@bongos/core 1.19.422 → 1.19.424

package/modules/onboarding/routes/access-requests.js

@@ -15,8 +15,13 @@
 //                                          one (sign in — you're in already).
 //   GET  /api/bongos/access-requests          Archon-only — the pending queue (and
 //                                          ?status=invited|dismissed history).
+//                                          Every row carries `vouched` — see the
+//                                          route.
 //   PATCH /api/bongos/access-requests/:id     Archon-only — resolve a request:
 //                                          { status: 'invited' | 'dismissed' }.
+//                                          Approve, decline, RESCIND an approval
+//                                          (invited → dismissed), and idempotent
+//                                          on the state already held (ADR 0201 D4).
 //   POST /api/bongos/access-requests/invite   Archon-only — invite a GitHub
 //                                          username before any request exists:
 //                                          the way in on an invite-only project.
@@ -179,9 +184,23 @@ module.exports = function buildAccessRequestsRouter() {
     }
   });
 
-  // GET /access-requests?status=pending — Archon queue. Defaults to pending;
+  // GET /access-requests?status=pending — the owner's queue. Defaults to pending;
   // pass ?status=invited|dismissed for the resolved history.
   // rank: archon — the queue exposes would-be builders' usernames.
+  //
+  // EVERY ROW SAYS WHETHER IT IS VOUCHED, and that is load-bearing rather than
+  // decoration (ADR 0201, Consequences). This endpoint is fed by the one PUBLIC
+  // unauthenticated write on the GDS, so anyone may file a request naming anyone
+  // — including a well-known builder. `vouched` is the reviewer's ONLY basis for
+  // reading a cross-project record beside a name: an unvouched row that LOOKED
+  // vouched is the entire impersonation vulnerability the vouch exists to close.
+  // It is derived here from `applicant_github_id IS NOT NULL` — the single mark
+  // (core_230) — rather than stored, so there is no second flag free to disagree
+  // with the identity it claims to describe.
+  //
+  // A VOUCH IS NOT AUTHORITY (ADR 0016). It says the hub confirmed WHO this is;
+  // it never says they may enter. Nothing on the approve path reads these three
+  // fields, and `hasInvitedAccessRequest` still reads status='invited' alone.
   router.get('/access-requests', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     const status = req.query.status || 'pending';
     if (!['pending', 'invited', 'dismissed'].includes(status)) {
@@ -191,6 +210,8 @@ module.exports = function buildAccessRequestsRouter() {
       const { rows } = await pool.query(
         `SELECT ar.id, ar.github_login, ar.display_name, ar.note, ar.status,
                 ar.created_at, ar.resolved_at,
+                ar.applicant_github_id, ar.vouched_at,
+                (ar.applicant_github_id IS NOT NULL) AS vouched,
                 rb.github_login AS resolved_by_login
            FROM access_requests ar
            LEFT JOIN builders rb ON rb.id = ar.resolved_by_builder_id
@@ -201,16 +222,68 @@ module.exports = function buildAccessRequestsRouter() {
       );
       res.json({ requests: rows });
     } catch (err) {
-      console.error('[gds] GET /access-requests', err);
+      log.error('[gds] GET /access-requests', err);
       res.fail('list_failed', { status: 500, message: 'internal error' });
     }
   });
 
-  // PATCH /access-requests/:id — Archon resolves a request.
-  // body: { status: 'invited' | 'dismissed' }. 'invited' = admitted to the hall
-  // (the only sign-in gate — no repo access needed); 'dismissed' = declined /
-  // spam / dup. The row stays as the audit trail either way.
+  // PATCH /access-requests/:id — the owner resolves a request.
+  // body: { status: 'invited' | 'dismissed' }. 'invited' = admitted (the only
+  // sign-in gate — no repo access needed); 'dismissed' = declined / spam / dup.
+  // The row stays as the audit trail either way.
   // rank: archon — same gate as the rest of the roster management surface.
+  //
+  // THREE STATES, AND EVERY MOVE BETWEEN THEM THAT MEANS SOMETHING (ADR 0201 D4):
+  //
+  //   pending → invited     approve
+  //   pending → dismissed   decline
+  //   invited → dismissed   RESCIND (task 1002284, D4.2). An approval given by
+  //                         mistake, BEFORE the applicant has ever signed in,
+  //                         must be revocable: hasInvitedAccessRequest stops
+  //                         matching and the door re-locks.
+  //
+  //                         AFTER they have signed in the row is history, and
+  //                         this route REFUSES rather than flipping it. The
+  //                         refusal is the whole point: firstTimeAdmissionBlocked
+  //                         short-circuits on an existing `builders` row, so
+  //                         dismissing an invited row for someone who already
+  //                         signed in changes NOTHING about their access — it
+  //                         would answer 200 and let the queue report a removal
+  //                         that did not happen. Offboarding a member is the
+  //                         instance's own act (/builder-exit), and the guard is
+  //                         a NOT EXISTS in the UPDATE's own WHERE so it cannot
+  //                         be lost to a read-then-write window.
+  //                         KNOWN LIMIT: a rescind overwrites resolved_by/
+  //                         resolved_at with the RESCINDER, so who originally
+  //                         approved is not recoverable from the row, and this
+  //                         route writes no audit_log for any transition (it
+  //                         never has — approve and decline lose nothing only
+  //                         because they start from `pending`, which has no
+  //                         resolver to lose). Carrying the prior approver out
+  //                         would mean a CTE on the one statement in this change
+  //                         that no engine executes in CI; it belongs with the
+  //                         queue UI that would display it (R11). ADR 0208.
+  //   x → x                 IDEMPOTENT (D4.4). A double-clicked button in the
+  //                         queue returns the row it already holds, 200, rather
+  //                         than a 409 that reads as a failure. It does NOT
+  //                         re-stamp resolved_by/resolved_at: the audit trail
+  //                         records who ACTUALLY resolved it, not who clicked
+  //                         again afterwards.
+  //   dismissed → invited   REFUSED here on purpose. Re-admitting a declined
+  //                         applicant is POST /access-requests/invite, which
+  //                         already resolves-or-inserts an invited row for any
+  //                         login (D4.2) — a second path to the same write would
+  //                         be the drift. The refusal names the state and that
+  //                         route, per ADR 0116.
+  //
+  // The transition is enforced in the UPDATE's own WHERE, so a concurrent write
+  // loses the race in the database rather than in a read-then-write window. The
+  // follow-up SELECT runs ONLY to explain a refusal — it decides nothing.
+  //
+  // $1 is spelled $1::text in that WHERE because the same parameter is also
+  // the SET value. Postgres infers text from the assignment anyway, but no real
+  // engine ever executes this statement — there is no integration test for this
+  // route and CI has no Postgres — so the type is stated rather than relied on.
   router.patch('/access-requests/:id', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
@@ -227,16 +300,47 @@ module.exports = function buildAccessRequestsRouter() {
             SET status = $1,
                 resolved_by_builder_id = $2,
                 resolved_at = now()
-          WHERE id = $3 AND status = 'pending'
+          WHERE id = $3
+            AND (status = 'pending'
+                 OR (status = 'invited' AND $1::text = 'dismissed'
+                     AND NOT EXISTS (SELECT 1 FROM builders b
+                                      WHERE lower(b.github_login) = lower(access_requests.github_login))))
           RETURNING id, github_login, status, resolved_at`,
         [next, req.builder.id, id]
       );
-      if (rows.length === 0) {
-        return res.fail('not_pending', { status: 409, message: 'That request is gone or already resolved.' });
+      if (rows.length > 0) {
+        return res.json({ ok: true, request: rows[0] });
+      }
+      const current = await pool.query(
+        `SELECT ar.id, ar.github_login, ar.status, ar.resolved_at,
+                EXISTS (SELECT 1 FROM builders b
+                         WHERE lower(b.github_login) = lower(ar.github_login)) AS is_member
+           FROM access_requests ar
+          WHERE ar.id = $1`,
+        [id]
+      );
+      if (current.rows.length === 0) {
+        return res.fail('request_not_found', { status: 404, message: 'That request no longer exists.' });
+      }
+      const { is_member: isMember, ...row } = current.rows[0];
+      if (row.status === next) {
+        return res.json({ ok: true, request: row, unchanged: true });
+      }
+      if (row.status === 'invited' && next === 'dismissed' && isMember) {
+        return res.fail('already_member', {
+          status: 409,
+          message: 'They have already signed in, so this request is history — dismissing it would remove nothing. Offboard the builder instead (/builder-exit).',
+        });
+      }
+      if (row.status === 'dismissed' && next === 'invited') {
+        return res.fail('already_dismissed', {
+          status: 409,
+          message: 'That request was declined. To admit them anyway, invite the username directly (POST /access-requests/invite) — it opens the door without reviving a declined request.',
+        });
       }
-      res.json({ ok: true, request: rows[0] });
+      return res.fail('not_pending', { status: 409, message: `That request is ${row.status} — it changed underneath this response. Re-read the queue and retry.` });
     } catch (err) {
-      console.error('[gds] PATCH /access-requests/:id', err);
+      log.error('[gds] PATCH /access-requests/:id', err);
       res.fail('resolve_failed', { status: 500, message: 'internal error' });
     }
   });

package/modules/platform-identity/application-echo.js

@@ -0,0 +1,115 @@
+// modules/platform-identity/application-echo.js — the hub's STATUSLESS memory of
+// "you applied to this project, on this date" (task 1002284, R08 of goal 1000045;
+// ADR 0201 D1.3).
+//
+// WHAT IT ANSWERS, and the one thing it must never answer. The application
+// itself is the TARGET PROJECT's own `access_requests` row: the hub relays it
+// (routes/my-projects.js) and the project decides. This file owns the only fact
+// the hub is allowed to keep about that — WHO asked WHICH project WHEN — so the
+// applicant's own surfaces can say "applied on <date>" without asking every
+// project on the platform on every render.
+//
+// It can never say what came of it. A hub-held "pending / approved / declined"
+// would be an admission fact on the wrong side of the trust boundary (ADR 0016 /
+// ADR 0141) and stale the moment the owner acted. An approval becomes visible
+// the way membership always becomes visible: the check-in writes the membership
+// row and the card flips to *member*. That is why the table has no status column
+// and why nothing here returns one.
+//
+// NOT AUTHORITY. No rank check, admission gate, permission resolve or credit path
+// reads this. Writing an echo grants nobody anything anywhere; deleting every row
+// would cost only a sentence on a card. Both functions are best-effort by design
+// — see `recordApplication`.
+//
+// WHY ITS OWN FILE rather than platform-identity.js: that file sits at the 1500-
+// line fitness ratchet with zero headroom, and the `account-visibility.js`
+// precedent (ADR 0202 D4) is exactly this shape — one small table's answers,
+// alone, requireable by a route.
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { isNumericGithubId } = require('./platform-identity');
+
+// How long an echo stays visible on the applicant's own surfaces. READ-TIME, not
+// a sweep and not a column: the row lives forever and simply stops matching, so
+// there is no expiry job to fall behind and no second state to disagree with the
+// project's own row. 30 days is the privacy spec D4 constant, reused so a
+// declined application does not read as "applied" forever. Exported because the
+// reader, the tests and the docs must all quote the same number.
+const APPLICATION_ECHO_WINDOW_DAYS = 30;
+
+// recordApplication — remember that this account asked to join this project, now.
+// Called ONLY after the target project answered a relayed application with a
+// success (ADR 0201 D1.3); a refusal is not an application and leaves no echo.
+//
+// Upserts on the (account, project) pair, refreshing `applied_at`, because
+// re-applying is a success rather than an error (D1.4) and the visibility window
+// is measured from the most recent ask — otherwise an applicant who re-asks
+// watches their own card go quiet while their request is still open.
+//
+// BEST-EFFORT BY CONTRACT: returns false instead of throwing when the account is
+// a non-numeric principal (ADR 0171 D2). The caller must also swallow a DB error
+// — the echo is a convenience on the applicant's own view, and losing it must
+// never turn a filed application into a reported failure.
+async function recordApplication({ githubId, clientId }, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return false;
+  const client = String(clientId || '');
+  if (!client) return false;
+  await pool.query(
+    `INSERT INTO platform_identity_application_echoes (github_id, client_id, applied_at)
+     VALUES ($1::bigint, $2, now())
+     ON CONFLICT (github_id, client_id) DO UPDATE SET applied_at = now()`,
+    [String(githubId), client],
+  );
+  return true;
+}
+
+// listRecentApplications — the applicant's OWN "I asked these projects" list,
+// inside the read-time window. Own-scope only: every caller passes the session's
+// github_id, and there is no cross-account read of this table anywhere.
+//
+// Returns [{ client_id, applied_at, project_name, project_origin }], newest
+// first, or [] for a non-numeric principal. The LEFT JOIN mirrors
+// listMembershipsForAccount so a client_id renders as a project rather than an
+// opaque key; a de-registered project degrades to nulls beside a real date
+// rather than vanishing. Carries NO status, because the table holds none.
+async function listRecentApplications(githubId, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return [];
+  const { rows } = await pool.query(
+    `SELECT e.client_id, e.applied_at,
+            c.name AS project_name, c.origin AS project_origin
+       FROM platform_identity_application_echoes e
+       LEFT JOIN platform_identity_sso_clients c ON c.client_id = e.client_id
+      WHERE e.github_id = $1::bigint
+        AND e.applied_at > now() - make_interval(days => $2::int)
+      ORDER BY e.applied_at DESC`,
+    [String(githubId), APPLICATION_ECHO_WINDOW_DAYS],
+  );
+  return rows;
+}
+
+// forgetApplication — drop this account's echo for one project. Called when the
+// account LEAVES the project: the echo means "I asked to join and have not yet",
+// and someone who joined and left has neither. Without it, leaving RESURRECTS the
+// original application on the applicant's own card for the rest of the 30-day
+// window — "you applied on <date>" about a project they were already a member of,
+// which is the one thing the echo must never imply (ADR 0201 D1.3). Best-effort
+// like its siblings; returns the number of echoes dropped (0 or 1).
+async function forgetApplication({ githubId, clientId }, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return 0;
+  const client = String(clientId || '');
+  if (!client) return 0;
+  const { rowCount } = await pool.query(
+    `DELETE FROM platform_identity_application_echoes
+      WHERE github_id = $1::bigint AND client_id = $2`,
+    [String(githubId), client],
+  );
+  return rowCount;
+}
+
+module.exports = {
+  APPLICATION_ECHO_WINDOW_DAYS,
+  recordApplication,
+  listRecentApplications,
+  forgetApplication,
+};

package/modules/platform-identity/migrations/platform_identity_016_application_echo.sql

@@ -0,0 +1,68 @@
+-- platform_identity_016_application_echo.sql — the hub's statusless ECHO of "you
+-- applied to this project, on this date" (task 1002284, R08 of goal 1000045;
+-- ADR 0201 D1.3, whose migration sketch this is).
+--
+-- WHAT THIS IS, AND MORE IMPORTANTLY WHAT IT IS NOT. The application itself is
+-- the TARGET PROJECT's own `access_requests` row — the hub relays it and the
+-- project decides. This table holds one thing the hub is allowed to know: that
+-- an account asked, and when. It exists so the applicant's own surfaces (My
+-- Projects, the orbs card) can say "applied on <date>" without asking every
+-- project on the platform on every render.
+--
+-- THERE IS NO STATUS COLUMN, AND ADDING ONE WOULD BE THE BUG. A hub-held row
+-- saying a project has a pending/approved/declined application would be a
+-- hub-held ADMISSION FACT — authority on the wrong side of the trust boundary
+-- (ADR 0016 / ADR 0141), and stale the moment the owner acted on it. An approval
+-- becomes visible the way membership always becomes visible: the check-in
+-- (ADR 0141 §3) writes the membership row and the card flips to *member*. The
+-- honest reading of this table is "asked" or nothing; a card that wants to say
+-- "declined" is asking for a fact the hub is not allowed to hold.
+--
+-- THE 30-DAY WINDOW IS READ-TIME, NOT A COLUMN AND NOT A SWEEP. `applied_at` is
+-- the whole of it: the reader filters `applied_at > now() - 30 days`
+-- (APPLICATION_ECHO_WINDOW_DAYS in ../application-echo.js — one constant, shared
+-- by the reader and the doc). The same read-time constant the privacy spec D4
+-- chose, so a declined application does not read as "applied" forever. Nothing
+-- expires the rows; there is no status for them to expire INTO, and a stale row
+-- is invisible rather than wrong.
+--
+-- THE KEY IS THE PAIR, so re-applying cannot pile up rows: the upsert refreshes
+-- `applied_at` in place. That is deliberate — the window is measured from the
+-- most recent ask, so an applicant who re-asks (which ADR 0201 D1.4 makes a
+-- success, not an error) does not watch their own card go quiet while their
+-- request is still open on the project.
+--
+-- github_id is `bigint` here and `text` on core's access_requests.applicant_github_id:
+-- each side matches the table it joins (platform_identity_accounts.github_id is
+-- bigint, core builders.github_id is text). That asymmetry is ADR 0201 D1.2's
+-- explicit call, not an oversight.
+--
+-- NOTHING HERE IS AUTHORITY. No rank check, admission gate, permission resolve or
+-- credit path reads this table. Writing an echo grants nobody anything anywhere;
+-- deleting every row would cost only a sentence on a card.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5 — a module migration may
+-- touch only its own <key>_ objects). Forward-safe: CREATE only, so the previous
+-- code release still runs against this schema. Idempotent.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS platform_identity_application_echoes (
+  -- The applicant's platform account. Matches platform_identity_accounts.github_id.
+  github_id  bigint      NOT NULL,
+  -- The project applied to — the registered sso_client, never a caller-supplied
+  -- origin (the relay resolves the origin against the registry first; that is
+  -- the SSRF guard, and this column inherits it).
+  client_id  text        NOT NULL,
+  applied_at timestamptz NOT NULL DEFAULT now(),
+  -- The pair IS the key: one echo per (account, project), refreshed in place.
+  PRIMARY KEY (github_id, client_id)
+);
+
+COMMENT ON TABLE platform_identity_application_echoes IS
+  'The hub''s STATUSLESS echo of a cross-project application (ADR 0201 D1.3): this account asked to join this project, at this time. The application itself is the project''s own access_requests row; this exists only so the applicant''s own surfaces can say "applied on <date>" without polling every project. It must NEVER gain a status column — that would be a hub-held admission fact, authority on the wrong side of the boundary (ADR 0016 / ADR 0141), and stale the instant the owner acted. Read-time 30-day window (APPLICATION_ECHO_WINDOW_DAYS); no sweep, no expiry column. Descriptive only — nothing reads this to decide anything.';
+
+COMMENT ON COLUMN platform_identity_application_echoes.applied_at IS
+  'When this account most recently applied to this project. Refreshed in place by the upsert, because re-applying is a success (ADR 0201 D1.4) and the 30-day view window is measured from the most recent ask. The ONLY fact this table carries beyond the pair itself.';
+
+COMMIT;

package/modules/platform-identity/routes/my-projects.js

@@ -1,7 +1,9 @@
 // modules/platform-identity/routes/my-projects.js — the signed-in builder's cross-
 // project "My Projects" view + self-service join / leave (ADR 0141 §3, task #1002112).
 //
-//   GET  /my-projects              — projects this account builds on, owned grouped apart
+//   GET  /my-projects              — projects this account builds on, owned grouped
+//                                    apart, plus `applied`: the projects it has
+//                                    asked to join and when (ADR 0201 D1.3)
 //   POST /my-projects/join         — apply to a project: one click plus an optional
 //                                    note in the applicant's own words (task 1002330).
 //                                    Relayed; the project executes and decides.
@@ -10,12 +12,18 @@
 // All gated on a live HUB session (requireBuilder). Authority stays LOCAL: JOIN only
 // RELAYS an admission request to the target project (which enforces its own gate);
 // the hub never admits anyone on its own. Reaches core only via the doorway (ADR 0083).
+//
+// `applied` is an ECHO, never a status (ADR 0201 D1.3). The hub records THAT this
+// account asked and WHEN, and is not allowed to know what came of it — an
+// approval becomes visible only when membership does, by moving the project from
+// `applied` into `building`. See ../application-echo.js.
 'use strict';
 
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const projectStats = require('../project-stats');
+const applicationEcho = require('../application-echo');
 
 const { pool, requireBuilder, validateOrRespond, userAgent } = api;
 
@@ -112,7 +120,29 @@ module.exports = function myProjectsRoutes() {
           last_active: m.last_active,
         });
       }
-      res.json({ owned, building });
+      // `applied` — the echo (ADR 0201 D1.3): projects this account asked to join
+      // inside the read-time window, carrying WHEN and deliberately no status.
+      // A project the applicant now builds on is dropped, because membership is
+      // the only approval signal the hub is allowed to show and it already reads
+      // it from the membership rows above — showing both would let a card claim
+      // "applied" about a project it is already a member of. Best-effort: a
+      // failed echo read costs the applied list, never the memberships listing.
+      const memberOf = new Set(rows.map((m) => m.client_id));
+      let applied = [];
+      try {
+        const echoes = await applicationEcho.listRecentApplications(req.builder.github_id, { pool });
+        applied = echoes
+          .filter((e) => !memberOf.has(e.client_id))
+          .map((e) => ({
+            client_id: e.client_id,
+            name: e.project_name || e.project_origin || e.client_id,
+            origin: e.project_origin || null,
+            applied_at: e.applied_at,
+          }));
+      } catch (err) {
+        api.logger('platform-identity').error(`my-projects applied echo read failed (non-fatal): ${err && err.message}`);
+      }
+      res.json({ owned, building, applied });
     } catch (err) {
       console.error('[platform-identity] GET /my-projects', err);
       res.fail('my_projects_failed', { status: 500, message: 'internal error' });
@@ -153,6 +183,22 @@ module.exports = function myProjectsRoutes() {
         console.log('[platform-identity] join relay failed (non-fatal):', e.message);
       }
       if (!outcome) return res.fail('join_relay_failed', { status: 502, message: 'the project could not be reached to request access' });
+      // The echo (ADR 0201 D1.3) — written ONLY when the project actually took an
+      // application. 'already_member', the two door refusals and 'members_only'
+      // are not applications and must leave no trace; a re-apply IS one ('requested'
+      // covers the project's own already_pending 200, D1.4), and refreshes the date.
+      // Best-effort in both directions: a lost echo must never turn a filed
+      // application into a reported failure, which is the only reason this is
+      // allowed to swallow its error.
+      if (outcome.status === 'requested') {
+        try {
+          await applicationEcho.recordApplication(
+            { githubId: req.builder.github_id, clientId: client.client_id }, { pool },
+          );
+        } catch (e) {
+          api.logger('platform-identity').error(`join echo write failed (non-fatal): ${e && e.message}`);
+        }
+      }
       res.json({
         ok: true,
         status: outcome.status,
@@ -210,6 +256,15 @@ module.exports = function myProjectsRoutes() {
     if (!clientId) return res.fail('bad_client_id', 400);
     try {
       const removed = await pi.removeMembership(clientId, req.builder.github_id, { pool });
+      // Leaving also forgets the application that got them in — otherwise the echo
+      // resurfaces on their own card and claims they applied to a project they had
+      // already joined (ADR 0201 D1.3: the echo may never imply an outcome).
+      // Best-effort: a stale echo must not fail a leave that already happened.
+      try {
+        await applicationEcho.forgetApplication({ githubId: req.builder.github_id, clientId }, { pool });
+      } catch (e) {
+        api.logger('platform-identity').error(`leave echo cleanup failed (non-fatal): ${e && e.message}`);
+      }
       res.json({ ok: true, left: removed > 0 });
     } catch (err) {
       console.error('[platform-identity] POST /my-projects/:clientId/leave', err);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.422",
+  "version": "1.19.424",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.422",
+      "version": "1.19.424",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.422",
+  "version": "1.19.424",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -106,7 +106,14 @@ const INTEGRATION = new Set([
   // the DISTINCT, and that a deactivated builder or a machine principal still
   // never governs under the widened predicate.
   'government_board_membership_db',
-  'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
+  'government_fold_bench', 'government_live_proof',
+  // task 1002806: these three declare "in the INTEGRATION set" in their own headers
+  // and were never in it. Every one boots a real Postgres and self-skips without one,
+  // so in the DB-free lane they ran, skipped, exited 0 and asserted NOTHING — while
+  // the --integration lane never saw them either, because it runs only this set. A
+  // test that cannot fail in either lane is a file that looks like a gate.
+  'handle_machinery', 'hub_profile_leak', 'profile_fields',
+  'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent',
   // task 1003145: whether the PLANNER uses the migration 225 index for the recall
   // freshness probe. The DB-free sibling (recall_corpus_health) pins the query

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.422'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.424'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');