@bongos/core 1.19.427 → 1.19.428

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1580,
-    "unique_ids": 1374,
-    "certain": 1580,
+    "strings": 1588,
+    "unique_ids": 1382,
+    "certain": 1588,
     "heuristic": 0,
     "duplicate_ids": 157
   },
@@ -23,7 +23,7 @@
     "landing": {
       "at": "public-landing",
       "files": 5,
-      "strings": 318
+      "strings": 326
     }
   },
   "blind_spots": [
@@ -92,7 +92,7 @@
         "public-landing/index.html:900",
         "public-landing/privacy.html:80",
         "public-landing/projects.html:1115",
-        "public-landing/terms.html:76"
+        "public-landing/terms.html:84"
       ]
     },
     {
@@ -105,7 +105,7 @@
         "public-landing/index.html:900",
         "public-landing/privacy.html:80",
         "public-landing/projects.html:1115",
-        "public-landing/terms.html:76"
+        "public-landing/terms.html:84"
       ]
     },
     {
@@ -142,7 +142,7 @@
         "public-landing/contact.html:71",
         "public-landing/index.html:900",
         "public-landing/privacy.html:80",
-        "public-landing/terms.html:76"
+        "public-landing/terms.html:84"
       ]
     },
     {
@@ -1104,7 +1104,7 @@
       "occurrences": 2,
       "at": [
         "public-landing/privacy.html:75",
-        "public-landing/terms.html:71"
+        "public-landing/terms.html:79"
       ]
     },
     {
@@ -1414,7 +1414,7 @@
       "occurrences": 2,
       "at": [
         "public-landing/privacy.html:72",
-        "public-landing/terms.html:72"
+        "public-landing/terms.html:80"
       ]
     },
     {
@@ -1484,7 +1484,7 @@
       "occurrences": 2,
       "at": [
         "public-landing/contact.html:59",
-        "public-landing/terms.html:72"
+        "public-landing/terms.html:80"
       ]
     },
     {
@@ -12257,7 +12257,7 @@
       "surface": "landing",
       "text": "A non-profit, capture-resistant commons.",
       "file": "public-landing/terms.html",
-      "line": 76,
+      "line": 84,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12518,7 +12518,7 @@
       "surface": "landing",
       "text": "Built by agents, on Cloud Bongos.",
       "file": "public-landing/terms.html",
-      "line": 76,
+      "line": 84,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12698,7 +12698,7 @@
       "surface": "landing",
       "text": "Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.",
       "file": "public-landing/terms.html",
-      "line": 65,
+      "line": 73,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12779,7 +12779,7 @@
       "surface": "landing",
       "text": "Fair use",
       "file": "public-landing/terms.html",
-      "line": 64,
+      "line": 72,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12882,6 +12882,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "0808df6e434c",
+      "surface": "landing",
+      "text": "From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform’s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.",
+      "file": "public-landing/terms.html",
+      "line": 69,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "8bb1f00b1558",
       "surface": "landing",
@@ -13170,6 +13179,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "69400ca12477",
+      "surface": "landing",
+      "text": "Once you have signed in here and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in here stays provisional and is published nowhere.",
+      "file": "public-landing/terms.html",
+      "line": 68,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "8329bb1a3693",
       "surface": "landing",
@@ -13238,7 +13256,7 @@
       "surface": "landing",
       "text": "Open source (AGPL-3.0)",
       "file": "public-landing/terms.html",
-      "line": 76,
+      "line": 84,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13382,7 +13400,7 @@
       "surface": "landing",
       "text": "Questions go through the",
       "file": "public-landing/terms.html",
-      "line": 72,
+      "line": 80,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13400,7 +13418,7 @@
       "surface": "landing",
       "text": "Read the source.",
       "file": "public-landing/terms.html",
-      "line": 71,
+      "line": 79,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13881,6 +13899,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "198f1eac5a95",
+      "surface": "landing",
+      "text": "The platform stores the date you accepted these terms, and which version, on your account. It is written only by signing in here, and only once — signing in again does not change the original date. This is version",
+      "file": "public-landing/terms.html",
+      "line": 70,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "20fcebaa85c4",
       "surface": "landing",
@@ -13944,12 +13971,21 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "02e596cc4569",
+      "surface": "landing",
+      "text": "These numbers describe; they do not govern.",
+      "file": "public-landing/terms.html",
+      "line": 67,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "ea7de26ce2f0",
       "surface": "landing",
       "text": "These terms ship with the software and change with it. The version served on this page is the one that applies; the repository keeps the history.",
       "file": "public-landing/terms.html",
-      "line": 71,
+      "line": 79,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14003,7 +14039,7 @@
       "surface": "landing",
       "text": "To the extent the law allows, the people running {{productName}} are not liable for loss arising from its use. It is free software, offered without warranty, as the AGPL-3.0 states.",
       "file": "public-landing/terms.html",
-      "line": 68,
+      "line": 76,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14106,6 +14142,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "9b3312899fb1",
+      "surface": "landing",
+      "text": "What is public.",
+      "file": "public-landing/terms.html",
+      "line": 68,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "b19e6b7ddc42",
       "surface": "landing",
@@ -14142,6 +14187,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "6130dcb60532",
+      "surface": "landing",
+      "text": "What you control.",
+      "file": "public-landing/terms.html",
+      "line": 69,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "b938baf0f723",
       "surface": "landing",
@@ -14250,6 +14304,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "0f06f7e72ea7",
+      "surface": "landing",
+      "text": "Your acceptance is recorded.",
+      "file": "public-landing/terms.html",
+      "line": 70,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "a4d2357d486b",
       "surface": "landing",
@@ -14358,6 +14421,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "cd379e3e0111",
+      "surface": "landing",
+      "text": "Your work across projects",
+      "file": "public-landing/terms.html",
+      "line": 65,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "bb158e10340b",
       "surface": "landing",
@@ -14444,7 +14516,7 @@
       "surface": "landing",
       "text": "contact page",
       "file": "public-landing/terms.html",
-      "line": 72,
+      "line": 80,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14606,7 +14678,7 @@
       "surface": "landing",
       "text": "privacy page",
       "file": "public-landing/terms.html",
-      "line": 72,
+      "line": 80,
       "origin": "html-text",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -355,6 +355,7 @@ tests/
 ├── application_echo.mjs          ← (task 1002284, goal 1000045, ADR 0201 D1.3/D1.4): the hub's STATUSLESS echo of an application. Part A pins the domain functions — the read binds `APPLICATION_ECHO_WINDOW_DAYS` itself (one 30, not three), the write is an upsert on the pair, neither statement mentions a status, and a non-numeric principal is refused before any query (ADR 0171 D2). Part B runs the real `POST /my-projects/join` and `GET /my-projects` over an in-memory `platform_identity_application_echoes` table with the relay's answer scripted: only an accepted application leaves a trace — a standing membership, either door refusal, a members-only project and an unreachable project leave none — and best-effort is asserted in both directions (a failed echo write still reports the filed application; a failed echo read still lands the memberships listing). DB-free `unit` lane.
 ├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked three ways. DB-free `unit` lane.
 ├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
+├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
 └── public_task_resolver.mjs      ← (#604): the public `/public/tasks/:id` projection — title/value_summary exposed only for shipped|confirmed; withheld for in-flight so unshipped/security task names can't leak.
 ```
 

package/docs/module-api-changelog.md

@@ -1291,5 +1291,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.425 with no explicit bump. run 33270772607. (task 1002620)
   1.19.427 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.426 with no explicit bump. run 33271340372. (task 1002620)
+  1.19.428 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.427 with no explicit bump. run 33274315388. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/account-visibility.js

@@ -3,9 +3,10 @@
 // query cannot drift (ADR 0202 D4; the ADR 0182 `publishableSql` precedent).
 //
 // WHAT IT ANSWERS: "may the world see that this account exists at all?" —
-// profile_state = 'active' (consent: a hub session has touched the account,
-// ADR 0171 D3) AND account_visibility = 'public' (existence: the privacy-spec
-// D1 axis). Both floors, ANDed, in one place.
+// CONSENT (profile_state = 'active' AND terms_accepted_at IS NOT NULL: a hub
+// session has touched the account AND that human accepted the platform terms,
+// ADR 0171 D3 + ADR 0213) AND account_visibility = 'public' (existence: the
+// privacy-spec D1 axis). Both floors, ANDed, in one place.
 //
 // WHY ITS OWN FILE. ADR 0202 D4 requires connections to consume ONE shared
 // reader rather than grow a connections-flavoured variant — "adding a second
@@ -52,11 +53,11 @@
 // (ADR 0192 §6 / ADR 0194 §2).
 'use strict';
 
-// The JS twin. `account` is any row carrying profile_state + account_visibility;
-// anything falsy (absent row, unreadable account) answers false.
+// The JS twin. `account` is any row carrying the consent columns +
+// account_visibility; anything falsy (absent row, unreadable account) answers
+// false. COMPOSED from isAccountActive so the consent axis has one definition.
 function isAccountVisible(account) {
-  if (!account) return false;
-  return account.profile_state === 'active' && account.account_visibility === 'public';
+  return isAccountActive(account) && account.account_visibility === 'public';
 }
 
 // The SAME predicate as a SQL fragment, for the reads that filter in the
@@ -70,25 +71,43 @@ function accountVisibleSql(alias) {
     throw new Error('accountVisibleSql: alias must be a bare SQL identifier');
   }
   const q = alias ? `${alias}.` : '';
-  return `(${q}profile_state = 'active' AND ${q}account_visibility = 'public')`;
+  return `(${accountActiveSql(alias)} AND ${q}account_visibility = 'public')`;
 }
 
-// The CONSENT floor on its own — active, without the existence axis. A private
+// The CONSENT floor on its own — consented, without the existence axis. A private
 // account is still a real participant in its OWN scope: ADR 0202 D4 §2 says its
 // connections appear in its own list and in the counterparty's own list, and an
 // incoming request must name who is asking or it cannot be decided. Those
 // own-scope reads floor on this; every PUBLIC read floors on accountVisibleSql.
+//
+// CONSENT IS TWO COLUMNS, NOT ONE (ADR 0213, task 1002913). profile_state='active'
+// says the hub witnessed a human at /sso/authorize; terms_accepted_at says that
+// human accepted the platform terms — the artifact ADR 0141 §4 deferred
+// cross-project-aggregation consent to, and which ADR 0171 D3 wrote its own
+// definition around ("the one path where a human is demonstrably at the hub, and
+// where T&C acceptance can later be captured"). Both are stamped by the SAME
+// upsertAccount branch, so they cannot disagree for any account activated after
+// ADR 0213 shipped; requiring both here is what makes that structural rather than
+// a promise, and what keeps a legacy row that predates the terms from publishing
+// on a consent premise that was never true. It re-publishes on its next hub
+// sign-in — the lazy upgrade D3's own backfill rule and P03 already chose.
+//
+// This is the ONE place terms_accepted_at is read. tests/effective_visibility_-
+// predicate.mjs fails any other file that tests it, exactly as for the columns
+// above.
 function accountActiveSql(alias) {
   if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
     throw new Error('accountActiveSql: alias must be a bare SQL identifier');
   }
-  return `(${alias ? `${alias}.` : ''}profile_state = 'active')`;
+  const q = alias ? `${alias}.` : '';
+  return `(${q}profile_state = 'active' AND ${q}terms_accepted_at IS NOT NULL)`;
 }
 
 // The JS twin of accountActiveSql, for an own-scope reader that already holds
-// the row (routes/connections.js). Fail-closed, same as isAccountVisible.
+// the row (routes/connections.js). Fail-closed, same as isAccountVisible: a row
+// missing EITHER consent column is not consented.
 function isAccountActive(account) {
-  return !!account && account.profile_state === 'active';
+  return !!account && account.profile_state === 'active' && account.terms_accepted_at != null;
 }
 
 // -------------------------------------------------------------------------

package/modules/platform-identity/connections.js

@@ -23,8 +23,9 @@
 //     (ADR 0171 D4 / ADR 0202 D4).
 //
 // WHOSE GRAPH. Node visibility is viewer-relative by design (ADR 0202 title):
-// the viewer's OWN connections floor on profile_state='active' alone — a private
-// account that accepted you appears in your own-scope list (D4 §2) — while every
+// the viewer's OWN connections floor on the CONSENT axis alone (accountActiveSql:
+// profile_state + terms acceptance, ADR 0213) — a private account that accepted
+// you appears in your own-scope list (D4 §2) — while every
 // DEEPER hop floors on the full public predicate in account-visibility.js. So a
 // bridge the viewer may not see yields `null`, not "3rd", and two viewers
 // legitimately seeing different labels for the same target is the model working.
@@ -128,7 +129,7 @@ async function findAccountByHandle(handle, { pool = defaultPool } = {}) {
   const norm = String(handle ?? '').trim().toLowerCase();
   if (!/^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$/.test(norm)) return null;
   const { rows } = await pool.query(
-    `SELECT github_id, handle, display_name, avatar_url, profile_state, account_visibility
+    `SELECT github_id, handle, display_name, avatar_url, profile_state, terms_accepted_at, account_visibility
        FROM platform_identity_accounts
       WHERE lower(handle) = $1 OR lower(previous_handle) = $1
       ORDER BY (lower(handle) = $1) DESC

package/modules/platform-identity/migrations/platform_identity_019_terms_acceptance.sql

@@ -0,0 +1,47 @@
+-- platform_identity_019_terms_acceptance.sql — the platform T&C acceptance
+-- record (ADR 0213, task 1002913; the artifact ADR 0141 §4 assumed and ADR 0171
+-- D3 reserved a place for).
+--
+-- WHAT IT IS. ADR 0141 deferred consent for CROSS-PROJECT AGGREGATION to "the
+-- platform T&C" and conditioned the scouting view on it; ADR 0171 D3 then made
+-- consent a fail-closed profile_state whose activation moment is "the one path
+-- where a human is demonstrably at the hub (and where T&C acceptance can later
+-- be captured, task 1002913)". This is that capture. terms_accepted_at is the
+-- moment the hub itself witnessed the human accept; terms_version records WHICH
+-- text they accepted, so a later revision is a distinguishable event rather than
+-- a silent overwrite.
+--
+-- WRITTEN ONLY BY THE HUB'S OWN SIGN-IN. Both columns are set exclusively by
+-- upsertAccount's `activate` branch, whose sole caller is /sso/authorize, where
+-- `activate: true` is a source literal and every other field comes from the
+-- hub's resolved session (ADR 0205 D3). No request-body field can reach them —
+-- an acceptance record a caller could assert is not evidence of anything.
+--
+-- IDEMPOTENT BY CONSTRUCTION. The conflict branch writes
+-- COALESCE(existing, now()), so the FIRST acceptance is the one that stands and
+-- signing in again never rewrites or duplicates it.
+--
+-- NO BACKFILL — DELIBERATE, and the same asymmetry ADR 0171 D3 chose. Existing
+-- accounts get NULL: no platform T&C covering cross-project aggregation has ever
+-- been shown to anyone, so no acceptance exists to record, and inventing a
+-- timestamp would fabricate the very artifact this task exists to make real.
+-- They re-accept on their next hub-session authorize, exactly as D3's own
+-- backfill rule provides ("all existing accounts start provisional and lazily
+-- upgrade on their next hub-session authorize") and P03 ratified (task 1002799:
+-- no backfill activation). The consequence — currently-active accounts are not
+-- publicly visible until their next hub sign-in — is the owner decision carried
+-- on blocker 1000122; grandfathering is one line here if the owner prefers it.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_accounts
+  ADD COLUMN IF NOT EXISTS terms_accepted_at timestamptz,
+  ADD COLUMN IF NOT EXISTS terms_version text;
+
+-- No index: acceptance is read only as part of the per-account effective-
+-- visibility predicate, and accounts are already looked up by github_id via the
+-- UNIQUE constraint from platform_identity_001_tables.sql.
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -18,6 +18,7 @@ const api = require('../../src/module-api');
 // D4 named). Every public read below joins it from here; nothing in this file
 // re-derives one (see account-visibility.js).
 const visibility = require('./account-visibility');
+const terms = require('./terms-acceptance');
 
 const { pool: defaultPool } = api;
 const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible, scoutingListableSql } = visibility;
@@ -139,10 +140,11 @@ async function ensureAccount({ githubId, githubLogin, displayName, avatarUrl },
 // github_id). Called at /sso/authorize for the signed-in hub user. Identity only.
 //
 // `activate` is the ONE consent upgrade path (ADR 0171 D3): an account becomes
-// profile_state='active' iff touched by a hub-session /sso/authorize — the path
-// where a human is demonstrably at the hub. Every other caller (device-poll,
-// membership check-in) leaves the fail-closed 'provisional' default; activation
-// is one-way (a later non-activating upsert never demotes an active account).
+// profile_state='active' iff touched by a hub-session /sso/authorize — where a
+// human is demonstrably at the hub — and the SAME branch stamps the platform T&C
+// acceptance (ADR 0213, idempotent; ./terms-acceptance.js), so no account is
+// active without one. Other callers (device-poll, check-in) leave the fail-closed
+// 'provisional' + a NULL acceptance; activation is one-way (never demotes).
 //
 // display_name is source-guarded (the ADR 0156 mirror, P02/task 1002798): once
 // a builder sets the account name themselves (setAccountProfileFields stamps
@@ -154,18 +156,18 @@ async function ensureAccount({ githubId, githubLogin, displayName, avatarUrl },
 // rewrites identity; a federated check-in gets `ensureAccount`.
 async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
-     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END)
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state${terms.acceptanceInsertColumns()})
+     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END${terms.acceptanceInsertValues('$5', '$6')})
      ON CONFLICT (github_id) DO UPDATE SET
        github_login = EXCLUDED.github_login,
        display_name = CASE WHEN platform_identity_accounts.display_name_source = 'user'
                            THEN platform_identity_accounts.display_name
                            ELSE EXCLUDED.display_name END,
        avatar_url   = EXCLUDED.avatar_url,
-       profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END,
+       profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END, ${terms.acceptanceConflictSet('$5', '$6')}
        updated_at   = now()
      RETURNING id, github_id, github_login, display_name, avatar_url, profile_state, handle`,
-    [githubId, githubLogin, displayName ?? null, safeAvatarUrl(avatarUrl), !!activate],
+    [githubId, githubLogin, displayName ?? null, safeAvatarUrl(avatarUrl), !!activate, terms.TERMS_VERSION],
   );
   const row = rows[0];
   // Seed the handle on first sight (spec Decision 3); a no-op once set.
@@ -189,7 +191,7 @@ async function getAccountByLogin(githubLogin, { pool = defaultPool } = {}) {
 async function getAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, profile_state, hide_stats,
-            account_visibility, recruiter_discoverable,
+            terms_accepted_at, terms_version, account_visibility, recruiter_discoverable,
             handle, previous_handle, handle_changed_at, bio, links, display_name_source,
             created_at, updated_at
        FROM platform_identity_accounts WHERE github_id = $1`,
@@ -861,7 +863,7 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
 async function getPublicProfileExtras(githubId, { pool = defaultPool } = {}) {
   if (!isNumericGithubId(githubId)) return null;
   const { rows } = await pool.query(
-    `SELECT profile_state, account_visibility, hide_stats
+    `SELECT profile_state, terms_accepted_at, account_visibility, hide_stats
        FROM platform_identity_accounts WHERE github_id = $1`,
     [githubId],
   );

package/modules/platform-identity/routes/connections.js

@@ -55,9 +55,10 @@ function connectionId(req) {
 }
 
 // The caller's platform account, or a { fail } describing why they cannot take
-// part. profile_state = 'active' is the floor for the WHOLE feature (ADR 0202
-// D4 §1): a provisional account cannot send, cannot receive, and never appears
-// in a list or a frontier. This is about the CALLER, so it may say so plainly.
+// part. The CONSENT axis (isAccountActive — active AND the platform terms
+// accepted, ADR 0213) is the floor for the WHOLE feature (ADR 0202 D4 §1): a
+// provisional account cannot send, cannot receive, and never appears in a list
+// or a frontier. This is about the CALLER, so it may say so plainly.
 async function actingAccount(builder) {
   const githubId = builder && builder.github_id;
   if (!pi.isNumericGithubId(githubId)) {

package/modules/platform-identity/terms-acceptance.js

@@ -0,0 +1,97 @@
+// modules/platform-identity/terms-acceptance.js — THE platform T&C acceptance
+// record: which text is current, and the SQL that stamps a builder's acceptance
+// of it (ADR 0213, task 1002913).
+//
+// WHAT THIS ANSWERS: "did the hub itself witness this human accept the platform
+// terms, and which text did they accept?" — the artifact ADR 0141 §4 deferred
+// consent for cross-project aggregation to, and ADR 0171 D3 reserved a place for
+// ("the one path where a human is demonstrably at the hub, and where T&C
+// acceptance can later be captured, task 1002913").
+//
+// WHY ITS OWN FILE. platform-identity.js sits at the 1500-line fitness ratchet
+// with `oversized_file_count: 0` as the baseline — there is no headroom, and
+// four sessions have already set the precedent that new logic lands beside it
+// (account-visibility.js, application-echo.js, routes/connections.js,
+// src/bongos/routes/my-sessions.js). This file is that, for consent.
+//
+// THE WRITE SIDE ONLY — read the record through account-visibility.js. That file
+// is the SOLE owner of every effective-visibility answer, and acceptance is now
+// part of the consent axis it publishes (accountActiveSql / isAccountActive).
+// Nothing here compares terms_accepted_at to anything; these are the statements
+// that SET it. tests/effective_visibility_predicate.mjs enforces that split —
+// its SPELLINGS list fails any file but the owner that writes the acceptance
+// predicate, and deliberately does not match a write.
+//
+// WHY THE CALLER CANNOT FORGE ONE. These fragments have exactly one call site:
+// upsertAccount's `activate` branch, whose only caller is /sso/authorize
+// (routes/sso.js). There `activate: true` is a SOURCE LITERAL and every other
+// field comes from the hub's own resolved session — the ADR 0205 D3 property
+// established for recordFederatedSignin by task 1003340. No request-body field
+// reaches these statements, which is the whole point: an acceptance record a
+// caller could assert would be evidence of nothing.
+//
+// IDEMPOTENT BY CONSTRUCTION: the conflict branch is COALESCE(existing, new), so
+// the FIRST acceptance stands and a second sign-in never rewrites or duplicates
+// it. The two columns are only ever written together, so they cannot diverge.
+//
+// A LATER REVISION IS A KNOWN GAP, NOT A SILENT ONE. Because the version is
+// recorded and never overwritten, publishing a new TERMS_VERSION leaves every
+// existing row naming the text it actually agreed to — so the platform can see
+// who has not accepted the new one. Re-acceptance on revision is deliberately
+// NOT built here (ADR 0213 D4): it is a product flow, not a storage shape.
+'use strict';
+
+// The version of the platform terms currently served at /terms. It is stamped
+// onto every acceptance, so it must match the version the page states — the
+// pairing is asserted by tests/terms_acceptance.mjs, which reads both.
+//
+// Date-stamped rather than numbered: the page says "Version <this>", and a
+// reader comparing page to record should not have to translate.
+const TERMS_VERSION = '2026-08-29';
+
+// A Postgres placeholder, e.g. '$5'. Interpolated into SQL, so it is validated
+// rather than trusted — the account-visibility.js alias-guard pattern.
+function assertPlaceholder(fn, value) {
+  if (!/^\$[1-9][0-9]*$/.test(String(value))) {
+    throw new Error(`${fn}: expected a Postgres placeholder like '$5', got ${JSON.stringify(value)}`);
+  }
+}
+
+// The acceptance columns, for an INSERT column list. Leading comma: it appends
+// to an existing list rather than standing alone.
+function acceptanceInsertColumns() {
+  return ', terms_accepted_at, terms_version';
+}
+
+// The matching VALUES fragment. A row created by a NON-activating caller
+// (ensureAccount's check-in / device-poll path) gets NULL — fail-closed: no hub
+// session witnessed that human, so there is no acceptance to record.
+function acceptanceInsertValues(activateParam, versionParam) {
+  assertPlaceholder('acceptanceInsertValues', activateParam);
+  assertPlaceholder('acceptanceInsertValues', versionParam);
+  return `, CASE WHEN ${activateParam}::boolean THEN now() ELSE NULL END`
+    + `, CASE WHEN ${activateParam}::boolean THEN ${versionParam}::text ELSE NULL END`;
+}
+
+// The ON CONFLICT DO UPDATE SET fragment — the idempotent half. COALESCE keeps
+// the FIRST acceptance, so signing in again re-reads the terms but does not
+// restamp them; a non-activating upsert leaves both columns exactly as they are,
+// mirroring the one-way rule profile_state already follows.
+//
+// Trailing comma: it sits between two other assignments in the SET list.
+function acceptanceConflictSet(activateParam, versionParam) {
+  assertPlaceholder('acceptanceConflictSet', activateParam);
+  assertPlaceholder('acceptanceConflictSet', versionParam);
+  const self = 'platform_identity_accounts';
+  return `terms_accepted_at = CASE WHEN ${activateParam}::boolean`
+    + ` THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
+    + ` terms_version = CASE WHEN ${activateParam}::boolean`
+    + ` THEN COALESCE(${self}.terms_version, ${versionParam}::text) ELSE ${self}.terms_version END,`;
+}
+
+module.exports = {
+  TERMS_VERSION,
+  acceptanceInsertColumns,
+  acceptanceInsertValues,
+  acceptanceConflictSet,
+};