@bongos/core 1.19.428 → 1.19.429

package/tests/canonical_profile_url.mjs

@@ -0,0 +1,628 @@
+// tests/canonical_profile_url.mjs — the proof for P08 (task 1002804, ADR 0214):
+// the canonical profile URL is resolved in ONE place, it is emitted only when
+// the builder actually has a publicly visible platform account, the numeric-id
+// redirect is not an existence oracle, and widening the profile response did not
+// widen what it leaks.
+//
+// THE MECHANISM (the tests/connections_ownership.mjs → profile_privacy_owner_view
+// .mjs house pattern). The fake pool builds its row filter FROM EACH STATEMENT'S
+// OWN WHERE CLAUSE and throws on a placeholder or a literal comparison it did
+// not consume, so a predicate this file cannot read can never degrade into "no
+// constraint" and quietly pass. The REAL core router runs above it over a REAL
+// loopback socket, and the REAL browser script runs in a vm above a stub DOM.
+// Nothing here asserts against a canned response.
+//
+// THE FLAG IS FALSE TODAY (ADR 0214 D1), so the three render behaviours are all
+// no-ops in production. Testing only that would be testing nothing, so the
+// client tests run the SAME source with the one constant flipped — and assert
+// the substitution changed exactly one thing, because a mutation that misses is
+// the failure mode this file exists to avoid.
+//
+// LANE: DB-free. It must run on every PR, where there is no Postgres. The last
+// test asserts that membership from the runner's own source (learning 1000218 —
+// three tests declared INTEGRATION in a header, were in neither lane, and
+// asserted nothing for months).
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import vm from 'node:vm';
+import express from 'express';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// ESM `import`, not createRequire: knip credits a CJS module's exports as used
+// only through real import bindings (the knip-createrequire learning).
+import {
+  CANONICAL_PROFILE_PREFIX,
+  CANONICAL_PROFILE_PAGE_LIVE,
+  canonicalProfilePath,
+  canonicalProfileUrl,
+  normalizeHubOrigin,
+  getPublicHandle,
+} from '../modules/platform-identity/canonical-profile.js';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const read = (...p) => readFileSync(join(ROOT, ...p), 'utf8');
+
+const CLIENT_SRC = read('modules', 'hall-ui', 'public', 'profile-canonical.js');
+const MODULE_SRC = read('modules', 'platform-identity', 'canonical-profile.js');
+const PROFILE_JS = read('modules', 'hall-ui', 'public', 'profile.js');
+const PROFILE_HTML = read('modules', 'hall-ui', 'public', 'profile.html');
+const SERVE_INTERNAL = read('src', 'bongos', 'serve-internal.js');
+
+// ===========================================================================
+// The fake pool — its filter comes from the statement, and it refuses what it
+// cannot read
+// ===========================================================================
+
+// github_id -> row. Only the columns the read actually SELECTs.
+let ACCOUNTS = new Map();
+
+function predicateFor(rawWhere, params) {
+  const consumed = new Set();
+  const tests = [];
+  const p = (n) => { consumed.add(String(n)); return params[Number(n) - 1]; };
+
+  let where = rawWhere;
+  let m;
+  if ((m = /\bgithub_id = \$(\d+)::bigint/.exec(where))) {
+    const v = p(m[1]);
+    tests.push((r) => String(r.github_id) === String(v));
+    where = where.replace(m[0], ' TRUE ');
+  }
+
+  for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(ph[1])) {
+      throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
+    }
+  }
+  // A literal comparison this interpreter does not model would be a visibility
+  // predicate applied in SQL that the fake pool silently ignores — the exact
+  // shape that makes a privacy test pass while the code leaks.
+  const leftover = where.replace(/\bTRUE\b/g, '').trim();
+  if (leftover) {
+    throw new Error(`fake pool: unmodelled WHERE remainder "${leftover}" — refusing rather than ignoring a filter`);
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+const pool = {
+  async query(text, params = []) {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    const m = /^SELECT (.+?) FROM platform_identity_accounts WHERE (.+)$/i.exec(sql);
+    if (!m) throw new Error(`fake pool: unsupported statement — ${sql}`);
+    const cols = m[1].split(',').map((c) => c.trim());
+    const keep = predicateFor(m[2], params);
+    const rows = [...ACCOUNTS.values()].filter(keep).map((r) => {
+      const out = {};
+      for (const c of cols) out[c] = r[c];
+      return out;
+    });
+    return { rows, rowCount: rows.length };
+  },
+};
+
+// Calibrate the instrument before trusting it (the house rule).
+test('the fake pool refuses a filter it cannot read rather than ignoring it', () => {
+  assert.throws(
+    () => predicateFor('github_id = $1::bigint AND secret = $2', ['1', 'x']),
+    /unread predicate on \$2/,
+  );
+  assert.throws(
+    () => predicateFor("github_id = $1::bigint AND profile_state = 'active'", ['1']),
+    /unmodelled WHERE remainder/,
+  );
+});
+
+test('the fake pool refuses a statement shape it does not model', async () => {
+  await assert.rejects(() => pool.query('DELETE FROM platform_identity_accounts'), /unsupported statement/);
+});
+
+const account = (over = {}) => ({
+  github_id: '4242',
+  handle: 'ada',
+  profile_state: 'active',
+  account_visibility: 'public',
+  // The T&C witness task 1002913 folded into the CONSENT floor that
+  // isAccountVisible composes from. A visible account has one.
+  terms_accepted_at: '2026-08-01T00:00:00.000Z',
+  ...over,
+});
+
+const seed = (...rows) => { ACCOUNTS = new Map(rows.map((r) => [String(r.github_id), r])); };
+
+// ===========================================================================
+// The resolver — composition rules, provable while the flag is false
+// ===========================================================================
+
+test('normalizeHubOrigin accepts a bare https origin and refuses everything else', () => {
+  assert.equal(normalizeHubOrigin('https://cloudbongos.com'), 'https://cloudbongos.com');
+  assert.equal(normalizeHubOrigin('https://cloudbongos.com/'), 'https://cloudbongos.com');
+  assert.equal(normalizeHubOrigin('  https://cloudbongos.com//  '), 'https://cloudbongos.com');
+  // A downgraded scheme must never be named by a canonical.
+  assert.equal(normalizeHubOrigin('http://cloudbongos.com'), null);
+  // Credentials, a path, a query and a fragment are not origins.
+  assert.equal(normalizeHubOrigin('https://u:p@cloudbongos.com'), null);
+  assert.equal(normalizeHubOrigin('https://cloudbongos.com/u'), null);
+  assert.equal(normalizeHubOrigin('https://cloudbongos.com?x=1'), null);
+  assert.equal(normalizeHubOrigin('https://cloudbongos.com#f'), null);
+  assert.equal(normalizeHubOrigin('javascript:alert(1)'), null);
+  assert.equal(normalizeHubOrigin(''), null);
+  assert.equal(normalizeHubOrigin(null), null);
+  assert.equal(normalizeHubOrigin(undefined), null);
+});
+
+test('canonicalProfilePath vouches only for a handle in the handle charset', () => {
+  assert.equal(canonicalProfilePath('ada'), '/u/ada');
+  assert.equal(canonicalProfilePath('ADA'), '/u/ada');
+  assert.equal(canonicalProfilePath('  ada-l  '), '/u/ada-l');
+  // Anything that could escape the path segment is refused, not encoded — this
+  // value goes into an href and a <link rel=canonical>.
+  assert.equal(canonicalProfilePath('ada/../../etc'), null);
+  assert.equal(canonicalProfilePath('ada?x=1'), null);
+  assert.equal(canonicalProfilePath('a b'), null);
+  assert.equal(canonicalProfilePath('a'.repeat(40)), null);
+  assert.equal(canonicalProfilePath(''), null);
+  assert.equal(canonicalProfilePath(null), null);
+});
+
+test('the canonical URL is DARK: the page at /u/ does not resolve yet (ADR 0214 D1)', () => {
+  assert.equal(CANONICAL_PROFILE_PAGE_LIVE, false);
+  assert.equal(canonicalProfileUrl('https://cloudbongos.com', 'ada'), null,
+    'while the page 404s, the resolver must point nowhere — a canonical naming a 404 spends the page that works');
+});
+
+test('no /u/ page route exists while the flag says the page is not live', () => {
+  // The anti-drift device R14 inherits: land the page without flipping the flag
+  // and this fails. Scans every server-side route file for a registration in the
+  // canonical namespace.
+  const dirs = ['src', 'modules'];
+  const found = [];
+  const walk = (rel) => {
+    for (const e of require('node:fs').readdirSync(join(ROOT, rel), { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+      const next = `${rel}/${e.name}`;
+      if (e.isDirectory()) { walk(next); continue; }
+      if (!e.name.endsWith('.js')) continue;
+      const code = readFileSync(join(ROOT, next), 'utf8');
+      if (new RegExp(`(?:router|app)\\.(?:get|use|all)\\(\\s*['"\`]\\${CANONICAL_PROFILE_PREFIX}`).test(code)) found.push(next);
+    }
+  };
+  for (const d of dirs) walk(d);
+  if (!CANONICAL_PROFILE_PAGE_LIVE) {
+    assert.deepEqual(found, [],
+      `a route in the ${CANONICAL_PROFILE_PREFIX} namespace has landed while CANONICAL_PROFILE_PAGE_LIVE is still false — `
+      + 'flip it (modules/platform-identity/canonical-profile.js) and its client mirror, or the page will exist and nothing will point at it');
+  } else {
+    assert.ok(found.length, 'the flag says the canonical page is live but no route serves it');
+  }
+});
+
+// ===========================================================================
+// getPublicHandle — the EXISTENCE predicate, and the indistinguishable null
+// ===========================================================================
+
+test('getPublicHandle answers the handle for an active, public account', async () => {
+  seed(account());
+  assert.equal(await getPublicHandle('4242', { pool }), 'ada');
+  assert.equal(await getPublicHandle(4242, { pool }), 'ada', 'a numeric id resolves the same as its string');
+});
+
+test('getPublicHandle returns an INDISTINGUISHABLE null for absent, provisional and private', async () => {
+  const answers = [];
+  seed();
+  answers.push(await getPublicHandle('4242', { pool }));                                  // absent
+  seed(account({ profile_state: 'provisional' }));
+  answers.push(await getPublicHandle('4242', { pool }));                                  // provisional
+  seed(account({ account_visibility: 'private' }));
+  answers.push(await getPublicHandle('4242', { pool }));                                  // private
+  assert.deepEqual(answers, [null, null, null],
+    'the three "no" cases ADR 0171 D2 requires to stay merged must produce the identical answer');
+});
+
+test('getPublicHandle is NOT gated on hide_stats — hiding suppresses numbers, never addressability', async () => {
+  seed(account({ hide_stats: true }));
+  assert.equal(await getPublicHandle('4242', { pool }), 'ada',
+    'a builder who hides their stats still has a public profile at a canonical URL; it just carries no numbers');
+  // The assertion above only BITES because the read hands the predicate all
+  // three columns. Drop hide_stats from the SELECT and isAccountVisible and
+  // isRollupVisible return the same answer here — the predicate choice becomes
+  // decorative and a later swap to the wrong one fails open, silently. Pinning
+  // the projection is what keeps the test above a real test.
+  assert.match(MODULE_SRC, /SELECT handle, profile_state, account_visibility, terms_accepted_at, hide_stats/,
+    'getPublicHandle must SELECT the shared predicates’ WHOLE column set: hide_stats so the predicate choice above still decides something, terms_accepted_at because isAccountVisible composes the consent floor that reads it (task 1002913) and a missing column fail-closes this to null for everyone');
+});
+
+// Locked in after a live near-miss: merging origin/main mid-session brought task
+// 1002913, which folded the T&C witness into isAccountActive — the consent floor
+// isAccountVisible composes from. This read did not SELECT the new column, so
+// every account read as un-consented and the whole feature fail-closed to null.
+// Safe direction, still broken. The assertion below is what caught it, and it
+// stays so the next predicate change cannot pass silently.
+test('an account that never accepted the terms gets no handle — the consent floor still applies', async () => {
+  seed(account({ terms_accepted_at: null }));
+  assert.equal(await getPublicHandle('4242', { pool }), null,
+    'isAccountVisible composes the consent floor (task 1002913); an un-accepted account is not publicly addressable');
+  seed(account());
+  assert.equal(await getPublicHandle('4242', { pool }), 'ada',
+    'and the same row WITH the witness resolves — otherwise the test above passes because the read is simply broken');
+});
+
+test('getPublicHandle refuses a non-numeric principal without touching the database', async () => {
+  seed(account());
+  let queried = false;
+  const spy = { query: async (...a) => { queried = true; return pool.query(...a); } };
+  assert.equal(await getPublicHandle('system:reconciler', { pool: spy }), null);
+  assert.equal(await getPublicHandle(null, { pool: spy }), null);
+  assert.equal(queried, false, 'a system:* id must answer null, not reach a bigint cast');
+});
+
+test('getPublicHandle refuses a stored handle outside the handle charset', async () => {
+  seed(account({ handle: 'ada/../etc' }));
+  assert.equal(await getPublicHandle('4242', { pool }), null,
+    'the resolver validates on the way OUT too — a malformed stored handle must not reach an href');
+});
+
+// ===========================================================================
+// The widened profile response — real router, real socket
+// ===========================================================================
+
+const BUILDER = {
+  id: 7,
+  github_id: '4242',
+  github_login: 'ada',
+  display_name: 'Ada',
+  avatar_url: null,
+  rank: 'metic',
+  total_credits: 12,
+  karma: 3,
+  created_at: '2026-01-01T00:00:00.000Z',
+  preferred_disciplines: ['engineer'],
+  // The private columns the whitelist exists to keep out. Sentinel values so a
+  // raw-text scan of the serialized body bites even if a key were renamed.
+  anthropic_email: 'SENTINEL-anthropic-email',
+  anthropic_user_id: 'SENTINEL-anthropic-user',
+  monthly_budget_usd: 999,
+  system_role: 'SENTINEL-system-role',
+  box_blocked: true,
+  box_blocked_reason: 'SENTINEL-box-blocked',
+  deactivated_reason: 'SENTINEL-deactivated',
+};
+
+const dbPath = require.resolve('../src/bongos/db.js');
+require.cache[dbPath] = {
+  id: dbPath,
+  filename: dbPath,
+  loaded: true,
+  exports: {
+    RANKS: ['xenos', 'thetes', 'metic', 'archon'],
+    getBuilderById: async (id) => (String(id) === '7' ? { ...BUILDER } : null),
+    hasCliSession: async () => false,
+  },
+};
+
+const seams = require('../src/module-seams.js');
+seams._reset();
+seams.registerProvider('lifecycle', {
+  countShippedTasksForBuilder: async () => 3,
+  recentShippedTasksByBuilder: async () => [],
+});
+seams.registerProvider('reward', { getBuilderAchievements: async () => [] });
+
+// The hub port, resolved per request, so a test can flip what it answers.
+let hubHandle = async (githubId) => getPublicHandle(githubId, { pool });
+let hubExtras = async () => null;
+seams.registerProvider('platform-identity.hub', {
+  getPublicProfileExtras: (githubId) => hubExtras(githubId),
+  getOwnProfileExtras: async () => null,
+  getPublicHandle: (githubId) => hubHandle(githubId),
+});
+
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildBuildersRouter = require('../src/bongos/routes/builders.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildBuildersRouter());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+
+function get(path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let data = null; try { data = JSON.parse(text); } catch { /* non-JSON */ }
+        resolve({ status: res.statusCode, text, data });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('the profile response carries the handle when the account is publicly visible', async () => {
+  seed(account());
+  const r = await get('/api/gds/builders/7/profile');
+  assert.equal(r.status, 200);
+  assert.equal(r.data.handle, 'ada');
+});
+
+test('the profile response omits the handle for absent / provisional / private, identically', async () => {
+  const bodies = [];
+  seed();
+  bodies.push((await get('/api/gds/builders/7/profile')).data);
+  seed(account({ profile_state: 'provisional' }));
+  bodies.push((await get('/api/gds/builders/7/profile')).data);
+  seed(account({ account_visibility: 'private' }));
+  bodies.push((await get('/api/gds/builders/7/profile')).data);
+  for (const b of bodies) assert.equal(b.handle, null);
+  assert.equal(JSON.stringify(bodies[0]), JSON.stringify(bodies[1]),
+    'a provisional account must be byte-identical to no account');
+  assert.equal(JSON.stringify(bodies[1]), JSON.stringify(bodies[2]),
+    'a private account must be byte-identical to a provisional one — a redirect that fires on the difference would be an oracle');
+});
+
+test('widening the response did not widen the leak: no private column appears anywhere in the body', async () => {
+  seed(account());
+  hubExtras = async () => ({ totals: { projects: 1, credits: 2, works_shipped: 3, karma: 4 }, disciplines: [], last_active: null, projects: [], more_projects: 0 });
+  const r = await get('/api/gds/builders/7/profile');
+  hubExtras = async () => null;
+  assert.equal(r.status, 200);
+  // The raw serialized text, not the parsed keys — a private value smuggled
+  // under a different key still fails.
+  assert.doesNotMatch(r.text, /SENTINEL-/, 'a private builder column reached the public profile body');
+  assert.doesNotMatch(r.text, /monthly_budget_usd|anthropic_|system_role|box_blocked|deactivated_reason/);
+  assert.deepEqual(Object.keys(r.data.builder).sort(), [
+    'avatar_url', 'created_at', 'display_name', 'github_login', 'id', 'karma',
+    'preferred_disciplines', 'rank', 'total_credits',
+  ], 'the builder whitelist itself must not have grown — handle rides beside it, not inside it');
+});
+
+test('the handle rides a DIFFERENT predicate from cross_project, which is what closes the twice-renamed hole', async () => {
+  seed(account({ hide_stats: true }));
+  hubExtras = async () => null; // rollup-invisible: hidden
+  const r = await get('/api/gds/builders/7/profile');
+  assert.equal(r.data.cross_project, null);
+  assert.equal(r.data.handle, 'ada',
+    'a hidden builder still needs an address: this is the handle profile-connections.js could not get from a twice-renamed github_login');
+});
+
+test('publishing the handle map put the route under the SHARED public read ceiling', async () => {
+  // The global limiter meters writes only, and the public read limiter is
+  // mounted under /public/*, which this route is not — so before this task an
+  // id walk read the whole roster at line rate, and it now also carries the
+  // builder → canonical-handle map that /profiles/:handle is capped for.
+  // Asserted by OBJECT IDENTITY against the shared instance, not by "some
+  // limiter is mounted": a second 120/60s limiter would look identical in a
+  // diff and hand an enumerator two budgets (ADR 0209's finding).
+  const { publicReadRateLimitMiddleware, PUBLIC_READ_LIMIT } = require('../src/bongos/middleware/rate-limit.js');
+  const layer = buildBuildersRouter().stack.find(
+    (l) => l.route && l.route.path === '/builders/:id/profile' && l.route.methods.get,
+  );
+  assert.ok(layer, 'the profile route is no longer registered under the path this guard watches');
+  const handlers = layer.route.stack.map((s) => s.handle);
+  assert.ok(handlers.includes(publicReadRateLimitMiddleware),
+    'GET /builders/:id/profile must mount the SHARED public read limiter — a private copy would be a second budget');
+  assert.equal(PUBLIC_READ_LIMIT, 120, 'the /public/* posture this route now shares');
+});
+
+test('an older hub provider without getPublicHandle degrades to null instead of throwing', async () => {
+  seams._reset();
+  seams.registerProvider('lifecycle', {
+    countShippedTasksForBuilder: async () => 3,
+    recentShippedTasksByBuilder: async () => [],
+  });
+  seams.registerProvider('reward', { getBuilderAchievements: async () => [] });
+  seams.registerProvider('platform-identity.hub', { getPublicProfileExtras: async () => null, getOwnProfileExtras: async () => null });
+  const r = await get('/api/gds/builders/7/profile');
+  assert.equal(r.status, 200, 'a cross-version hub must not 500 the profile route');
+  assert.equal(r.data.handle, null);
+});
+
+test.after(() => server.close());
+
+// ===========================================================================
+// The browser script — the three behaviours, run for real in a vm
+// ===========================================================================
+
+const LIVE_SRC = CLIENT_SRC.replace('const CANONICAL_PROFILE_PAGE_LIVE = false;', 'const CANONICAL_PROFILE_PAGE_LIVE = true;');
+
+test('the live-source substitution changes exactly one thing (the instrument, checked first)', () => {
+  assert.notEqual(LIVE_SRC, CLIENT_SRC, 'the constant this file flips is not spelled the way the test expects — every client assertion below would be testing the dark path');
+  const diffs = CLIENT_SRC.split('\n').filter((l, i) => l !== LIVE_SRC.split('\n')[i]);
+  assert.equal(diffs.length, 1, 'the substitution must flip one line, not rewrite the module');
+});
+
+function boot(src, { hubOriginMeta, modules, search } = {}) {
+  const head = { children: [], appendChild(el) { this.children.push(el); } };
+  const els = new Map();
+  const el = (id) => {
+    if (!els.has(id)) els.set(id, { id, hidden: true, _html: '', attrs: {}, setAttribute(k, v) { this.attrs[k] = v; }, getAttribute(k) { return this.attrs[k] ?? null; }, set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } });
+    return els.get(id);
+  };
+  const meta = hubOriginMeta === undefined ? null : { getAttribute: () => hubOriginMeta };
+  const replaced = [];
+  const assigned = [];
+  const sandbox = {
+    console: { error() {}, warn() {}, log() {} },
+    URL,
+    URLSearchParams,
+    document: {
+      head,
+      querySelector: (sel) => (sel === 'meta[name="hub-origin"]' ? meta : (head.children.find((c) => c.attrs.rel === 'canonical') || null)),
+      getElementById: (id) => (id === 'xp-scroll' || id === 'xp-body' ? el(id) : null),
+      createElement: () => ({ attrs: {}, setAttribute(k, v) { this.attrs[k] = v; }, getAttribute(k) { return this.attrs[k] ?? null; } }),
+    },
+    // `assign` is stubbed too, and deliberately records into a SEPARATE list:
+    // swapping replace→assign must fail on the assertion (the numeric URL would
+    // stay in history as a place Back returns to), not crash on an undefined
+    // method, which would "pass" the mutation check for the wrong reason.
+    location: { search: search || '', replace: (u) => replaced.push(u), assign: (u) => assigned.push(u), href: '' },
+    window: { OTB: { escapeHtml: (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;') }, __MODULES__: modules || [] },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(src, sandbox, { filename: 'profile-canonical.js' });
+  return {
+    api: sandbox.window.OTBCanonical,
+    canonicalHref: () => { const l = head.children.find((c) => c.attrs.rel === 'canonical'); return l ? l.attrs.href : null; },
+    xp: () => el('xp-scroll'),
+    xpHtml: () => el('xp-body').innerHTML,
+    replaced,
+    assigned,
+  };
+}
+
+const FEDERATED = { hubOriginMeta: 'https://cloudbongos.com', modules: ['lifecycle', 'hall-ui'] };
+const HUB = { hubOriginMeta: 'https://cloudbongos.com', modules: ['platform-identity', 'hall-ui'] };
+
+test('DARK today: with the shipped source nothing is emitted, anywhere', () => {
+  const fed = boot(CLIENT_SRC, FEDERATED);
+  fed.api.render({ handle: 'ada' });
+  assert.equal(fed.canonicalHref(), null, 'a canonical must not name a URL that 404s');
+  assert.equal(fed.xp().hidden, true);
+  const hub = boot(CLIENT_SRC, { ...HUB, search: '?id=7' });
+  hub.api.render({ handle: 'ada' });
+  assert.deepEqual(hub.replaced, [], 'redirecting a working page to a 404 would be the worst of the three');
+});
+
+test('LIVE, federated: rel=canonical points at the hub and the link-out is visible', () => {
+  const page = boot(LIVE_SRC, FEDERATED);
+  page.api.render({ handle: 'ada' });
+  assert.equal(page.canonicalHref(), 'https://cloudbongos.com/u/ada');
+  assert.equal(page.xp().hidden, false);
+  assert.match(page.xpHtml(), /href="https:\/\/cloudbongos\.com\/u\/ada"/);
+  assert.match(page.xpHtml(), /See the cross-project record/,
+    'the link-out is what ADR 0171 D1 asks a federated instance to render instead of inlining numbers');
+  assert.deepEqual(page.replaced, [], 'a federated instance shows its OWN record — it must never redirect away from it');
+});
+
+test('LIVE, hub: the numeric ?id= form redirects to the canonical handle URL', () => {
+  const page = boot(LIVE_SRC, { ...HUB, search: '?id=7' });
+  page.api.render({ handle: 'ada' });
+  assert.deepEqual(page.replaced, ['https://cloudbongos.com/u/ada']);
+  assert.equal(page.canonicalHref(), null, 'a page that redirects must not also declare a canonical');
+});
+
+test('LIVE, hub without ?id=: the self view is not redirected', () => {
+  const page = boot(LIVE_SRC, { ...HUB, search: '' });
+  page.api.render({ handle: 'ada' });
+  assert.deepEqual(page.replaced, [], 'the handle-less /profile is the viewer\'s own page, not a numeric address');
+});
+
+test('LIVE: no handle means no canonical, no link-out and NO REDIRECT — the fallback is a working page', () => {
+  for (const data of [{}, { handle: null }, { handle: '' }]) {
+    const fed = boot(LIVE_SRC, FEDERATED);
+    fed.api.render(data);
+    assert.equal(fed.canonicalHref(), null);
+    assert.equal(fed.xp().hidden, true);
+
+    const hub = boot(LIVE_SRC, { ...HUB, search: '?id=7' });
+    hub.api.render(data);
+    assert.deepEqual(hub.replaced, [],
+      'absent, provisional and private all arrive here as a missing handle and all get the ordinary local page — there is no error shape to read a signal off');
+  }
+});
+
+test('LIVE: a vanilla instance with no hub origin emits nothing', () => {
+  for (const meta of [undefined, '', '   ', 'http://cloudbongos.com', 'https://cloudbongos.com/u']) {
+    const page = boot(LIVE_SRC, { hubOriginMeta: meta, modules: [] });
+    page.api.render({ handle: 'ada' });
+    assert.equal(page.canonicalHref(), null, `an unusable hub-origin meta (${JSON.stringify(meta)}) must produce no canonical, never a relative one`);
+    assert.equal(page.xp().hidden, true);
+  }
+});
+
+test('LIVE: a hostile handle from the wire never reaches an href', () => {
+  for (const handle of ['ada/../../admin', 'ada"onload=x', '../evil', 'a b']) {
+    const page = boot(LIVE_SRC, FEDERATED);
+    page.api.render({ handle });
+    assert.equal(page.canonicalHref(), null, `handle ${JSON.stringify(handle)} must be refused, not encoded`);
+  }
+});
+
+// ===========================================================================
+// The wiring: the mirror, the page, and the stamp
+// ===========================================================================
+
+test('the client mirror and the module agree on both constants', () => {
+  const liveInModule = /const CANONICAL_PROFILE_PAGE_LIVE = (true|false);/.exec(MODULE_SRC);
+  const liveInClient = /const CANONICAL_PROFILE_PAGE_LIVE = (true|false);/.exec(CLIENT_SRC);
+  assert.ok(liveInModule && liveInClient, 'both files must spell the flag as a plain const so this guard can read it');
+  assert.equal(liveInClient[1], liveInModule[1],
+    'the browser mirror has drifted from modules/platform-identity/canonical-profile.js — flip both or neither');
+  assert.equal(String(CANONICAL_PROFILE_PAGE_LIVE), liveInModule[1], 'the module export disagrees with its own source');
+
+  const prefixInClient = /const CANONICAL_PROFILE_PREFIX = '([^']+)';/.exec(CLIENT_SRC);
+  assert.ok(prefixInClient, 'the client must spell the prefix as a plain const');
+  assert.equal(prefixInClient[1], CANONICAL_PROFILE_PREFIX, 'the two canonical namespaces have drifted apart');
+});
+
+test('the profile page loads the script BEFORE profile.js, and profile.js calls it', () => {
+  // Match the <script> TAGS, not the filenames: both names also appear in the
+  // page's prose, and an ordering assertion that reads a comment proves nothing.
+  const tags = [...PROFILE_HTML.matchAll(/<script\s+src="\/builders\/([a-z-]+\.js)/g)].map((m) => m[1]);
+  assert.ok(tags.includes('profile-canonical.js'),
+    'the page never loads the script, so nothing above runs in a browser');
+  assert.ok(
+    tags.indexOf('profile-canonical.js') < tags.indexOf('profile.js'),
+    `profile.js must load AFTER profile-canonical.js so window.OTBCanonical exists when renderProfile runs — got ${tags.join(', ')}`,
+  );
+  assert.match(PROFILE_JS, /window\.OTBCanonical\.render\(data\)/,
+    'profile.js must hand the profile response to the canonical wiring');
+});
+
+test('the hub origin is stamped as a meta, and never straight into an href', () => {
+  assert.match(PROFILE_HTML, /<meta name="hub-origin" content="\{\{hubOrigin\}\}">/,
+    'the page must carry the server-stamped hub origin (ADR 0171 D1 named this gap)');
+  assert.match(SERVE_INTERNAL, /\.split\('\{\{hubOrigin\}\}'\)\.join\(/,
+    'applyBrandTokens must resolve the token, or the page ships the literal {{hubOrigin}}');
+  assert.match(SERVE_INTERNAL, /function safeHubOrigin\(\)/);
+  // An empty token inside an href silently becomes a same-host relative URL —
+  // a canonical claiming the instance IS the hub. dropEmptyHrefLinks only saves
+  // a BARE token, so the rule is that the token never appears in an href at all.
+  assert.doesNotMatch(PROFILE_HTML, /href="[^"]*\{\{hubOrigin\}\}/,
+    'an empty hubOrigin in an href degrades to a same-host URL claiming to be the hub');
+});
+
+test('the resolver is the ONLY place that spells the canonical namespace', () => {
+  // Two files may carry it: the module and its browser mirror (checked equal
+  // above). A third would be a second opinion about where a profile lives.
+  const owners = ['modules/platform-identity/canonical-profile.js', 'modules/hall-ui/public/profile-canonical.js'];
+  const offenders = [];
+  const walk = (rel) => {
+    for (const e of require('node:fs').readdirSync(join(ROOT, rel), { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+      const next = `${rel}/${e.name}`;
+      if (e.isDirectory()) { walk(next); continue; }
+      if (!e.name.endsWith('.js')) continue;
+      if (owners.includes(next)) continue;
+      const code = readFileSync(join(ROOT, next), 'utf8').replace(/\/\/[^\n]*/g, '');
+      if (/['"`]\/u\/\$\{|['"`]\/u\/['"`+]/.test(code)) offenders.push(next);
+    }
+  };
+  for (const d of ['src', 'modules']) walk(d);
+  assert.deepEqual(offenders, [],
+    'a canonical profile URL is built somewhere other than the resolver — three surfaces building their own URL is three ways to disagree');
+});
+
+// ===========================================================================
+// Lane membership — this proof must RUN, on every PR
+// ===========================================================================
+
+test('this proof runs in the DB-free lane that executes on every PR', () => {
+  const runner = read('scripts', 'gds', 'run-unit-tests.js');
+  assert.ok(
+    !/canonical_profile_url/.test(runner),
+    'named in run-unit-tests.js means parked into INTEGRATION or KNOWN_FAILING — where CI has no Postgres, this file would self-skip forever and gate nothing (learning 1000218)',
+  );
+});