@bongos/core 1.19.426 → 1.19.428

package/modules/hall-ui/public/profile-connections.js

@@ -0,0 +1,304 @@
+// modules/hall-ui/public/profile-connections.js — section 6 of the builder
+// profile page: connections, degree labels, and the connect button (R20,
+// task 1002296 / goal 1000045 criterion C6; ADR 0202, ADR 0207).
+//
+// WHAT IT RENDERS, and to whom:
+//   * on YOUR OWN profile — the pending requests in both directions (incoming
+//     ones you Accept or Decline, outgoing ones you Withdraw) and your accepted
+//     connections, each 1st degree by definition, each removable.
+//   * on ANOTHER builder's profile — the viewer-relative degree label, the
+//     mutual connections it was computed from, and the connect affordance.
+//
+// HUB-ONLY, AND IT DEGRADES TO NOTHING. Connections are account-to-account on
+// the platform hub (modules/platform-identity); on an instance without that
+// module every route here is absent, every call 404s, and the section never
+// reveals — the same "reveal only when the data is there" contract the
+// cross-project section already keeps on this page.
+//
+// FOUR THINGS THIS FILE MUST NOT DO. Each is a privacy decision the API made
+// deliberately, and the UI is the last place it can be undone:
+//
+//   1. `degree: null` is OUT OF NETWORK, never "not connected" (ADR 0202
+//      Consequences). Past the fan-out caps or past three hops the API stops
+//      searching and says so honestly; rendering that as the absence of a
+//      relationship states something the query never established.
+//   2. The uncertainty copy beside an out-of-network label is CONSTANT. The
+//      API's `truncated` describes the VIEWER's own expansion; the target's
+//      1-hop truncation is deliberately unreported (ADR 0207 L2) because
+//      reporting it leaks a bit about a third party's degree. Copy that varied
+//      with `truncated` would rebuild that side channel in words.
+//   3. A sent request claims exactly `201 { status: 'pending' }` and nothing
+//      more (ADR 0207 D6) — no id, no timestamp, no "they will be notified",
+//      and no remark when a re-ask inside the 90-day decline cooldown is
+//      silently swallowed (ADR 0207 L1). "Request sent" is the whole claim.
+//   4. `seen_at` never reaches the screen. It was stripped from outgoing rows
+//      so a requester cannot learn when their request was read; rendering it on
+//      the incoming side re-creates that signal the moment a screenshot passes
+//      between the two people.
+//
+// COUNTS ARE ARRAY LENGTHS. Every number here is the length of the list the
+// viewer was actually handed — never a total carried beside a filtered list,
+// which is a leak by subtraction (ADR 0171 D4 / ADR 0202 D4).
+//
+// NOTHING HERE IS AUTHORITY (ADR 0016): a connection grants no rank, no credits
+// and no admission. Nothing rendered here is rollup-derived either, which is
+// why `hide_stats` does not suppress it — hiding your stats hides the numbers
+// beside an edge, not the edge itself (ADR 0202 D4 §3).
+//
+// ADDRESSING. The connections API names a counterparty by HANDLE; this page
+// knows only a builder's github_login. It hands that login to
+// GET /connections/degree/:handle, which resolves the current handle or the
+// single previous-handle rename slot and echoes the CANONICAL handle back —
+// and that echoed handle, never the login, is what every write here sends. A
+// login resolving to neither answers 404 and the section stays hidden, the same
+// fail-closed answer a private or provisional account gets. The handle-addressed
+// hub page (/u/<handle>) will not need this hop at all.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml, $, fmtDate } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg, { duration: 2600, clear: true });
+
+  // The only degrees that have a name. Anything else — null, or a number the
+  // API never promised — falls through to "out of network" rather than being
+  // invented a label (note 1 above).
+  const DEGREE_SHORT = { 0: 'You', 1: '1st', 2: '2nd', 3: '3rd' };
+  const DEGREE_LINE = {
+    0: 'This is your own profile.',
+    1: 'You are connected.',
+    2: 'You know someone they know.',
+    3: 'Three connections away in your network.',
+  };
+  const OUT_OF_NETWORK = 'Out of network';
+  // CONSTANT by decision — it must read the same whether or not the response
+  // said `truncated` (note 2 above).
+  const OUT_OF_NETWORK_WHY = 'No path to this builder through the connections you can see. '
+    + 'There may be none, or it may run through someone whose account is not visible to you.';
+  // The whole claim a 201 supports, in markup, used by both the first render
+  // and the click that earns it.
+  const SENT_HTML = '<p class="conn-act"><button class="btn-ghost" type="button" disabled>Request sent</button></p>';
+
+  const known = (degree) => Object.prototype.hasOwnProperty.call(DEGREE_SHORT, degree);
+  const arr = (v) => (Array.isArray(v) ? v : []);
+  const plural = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`;
+
+  // The last render's inputs, so an accept/decline/remove can repaint the
+  // section from the server rather than patching the DOM it just changed.
+  let last = null;
+
+  // ---- shared cells ---------------------------------------------------------
+
+  // One counterparty, rendered from the only three columns the API projects
+  // for one (handle, display_name, avatar_url) — nothing rollup-derived, so
+  // there is nothing here for hide_stats to suppress.
+  function personHtml(row) {
+    const name = escapeHtml(row.display_name || row.handle || 'Builder');
+    const avatar = row.avatar_url
+      ? `<img class="conn-person__avatar" src="${escapeHtml(row.avatar_url)}" alt="">`
+      : '<span class="conn-person__avatar" aria-hidden="true"></span>';
+    const handle = row.handle ? `<span class="conn-person__handle">@${escapeHtml(row.handle)}</span>` : '';
+    return `<span class="conn-person">${avatar}<span class="conn-person__name">${name}</span>${handle}</span>`;
+  }
+
+  function btn(act, id, label) {
+    return `<button class="btn-ghost" type="button" data-act="${escapeHtml(act)}" data-id="${escapeHtml(id)}">${escapeHtml(label)}</button>`;
+  }
+
+  // ---- your own profile -----------------------------------------------------
+
+  // Every row is an accepted connection of yours, so its degree is 1 by
+  // definition — no per-row query, and no chance of a fan-out cap making the
+  // label wrong (ADR 0207 D2: a cap may make an answer less specific, never
+  // wrong). `connected_at` is the edge's own timestamp, not a rollup number.
+  function connectionRow(row) {
+    return `<tr>
+      <td>${personHtml(row)}</td>
+      <td><span class="conn-degree conn-degree--1">1st</span></td>
+      <td class="ledger__date">${row.connected_at ? escapeHtml(fmtDate(row.connected_at)) : '—'}</td>
+      <td>${btn('remove', row.id, 'Remove')}</td>
+    </tr>`;
+  }
+
+  function requestsHtml(incoming, outgoing) {
+    const inbox = incoming.map((r) => `<li class="conn-req">${personHtml(r)}`
+      + (r.note ? `<p class="conn-req__note">${escapeHtml(r.note)}</p>` : '')
+      + `<span class="conn-req__acts">${btn('accept', r.id, 'Accept')}${btn('decline', r.id, 'Decline')}</span></li>`).join('');
+    const outbox = outgoing.map((r) => `<li class="conn-req">${personHtml(r)}`
+      + '<span class="conn-req__state">Request sent</span>'
+      + `<span class="conn-req__acts">${btn('withdraw', r.id, 'Withdraw')}</span></li>`).join('');
+    return (incoming.length ? `<h3 class="conn-sub">${escapeHtml(plural(incoming.length, 'builder'))} asking to connect</h3><ul class="conn-reqs">${inbox}</ul>` : '')
+      + (outgoing.length ? `<h3 class="conn-sub">${escapeHtml(plural(outgoing.length, 'request'))} you have sent</h3><ul class="conn-reqs">${outbox}</ul>` : '');
+  }
+
+  // Your own connections + both request queues. Returns false when the hub
+  // routes are absent or the session is gone, so the caller leaves the section
+  // hidden rather than rendering an empty shell.
+  async function renderOwn(body) {
+    const [list, reqs] = await Promise.all([
+      api.request('GET', `${API}/connections`),
+      api.request('GET', `${API}/connections/requests`),
+    ]);
+    if (!list.ok || !reqs.ok) return false;
+    const connections = arr(list.data && list.data.connections);
+    const incoming = arr(reqs.data && reqs.data.incoming);
+    const outgoing = arr(reqs.data && reqs.data.outgoing);
+    body.innerHTML = requestsHtml(incoming, outgoing)
+      + `<p class="scroll__lede">${escapeHtml(plural(connections.length, 'connection'))}.</p>`
+      + '<div id="conn-ledger"></div>';
+    const mount = $('#conn-ledger');
+    if (mount) {
+      const pager = window.OTBKit.makePager('conn', 'profile.connections.perPage');
+      window.OTBKit.makeLedger({
+        mount,
+        columns: ['Builder', 'Degree', { label: 'Connected', class: 'ledger__date' }, ''],
+        rowHtml: connectionRow,
+        emptyMsg: 'No connections yet.',
+        pager,
+      }).render(connections);
+    }
+    return true;
+  }
+
+  // ---- someone else's profile -----------------------------------------------
+
+  function degreeHtml(degree, mutuals) {
+    const chip = `<span class="conn-degree conn-degree--${known(degree) ? degree : 'out'}">`
+      + `${escapeHtml(known(degree) ? DEGREE_SHORT[degree] : OUT_OF_NETWORK)}</span>`;
+    const line = known(degree) ? DEGREE_LINE[degree] : OUT_OF_NETWORK_WHY;
+    // The count is the length of the names beside it — never a total the
+    // response carried, which would disclose a filtered mutual by subtraction.
+    const mutual = mutuals.length
+      ? `<p class="scroll__lede">${escapeHtml(plural(mutuals.length, 'connection'))} in common: `
+        + `${mutuals.map((m) => escapeHtml(`@${m.handle || 'unknown'}`)).join(', ')}</p>`
+      : '';
+    return `<p class="conn-degree-line">${chip} ${escapeHtml(line)}</p>${mutual}`;
+  }
+
+  // Which pending request, if any, already stands with this handle — read from
+  // the caller's OWN inbox and outbox, the only place the API says anything
+  // about one. An empty outbox is not evidence a request was refused: a re-ask
+  // inside the decline cooldown writes nothing (ADR 0207 L1), so absence means
+  // "nothing is pending" and the UI draws no further conclusion from it.
+  async function pendingWith(handle) {
+    const res = await api.request('GET', `${API}/connections/requests`);
+    if (!res.ok) return null;
+    const same = (r) => r && typeof r.handle === 'string' && r.handle.toLowerCase() === handle.toLowerCase();
+    const incoming = arr(res.data && res.data.incoming).find(same);
+    if (incoming) return { dir: 'incoming', id: incoming.id };
+    const outgoing = arr(res.data && res.data.outgoing).find(same);
+    return outgoing ? { dir: 'outgoing', id: outgoing.id } : null;
+  }
+
+  function actionHtml(degree, handle, pending) {
+    if (degree === 0) return ''; // your own account reached by ?id= — nothing to ask
+    if (degree === 1) return '<p class="conn-act"><span class="conn-state">Connected</span></p>';
+    if (pending && pending.dir === 'incoming') {
+      return '<p class="conn-act"><span class="conn-state">They have asked to connect.</span>'
+        + `${btn('accept', pending.id, 'Accept')}${btn('decline', pending.id, 'Decline')}</p>`;
+    }
+    if (pending && pending.dir === 'outgoing') return SENT_HTML;
+    return `<p class="conn-act"><button class="btn-ghost" type="button" data-act="connect" data-handle="${escapeHtml(handle)}">Connect</button></p>`;
+  }
+
+  // The viewer-relative view. A 404 here is the deliberately indistinguishable
+  // set — unknown handle, provisional account, private stranger — and all of
+  // them mean the same thing to this page: there is nothing to offer, so the
+  // section stays hidden and no connect button is drawn.
+  async function renderOther(body, login) {
+    if (!login) return false;
+    const res = await api.request('GET', `${API}/connections/degree/${encodeURIComponent(login)}`);
+    if (res.status === 403) {
+      // About the VIEWER, not the target: their own account has not been
+      // activated at the hub yet, so they cannot take part at all.
+      body.innerHTML = '<p class="scroll__lede">Sign in to the platform once to activate your profile before connecting.</p>';
+      return true;
+    }
+    if (!res.ok) return false;
+    const data = res.data || {};
+    const handle = typeof data.handle === 'string' ? data.handle : null;
+    if (!handle) return false;
+    const mutuals = arr(data.mutuals);
+    body.innerHTML = degreeHtml(data.degree, mutuals) + actionHtml(data.degree, handle, await pendingWith(handle));
+    return true;
+  }
+
+  // ---- actions --------------------------------------------------------------
+
+  async function connect(handle) {
+    const res = await api.request('POST', `${API}/connections`, { body: { handle } });
+    // 201 { status: 'pending' } is byte-identical for a request that was written
+    // and one swallowed by the cooldown. "Request sent" claims exactly that.
+    if (res.status === 201) return { html: SENT_HTML, message: 'Request sent.' };
+    if (res.status === 409) return { message: 'There is already a request or a connection between you.' };
+    if (res.status === 403) return { message: 'Activate your platform profile before connecting.' };
+    // 404 is absent / provisional / private, indistinguishable on purpose.
+    if (res.status === 404) return { message: 'That builder cannot be connected with right now.' };
+    return { message: 'Could not send the request.' };
+  }
+
+  const ROW_ACTIONS = {
+    accept: { call: (id) => api.request('POST', `${API}/connections/${encodeURIComponent(id)}/accept`), message: 'Connected.' },
+    decline: { call: (id) => api.request('POST', `${API}/connections/${encodeURIComponent(id)}/decline`), message: 'Declined.' },
+    remove: { call: (id) => api.request('DELETE', `${API}/connections/${encodeURIComponent(id)}`), message: 'Connection removed.' },
+    withdraw: { call: (id) => api.request('DELETE', `${API}/connections/${encodeURIComponent(id)}`), message: 'Request withdrawn.' },
+  };
+
+  async function onClick(ev) {
+    const el = ev.target && ev.target.closest ? ev.target.closest('button[data-act]') : null;
+    if (!el) return;
+    const act = el.dataset.act;
+    el.disabled = true;
+    try {
+      if (act === 'connect') {
+        const out = await connect(el.dataset.handle);
+        // Replace only the action line: a 201 tells us nothing about the rest
+        // of the page, so nothing else is restated.
+        if (out.html) { const body = $('#conn-body'); if (body) body.innerHTML = body.innerHTML.replace(/<p class="conn-act">[\s\S]*?<\/p>/, out.html); }
+        toast(out.message);
+        return;
+      }
+      const spec = ROW_ACTIONS[act];
+      if (!spec) return;
+      const res = await spec.call(el.dataset.id);
+      if (!res.ok && res.status !== 204) { toast('That request is no longer available.'); }
+      else toast(spec.message);
+      if (last) await render(last.data, last.selfId);
+    } catch (err) {
+      console.error('[profile-connections] action failed', err);
+      toast('Something went wrong. Try again.');
+    } finally {
+      el.disabled = false;
+    }
+  }
+
+  // ---- entry ----------------------------------------------------------------
+
+  // Called by profile.js once the profile response has landed. Reveals the
+  // section only when the hub answered with something to show; any other
+  // outcome — module absent, signed out, target not addressable — leaves the
+  // markup's `hidden` in place.
+  async function render(data, selfId) {
+    const section = $('#conn-scroll');
+    const body = $('#conn-body');
+    if (!section || !body) return;
+    last = { data, selfId };
+    const builder = (data && data.builder) || {};
+    const isSelf = selfId != null && String(builder.id) === String(selfId);
+    try {
+      const shown = isSelf ? await renderOwn(body) : await renderOther(body, builder.github_login);
+      section.hidden = !shown;
+      if (shown && body.addEventListener && !body.dataset.connWired) {
+        body.dataset.connWired = '1';
+        body.addEventListener('click', onClick);
+      }
+    } catch (err) {
+      console.error('[profile-connections] failed to load', err);
+      section.hidden = true;
+    }
+  }
+
+  window.OTBConnections = { render };
+})();

package/modules/hall-ui/public/profile.html

@@ -107,9 +107,20 @@
           </div>
         </section>
 
+        <!-- Connections — section 6 of the profile-page spec (R20, task
+             1002296; ADR 0202). Hub-only, like the cross-project record:
+             profile-connections.js reveals it only when the hub's connections
+             API answers, so on an instance without platform-identity the
+             routes are absent and the section never renders. -->
+        <section class="scroll" id="conn-scroll" aria-labelledby="conn-h" hidden>
+          <h2 id="conn-h" class="scroll__h">Connections</h2>
+          <div id="conn-body"></div>
+        </section>
+
         <!-- Reserved slots — connections, guilds, and actions (profile-page
              spec sections 6–8) mount here in later phases; keeping the order
-             fixed now means the page is not re-laid-out twice (Decision 5). -->
+             fixed now means the page is not re-laid-out twice (Decision 5).
+             Section 6 landed above (task 1002296); 7 and 8 are still to come. -->
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>
@@ -130,6 +141,10 @@
 <!-- hall-kit (window.OTBKit) — profile.js renders ship-time task visuals through
      its shared thumbnail helper (task 1003109), so it must load first. -->
 <script src="/builders/hall-kit.js?v=2026-08-27-activity"></script>
+<!-- Connections (section 6). Loaded BEFORE profile.js so window.OTBConnections
+     exists by the time renderProfile runs; profile.js guards on it anyway, so a
+     page that omits this script simply has no connections section. -->
+<script src="/builders/profile-connections.js?v=2026-08-29-r20"></script>
 <script src="/builders/profile.js?v=2026-08-27-activity"></script>
 </body>
 </html>

package/modules/hall-ui/public/profile.js

@@ -534,6 +534,10 @@
     // The activity log needs a session (private goals + the idea trail), so it
     // keys off whether /me resolved — the same signal the self-detect uses.
     renderActivity(builder.id, selfId != null);
+    // Connections (section 6, task 1002296) — a separate hub-only script that
+    // reveals its own section or leaves it hidden. Optional by design: a page
+    // that does not load it simply has no connections section.
+    if (window.OTBConnections) window.OTBConnections.render(data, selfId);
   }
 
   // Render the friendly "no builder chosen" empty state for a signed-out visitor
@@ -557,6 +561,7 @@
     const worksLede = $('#works-lede'); if (worksLede) worksLede.hidden = true;
     const xp = $('#xp-scroll'); if (xp) xp.hidden = true;
     const act = $('#activity-scroll'); if (act) act.hidden = true;
+    const conn = $('#conn-scroll'); if (conn) conn.hidden = true;
   }
 
   async function fetchProfile(id, selfId) {

package/modules/hall-ui/public/style.css

@@ -1107,6 +1107,44 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 
 .disc-pref { margin-right: 4px; }
 
+/* ---------- connections (profile section 6, task 1002296) ---------- */
+
+.conn-person { display: inline-flex; align-items: center; gap: 7px; min-width: 0; }
+.conn-person__avatar {
+  width: 22px; height: 22px; border-radius: 50%; flex: none;
+  background: var(--surface-2); border: 1px solid var(--border); object-fit: cover;
+}
+.conn-person__name { font-weight: 500; }
+.conn-person__handle { color: var(--ink-faint); font-size: 12.5px; }
+
+/* The degree chip. `--out` is the null answer — deliberately the quietest of
+   the four, because "out of network" is an absence of knowledge, not a rank. */
+/* nowrap + flex:none — "Out of network" is the longest label and must stay one
+   pill; wrapped, it reads as two chips. */
+.conn-degree {
+  display: inline-block; flex: none; white-space: nowrap;
+  padding: 1px 7px; border-radius: 999px;
+  font-size: 11.5px; font-weight: 600; letter-spacing: 0.02em;
+  border: 1px solid var(--border-strong); background: var(--surface-2); color: var(--ink-soft);
+}
+.conn-degree--1 { background: var(--ok-weak); color: var(--ok); border-color: color-mix(in srgb, var(--ok) 30%, transparent); }
+.conn-degree--2 { background: var(--info-weak); color: var(--info); border-color: color-mix(in srgb, var(--info) 30%, transparent); }
+.conn-degree--3 { background: var(--surface-2); color: var(--ink-soft); }
+.conn-degree--out { background: none; color: var(--ink-faint); border-style: dashed; }
+
+.conn-degree-line { display: flex; align-items: baseline; gap: 8px; flex-wrap: wrap; margin: 0 0 6px; font-size: 13.5px; color: var(--ink-soft); }
+.conn-act { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; margin: 10px 0 0; }
+.conn-state { font-size: 13px; color: var(--ink-faint); }
+.conn-sub { margin: 14px 0 6px; font-size: 12px; text-transform: uppercase; letter-spacing: 0.06em; color: var(--ink-faint); }
+.conn-reqs { list-style: none; margin: 0; padding: 0; display: grid; gap: 6px; }
+.conn-req {
+  display: flex; align-items: center; gap: 10px; flex-wrap: wrap;
+  padding: 8px 10px; border: 1px solid var(--border); border-radius: 8px; background: var(--surface-1);
+}
+.conn-req__note { flex: 1 1 100%; margin: 0; font-size: 13px; color: var(--ink-soft); }
+.conn-req__state { font-size: 13px; color: var(--ink-faint); }
+.conn-req__acts { margin-left: auto; display: flex; gap: 6px; }
+
 @media (max-width: 640px) {
   .profile { grid-template-columns: 48px minmax(0, 1fr); }
   .profile__avatar { width: 48px; height: 48px; }

package/modules/platform-identity/account-visibility.js

@@ -3,9 +3,10 @@
 // query cannot drift (ADR 0202 D4; the ADR 0182 `publishableSql` precedent).
 //
 // WHAT IT ANSWERS: "may the world see that this account exists at all?" —
-// profile_state = 'active' (consent: a hub session has touched the account,
-// ADR 0171 D3) AND account_visibility = 'public' (existence: the privacy-spec
-// D1 axis). Both floors, ANDed, in one place.
+// CONSENT (profile_state = 'active' AND terms_accepted_at IS NOT NULL: a hub
+// session has touched the account AND that human accepted the platform terms,
+// ADR 0171 D3 + ADR 0213) AND account_visibility = 'public' (existence: the
+// privacy-spec D1 axis). Both floors, ANDed, in one place.
 //
 // WHY ITS OWN FILE. ADR 0202 D4 requires connections to consume ONE shared
 // reader rather than grow a connections-flavoured variant — "adding a second
@@ -52,11 +53,11 @@
 // (ADR 0192 §6 / ADR 0194 §2).
 'use strict';
 
-// The JS twin. `account` is any row carrying profile_state + account_visibility;
-// anything falsy (absent row, unreadable account) answers false.
+// The JS twin. `account` is any row carrying the consent columns +
+// account_visibility; anything falsy (absent row, unreadable account) answers
+// false. COMPOSED from isAccountActive so the consent axis has one definition.
 function isAccountVisible(account) {
-  if (!account) return false;
-  return account.profile_state === 'active' && account.account_visibility === 'public';
+  return isAccountActive(account) && account.account_visibility === 'public';
 }
 
 // The SAME predicate as a SQL fragment, for the reads that filter in the
@@ -70,25 +71,43 @@ function accountVisibleSql(alias) {
     throw new Error('accountVisibleSql: alias must be a bare SQL identifier');
   }
   const q = alias ? `${alias}.` : '';
-  return `(${q}profile_state = 'active' AND ${q}account_visibility = 'public')`;
+  return `(${accountActiveSql(alias)} AND ${q}account_visibility = 'public')`;
 }
 
-// The CONSENT floor on its own — active, without the existence axis. A private
+// The CONSENT floor on its own — consented, without the existence axis. A private
 // account is still a real participant in its OWN scope: ADR 0202 D4 §2 says its
 // connections appear in its own list and in the counterparty's own list, and an
 // incoming request must name who is asking or it cannot be decided. Those
 // own-scope reads floor on this; every PUBLIC read floors on accountVisibleSql.
+//
+// CONSENT IS TWO COLUMNS, NOT ONE (ADR 0213, task 1002913). profile_state='active'
+// says the hub witnessed a human at /sso/authorize; terms_accepted_at says that
+// human accepted the platform terms — the artifact ADR 0141 §4 deferred
+// cross-project-aggregation consent to, and which ADR 0171 D3 wrote its own
+// definition around ("the one path where a human is demonstrably at the hub, and
+// where T&C acceptance can later be captured"). Both are stamped by the SAME
+// upsertAccount branch, so they cannot disagree for any account activated after
+// ADR 0213 shipped; requiring both here is what makes that structural rather than
+// a promise, and what keeps a legacy row that predates the terms from publishing
+// on a consent premise that was never true. It re-publishes on its next hub
+// sign-in — the lazy upgrade D3's own backfill rule and P03 already chose.
+//
+// This is the ONE place terms_accepted_at is read. tests/effective_visibility_-
+// predicate.mjs fails any other file that tests it, exactly as for the columns
+// above.
 function accountActiveSql(alias) {
   if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
     throw new Error('accountActiveSql: alias must be a bare SQL identifier');
   }
-  return `(${alias ? `${alias}.` : ''}profile_state = 'active')`;
+  const q = alias ? `${alias}.` : '';
+  return `(${q}profile_state = 'active' AND ${q}terms_accepted_at IS NOT NULL)`;
 }
 
 // The JS twin of accountActiveSql, for an own-scope reader that already holds
-// the row (routes/connections.js). Fail-closed, same as isAccountVisible.
+// the row (routes/connections.js). Fail-closed, same as isAccountVisible: a row
+// missing EITHER consent column is not consented.
 function isAccountActive(account) {
-  return !!account && account.profile_state === 'active';
+  return !!account && account.profile_state === 'active' && account.terms_accepted_at != null;
 }
 
 // -------------------------------------------------------------------------

package/modules/platform-identity/connections.js

@@ -23,8 +23,9 @@
 //     (ADR 0171 D4 / ADR 0202 D4).
 //
 // WHOSE GRAPH. Node visibility is viewer-relative by design (ADR 0202 title):
-// the viewer's OWN connections floor on profile_state='active' alone — a private
-// account that accepted you appears in your own-scope list (D4 §2) — while every
+// the viewer's OWN connections floor on the CONSENT axis alone (accountActiveSql:
+// profile_state + terms acceptance, ADR 0213) — a private account that accepted
+// you appears in your own-scope list (D4 §2) — while every
 // DEEPER hop floors on the full public predicate in account-visibility.js. So a
 // bridge the viewer may not see yields `null`, not "3rd", and two viewers
 // legitimately seeing different labels for the same target is the model working.
@@ -128,7 +129,7 @@ async function findAccountByHandle(handle, { pool = defaultPool } = {}) {
   const norm = String(handle ?? '').trim().toLowerCase();
   if (!/^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$/.test(norm)) return null;
   const { rows } = await pool.query(
-    `SELECT github_id, handle, display_name, avatar_url, profile_state, account_visibility
+    `SELECT github_id, handle, display_name, avatar_url, profile_state, terms_accepted_at, account_visibility
        FROM platform_identity_accounts
       WHERE lower(handle) = $1 OR lower(previous_handle) = $1
       ORDER BY (lower(handle) = $1) DESC

package/modules/platform-identity/migrations/platform_identity_019_terms_acceptance.sql

@@ -0,0 +1,47 @@
+-- platform_identity_019_terms_acceptance.sql — the platform T&C acceptance
+-- record (ADR 0213, task 1002913; the artifact ADR 0141 §4 assumed and ADR 0171
+-- D3 reserved a place for).
+--
+-- WHAT IT IS. ADR 0141 deferred consent for CROSS-PROJECT AGGREGATION to "the
+-- platform T&C" and conditioned the scouting view on it; ADR 0171 D3 then made
+-- consent a fail-closed profile_state whose activation moment is "the one path
+-- where a human is demonstrably at the hub (and where T&C acceptance can later
+-- be captured, task 1002913)". This is that capture. terms_accepted_at is the
+-- moment the hub itself witnessed the human accept; terms_version records WHICH
+-- text they accepted, so a later revision is a distinguishable event rather than
+-- a silent overwrite.
+--
+-- WRITTEN ONLY BY THE HUB'S OWN SIGN-IN. Both columns are set exclusively by
+-- upsertAccount's `activate` branch, whose sole caller is /sso/authorize, where
+-- `activate: true` is a source literal and every other field comes from the
+-- hub's resolved session (ADR 0205 D3). No request-body field can reach them —
+-- an acceptance record a caller could assert is not evidence of anything.
+--
+-- IDEMPOTENT BY CONSTRUCTION. The conflict branch writes
+-- COALESCE(existing, now()), so the FIRST acceptance is the one that stands and
+-- signing in again never rewrites or duplicates it.
+--
+-- NO BACKFILL — DELIBERATE, and the same asymmetry ADR 0171 D3 chose. Existing
+-- accounts get NULL: no platform T&C covering cross-project aggregation has ever
+-- been shown to anyone, so no acceptance exists to record, and inventing a
+-- timestamp would fabricate the very artifact this task exists to make real.
+-- They re-accept on their next hub-session authorize, exactly as D3's own
+-- backfill rule provides ("all existing accounts start provisional and lazily
+-- upgrade on their next hub-session authorize") and P03 ratified (task 1002799:
+-- no backfill activation). The consequence — currently-active accounts are not
+-- publicly visible until their next hub sign-in — is the owner decision carried
+-- on blocker 1000122; grandfathering is one line here if the owner prefers it.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_accounts
+  ADD COLUMN IF NOT EXISTS terms_accepted_at timestamptz,
+  ADD COLUMN IF NOT EXISTS terms_version text;
+
+-- No index: acceptance is read only as part of the per-account effective-
+-- visibility predicate, and accounts are already looked up by github_id via the
+-- UNIQUE constraint from platform_identity_001_tables.sql.
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -18,6 +18,7 @@ const api = require('../../src/module-api');
 // D4 named). Every public read below joins it from here; nothing in this file
 // re-derives one (see account-visibility.js).
 const visibility = require('./account-visibility');
+const terms = require('./terms-acceptance');
 
 const { pool: defaultPool } = api;
 const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible, scoutingListableSql } = visibility;
@@ -139,10 +140,11 @@ async function ensureAccount({ githubId, githubLogin, displayName, avatarUrl },
 // github_id). Called at /sso/authorize for the signed-in hub user. Identity only.
 //
 // `activate` is the ONE consent upgrade path (ADR 0171 D3): an account becomes
-// profile_state='active' iff touched by a hub-session /sso/authorize — the path
-// where a human is demonstrably at the hub. Every other caller (device-poll,
-// membership check-in) leaves the fail-closed 'provisional' default; activation
-// is one-way (a later non-activating upsert never demotes an active account).
+// profile_state='active' iff touched by a hub-session /sso/authorize — where a
+// human is demonstrably at the hub — and the SAME branch stamps the platform T&C
+// acceptance (ADR 0213, idempotent; ./terms-acceptance.js), so no account is
+// active without one. Other callers (device-poll, check-in) leave the fail-closed
+// 'provisional' + a NULL acceptance; activation is one-way (never demotes).
 //
 // display_name is source-guarded (the ADR 0156 mirror, P02/task 1002798): once
 // a builder sets the account name themselves (setAccountProfileFields stamps
@@ -154,18 +156,18 @@ async function ensureAccount({ githubId, githubLogin, displayName, avatarUrl },
 // rewrites identity; a federated check-in gets `ensureAccount`.
 async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
-     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END)
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state${terms.acceptanceInsertColumns()})
+     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END${terms.acceptanceInsertValues('$5', '$6')})
      ON CONFLICT (github_id) DO UPDATE SET
        github_login = EXCLUDED.github_login,
        display_name = CASE WHEN platform_identity_accounts.display_name_source = 'user'
                            THEN platform_identity_accounts.display_name
                            ELSE EXCLUDED.display_name END,
        avatar_url   = EXCLUDED.avatar_url,
-       profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END,
+       profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END, ${terms.acceptanceConflictSet('$5', '$6')}
        updated_at   = now()
      RETURNING id, github_id, github_login, display_name, avatar_url, profile_state, handle`,
-    [githubId, githubLogin, displayName ?? null, safeAvatarUrl(avatarUrl), !!activate],
+    [githubId, githubLogin, displayName ?? null, safeAvatarUrl(avatarUrl), !!activate, terms.TERMS_VERSION],
   );
   const row = rows[0];
   // Seed the handle on first sight (spec Decision 3); a no-op once set.
@@ -189,7 +191,7 @@ async function getAccountByLogin(githubLogin, { pool = defaultPool } = {}) {
 async function getAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, profile_state, hide_stats,
-            account_visibility, recruiter_discoverable,
+            terms_accepted_at, terms_version, account_visibility, recruiter_discoverable,
             handle, previous_handle, handle_changed_at, bio, links, display_name_source,
             created_at, updated_at
        FROM platform_identity_accounts WHERE github_id = $1`,
@@ -861,7 +863,7 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
 async function getPublicProfileExtras(githubId, { pool = defaultPool } = {}) {
   if (!isNumericGithubId(githubId)) return null;
   const { rows } = await pool.query(
-    `SELECT profile_state, account_visibility, hide_stats
+    `SELECT profile_state, terms_accepted_at, account_visibility, hide_stats
        FROM platform_identity_accounts WHERE github_id = $1`,
     [githubId],
   );

package/modules/platform-identity/routes/connections.js

@@ -55,9 +55,10 @@ function connectionId(req) {
 }
 
 // The caller's platform account, or a { fail } describing why they cannot take
-// part. profile_state = 'active' is the floor for the WHOLE feature (ADR 0202
-// D4 §1): a provisional account cannot send, cannot receive, and never appears
-// in a list or a frontier. This is about the CALLER, so it may say so plainly.
+// part. The CONSENT axis (isAccountActive — active AND the platform terms
+// accepted, ADR 0213) is the floor for the WHOLE feature (ADR 0202 D4 §1): a
+// provisional account cannot send, cannot receive, and never appears in a list
+// or a frontier. This is about the CALLER, so it may say so plainly.
 async function actingAccount(builder) {
   const githubId = builder && builder.github_id;
   if (!pi.isNumericGithubId(githubId)) {