@bongos/core 1.19.427 → 1.19.429

package/modules/hall-ui/public/profile-canonical.js

@@ -0,0 +1,137 @@
+// modules/hall-ui/public/profile-canonical.js — the canonical-profile wiring on
+// the hall's profile page (P08, task 1002804; ADR 0214, ADR 0171 D1,
+// profile-page spec Decision 1).
+//
+// ONE ANSWER, THREE BEHAVIOURS. A builder has exactly one canonical public
+// profile, at <hub>/u/<handle>. What this page does about that depends on which
+// instance is serving it, and the two cases are opposites:
+//
+//   * THE HUB serves the same person's canonical page itself, from the same
+//     database. Two URLs for one page on one host is the duplication Decision 1
+//     exists to end, so the numeric ?id= form REDIRECTS to the handle URL.
+//   * A FEDERATED INSTANCE shows its OWN rank, works and achievements here —
+//     genuinely different content — so it must not redirect. It stays the local
+//     view, declares the hub page canonical, and LINKS OUT to the cross-project
+//     record rather than inlining numbers it would have to keep fresh
+//     (ADR 0171 D1: an instance-side copy is stale the moment a builder hides).
+//   * A VANILLA INSTANCE has no hub. Nothing here does anything.
+//
+// A page cannot both redirect to a URL and declare it canonical, and it does not
+// have to: those are two different instances.
+//
+// IT IS ALL DARK TODAY, ON PURPOSE. `/u/<handle>` does not exist yet — the page
+// is goal 1000048 R14, and the ADR that fixes its PATH (R01) is unwritten. A
+// rel=canonical naming a 404 consolidates nothing and risks the one page that
+// works, so CANONICAL_PROFILE_PAGE_LIVE is false and every branch below is a
+// no-op. ADR 0214 D1 carries the argument.
+//
+// NOTHING HERE IS AUTHORITY (ADR 0016): a canonical URL is an address, never a
+// grant. And nothing here decides who is visible — the server already did that
+// by omitting `handle` for an account that is absent, provisional or private,
+// identically in all three cases (ADR 0214 D5).
+
+(() => {
+  'use strict';
+
+  // BOUNDARY-FORCED DUPLICATION (the ADR 0091 §2 pattern, as
+  // platform-identity.js already does for the display-name cap): a browser
+  // script cannot require modules/platform-identity/canonical-profile.js, so the
+  // two constants below MIRROR it. tests/canonical_profile_url.mjs reads both
+  // files and fails if they ever disagree, which is what keeps this a mirror
+  // rather than a second opinion. Flip the module's copy and this one together.
+  const CANONICAL_PROFILE_PAGE_LIVE = false;
+  const CANONICAL_PROFILE_PREFIX = '/u/';
+
+  // Same charset the module re-checks: a handle is about to be interpolated into
+  // an href and a <link rel=canonical>, so it is validated here too rather than
+  // trusted because it arrived over the wire.
+  const HANDLE_RE = /^[a-z0-9-]{1,39}$/;
+
+  // The hub apex, stamped server-side into a <meta> (never a script global, and
+  // never straight into an href — an empty value in an href would silently
+  // become a same-host relative URL claiming to be the hub). Absent or empty
+  // means "no hub", and every branch below then does nothing.
+  function hubOrigin() {
+    const meta = document.querySelector('meta[name="hub-origin"]');
+    const raw = ((meta && meta.getAttribute('content')) || '').trim().replace(/\/+$/, '');
+    if (!raw) return null;
+    // Bare https origin only — a canonical must never name a downgraded scheme,
+    // and a value carrying a path is not an origin.
+    try {
+      const url = new URL(raw);
+      if (url.protocol !== 'https:' || url.username || url.password) return null;
+      if (url.pathname !== '/' || url.search || url.hash) return null;
+      return url.origin;
+    } catch (err) { return null; }
+  }
+
+  // The canonical public profile URL, or null when we must not point anywhere:
+  // the page is not live, no hub is known, or the account has no public handle
+  // (absent / provisional / private — indistinguishable by design).
+  function canonicalProfileUrl(handle) {
+    if (!CANONICAL_PROFILE_PAGE_LIVE) return null;
+    const origin = hubOrigin();
+    if (!origin) return null;
+    const h = String(handle == null ? '' : handle).trim().toLowerCase();
+    if (!HANDLE_RE.test(h)) return null;
+    return `${origin}${CANONICAL_PROFILE_PREFIX}${h}`;
+  }
+
+  // "Am I the hub?" — the enabled-module set the server injects. `platform-
+  // identity` IS the hub flag rather than a proxy for it (src/platform-server.js
+  // says so), so this asks the instance what it is and nothing has to know the
+  // platform's hostname.
+  function isHub() {
+    const mods = window.__MODULES__;
+    return Array.isArray(mods) ? mods.includes('platform-identity') : !!(mods && mods['platform-identity']);
+  }
+
+  function setCanonicalLink(url) {
+    let link = document.querySelector('link[rel="canonical"]');
+    if (!link) {
+      link = document.createElement('link');
+      link.setAttribute('rel', 'canonical');
+      document.head.appendChild(link);
+    }
+    link.setAttribute('href', url);
+  }
+
+  // The visible link-out — ADR 0171 D1's federated render path. It reuses the
+  // page's existing cross-project section, which on a federated instance is
+  // empty and hidden (the response carries no cross_project key there), so the
+  // heading a reader already understands gets the link instead of numbers.
+  function renderLinkOut(url) {
+    const section = document.getElementById('xp-scroll');
+    const body = document.getElementById('xp-body');
+    if (!section || !body) return;
+    // Defence in depth, and honestly UNOBSERVABLE today: canonicalProfileUrl has
+    // already refused anything outside `https://<bare origin>/u/[a-z0-9-]{1,39}`,
+    // so no value reaching here can contain a character this changes. It is the
+    // second wall for the day someone loosens the handle charset — a mutation
+    // test cannot make it bite, and that is the point rather than a gap.
+    const escapeHtml = (window.OTB && window.OTB.escapeHtml) || ((s) => String(s));
+    body.innerHTML = `<p class="scroll__lede">This builder's work spans more than this project. `
+      + `<a href="${escapeHtml(url)}" rel="noopener">See the cross-project record</a>.</p>`;
+    section.hidden = false;
+  }
+
+  // render(data) — called by profile.js once the profile response is in hand.
+  // `data.handle` is present iff the builder has a PUBLICLY VISIBLE platform
+  // account; absent for no account, provisional and private alike, so nothing
+  // here can tell those apart and neither can a visitor watching it.
+  function render(data) {
+    const url = canonicalProfileUrl(data && data.handle);
+    if (!url) return;
+    if (isHub()) {
+      // The hub's numeric form is an address for a page the hub also serves at
+      // the canonical URL. `replace`, not `assign`: the numeric URL should not
+      // sit in history as a place Back returns to.
+      if (new URLSearchParams(location.search).get('id')) location.replace(url);
+      return;
+    }
+    setCanonicalLink(url);
+    renderLinkOut(url);
+  }
+
+  window.OTBCanonical = { render, canonicalProfileUrl, hubOrigin, isHub };
+})();

package/modules/hall-ui/public/profile-connections.js

@@ -45,14 +45,18 @@
 // why `hide_stats` does not suppress it — hiding your stats hides the numbers
 // beside an edge, not the edge itself (ADR 0202 D4 §3).
 //
-// ADDRESSING. The connections API names a counterparty by HANDLE; this page
-// knows only a builder's github_login. It hands that login to
-// GET /connections/degree/:handle, which resolves the current handle or the
-// single previous-handle rename slot and echoes the CANONICAL handle back —
-// and that echoed handle, never the login, is what every write here sends. A
-// login resolving to neither answers 404 and the section stays hidden, the same
-// fail-closed answer a private or provisional account gets. The handle-addressed
-// hub page (/u/<handle>) will not need this hop at all.
+// ADDRESSING. The connections API names a counterparty by HANDLE. Since task
+// 1002804 the profile response carries the canonical `handle` itself (whenever
+// the builder has a publicly visible platform account), so this page addresses
+// by that and the login hop is only the FALLBACK for a server that predates it.
+// That fallback is the one with the hole, and it is why the widening mattered:
+// GET /connections/degree/:handle resolves a login against the current handle or
+// the SINGLE previous-handle rename slot, so a twice-renamed builder matched
+// neither, answered 404, and the section silently never appeared — the honest
+// gap ADR 0212 named and left open. Either way the API echoes the CANONICAL
+// handle back, and that echoed handle, never the login, is what every write here
+// sends. An address resolving to nothing answers 404 and the section stays
+// hidden, the same fail-closed answer a private or provisional account gets.
 
 (() => {
   'use strict';
@@ -288,7 +292,14 @@
     const builder = (data && data.builder) || {};
     const isSelf = selfId != null && String(builder.id) === String(selfId);
     try {
-      const shown = isSelf ? await renderOwn(body) : await renderOther(body, builder.github_login);
+      // Address by the CANONICAL handle when the response carries one (task
+      // 1002804 widened the profile read to include it), and fall back to the
+      // github_login hop for a server that predates that. The fallback is the
+      // thing with the hole: the rename window is a SINGLE previous_handle slot,
+      // so a twice-renamed builder's login matches neither and the section
+      // silently never appears — the honest gap ADR 0212 named and this closes.
+      const address = (data && typeof data.handle === 'string' && data.handle) || builder.github_login;
+      const shown = isSelf ? await renderOwn(body) : await renderOther(body, address);
       section.hidden = !shown;
       if (shown && body.addEventListener && !body.dataset.connWired) {
         body.dataset.connWired = '1';

package/modules/hall-ui/public/profile.html

@@ -5,6 +5,11 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Profile — {{worldName}}</title>
   <meta name="description" content="A builder of {{worldName}} — rank, works shipped, standing, and achievements.">
+  <!-- The platform hub's apex, stamped server-side (P08, task 1002804; ADR 0214
+       D2). Empty on a vanilla instance, and profile-canonical.js renders nothing
+       then — a meta, never an href, so an empty value cannot degrade into a
+       same-host URL claiming to be the hub. -->
+  <meta name="hub-origin" content="{{hubOrigin}}">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
@@ -145,6 +150,10 @@
      exists by the time renderProfile runs; profile.js guards on it anyway, so a
      page that omits this script simply has no connections section. -->
 <script src="/builders/profile-connections.js?v=2026-08-29-r20"></script>
+<!-- Canonical-profile wiring (P08). Loaded BEFORE profile.js so
+     window.OTBCanonical exists when renderProfile runs; profile.js guards on it,
+     so a page that omits this script simply declares no canonical. -->
+<script src="/builders/profile-canonical.js?v=2026-08-29-p08"></script>
 <script src="/builders/profile.js?v=2026-08-27-activity"></script>
 </body>
 </html>

package/modules/hall-ui/public/profile.js

@@ -538,6 +538,11 @@
     // reveals its own section or leaves it hidden. Optional by design: a page
     // that does not load it simply has no connections section.
     if (window.OTBConnections) window.OTBConnections.render(data, selfId);
+    // Canonical-profile wiring (P08, task 1002804) — the rel=canonical + the
+    // link-out to the cross-project record on a federated instance, and the
+    // numeric-id redirect on the hub. Optional the same way: a page without the
+    // script declares no canonical rather than breaking.
+    if (window.OTBCanonical) window.OTBCanonical.render(data);
   }
 
   // Render the friendly "no builder chosen" empty state for a signed-out visitor

package/modules/platform-identity/account-visibility.js

@@ -3,9 +3,10 @@
 // query cannot drift (ADR 0202 D4; the ADR 0182 `publishableSql` precedent).
 //
 // WHAT IT ANSWERS: "may the world see that this account exists at all?" —
-// profile_state = 'active' (consent: a hub session has touched the account,
-// ADR 0171 D3) AND account_visibility = 'public' (existence: the privacy-spec
-// D1 axis). Both floors, ANDed, in one place.
+// CONSENT (profile_state = 'active' AND terms_accepted_at IS NOT NULL: a hub
+// session has touched the account AND that human accepted the platform terms,
+// ADR 0171 D3 + ADR 0213) AND account_visibility = 'public' (existence: the
+// privacy-spec D1 axis). Both floors, ANDed, in one place.
 //
 // WHY ITS OWN FILE. ADR 0202 D4 requires connections to consume ONE shared
 // reader rather than grow a connections-flavoured variant — "adding a second
@@ -52,11 +53,11 @@
 // (ADR 0192 §6 / ADR 0194 §2).
 'use strict';
 
-// The JS twin. `account` is any row carrying profile_state + account_visibility;
-// anything falsy (absent row, unreadable account) answers false.
+// The JS twin. `account` is any row carrying the consent columns +
+// account_visibility; anything falsy (absent row, unreadable account) answers
+// false. COMPOSED from isAccountActive so the consent axis has one definition.
 function isAccountVisible(account) {
-  if (!account) return false;
-  return account.profile_state === 'active' && account.account_visibility === 'public';
+  return isAccountActive(account) && account.account_visibility === 'public';
 }
 
 // The SAME predicate as a SQL fragment, for the reads that filter in the
@@ -70,25 +71,43 @@ function accountVisibleSql(alias) {
     throw new Error('accountVisibleSql: alias must be a bare SQL identifier');
   }
   const q = alias ? `${alias}.` : '';
-  return `(${q}profile_state = 'active' AND ${q}account_visibility = 'public')`;
+  return `(${accountActiveSql(alias)} AND ${q}account_visibility = 'public')`;
 }
 
-// The CONSENT floor on its own — active, without the existence axis. A private
+// The CONSENT floor on its own — consented, without the existence axis. A private
 // account is still a real participant in its OWN scope: ADR 0202 D4 §2 says its
 // connections appear in its own list and in the counterparty's own list, and an
 // incoming request must name who is asking or it cannot be decided. Those
 // own-scope reads floor on this; every PUBLIC read floors on accountVisibleSql.
+//
+// CONSENT IS TWO COLUMNS, NOT ONE (ADR 0213, task 1002913). profile_state='active'
+// says the hub witnessed a human at /sso/authorize; terms_accepted_at says that
+// human accepted the platform terms — the artifact ADR 0141 §4 deferred
+// cross-project-aggregation consent to, and which ADR 0171 D3 wrote its own
+// definition around ("the one path where a human is demonstrably at the hub, and
+// where T&C acceptance can later be captured"). Both are stamped by the SAME
+// upsertAccount branch, so they cannot disagree for any account activated after
+// ADR 0213 shipped; requiring both here is what makes that structural rather than
+// a promise, and what keeps a legacy row that predates the terms from publishing
+// on a consent premise that was never true. It re-publishes on its next hub
+// sign-in — the lazy upgrade D3's own backfill rule and P03 already chose.
+//
+// This is the ONE place terms_accepted_at is read. tests/effective_visibility_-
+// predicate.mjs fails any other file that tests it, exactly as for the columns
+// above.
 function accountActiveSql(alias) {
   if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
     throw new Error('accountActiveSql: alias must be a bare SQL identifier');
   }
-  return `(${alias ? `${alias}.` : ''}profile_state = 'active')`;
+  const q = alias ? `${alias}.` : '';
+  return `(${q}profile_state = 'active' AND ${q}terms_accepted_at IS NOT NULL)`;
 }
 
 // The JS twin of accountActiveSql, for an own-scope reader that already holds
-// the row (routes/connections.js). Fail-closed, same as isAccountVisible.
+// the row (routes/connections.js). Fail-closed, same as isAccountVisible: a row
+// missing EITHER consent column is not consented.
 function isAccountActive(account) {
-  return !!account && account.profile_state === 'active';
+  return !!account && account.profile_state === 'active' && account.terms_accepted_at != null;
 }
 
 // -------------------------------------------------------------------------

package/modules/platform-identity/canonical-profile.js

@@ -0,0 +1,143 @@
+// modules/platform-identity/canonical-profile.js — THE one answer to "where
+// does this builder's canonical public profile live, and is it safe to point
+// there?" (P08, task 1002804; ADR 0214; profile-page spec Decision 1, ADR 0171
+// D1/D8).
+//
+// WHY ITS OWN FILE. Three surfaces need the same answer — the `rel=canonical`
+// a federated instance emits, the visible "see the cross-project record" link
+// beside it, and the numeric-id redirect the hub performs. Three surfaces each
+// building their own URL is three ways to disagree about where a profile lives
+// and, worse, three independent judgements about whether the target exists yet.
+// One resolver removes both. (platform-identity.js is also at its file-size
+// ratchet with zero headroom, which is why this lands beside it rather than in
+// it — the account-visibility.js precedent.)
+//
+// THE FLAG IS THE POINT. `/u/<handle>` does not exist: the page is goal 1000048
+// R14 (task 1002365, `backlog`), the SEO-namespace ADR that fixes its PATH is
+// R01 (`ready`, unwritten), and R03 in the same goal proposes moving platform
+// pages under /bongos/…. A rel=canonical naming a URL that 404s consolidates
+// nothing — a 404 cannot be indexed — while risking the one page that does
+// work. So the resolver answers null and every consumer renders nothing.
+// ADR 0214 D1 carries the full argument and the flip checklist.
+//
+// Not authority (ADR 0016): a canonical URL is an address, never a grant.
+'use strict';
+
+const { isAccountVisible } = require('./account-visibility');
+
+// The canonical profile namespace on the hub (profile-page spec Decision 1).
+// One spelling, so nothing hardcodes '/u/' a second time.
+const CANONICAL_PROFILE_PREFIX = '/u/';
+
+// FALSE until the page at CANONICAL_PROFILE_PREFIX actually resolves. Flipping
+// this turns on the canonical link, the link-out and the numeric-id redirect
+// together, everywhere, at once — which is exactly why it is one boolean and
+// not three.
+//
+// Flip it only when ALL FOUR hold (ADR 0214 D1):
+//   1. goal 1000048 R14 (task 1002365) serves the page at this path;
+//   2. R01 has ratified that path — R03 may still move platform pages;
+//   3. the page answers 404, never 403, for absent / provisional / private,
+//      matching GET /profiles/:handle;
+//   4. P09's noindex-until-first-ship is in place, so flipping does not publish
+//      a farm of empty profiles.
+// tests/canonical_profile_url.mjs fails if a /u/ page route lands in the tree
+// while this is still false, so the flag cannot silently fall behind the page.
+const CANONICAL_PROFILE_PAGE_LIVE = false;
+
+// A handle is the URL key, so it may only ever be the charset P01 normalizes to
+// (lowercase alnum + hyphen). Re-checked HERE rather than trusted, because this
+// value is about to be interpolated into a URL that goes into an href and a
+// <link rel=canonical>: a resolver that builds URLs should refuse anything it
+// cannot vouch for rather than rely on every future caller having normalized.
+const HANDLE_RE = /^[a-z0-9-]{1,39}$/;
+
+// An origin is only usable as a canonical target if it is a bare https origin —
+// no path, no query, no credentials. http is refused outright: a canonical
+// pointing at a downgraded scheme is a signal we should never emit.
+function normalizeHubOrigin(origin) {
+  const raw = String(origin ?? '').trim().replace(/\/+$/, '');
+  if (!raw) return null;
+  let url;
+  try { url = new URL(raw); } catch { return null; }
+  if (url.protocol !== 'https:') return null;
+  if (url.username || url.password) return null;
+  if (url.pathname !== '/' || url.search || url.hash) return null;
+  return url.origin;
+}
+
+// canonicalProfilePath(handle) — the path half, or null for a handle this
+// resolver will not vouch for. Split out from the URL so the composition rules
+// stay provable while the liveness flag below is false: a gate that short-
+// circuits everything would otherwise leave the interesting logic untested.
+function canonicalProfilePath(handle) {
+  const h = String(handle ?? '').trim().toLowerCase();
+  return HANDLE_RE.test(h) ? `${CANONICAL_PROFILE_PREFIX}${h}` : null;
+}
+
+// canonicalProfileUrl(hubOrigin, handle) — the canonical public profile URL, or
+// null when we must not point anywhere: the page is not live, no hub origin is
+// known (a vanilla instance), the origin is not a bare https origin, or the
+// handle is absent/malformed. EVERY consumer renders nothing on null; none of
+// them may fall back to a guess.
+function canonicalProfileUrl(hubOrigin, handle) {
+  if (!CANONICAL_PROFILE_PAGE_LIVE) return null;
+  const origin = normalizeHubOrigin(hubOrigin);
+  const path = canonicalProfilePath(handle);
+  return origin && path ? `${origin}${path}` : null;
+}
+
+// getPublicHandle(githubId) — the account's PUBLIC handle, or null.
+//
+// Floors on the SHARED existence predicate (isAccountVisible), never a variant:
+// active AND public. Deliberately NOT the rollup predicate — `hide_stats`
+// suppresses NUMBERS and never existence (account-visibility.js; resolveHandle
+// says the same), so a builder who hides their stats still has a public profile
+// at a canonical URL, it just carries no numbers. Gating the handle on
+// hide_stats would deny a canonical URL and a connect button to exactly the
+// people who chose a public profile without public numbers.
+//
+// A null is returned identically for "no account", "provisional" and "private"
+// — the three cases ADR 0171 D2 requires to stay indistinguishable — so a
+// caller can never tell them apart, and neither can anything downstream of one.
+async function getPublicHandle(githubId, { pool }) {
+  if (githubId === null || githubId === undefined) return null;
+  const id = String(githubId);
+  // Non-numeric principals (the `system:*` ids) would blow up the bigint cast;
+  // they have no account, so answer the same null an absent row gets.
+  if (!/^\d+$/.test(id)) return null;
+  // THE ROW CARRIES EVERY COLUMN THE THREE SHARED PREDICATES READ, not just the
+  // ones this function happens to need — the getPublicProfileExtras shape.
+  //
+  // Two different reasons, both learned the hard way:
+  //  * `terms_accepted_at` is REQUIRED. Task 1002913 moved the T&C witness into
+  //    isAccountActive, which isAccountVisible composes from, so a row without
+  //    the column reads as un-consented and this function fail-closes to null
+  //    for EVERYONE. Fail-closed is the safe direction, but it is still broken.
+  //  * `hide_stats` is NOT read here, and is selected anyway so the CHOICE of
+  //    predicate is the only thing deciding the answer. Omit it and
+  //    isAccountVisible and isRollupVisible agree on every row — the predicate
+  //    looks load-bearing while being decorative, and a later swap to the wrong
+  //    one fails OPEN in silence.
+  //
+  // The rule this leaves behind: a reader that applies a shared predicate must
+  // SELECT that predicate's whole column set, or it is deciding on absent data.
+  const { rows } = await pool.query(
+    `SELECT handle, profile_state, account_visibility, terms_accepted_at, hide_stats
+       FROM platform_identity_accounts WHERE github_id = $1::bigint`,
+    [id],
+  );
+  const row = rows[0];
+  if (!isAccountVisible(row)) return null;
+  const handle = String(row.handle ?? '').trim().toLowerCase();
+  return HANDLE_RE.test(handle) ? handle : null;
+}
+
+module.exports = {
+  CANONICAL_PROFILE_PREFIX,
+  CANONICAL_PROFILE_PAGE_LIVE,
+  canonicalProfilePath,
+  canonicalProfileUrl,
+  normalizeHubOrigin,
+  getPublicHandle,
+};

package/modules/platform-identity/connections.js

@@ -23,8 +23,9 @@
 //     (ADR 0171 D4 / ADR 0202 D4).
 //
 // WHOSE GRAPH. Node visibility is viewer-relative by design (ADR 0202 title):
-// the viewer's OWN connections floor on profile_state='active' alone — a private
-// account that accepted you appears in your own-scope list (D4 §2) — while every
+// the viewer's OWN connections floor on the CONSENT axis alone (accountActiveSql:
+// profile_state + terms acceptance, ADR 0213) — a private account that accepted
+// you appears in your own-scope list (D4 §2) — while every
 // DEEPER hop floors on the full public predicate in account-visibility.js. So a
 // bridge the viewer may not see yields `null`, not "3rd", and two viewers
 // legitimately seeing different labels for the same target is the model working.
@@ -128,7 +129,7 @@ async function findAccountByHandle(handle, { pool = defaultPool } = {}) {
   const norm = String(handle ?? '').trim().toLowerCase();
   if (!/^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$/.test(norm)) return null;
   const { rows } = await pool.query(
-    `SELECT github_id, handle, display_name, avatar_url, profile_state, account_visibility
+    `SELECT github_id, handle, display_name, avatar_url, profile_state, terms_accepted_at, account_visibility
        FROM platform_identity_accounts
       WHERE lower(handle) = $1 OR lower(previous_handle) = $1
       ORDER BY (lower(handle) = $1) DESC

package/modules/platform-identity/migrations/platform_identity_019_terms_acceptance.sql

@@ -0,0 +1,47 @@
+-- platform_identity_019_terms_acceptance.sql — the platform T&C acceptance
+-- record (ADR 0213, task 1002913; the artifact ADR 0141 §4 assumed and ADR 0171
+-- D3 reserved a place for).
+--
+-- WHAT IT IS. ADR 0141 deferred consent for CROSS-PROJECT AGGREGATION to "the
+-- platform T&C" and conditioned the scouting view on it; ADR 0171 D3 then made
+-- consent a fail-closed profile_state whose activation moment is "the one path
+-- where a human is demonstrably at the hub (and where T&C acceptance can later
+-- be captured, task 1002913)". This is that capture. terms_accepted_at is the
+-- moment the hub itself witnessed the human accept; terms_version records WHICH
+-- text they accepted, so a later revision is a distinguishable event rather than
+-- a silent overwrite.
+--
+-- WRITTEN ONLY BY THE HUB'S OWN SIGN-IN. Both columns are set exclusively by
+-- upsertAccount's `activate` branch, whose sole caller is /sso/authorize, where
+-- `activate: true` is a source literal and every other field comes from the
+-- hub's resolved session (ADR 0205 D3). No request-body field can reach them —
+-- an acceptance record a caller could assert is not evidence of anything.
+--
+-- IDEMPOTENT BY CONSTRUCTION. The conflict branch writes
+-- COALESCE(existing, now()), so the FIRST acceptance is the one that stands and
+-- signing in again never rewrites or duplicates it.
+--
+-- NO BACKFILL — DELIBERATE, and the same asymmetry ADR 0171 D3 chose. Existing
+-- accounts get NULL: no platform T&C covering cross-project aggregation has ever
+-- been shown to anyone, so no acceptance exists to record, and inventing a
+-- timestamp would fabricate the very artifact this task exists to make real.
+-- They re-accept on their next hub-session authorize, exactly as D3's own
+-- backfill rule provides ("all existing accounts start provisional and lazily
+-- upgrade on their next hub-session authorize") and P03 ratified (task 1002799:
+-- no backfill activation). The consequence — currently-active accounts are not
+-- publicly visible until their next hub sign-in — is the owner decision carried
+-- on blocker 1000122; grandfathering is one line here if the owner prefers it.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_accounts
+  ADD COLUMN IF NOT EXISTS terms_accepted_at timestamptz,
+  ADD COLUMN IF NOT EXISTS terms_version text;
+
+-- No index: acceptance is read only as part of the per-account effective-
+-- visibility predicate, and accounts are already looked up by github_id via the
+-- UNIQUE constraint from platform_identity_001_tables.sql.
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -18,6 +18,7 @@ const api = require('../../src/module-api');
 // D4 named). Every public read below joins it from here; nothing in this file
 // re-derives one (see account-visibility.js).
 const visibility = require('./account-visibility');
+const terms = require('./terms-acceptance');
 
 const { pool: defaultPool } = api;
 const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible, scoutingListableSql } = visibility;
@@ -139,10 +140,11 @@ async function ensureAccount({ githubId, githubLogin, displayName, avatarUrl },
 // github_id). Called at /sso/authorize for the signed-in hub user. Identity only.
 //
 // `activate` is the ONE consent upgrade path (ADR 0171 D3): an account becomes
-// profile_state='active' iff touched by a hub-session /sso/authorize — the path
-// where a human is demonstrably at the hub. Every other caller (device-poll,
-// membership check-in) leaves the fail-closed 'provisional' default; activation
-// is one-way (a later non-activating upsert never demotes an active account).
+// profile_state='active' iff touched by a hub-session /sso/authorize — where a
+// human is demonstrably at the hub — and the SAME branch stamps the platform T&C
+// acceptance (ADR 0213, idempotent; ./terms-acceptance.js), so no account is
+// active without one. Other callers (device-poll, check-in) leave the fail-closed
+// 'provisional' + a NULL acceptance; activation is one-way (never demotes).
 //
 // display_name is source-guarded (the ADR 0156 mirror, P02/task 1002798): once
 // a builder sets the account name themselves (setAccountProfileFields stamps
@@ -154,18 +156,18 @@ async function ensureAccount({ githubId, githubLogin, displayName, avatarUrl },
 // rewrites identity; a federated check-in gets `ensureAccount`.
 async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
-     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END)
+    `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state${terms.acceptanceInsertColumns()})
+     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END${terms.acceptanceInsertValues('$5', '$6')})
      ON CONFLICT (github_id) DO UPDATE SET
        github_login = EXCLUDED.github_login,
        display_name = CASE WHEN platform_identity_accounts.display_name_source = 'user'
                            THEN platform_identity_accounts.display_name
                            ELSE EXCLUDED.display_name END,
        avatar_url   = EXCLUDED.avatar_url,
-       profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END,
+       profile_state = CASE WHEN $5::boolean THEN 'active' ELSE platform_identity_accounts.profile_state END, ${terms.acceptanceConflictSet('$5', '$6')}
        updated_at   = now()
      RETURNING id, github_id, github_login, display_name, avatar_url, profile_state, handle`,
-    [githubId, githubLogin, displayName ?? null, safeAvatarUrl(avatarUrl), !!activate],
+    [githubId, githubLogin, displayName ?? null, safeAvatarUrl(avatarUrl), !!activate, terms.TERMS_VERSION],
   );
   const row = rows[0];
   // Seed the handle on first sight (spec Decision 3); a no-op once set.
@@ -189,7 +191,7 @@ async function getAccountByLogin(githubLogin, { pool = defaultPool } = {}) {
 async function getAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, profile_state, hide_stats,
-            account_visibility, recruiter_discoverable,
+            terms_accepted_at, terms_version, account_visibility, recruiter_discoverable,
             handle, previous_handle, handle_changed_at, bio, links, display_name_source,
             created_at, updated_at
        FROM platform_identity_accounts WHERE github_id = $1`,
@@ -861,7 +863,7 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
 async function getPublicProfileExtras(githubId, { pool = defaultPool } = {}) {
   if (!isNumericGithubId(githubId)) return null;
   const { rows } = await pool.query(
-    `SELECT profile_state, account_visibility, hide_stats
+    `SELECT profile_state, terms_accepted_at, account_visibility, hide_stats
        FROM platform_identity_accounts WHERE github_id = $1`,
     [githubId],
   );

package/modules/platform-identity/routes/connections.js

@@ -55,9 +55,10 @@ function connectionId(req) {
 }
 
 // The caller's platform account, or a { fail } describing why they cannot take
-// part. profile_state = 'active' is the floor for the WHOLE feature (ADR 0202
-// D4 §1): a provisional account cannot send, cannot receive, and never appears
-// in a list or a frontier. This is about the CALLER, so it may say so plainly.
+// part. The CONSENT axis (isAccountActive — active AND the platform terms
+// accepted, ADR 0213) is the floor for the WHOLE feature (ADR 0202 D4 §1): a
+// provisional account cannot send, cannot receive, and never appears in a list
+// or a frontier. This is about the CALLER, so it may say so plainly.
 async function actingAccount(builder) {
   const githubId = builder && builder.github_id;
   if (!pi.isNumericGithubId(githubId)) {

package/modules/platform-identity/routes/sso.js

@@ -18,6 +18,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
+const canonicalProfile = require('../canonical-profile');
 const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -120,6 +121,12 @@ function registerSeams() {
       // The ownership fact lives in this module, so the answer does too; core
       // asks through the port and treats an absent one as a denial.
       isProjectOwner: (githubId) => scoutingAuthz.hasOwnerMembership(githubId, { pool }),
+      // task 1002804 (P08, ADR 0214 D3): the account's PUBLIC handle — the
+      // canonical profile address — so the numeric profile route can name a
+      // builder by the rename-proof key instead of a mutable github_login.
+      // Floors on the EXISTENCE predicate, not the rollup one: hide_stats
+      // suppresses numbers, never addressability.
+      getPublicHandle: (githubId) => canonicalProfile.getPublicHandle(githubId, { pool }),
     });
   }
 }