githubId, { pool });
+  if (row && !row.handle) row.handle = await ensureHandle({ githubId, githubLogin }, { pool });
+  return row;
+}
+
 // Upsert the platform account for a GitHub identity (keyed on the stable
 // github_id). Called at /sso/authorize for the signed-in hub user. Identity only.
 //
@@ -113,6 +144,9 @@ function redirectUriAllowed(client, redirectUri) {
 // display_name_source='user'), no check-in/authorize re-sync overwrites it; a
 // never-renamed account keeps following GitHub. github_login and avatar_url
 // re-sync unconditionally — neither is user-editable (spec Decision 4).
+//
+// ONLY HUB-AUTHENTICATED CALLERS MAY USE THIS (ADR 0205 D3) — the conflict branch
+// rewrites identity; a federated check-in gets `ensureAccount`.
 async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
@@ -126,7 +160,7 @@ async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, ac
        profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END,
        updated_at   = now()
      RETURNING id, github_id, github_login, display_name, avatar_url, profile_state, handle`,
-    [githubId, githubLogin, displayName ?? null, avatarUrl ?? null, !!activate],
+    [githubId, githubLogin, displayName ?? null, safeAvatarUrl(avatarUrl), !!activate],
   );
   const row = rows[0];
   // Seed the handle on first sight (spec Decision 3); a no-op once set.
@@ -409,29 +443,57 @@ function legacyRoleFromKind(kind) {
   return kind === 'member' ? 'builder' : kind;
 }
 
-// Upsert a builder's membership in a project (keyed by the reporting client + the
-// builder's github_id). COARSE membership only — never a rank. Refreshes
-// last_active on every check-in. Returns the row.
-async function upsertMembership({ clientId, githubId, membershipKind = 'member' }, { pool = defaultPool } = {}) {
-  const k = MEMBERSHIP_KINDS.includes(membershipKind) ? membershipKind : 'member';
+// Stamp the hub's OWN witness that this person signed in to this project, and
+// create the membership if it is their first time — THE ONLY WAY A MEMBERSHIP ROW
+// IS BORN (ADR 0205 D1). Called from the two routes where the hub itself
+// authenticated the human for the client and no request body reaches the pairing:
+// POST /sso/token (a code minted at /sso/authorize under a live hub session) and
+// POST /sso/device/poll (a GitHub approval, audience bound from the origin) — which
+// is what makes signin_verified_at evidence rather than another self-report.
+// Signing in accepts a standing 'pending' invite; any other coarse kind is left
+// to the reporting instance to say, via touchMembership.
+async function recordFederatedSignin({ clientId, githubId }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind)
-     VALUES ($1, $2, $3)
+    `INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind, signin_verified_at)
+     VALUES ($1, $2, 'member', now())
      ON CONFLICT (client_id, github_id) DO UPDATE SET
-       membership_kind = EXCLUDED.membership_kind,
+       membership_kind = CASE WHEN platform_identity_project_memberships.membership_kind = 'pending'
+                              THEN 'member' ELSE platform_identity_project_memberships.membership_kind END,
+       signin_verified_at = now(),
        last_active = now()
-     RETURNING id, client_id, github_id, membership_kind, joined_at, last_active`,
+     RETURNING id, client_id, github_id, membership_kind, joined_at, last_active, signin_verified_at`,
+    [clientId, githubId],
+  );
+  return rows[0] || null;
+}
+
+// Refresh an EXISTING sign-in-backed membership from a federated check-in: the coarse
+// membership_kind the instance reports, plus last_active. Null when there is no such
+// row — which the route turns into a refusal.
+// UPDATE-ONLY AND GATED ON signin_verified_at BY DESIGN (ADR 0205 D2, security
+// report 1000027). Check-in authenticates the calling PROJECT, never the SUBJECT.
+// When this could INSERT, any client could mint a membership for anyone — the very
+// row the ADR 0171 D7 `membership_required` precheck at /sso/activity/rollup trusts
+// before publishing credits/karma/rank onto a public profile.
+async function touchMembership({ clientId, githubId, membershipKind = 'member' }, { pool = defaultPool } = {}) {
+  const k = MEMBERSHIP_KINDS.includes(membershipKind) ? membershipKind : 'member';
+  const { rows } = await pool.query(
+    `UPDATE platform_identity_project_memberships
+        SET membership_kind = $3,
+            last_active = now()
+      WHERE client_id = $1 AND github_id = $2 AND signin_verified_at IS NOT NULL
+      RETURNING id, client_id, github_id, membership_kind, joined_at, last_active, signin_verified_at`,
     [clientId, githubId, k],
   );
-  return rows[0];
+  return rows[0] || null;
 }
 
 // One membership row for (project, builder), any membership_kind — or null. Backs the
-// activity-rollup membership requirement (ADR 0171 D7): a client may only report
-// activity for a builder who actually has a membership on that project.
+// activity-rollup membership requirement (ADR 0171 D7), carrying `signin_verified_at`
+// so the caller can demand the hub's own sign-in witness, not the row's mere existence.
 async function getMembership(clientId, githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `SELECT id, client_id, github_id, membership_kind, joined_at, last_active
+    `SELECT id, client_id, github_id, membership_kind, joined_at, last_active, signin_verified_at
        FROM platform_identity_project_memberships
       WHERE client_id = $1 AND github_id = $2`,
     [clientId, githubId],
@@ -439,6 +501,13 @@ async function getMembership(clientId, githubId, { pool = defaultPool } = {}) {
   return rows[0] || null;
 }
 
+// Does a real federated sign-in stand behind this membership — the ONE predicate the
+// rollup publishes on (ADR 0205 D4)? 'pending' is an invite pre-seed, not a
+// membership; an un-witnessed row is a client's own unproven claim.
+function membershipBacksRollup(membership) {
+  return !!membership && membership.membership_kind !== 'pending' && !!membership.signin_verified_at;
+}
+
 // All memberships for one account, newest-active first, joined to the project's
 // display fields (name/origin from sso_clients). Powers "My Projects" (task #1002112).
 async function listMembershipsForAccount(githubId, { pool = defaultPool } = {}) {
@@ -1349,8 +1418,10 @@ module.exports = {
   clientSecretValid,
   redirectUriAllowed,
   sessionUsableForFederation,
+  safeAvatarUrl,
   // accounts
   upsertAccount,
+  ensureAccount,
   getAccount,
   getAccountByLogin,
   // clients
@@ -1378,8 +1449,10 @@ module.exports = {
   MEMBERSHIP_KINDS,
   membershipKindFromLegacy,
   legacyRoleFromKind,
-  upsertMembership,
+  recordFederatedSignin,
+  touchMembership,
   getMembership,
+  membershipBacksRollup,
   listMembershipsForAccount,
   removeMembership,
   // invitations

package/modules/platform-identity/routes/sso.js

@@ -259,6 +259,15 @@ module.exports = function ssoRoutes() {
       if (identity.redirect_uri !== redirect_uri) {
         return res.fail('invalid_grant', 400);
       }
+      // THE SIGN-IN WITNESS (ADR 0205, security report 1000027). A redeemed code
+      // means a human with a live hub session authorized THIS client for THIS
+      // github_id — the strongest binding the hub ever holds, and one no request
+      // body can fabricate. Record it here, so the /sso/membership/check-in and
+      // /sso/activity/rollup gates have something a caller cannot write. Inside
+      // the try on purpose: if the witness cannot be stored the sign-in fails
+      // rather than proceeding into a state where the client's own check-in is
+      // the only evidence it ever happened.
+      await pi.recordFederatedSignin({ clientId: client_id, githubId: identity.github_id }, { pool });
       // IDENTITY ONLY — never a rank, credits, or a session token (ADR 0016 / 0141).
       return res.json({
         github_id: Number(identity.github_id),
@@ -342,6 +351,10 @@ module.exports = function ssoRoutes() {
         displayName: id.display_name,
         avatarUrl: id.avatar_url,
       }, { pool });
+      // The CLI leg's sign-in witness (ADR 0205) — the device-flow twin of the
+      // /sso/token stamp. GitHub approved this person and the client was BOUND at
+      // start from the typed origin, so the pairing is the hub's own finding.
+      await pi.recordFederatedSignin({ clientId: out.client_id, githubId: id.github_id }, { pool });
       const assertion = hubKeys.mintHubAssertion({
         clientId: out.client_id, // BOUND at start from the origin — not caller-supplied
         githubId: id.github_id,
@@ -362,11 +375,23 @@ module.exports = function ssoRoutes() {
 
   // POST /sso/membership/check-in — a federated instance reports, on every sign-in,
   // that a builder builds on its project (ADR 0141 §3). Server-to-server, authed by
-  // client_id + client_secret (same constant-time check as /sso/token). Upserts the
-  // account (so a CLI-only builder still appears in My Projects) + the membership
-  // with a COARSE membership_kind. The client_id is taken from the AUTHENTICATED
-  // client — the caller cannot report membership for a project it doesn't hold the
-  // secret for.
+  // client_id + client_secret (same constant-time check as /sso/token). Refreshes an
+  // EXISTING `platform_identity_project_memberships` row's COARSE membership_kind.
+  // The client_id is taken from the AUTHENTICATED client — the caller cannot report
+  // membership for a project it doesn't hold the secret for.
+  //
+  // WHAT THIS CALL MAY NOT DO, AND WHY (ADR 0205, security report 1000027). Client
+  // credentials say WHICH PROJECT is calling; they say nothing about WHO the
+  // github_id in the body is. So this route may neither create a membership nor
+  // rewrite an account's identity: it updates a row the HUB already witnessed a
+  // sign-in for (signin_verified_at, stamped only at /sso/token and
+  // /sso/device/poll), and it creates the account shell only when absent. Before
+  // this, a client holding only its own secret could overwrite anyone's public
+  // github_login + avatar_url AND mint the membership that /sso/activity/rollup's
+  // membership_required precheck (the ADR 0171 D7 anti-impersonation gate) trusts —
+  // so the gate was satisfiable by the very call it was meant to gate. Nothing
+  // legitimate is lost: check-in only ever fires after a hub-authenticated sign-in
+  // (src/bongos/auth-idp.js), which stamps the witness first.
   //
   // THE FIELD IS `membership_kind`; `role` IS ACCEPTED FOR THE WINDOW (task 1003090,
   // ADR 0177 §"the fifth use"). ADR 0174 reserves `role` for the three crafts, and
@@ -399,10 +424,23 @@ module.exports = function ssoRoutes() {
       if (!client || client.status !== 'active' || !pi.clientSecretValid(client, client_secret)) {
         return res.fail('invalid_client', 401);
       }
-      // Upsert the account first so a CLI-only builder is known to the hub, then the
-      // membership — keyed to the AUTHENTICATED client_id, never a caller-named one.
-      await pi.upsertAccount({ githubId: github_id, githubLogin: github_login, displayName: display_name, avatarUrl: avatar_url }, { pool });
-      await pi.upsertMembership({ clientId: client_id, githubId: github_id, membershipKind }, { pool });
+      // Reject a non-numeric github_id before it reaches the bigint column (the
+      // rollup's isNumericGithubId guard, which this route was missing).
+      if (!pi.isNumericGithubId(github_id)) {
+        return res.fail('invalid_github_id', 400);
+      }
+      // The membership FIRST, and update-only: no hub-witnessed sign-in for
+      // (this client, this github_id) means the caller cannot speak for this
+      // person, and nothing at all is written — not the account shell either.
+      const membership = await pi.touchMembership({ clientId: client_id, githubId: github_id, membershipKind }, { pool });
+      if (!membership) {
+        return res.fail('signin_required', 409);
+      }
+      // Then the account shell, so a CLI-only builder is known to the hub —
+      // INSERT-ONLY (ensureAccount), never a re-sync of an existing row's
+      // identity. In the normal sequence the sign-in that stamped the witness
+      // above already created it, so this is a defensive no-op.
+      await pi.ensureAccount({ githubId: github_id, githubLogin: github_login, displayName: display_name, avatarUrl: avatar_url }, { pool });
       res.json({ ok: true });
     } catch (err) {
       log.error('[platform-identity] /sso/membership/check-in', err);
@@ -446,11 +484,17 @@ module.exports = function ssoRoutes() {
       // it), so it does not satisfy the requirement. The instance sequences its
       // check-in BEFORE this rollup (src/bongos/auth.js), so the legit first
       // sign-in always has its membership row by the time this arrives.
+      //
+      // AND THE ROW MUST CARRY THE HUB'S OWN SIGN-IN WITNESS (ADR 0205, security
+      // report 1000027). Row-existence alone was not a gate: check-in minted the
+      // row this precheck reads, so a client could satisfy D7 for any github_id
+      // by first calling the other endpoint. membershipBacksRollup demands
+      // signin_verified_at — a column only /sso/token and /sso/device/poll stamp.
       if (!pi.isNumericGithubId(b.github_id)) {
         return res.fail('invalid_github_id', 400);
       }
       const membership = await pi.getMembership(b.client_id, b.github_id, { pool });
-      if (!membership || membership.membership_kind === 'pending') {
+      if (!pi.membershipBacksRollup(membership)) {
         return res.fail('membership_required', 409);
       }
       await pi.upsertActivity({

package/modules/platform-identity/tests/platform-identity.mjs

@@ -408,19 +408,37 @@ await ta('registerClient auto-catalogues the project (2nd query) when an origin
 
 console.log('\nproject memberships (§3 check-in directory):');
 
-await ta('upsertMembership upserts on (client_id, github_id) with a coarse membership_kind', async () => {
-  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', membership_kind: 'owner' }] }]);
-  await P.upsertMembership({ clientId: 'c1', githubId: 42, membershipKind: 'owner' }, { pool });
+await ta('recordFederatedSignin is the ONE path that creates a membership, and stamps the witness', async () => {
+  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', membership_kind: 'member' }] }]);
+  await P.recordFederatedSignin({ clientId: 'c1', githubId: 42 }, { pool });
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_project_memberships/);
   assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE/);
+  assert.match(c.text, /signin_verified_at = now\(\)/);
+  assert.match(c.text, /membership_kind = CASE WHEN platform_identity_project_memberships\.membership_kind = 'pending'/,
+    "signing in accepts a standing invite, and never overwrites a real coarse kind");
+  assert.deepEqual(c.params, ['c1', 42], 'no caller-supplied field reaches this statement');
+});
+
+await ta('touchMembership UPDATEs only, and only a row the hub witnessed a sign-in for', async () => {
+  const pool = mockPool([{ rows: [{ id: '1', client_id: 'c1', github_id: '42', membership_kind: 'owner' }] }]);
+  await P.touchMembership({ clientId: 'c1', githubId: 42, membershipKind: 'owner' }, { pool });
+  const c = pool.calls[0];
+  assert.match(c.text, /UPDATE platform_identity_project_memberships/);
+  assert.doesNotMatch(c.text, /INSERT/, 'a check-in must never create a membership (report 1000027)');
+  assert.match(c.text, /signin_verified_at IS NOT NULL/);
   assert.match(c.text, /last_active = now\(\)/);
   assert.deepEqual(c.params, ['c1', 42, 'owner']);
 });
 
-await ta('upsertMembership clamps an unknown kind to member (never trusts a caller blindly)', async () => {
+await ta('touchMembership returns null when nothing matched (no witness → the route refuses)', async () => {
+  const pool = mockPool([{ rows: [] }]);
+  assert.equal(await P.touchMembership({ clientId: 'c1', githubId: 42 }, { pool }), null);
+});
+
+await ta('touchMembership clamps an unknown kind to member (never trusts a caller blindly)', async () => {
   const pool = mockPool([{ rows: [{}] }]);
-  await P.upsertMembership({ clientId: 'c1', githubId: 42, membershipKind: 'archon' }, { pool });
+  await P.touchMembership({ clientId: 'c1', githubId: 42, membershipKind: 'archon' }, { pool });
   assert.equal(pool.calls[0].params[2], 'member', 'a non-coarse membership_kind is clamped to member');
 });
 
@@ -538,12 +556,13 @@ await ta('upsertActivity keeps a legitimate core rank key', async () => {
 });
 
 await ta('getMembership reads one (client, builder) row — the rollup membership requirement', async () => {
-  const row = { id: '9', client_id: 'c1', github_id: '42', membership_kind: 'member' };
+  const row = { id: '9', client_id: 'c1', github_id: '42', membership_kind: 'member', signin_verified_at: 'T' };
   const pool = mockPool([{ rows: [row] }]);
   const out = await P.getMembership('c1', 42, { pool });
   assert.deepEqual(out, row);
   const c = pool.calls[0];
   assert.match(c.text, /FROM platform_identity_project_memberships/);
+  assert.match(c.text, /signin_verified_at/, 'the rollup gate reads the witness, not just the row');
   assert.deepEqual(c.params, ['c1', 42]);
   const miss = await P.getMembership('c1', 43, { pool });
   assert.equal(miss, null);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.416",
+  "version": "1.19.418",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.416",
+      "version": "1.19.418",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.416",
+  "version": "1.19.418",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/db.js

@@ -733,6 +733,50 @@ async function revokeAllSessionsForBuilder(builderId) {
   return rowCount;
 }
 
+// ---------- own-scoped session self-service (task 1003341) ----------
+//
+// The three helpers below are the account holder's OWN remedy for a leaked
+// bearer, and every one of them carries `builder_id = $caller` in its WHERE
+// clause. That predicate is the isolation: an id belonging to somebody else
+// matches no row, so a caller who guesses a stranger's session id learns
+// nothing and changes nothing. src/bongos/routes/my-sessions.js is the only
+// caller and always passes req.builder.id — never a client-supplied value.
+
+// listActiveSessionsForBuilder — the live (unrevoked, unexpired) sessions on one
+// account, newest-used first. Returns only what a person needs to RECOGNISE a
+// session — where it came from, when it was minted, when it was last used, what
+// client held it. The `token` column is deliberately never selected: a list that
+// returned tokens would turn one stolen session into all of them.
+
+async function listActiveSessionsForBuilder(builderId) {
+  const { rows } = await pool.query(
+    `SELECT id, source, user_agent, created_at, last_used_at, expires_at
+       FROM builder_sessions
+      WHERE builder_id = $1
+        AND revoked_at IS NULL
+        AND (expires_at IS NULL OR expires_at > now())
+      ORDER BY last_used_at DESC, id DESC`,
+    [builderId]
+  );
+  return rows;
+}
+
+// revokeSessionForBuilder — kill ONE session the caller owns. The own-scoped twin
+// of revokeSessionById: same effect, but it can only ever reach a row on the
+// caller's own account. Returns 1 when a session was killed, 0 when the id was
+// already revoked, expired, unknown, or somebody else's — the four cases are
+// deliberately indistinguishable to the caller.
+
+async function revokeSessionForBuilder(sessionId, builderId) {
+  const { rowCount } = await pool.query(
+    `UPDATE builder_sessions
+        SET revoked_at = now()
+      WHERE id = $1 AND builder_id = $2 AND revoked_at IS NULL`,
+    [sessionId, builderId]
+  );
+  return rowCount;
+}
+
 // -------------------------------------------------------------------------
 // Versions
 // -------------------------------------------------------------------------
@@ -994,6 +1038,8 @@ module.exports = {
   revokeSession,
   revokeSessionById,
   revokeAllSessionsForBuilder,
+  listActiveSessionsForBuilder,
+  revokeSessionForBuilder,
   hasCliSession,
   SESSION_TTL_MS,
   LIVE_RANK_LADDER,