@bongos/core 1.19.429 → 1.19.431

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.429",
-  "core_contract": "1.19.429",
-  "source_commit": "c9d9b31a6f80bb459bf490c45544f2edd344e056",
+  "core_version": "1.19.431",
+  "core_contract": "1.19.431",
+  "source_commit": "4fd9f0748403564b999e3e0459d44c169c751d4b",
   "source_ref": "HEAD",
-  "built_at": "2026-08-29T20:59:30.558Z",
+  "built_at": "2026-08-29T21:48:51.014Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 364,
+    "docs_redacted": 365,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1737,
+    "functional_verbatim": 1740,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2124,
-  "tree_sha256": "e575e80b0436081de41f6f6833a4a4f94d9420d69cb3357a68a33f4330902fa1",
+  "file_count": 2128,
+  "tree_sha256": "bc4e3ea3fba769c809456cccf0abb0abcc8d513d047083307f7431afbc38f780",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "f190d3844d06a676480e270b05f14c13bd797915a43619be0a18affa06117000"
+      "sha256": "6ad13168a2196e29e37c2810108686b3c24f30f739691634f9085ebfcd1fc804"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "562e26ce56898840c4bacf89ab7b31f7f80b30fa393374a3f8dc9c7ef973e48f"
+      "sha256": "dfaca6bbdd87f2d32b1684bbddd7bb4454367ccf1624a9bd5b38b571dd3708db"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "a4b6049666626ab1a99c8c30b0e8fa0ce40e11ba3e4ae61e5763c6ce6338a5e5"
+      "sha256": "92bcaf81301220166e1126d65492ecc011b3b2fac94e594bf22f8049aa45aece"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "0bd5a2773bde6bc126a6351d20f5ce30049d2a8bc9a8ba2154f74af9cb1401b2"
+      "sha256": "3ab2c5433e9a59032143ad2bc90dd9e4bad51ccaa9a2029034f0e53d199472ce"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "a8ea6b45b485350bb0190839cd89429706f9a046c9d2be2a7fe99555e691b852"
+      "sha256": "cf02ec862ca9fcf7700ed2566c2e148c83c763d9194a450a09cb3d191ad4c90b"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1569,20 +1569,25 @@
       "mode": "0000644",
       "sha256": "b964e1674d615cb4525e94bb4cac63d4ac0813e3c1ea9236620bf030d7c53124"
     },
+    {
+      "path": "docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md",
+      "mode": "0000644",
+      "sha256": "8c248b7e041f21da26ef55cb79c8bcaf20713d3e271ea7ee0de851d452c19e58"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "9b2d411decbc309773631064ed286ee0d134860ec688204ac45b827a28748d7a"
+      "sha256": "5cf8b81ec623dd3614683c2114c1fee38ddc5c3a1bf73e2c69ac4fe8ef79ff25"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "eb10a60b6ae1494a678c415d148dc0bf9b7ad552db6bf105993ad80eda7a4ee5"
+      "sha256": "c20be8f4ab3d66c348c6c2d4d4f45c3390a4078899459831fc4851d51a740ea2"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "6b3d91999080e09913f97a766b097e26ff9ae941d4026ab7b025c6dc4a7f9996"
+      "sha256": "8998dc287e00a54bfd206d427a923700874dc34db5a459671f8c90d8b6ec117c"
     },
     {
       "path": "docs/architecture.md",
@@ -1607,12 +1612,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "6192d6ab0115cd57a4dce5a61da2de1084ba6ccfa860356b8d54045ebd3609aa"
+      "sha256": "cd0071623f3a81620e356ad59ff90d68ab4f5a5630dff9399856bfd8ab0de508"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "9f52cecfbab533846f8e182676801940c94141c2fb6096b745e73aa0423688a9"
+      "sha256": "c4ebb37c87a7416aa4005812702980a084f39f69fe336d3676baf3dc8f0e6530"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -1704,6 +1709,11 @@
       "mode": "0000644",
       "sha256": "5de484be1af673bdb91eaf9b9221f8dbca9a47f0c8dad098a0898cd10721b497"
     },
+    {
+      "path": "docs/design/mocks/hub/picker.html",
+      "mode": "0000644",
+      "sha256": "357fedc874862a929590b7f7fb3177770ce0ad77f3683813b5e816181b67e88b"
+    },
     {
       "path": "docs/design/mocks/hub/planets.html",
       "mode": "0000644",
@@ -1907,7 +1917,7 @@
     {
       "path": "docs/design/projects-hub-direction-v2.md",
       "mode": "0000644",
-      "sha256": "63e580a90c728ac1cf39b8c7a26e660839fdd831e1c2ec5f9b9fb5dfbd7316c9"
+      "sha256": "b72f9c3989e6c66e275124b43ad0d36aa718bd2d670696d0053cb2e0653c0632"
     },
     {
       "path": "docs/design/projects-hub-direction.md",
@@ -1957,7 +1967,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "23121260ec5061645027d50609712217a619ea9ae8ad539cdeeb18e1cd552755"
+      "sha256": "b0b9355c79b2f1caa965baf8afd645140d341f30a56483a3724697611e20322a"
     },
     {
       "path": "docs/handoff-template.md",
@@ -1967,7 +1977,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b827125881354448b4c3e19a16a6b0a27210386869d33a09fa0d488812745b6a"
+      "sha256": "bd4bbd81fbdd0cbffbcc882bb8bd876caf4aacc863a0e4ae3b331ee8133053e6"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3282,7 +3292,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "a4b6049666626ab1a99c8c30b0e8fa0ce40e11ba3e4ae61e5763c6ce6338a5e5"
+      "sha256": "92bcaf81301220166e1126d65492ecc011b3b2fac94e594bf22f8049aa45aece"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4222,12 +4232,12 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "81da0b750da880c411a8604687a8c300852c631ffdd07d4fd1bb3c4533e650c0"
+      "sha256": "3760dd190ea83370de2d45f74b152f8bd24abe2a8761d5bb681d26600fdbd29e"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
       "mode": "0000644",
-      "sha256": "d3ddd434100c65a5839e3004ad1a5c4537d2da23ecd4441ee3eff3aa0ee8b5a1"
+      "sha256": "3d5881896057de05daba30382b7ebf5aeb9f61cba55aae75916594ed3dc1a80f"
     },
     {
       "path": "modules/hall-ui/public/shell.js",
@@ -4827,7 +4837,7 @@
     {
       "path": "modules/platform-identity/account-visibility.js",
       "mode": "0000644",
-      "sha256": "788d0a51e29e0bd7971a63b8ed168ce71beb2a30a170bd0dbfc457d96b275233"
+      "sha256": "020279ae50f2f9e7a004fe571e5ca14493ad26bd22c395cc4805f759f5560b72"
     },
     {
       "path": "modules/platform-identity/application-echo.js",
@@ -4957,7 +4967,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "09a9be4a79097faf612ee52b1eea1c5b845bba873032853aab36c55411395833"
+      "sha256": "1542edccc61a1cdb77540f5b6521a91477234af03cdde9178a1ed5516363e1fd"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -4969,6 +4979,11 @@
       "mode": "0000644",
       "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
     },
+    {
+      "path": "modules/platform-identity/recruiter-sliver.js",
+      "mode": "0000644",
+      "sha256": "e1385b83ac5bb82d13ffbe5070043c2fd0ca20385b3d62e8331ef917d9fca496"
+    },
     {
       "path": "modules/platform-identity/routes/connections.js",
       "mode": "0000644",
@@ -4987,7 +5002,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "cad8af2040afe189f2a5964af66b872bb1897d4259f73cab24765671a295493d"
+      "sha256": "7620a816ab376f77be6e46c8fe99c355ba323727fe7a6b2bfbf55b8b953626f3"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -4997,7 +5012,7 @@
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
-      "sha256": "e9afb0c1839c2933b1222158a3fccca8c3e3659282bb705e9d5c80575471200c"
+      "sha256": "0f898c038abc6c0aceb2f5649008cdc7fc66bc1b7f83129aae3da65f1eb33c15"
     },
     {
       "path": "modules/platform-identity/routes/sso.js",
@@ -5097,7 +5112,7 @@
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
-      "sha256": "5fcab8bc3d4987c93138642abd6d2bcb997691cd54811ca10633c186d27713b5"
+      "sha256": "26a6d752e610ac46f8306aa707f0229bf83ec9b0cb6c128ec723b7cc55b2b977"
     },
     {
       "path": "modules/provisioning/onboard-plan.js",
@@ -5112,7 +5127,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "b643caae4ce9e8cfa8d5f3dccbfe41e709b89ce6820ca0422aee3ac184f45a12"
+      "sha256": "114210686cfe2f287d4d29ee603a443b2794e2065709ff60d2cd2c7530c60cad"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -5122,7 +5137,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "100c0f73c26c1c4858009d8ce324b99e632c30725f32df84542ff7862bd339c2"
+      "sha256": "f3ee76de08591eb957c1e533f8b96d4cb9c716eb5f89ceda1875b97d84bd2246"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -5132,7 +5147,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "38bc7eb2f1dfd3c03f2c48f42683821ebefbe68fafec95dec491bb3df926b7e0"
+      "sha256": "559ae0d8025693a997a16012758236dbe895f28621de1a1a591d2a43fb21ff00"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -5462,12 +5477,12 @@
     {
       "path": "modules/ui-design/kit/fixtures/featured-hub.json",
       "mode": "0000644",
-      "sha256": "01de9651237575b29eea5eed816391176c9ed4bca7627b4f096a30f80fa1ceed"
+      "sha256": "1c3ca6573b3e7b08269ca885bfcb79cb27bb623501066cace9e2575fefff9e1b"
     },
     {
       "path": "modules/ui-design/kit/fixtures/featured.json",
       "mode": "0000644",
-      "sha256": "3fe95d4cc3a31c92b2b02040141dac487ac543a8e4551695883ae3cdf905e7c1"
+      "sha256": "569038c7cbe3a1ff12d361111d062715f38aebd73317816a87c400fa96c12b04"
     },
     {
       "path": "modules/ui-design/kit/fixtures/leaderboard.json",
@@ -5497,7 +5512,7 @@
     {
       "path": "modules/ui-design/kit/fixtures/provisioning-instances.json",
       "mode": "0000644",
-      "sha256": "c26cc842803d08f89a8c1545feb5feb6830159a7e283bcfb9846c7ce8e69ff4a"
+      "sha256": "35db35629d80420c5d816dff040934d69f5713dcf5ffbae2211d12172904dd8e"
     },
     {
       "path": "modules/ui-design/kit/fixtures/recent-shipped.json",
@@ -5527,7 +5542,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "fed82c37da8cae16ca1a29e521f83a8f91c72a6de4b4b6a9b21b0ed2e633d45b"
+      "sha256": "f42b175e75905d1fdd854bd13a76899e7ee83e9d0b8683325fff138eee78b07c"
     },
     {
       "path": "modules/ui-design/module.json",
@@ -5572,12 +5587,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f2b5dbf384c0e497631f003718439033bab6eb4b1f3ded6d29b187a0d487418d"
+      "sha256": "bf42d45381a85e4f5794f08f0deaf9e7baee6787599cbb0f034153c03e06affb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "42c9b8ace9c23611c7449eb129580b6c9b40eedb9e0ed9ac0c0a10fdf6c85408"
+      "sha256": "b2c2d95bd1b8ef2a9d5c6dfa42362827ddf2e50beddbc8765460885ecabd4cf5"
     },
     {
       "path": "public-docs/index.html",
@@ -5817,7 +5832,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "80f54ccdf5093065b48770c8c855f69d588483e19247446dc4a5d5735a3aaf11"
+      "sha256": "761b196a29b7d25d0ff1b2480e9462fd01ea2a4c57d889cd1689c6f4fbe9ca4d"
     },
     {
       "path": "public-landing/assets/verro-medallion.png",
@@ -6037,17 +6052,17 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "7856b0f10d782ea43cde64fe3dbbce0c6b295fbd58bef592e87973e298d9f15b"
+      "sha256": "5cdf9caf7e376f89d0092f289cf8430211e3f1ac3bbbfdb1f0e516babc970851"
     },
     {
       "path": "public-landing/projects.probes.json",
       "mode": "0000644",
-      "sha256": "d8667a5f7ccd7e03b6cda3dcfd1646a4927a68fdcc93480564943d0915db05a0"
+      "sha256": "3bc7cea614031e2c04246274adc8375b5f54d0a043e1bf4da0a564a10964db82"
     },
     {
       "path": "public-landing/projects.states.json",
       "mode": "0000644",
-      "sha256": "ad16ce4e24cbcee908c963022abf49b4e7f17ab1715ede31f743e278343059d6"
+      "sha256": "3217f46d975bd4bed7c17ee6d87b5150e81130f75a780371cb4cffb558a07373"
     },
     {
       "path": "public-landing/terms.html",
@@ -7707,7 +7722,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9a399f369f1c857fda182086231cee242e797eb7ac8fc24fdacdc9bdf706943e"
+      "sha256": "a5f2a1e430a0dc50156d93a88ed4bd1b6c6bc232eed2ea1aab4ae017ee768777"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7767,7 +7782,7 @@
     {
       "path": "tests/account_privacy_flags.mjs",
       "mode": "0000644",
-      "sha256": "d0c32156de102ab98447542def38978caded0dbe03e7a6f5004240484ba037ec"
+      "sha256": "ab99d502635f87dd4021ecdd0badb88f842889b1b8902919fe6511aa363457b1"
     },
     {
       "path": "tests/achievements_reconcile.mjs",
@@ -8577,7 +8592,7 @@
     {
       "path": "tests/effective_visibility_predicate.mjs",
       "mode": "0000644",
-      "sha256": "1aeeaea5d344543ab48b8dde994f4375bea9ef7678ce50e09402376334731f76"
+      "sha256": "88ff4b377f71785545e3aed908df70b505af40453f47695646a9f72bf7250ab0"
     },
     {
       "path": "tests/est_advisory.mjs",
@@ -8952,7 +8967,7 @@
     {
       "path": "tests/government_require_permission.mjs",
       "mode": "0000644",
-      "sha256": "36596b8870d2edc60bd810af5e10fa864d7f35e62e358d2dff58ed85b69922c0"
+      "sha256": "a2711b93fcb7e6a602d22fbc864676f5dfdc6c503cc6551badc32e36facb723c"
     },
     {
       "path": "tests/government_resolver.mjs",
@@ -9762,7 +9777,7 @@
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "0189425a0430dbab84044bdca2ac99e4dde87db061b8226412aa2fc393bb3119"
+      "sha256": "ab6881bf65742f82dcb748daa5b8665c3a852a8fcc5aedb0a7040cafd6a3bdf4"
     },
     {
       "path": "tests/profile_ui_cross_project.mjs",
@@ -9782,7 +9797,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "670cc7c20dbbc1da38d8a79bc5ee9dcead2453a2f782ef5354b1f91cae13d56d"
+      "sha256": "293c92d90457da1a3bd164f96bc897409275a7772c92c76b0b5b9bb6db8337e1"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
@@ -9842,7 +9857,7 @@
     {
       "path": "tests/provisioning_settings.mjs",
       "mode": "0000644",
-      "sha256": "662d193ac3567e984da03e13ec4d41950cc29b7687fd195513e0291cff37c1c4"
+      "sha256": "ffea349b46de6b790884eddcefbf7f756215c281f7d726ad43a81e22edcd4679"
     },
     {
       "path": "tests/provisioning_settings_apply.mjs",
@@ -9852,7 +9867,7 @@
     {
       "path": "tests/provisioning_settings_env.mjs",
       "mode": "0000644",
-      "sha256": "08770277cad7e16507a7c6c074732711fb9aad2025531ad8ec9de12c09c2d2d6"
+      "sha256": "4c8f1c7bdec5a063bcd3e76f4d43245c9491e3b8529593cdfaf33a3fbc85e319"
     },
     {
       "path": "tests/provisioning_slug_available.mjs",
@@ -9954,6 +9969,11 @@
       "mode": "0000644",
       "sha256": "6d82e99c69d23a4dd7a844ffdd7f239ea70c94d9c509e2fc8e1a672cd9f05a28"
     },
+    {
+      "path": "tests/recruiter_sliver_boundary.mjs",
+      "mode": "0000644",
+      "sha256": "cad269f556293e0caa234561f5764f90998a5d133b1e0147a5bbf22403c55e3a"
+    },
     {
       "path": "tests/redteam_patrol.mjs",
       "mode": "0000644",
@@ -10042,7 +10062,7 @@
     {
       "path": "tests/scouting_owner_access_and_reach.mjs",
       "mode": "0000644",
-      "sha256": "5c53f51280b77816b5498808ab097a209a368c2e3b6cbdbc6a8ed2a55e11d8b9"
+      "sha256": "db4aa5ab365d1d2e9884b2c5a3f2abc40942e123844b7d5434434ddce680fd13"
     },
     {
       "path": "tests/scouting_page_gate.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 338 operations across 53 resource groups
+- 339 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -705,6 +705,8 @@ function createClient(opts = {}) {
     "scouting": {
       // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
+      // GET /scouting/{handle} — rank: archon — GET /scouting/:handle
+      getScoutingHandle: (args) => request("GET", "/scouting/{handle}", { hasBody: false }, args),
     },
     "search": {
       // POST /search — rank: any-builder — POST /search

package/clients/bongos-client/index.cjs

@@ -704,6 +704,8 @@ function createClient(opts = {}) {
     "scouting": {
       // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
+      // GET /scouting/{handle} — rank: archon — GET /scouting/:handle
+      getScoutingHandle: (args) => request("GET", "/scouting/{handle}", { hasBody: false }, args),
     },
     "search": {
       // POST /search — rank: any-builder — POST /search

package/clients/bongos-client/index.d.ts

@@ -93,7 +93,7 @@ export interface GetProvisioningFleetResponse { instances: unknown }
 export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown }
 export interface GetProvisioningHealthResponse { module: unknown; ok: boolean; coreVersion: unknown }
 export interface GetProvisioningInstancesIdResponse { instance: unknown; open_intent: unknown; github_app: unknown }
-export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; options: unknown }
+export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; planet: unknown; options: unknown }
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
 export interface GetProvisioningSlugAvailableResponse { slug: unknown; available: unknown; reason: unknown; address: unknown }
@@ -110,6 +110,7 @@ export interface GetPublicRepoInfoResponse { blob_base: unknown; tree_base: unkn
 export interface GetPublicTasksIdResponse { task: unknown }
 export interface GetPublicUptimeResponse { services: unknown }
 export interface GetPublicVersionsResponse { versions: unknown; page: PageInfo }
+export interface GetScoutingHandleResponse { sliver: unknown }
 export interface GetScoutingResponse { builders: unknown }
 export interface GetSecurityDocsResponse { docs: unknown }
 export interface GetSecurityDocsSlugResponse { doc: unknown }
@@ -168,8 +169,8 @@ export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
 export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown> }
 export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown }
-export interface PatchProvisioningInstancesIdSettingsRequest { platform_visibility?: string; joinability?: string }
-export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; push: unknown }
+export interface PatchProvisioningInstancesIdSettingsRequest { platform_visibility?: string; joinability?: string; planet_template?: string; planet_accent?: string }
+export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
 export interface PatchTaskRecommendationsIdResponse { ok: boolean; recommendation: unknown }
 export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; title?: string; status?: unknown }
@@ -1012,6 +1013,8 @@ export interface BongosClient {
   "scouting": {
     /** GET /scouting — rank: metic+archon */
     getScouting(args?: RequestArgs): Promise<GetScoutingResponse>;
+    /** GET /scouting/{handle} — rank: archon */
+    getScoutingHandle(args?: RequestArgs): Promise<GetScoutingHandleResponse>;
   };
   "search": {
     /** POST /search — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -701,6 +701,8 @@ export function createClient(opts = {}) {
     "scouting": {
       // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
+      // GET /scouting/{handle} — rank: archon — GET /scouting/:handle
+      getScoutingHandle: (args) => request("GET", "/scouting/{handle}", { hasBody: false }, args),
     },
     "search": {
       // POST /search — rank: any-builder — POST /search

package/docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md

@@ -0,0 +1,116 @@
+# ADR 0215 — The pre-accept recruiter sliver is a CEILING, not a step: a whitelist keyed by consent-and-reach, on the recruiting surface's own door
+
+- **Status:** accepted
+- **Date:** 2026-08-29
+- **Task:** [task 1002968](https://cloudbongos.com/builders#/task/1002968) (PV3, goal 1000045 — Public builder profiles, criteria C2/C5)
+- **Relates to:** `docs/specs/<redacted>.md` **D3** (the owner-signed sliver, 2026-08-16) and D1/D2 (the two privacy axes), [ADR 0171](<redacted>.md) D2/D4/D5 (rollup consent, no partial numbers, no-store), [ADR 0210](<redacted>.md) D2/D4 (the recruiting door; reach composed but not folded down), [ADR 0201](<redacted>.md) D3 (the `project.recruit` atom belongs to the console wave), [ADR 0016](<redacted>.md) (cross-project numbers are descriptive, never authority), [ADR 0202](<redacted>.md) D4 (one shared effective-visibility predicate)
+
+> 0213 and 0214 are held by sessions in flight; this ADR takes 0215 rather than race them (the ADR 0199 / 0202 / 0207 / 0210 precedent).
+
+## Context
+
+Privacy spec D2 has a row that nothing could serve: **private · discoverable**. A builder who wants no public profile page but does want to be found for work sets `account_visibility = 'private'` and `recruiter_discoverable = true`, and until now that combination bought them exactly nothing — [ADR 0210](<redacted>.md) D4 says so in as many words: *"a private account is absent from the directory on purpose: the full rollup is never its disclosure — the D3 sliver is."* The sliver was the unbuilt half.
+
+Two consequences had accumulated around that gap. The Settings toggle's copy was deliberately **narrowed** by task 1002290 to "the People directory", because the sliver was unbuilt and no guard could hold a wider promise. And [ADR 0201](<redacted>.md) had to ship the cross-project application queue showing a private applicant's *name, handle and note only*, deferring the richer record to "the sliver half, sequenced behind the recruiter port".
+
+The design question is not what to show. The owner signed that on 2026-08-16 and it is short: **handle, display name, avatar, the disciplines union, and a coarse "active in the last 30 days" boolean — nothing else**; name-only under `hide_stats`; never for a provisional account; never a profile-page link. The question is what *kind of thing* the sliver is, and everything below follows from one answer: **it is a ceiling, not a step.** Nothing a recruiter holds after reading it gets them closer to the record it withholds.
+
+## Decision
+
+### D1 — The sliver's audience predicate is CONSENT **and** REACH, and it deliberately omits the EXISTENCE axis
+
+`recruiterSliverVisibleSql` / `isRecruiterSliverVisible` join `modules/platform-identity/account-visibility.js`, the sole owner of every effective-visibility answer (ADR 0202 D4). Like `rollupVisibleSql` and `scoutingListableSql` it is **composed**, never restated:
+
+```
+recruiterSliverVisibleSql = accountActiveSql  AND  recruiterReachSql
+```
+
+It is the one composed answer in that file that does **not** contain `accountVisibleSql`, and that omission is the decision. Every other public read floors on `account_visibility = 'public'`; ANDing it here would empty the sliver of precisely the account it exists to serve, leaving a poorer, redundant copy of the directory.
+
+**Dropping the existence axis is safe only because the reach half is an explicit opt-IN for a private account.** `recruiterReachSql` is `COALESCE(recruiter_discoverable, account_visibility = 'public')`: for a private account the `NULL` default resolves to **false**, so a private account reaches this surface only when its owner set the flag by hand. The widening is therefore not the platform's; it is the account's. Consent, not a relaxed floor.
+
+`profile_state = 'active'` still floors it — a provisional account is never recruiter-visible, exactly as spec D3 says out loud — and `hide_stats` appears nowhere in the predicate, because hiding changes the **shape** of the sliver, never who appears in it.
+
+**And the opt-in has to be the one they MEANT — which needed a write-path change, not only a predicate.** That safety argument holds only if an explicit `recruiter_discoverable = true` on a private account was given *as* a private account, and it need not have been. Toggle discoverability off and on again while **public** and the column stops being `NULL`: it becomes an explicit `true` meaning *"recruiters may see my public profile"*. Set the profile to Private later — reading a row that promises the page answers "not found" to every visitor — and that stale `true` used to be **inert**, because every recruiting surface floored on the existence axis. This ADR's own predicate is what would have activated it: silently, with no re-consent and no notice. So `setAccountPrivacy` now resets `recruiter_discoverable` to `NULL` — back to "follow visibility" — whenever a PATCH turns an account private **without naming reach**; naming it in the same PATCH *is* the re-consent and stands. The D2 "private · discoverable" row still exists; it now takes two deliberate moves instead of one forgotten one. (Found in adversarial review. The write's D2 matrix is resolved from the statement's own `CASE` in `tests/account_privacy_flags.mjs`, so deleting the arm reds it.)
+
+Because that predicate is the only shared answer missing the existence axis, `tests/effective_visibility_predicate.mjs` **pins it to its one reader**. Naming it in that guard's `ADOPTS` list is what lets the sliver's own query pass the adoption rule, and that would otherwise be a hole: a future public read joining it would look adopted while quietly serving private accounts.
+
+### D2 — The projection is a literal whitelist, `hide_stats` decides its SHAPE, and the hidden case never fetches what it will not show
+
+`modules/platform-identity/recruiter-sliver.js` builds the object key by key. No row is ever spread, so a column added to either query cannot ride along. Two shapes, and only two:
+
+| | keys |
+|---|---|
+| full | `handle`, `display_name`, `avatar_url`, `disciplines`, `active_recently` |
+| `hide_stats` | `handle`, `display_name`, `avatar_url` |
+
+The two rollup-derived keys are **absent, not null** — the sliver does not carry an empty box where a number used to be — and for a hidden account **the activity query is never issued at all**. Dropping the fields after fetching them would be equivalent today and strictly worse tomorrow: the cheapest way for a later edit to leak a number is for the number to already be in hand.
+
+Four absences are load-bearing rather than incidental:
+
+- **credits / works shipped / karma / project names / project count** — the post-accept record. "The aggregate is not the leak, the name is" (ADR 0171 D6), and a count beside a hidden total is a leak by subtraction, so there is no count either.
+- **`last_active` as a timestamp.** The comparison to the 30-day window happens **in SQL** and only the boolean returns, so the date never enters the process and no later refactor can serialize it. A date is a behavioural trace; a boolean is a yes/no.
+- **`github_id` and `github_login` as FIELDS.** Neither is a key of the sliver, and D3 names the *handle*, not the login. **The limit, stated rather than glossed:** the avatar D3 grants is GitHub's own URL — `https://avatars.githubusercontent.com/u/<github_id>?v=4` — so granting the avatar grants the account id inside it, and that id resolves through GitHub's public API to a login. Granting the avatar is the owner's decision, already made; pretending the id does not ride along was this ADR's. The proof now pins *where* it may appear (inside that URL and nowhere else) instead of asserting an absence the code does not deliver — an earlier draft claimed "the join key stays internal" while its fixture used an invented avatar host, so the sentinel could not have caught it.
+- **any profile-page URL**, which spec D3 forbids outright.
+
+### D3 — The handle is an ADDRESS, not a door — which is what "pre-accept" means operationally
+
+The sliver hands a recruiter a handle, and the handle opens nothing: `GET /profiles/:handle` joins `accountVisibleSql` and answers **404** for exactly the private account whose sliver the recruiter just read. That is the whole claim of this ADR reduced to one assertion, and it is asserted — with a control proving the same page renders 200 for a publicly-visible builder, so the 404 cannot pass by the route simply being broken.
+
+A **previous** handle resolves to nothing here either, deliberately unlike `resolveHandle`'s 301. The public page redirects so a *shared link* survives a rename; a recruiting read has no shared links to keep working, and resolving one would confirm to a recruiter that the account renamed — a disclosure the sliver never grants. (This was the one mutation the first draft of the proof did not catch; the rule was documented in the source and unheld by a test.)
+
+### D4 — The sliver holds spec D3's **archon floor**; the directory's wider door is not reused, and the audience goes to the owner
+
+`GET /scouting/:handle` sits in `modules/platform-identity/routes/scouting.js` beside `GET /scouting`, and the two do **not** share a gate. The sliver is `requireBuilder` → `api.requireRank('archon')`; the directory keeps `requireScoutingReader({ curateGate: requirePermission('project.curate') })`. Each gate is spelled in its own route's middleware list, so `route-rank-check.js` and `gen-api-docs.js` classify each from its real floor rather than recording a privileged route as `any-builder`.
+
+Spec D3 says the sliver is "gated at the route by `project.recruit`" — and that atom **does not exist**. ADR 0201 D3 and ADR 0210 both refuse to mint it, on the same grounds: it belongs to the project-admin-console wave ([spike 1002786](https://cloudbongos.com/builders#/task/1002786) R3), which defines it, and minting it in a third place would fork its definition across three waves before any had shipped. **So which door does it use meanwhile?** The first draft reused the directory's, and that was wrong in the dangerous direction. Spec D1 declares the missing atom's shape — **floor archon**, widenable per instance through the governance tab — while the directory admits `project.curate` at the **metic** floor (ADR 0157) **OR any project owner**, who is typically a bare `xenos` on the hub (ADR 0210 D2). That door is *wider* than the signed floor on both halves. Reusing it would have widened an owner-signed privacy decision by implementation convenience, on the first surface that discloses a private account — and narrowing after people have been disclosed is not a recoverable move, while widening later is. So the sliver holds D3's declared floor, by rank, until the atom exists.
+
+**The audience is the owner's call, and it is filed rather than taken.** [Blocker 1000126](https://cloudbongos.com/builders#/blocker/1000126) asks whether the wider recruiting audience is authorized here, with the evidence and a recommendation (hold the floor; let `project.recruit` — grantable per instance — settle it, which is exactly the knob the question wants). Answering it moves **one line**, and the tests that pin the floor flip with it. Goal 1000045 C5 (*"project owners, not only Archons, browse builder profiles to recruit"*) pulls the other way, and that tension is what the blocker carries: C5 was written about the DIRECTORY, which shows public builders; this surface shows private ones.
+
+The refusal for an unreachable *builder* is **404, never 403**: a 403 would confirm the handle exists, which is precisely the disclosure the opt-out removes. (A refusal of the *caller* is an ordinary rank 403 naming the floor it wanted, so the hall can render why.) And `Cache-Control: no-store`, the `/profiles/:handle` posture, because the rollup half is live-derived and hide must beat any cache (ADR 0171 D5) — the directory route gained the same header here, having been the last rollup read without it.
+
+### D5 — The sliver grants nothing (ADR 0016), and that is enforced structurally
+
+Being visible to a recruiter confers no rank, no permission, no claim right, and nothing consults the sliver to decide anything: the module is required by **exactly one** first-party server file, the route that serializes it, enumerated from source so a second reader fails the build. The response carries no rank, role, permission or membership under any name. The reverse holds too and is the point of the reach axis: a builder's recruiting opt-out changes who can *see* them and grants or denies them nothing.
+
+### D6 — The Settings copy widens back to name **both** recruiting surfaces, held by a guard rather than by good intentions
+
+Task 1002290 narrowed the discoverable toggle from "every recruiting view" to "the People directory" on the copy rule that *a toggle may promise exactly what is enforced* — the sliver was unbuilt, so no guard could hold the wider claim. It is built and gated now, so the row names both: *"removes you from both recruiting surfaces — the People directory, and a recruiter's look-up of one builder — straight away."*
+
+"Both" rather than "every", and that word choice is the decision. `tests/account_privacy_flags.mjs` asserts that `routes/scouting.js` mounts **exactly two** routes and that `scoutingListableSql` and `recruiterSliverVisibleSql` each compose `recruiterReachSql`. A third recruiting read in that file, or either reader dropping the reach axis, reds it. "Every recruiting view" would be an open-ended promise no guard can hold, and it stays banned.
+
+**The half that was actually wrong, though, was the GRANT.** Spec D3 makes stating it a MUST — *"the discoverable toggle's settings copy must state exactly this grant"* — and the shipped copy was false: it told a hidden account it would show *"your name and nothing else"* while `SLIVER_KEYS_HIDDEN` also ships the **avatar**, and the shown branch never mentioned the picture at all. Neither branch told a *private* account that this is the one thing a recruiter sees while their page answers "not found". All three are fixed, and the guard no longer checks transcribed phrases: it iterates `SLIVER_KEYS` / `SLIVER_KEYS_HIDDEN` from the module itself, so a sixth granted field cannot ship without the copy being made to name it.
+
+### D7 — No migration, and no new file in `platform-identity.js`
+
+Both columns exist (migration `<redacted>.sql`); the activity table's `(github_id)` index already serves both reads. Spec D3 asks for the port "beside `getPublicProfileExtras`" and it is beside it *in the module*, not in the file: `platform-identity.js` sits on the 1500-line ratchet with no headroom — the `account-visibility.js` / `scouting-authz.js` / `application-echo.js` precedent, now five sessions deep.
+
+## Consequences
+
+- Privacy spec **D2's "private · discoverable" row is finally served**, and [task 1002972](https://cloudbongos.com/builders#/task/1002972) — the application queue rendering a private applicant's record — has the port it was sequenced behind. Its own half of the problem is unchanged and still real: ADR 0201 notes the hub cannot check an *instance* permission from a cross-origin browser read, so how the reviewer's browser reaches this route is that task's decision, not this one's.
+- The recruiting surface now has two reads and one door. When `project.recruit` lands, it replaces `project.curate` in one expression and both routes move together.
+- **The directory is unchanged.** A private account — discoverable or not — is still absent from `GET /scouting`, and a public leaderboard must still join `rollupVisibleSql`, never `scoutingListableSql` (ADR 0210 D4). Reach still governs the recruiting surface only.
+
+⚠ **Honest limits, recorded rather than fixed:**
+
+- **No UI consumes the sliver yet.** This ships the port, the route and the proof; the recruiting *view* is the console wave's (spec D6, `<redacted>.md` CT6) and the application queue's (task 1002972). The route is reachable and gated today; nothing in the hall calls it.
+- **The audience is UNRESOLVED, not settled** ([blocker 1000126](https://cloudbongos.com/builders#/blocker/1000126)). The archon floor is the conservative reading of an owner-signed spec, not a call this ADR is entitled to make — and it is *narrower* than goal C5 describes, so project owners cannot use the sliver today. An earlier draft of this section called the shipped gate "narrower than the spec's atom" and "not a widening in any direction"; both were wrong, and wrong in the dangerous direction, because the SUBJECT set strictly grows: private accounts were on no recruiter surface at all before this.
+- **The rank gate is a documented HOLDOUT against the module-gate migration rule** (BV1.R105/R107, ADR 0151): `modules/*/routes` gates are supposed to be permission atoms, and `tests/government_require_permission.mjs` enforces it from source. This route is listed in that test's `RETAINED` set with its full argument — the atom it wants is specified and owned by another wave, minting it forks the definition, borrowing a different archon atom would name the wrong authority on a privacy surface, and the sibling's door is wider than the signed floor. It is temporary by construction: spike 1002786 R3 removes the entry.
+- **The two gates are spelled twice, on purpose.** An earlier draft called them "one gate expression … a one-line change reaching both"; they never were one, and now they are deliberately different.
+- **A recruiting read added in another FILE would not trip the two-route guard.** D6's count is over `routes/scouting.js` alone, so the "both recruiting surfaces" copy could become false without reddening. Sweeping every route file for reach-joining reads is a structural guard of its own and belongs with the shared-predicate work, not here.
+- **`getRecruiterSliver` (the by-id port spec D3 names) has no production caller yet** — [task 1002972](https://cloudbongos.com/builders#/task/1002972) is its consumer. The route uses the by-handle sibling; the proof exercises both.
+- **`active_recently` is coarse by design and coarse in practice.** It is derived from `max(last_active)` across the rollup, which is refreshed on federated sign-in and on ship — so a builder active only on a project that never reports will read as inactive. That understates rather than overstates, which is the safe direction for a privacy surface.
+- **This route is not rate-limited, and there is an asymmetry worth naming.** `GET /profiles/:handle` carries a per-IP read limiter precisely so the handle→identity mapping cannot be scripted at line rate (task 1002798), and `GET /scouting/:handle` — which is authenticated and permission-gated, so it starts from a much stronger position — has none. The asymmetry that remains is specific: a reader of this surface can probe guessed handles unmetered and learn *which private accounts opted into recruiting*, a set no other surface publishes. It is bounded by needing to guess a private account's handle (nothing publishes it) and by the audience already holding the full rollup of every public builder, so it is a widening of degree, not of kind. It is **not** fixable by reusing `accountExistenceReadRateLimit`: ADR 0209's whole decision is one budget per oracle, and this is a different oracle — sharing it would hand an enumerator the sum of two budgets on the route it cares about. The right fix is a dedicated budget behind a doorway-exported factory, which is a decision about the doorway rather than about the sliver; filed rather than smuggled in here.
+
+**Rejected:**
+
+- **Flooring the sliver on `accountVisibleSql`** — it would empty the surface of the exact account D3 exists to serve.
+- **Folding reach into `rollupVisibleSql`** so the sliver could reuse it — ADR 0210 D4's reason stands: it would silently empty a future public leaderboard of every opted-out builder.
+- **Minting `project.recruit` here** — ADR 0201 D3 and ADR 0210 both refuse it; it belongs to the console wave that defines it.
+- **A second route file** for one route — the two recruiting reads live in one file (they share consent machinery and a reader's mental model); what they deliberately do NOT share is a gate.
+- **Reusing the directory's door for the sliver** — wider than the owner-signed floor on both halves, on the one surface that discloses a private account.
+- **Leaving a stale `recruiter_discoverable = true` to be read as consent** after the account went private.
+- **Returning the rollup-derived keys as `null` under `hide_stats`** — an empty box is still a box, and it means the numbers were fetched.
+- **Returning a profile URL, `github_login`, a project count, or `last_active`** — each forbidden by spec D3 or by ADR 0171 D4's leak-by-subtraction rule.
+- **301-ing a previous handle**, the way the public page does — a recruiting read has no shared links to preserve, and the redirect would confirm a rename.
+- **403 for a non-discoverable builder** — it confirms the handle exists.