@bongos/core 1.19.430 → 1.19.431

package/modules/platform-identity/recruiter-sliver.js

@@ -0,0 +1,197 @@
+// modules/platform-identity/recruiter-sliver.js — THE PRE-ACCEPT BOUNDARY: what
+// a recruiter may see of a builder BEFORE that builder has accepted anything
+// (privacy spec D3, owner-signed 2026-08-16; ADR 0215, task 1002968).
+//
+// WHAT IT IS. One bounded projection — handle, display name, avatar, the
+// disciplines union, and a COARSE "active in the last 30 days" boolean — and
+// nothing else. It exists so a recruiter has enough to decide whether to reach
+// out, and so a builder who has decided nothing yet gives up no more than that.
+// Under `hide_stats` the last two drop (they are rollup-derived) and the sliver
+// is NAME-ONLY, exactly as the Settings toggle promises.
+//
+// NEVER IN IT, and each absence is load-bearing rather than an oversight:
+//   credits / works shipped / karma  — the numbers are the post-accept record.
+//   project names / project count    — "the aggregate is not the leak, the name
+//                                       is" (ADR 0171 D6), and a count beside a
+//                                       hidden total is a leak by subtraction,
+//                                       so there is no count either.
+//   last_active as a TIMESTAMP       — the signal is coarse ON PURPOSE; a date
+//                                       is a behavioural trace, a boolean is a
+//                                       yes/no. Only the boolean crosses.
+//   github_id / github_login as FIELDS — neither is a key of the sliver. Note
+//                                       the LIMIT, stated rather than glossed:
+//                                       the avatar D3 grants is GitHub's own URL
+//                                       and embeds the account id verbatim, so
+//                                       granting the avatar grants the id inside
+//                                       it. Recorded in ADR 0215's honest limits
+//                                       and asserted precisely in the proof (the
+//                                       id may ride the avatar and nothing else).
+//   a profile-page link              — spec D3 forbids it outright. The handle
+//                                       is an ADDRESS, not a door: for a private
+//                                       account GET /profiles/:handle joins
+//                                       accountVisibleSql and answers 404, so
+//                                       handing a recruiter the handle hands
+//                                       them no page. That is the whole meaning
+//                                       of "pre-accept": the sliver is the
+//                                       ceiling, not a step toward the rollup.
+//
+// WHY ITS OWN FILE. The spec says "a port beside getPublicProfileExtras", and
+// platform-identity.js sits ON the 1500-line ratchet with no headroom — the
+// account-visibility.js / scouting-authz.js / application-echo.js precedent.
+// Beside in the module, not in the file.
+//
+// WHO MAY READ IT is not this file's question — routes/scouting.js gates the one
+// surface, on the same door the recruiting directory uses. WHO MAY APPEAR IN IT
+// is enforced HERE, in the query, by the shared recruiterSliverVisibleSql:
+// consent (profile_state='active' — a provisional account is never
+// recruiter-visible) AND recruiting reach. Deliberately NOT the existence axis:
+// the private, explicitly-discoverable account is the row D3 exists to serve,
+// and reach for a private account is an opt-IN the owner had to set by hand.
+//
+// NOT AUTHORITY (ADR 0016). Appearing here confers nothing on the builder and
+// buys the recruiter nothing but a name to write to; nothing in this repo reads
+// the sliver to decide anything. The rollup it is derived from is descriptive
+// analytics, and a projection of descriptive data is still descriptive.
+//
+// Fail-closed everywhere: an absent row, an unreachable account, a non-numeric
+// principal and an unusable handle all answer the SAME null, so a caller cannot
+// tell "no such builder" from "not discoverable" (the ADR 0171 D4 rule).
+//
+// tests/recruiter_sliver_boundary.mjs is the proof — a whitelist over the exact
+// key set, planted sentinels asserted absent from the whole response body, and
+// the 404 that shows the boundary holds.
+'use strict';
+
+const pi = require('./platform-identity');
+const { recruiterSliverVisibleSql } = require('./account-visibility');
+
+// The complete, closed key set of a FULL sliver, in the order D3 names them.
+// Exported because the proof asserts against this list rather than a copy of it:
+// a key added to the projection and quietly added to the test's own expectation
+// is the failure mode a whitelist is supposed to make impossible.
+const SLIVER_KEYS = ['handle', 'display_name', 'avatar_url', 'disciplines', 'active_recently'];
+
+// The key set that survives `hide_stats`. The other two are rollup-derived, so
+// hiding the cross-project record hides them too — and they are ABSENT, not
+// null: the sliver does not carry an empty box where a number used to be.
+const SLIVER_KEYS_HIDDEN = ['handle', 'display_name', 'avatar_url'];
+
+// "Recently" is 30 days (spec D3). A named constant because it is a privacy
+// parameter, not a tuning knob — widening it widens what the boolean discloses.
+const ACTIVE_WINDOW_DAYS = 30;
+
+// The two columns a sliver may be addressed BY, as a closed vocabulary. The
+// lookup key is the one thing interpolated into the statement below, so it may
+// never come from a caller's string: a route passes one of these constants or
+// nothing at all (the account-visibility.js alias-guard posture).
+const BY_GITHUB_ID = 'github_id';
+const BY_HANDLE = 'lower(handle)';
+const ADDRESSABLE_BY = [BY_GITHUB_ID, BY_HANDLE];
+
+// readSliverAccount(by, value, { pool }) — the ONE account read behind both
+// entry points: the identity columns of an account that passes the shared
+// pre-accept predicate, or null. `hide_stats` is fetched because it decides the
+// SHAPE of the answer; it never crosses into one.
+async function readSliverAccount(by, value, { pool }) {
+  if (!ADDRESSABLE_BY.includes(by)) {
+    throw new Error('readSliverAccount: unknown lookup column');
+  }
+  const { rows } = await pool.query(
+    `SELECT github_id, handle, display_name, avatar_url, hide_stats
+       FROM platform_identity_accounts
+      WHERE ${recruiterSliverVisibleSql()} AND ${by} = $1
+      LIMIT 1`,
+    [value],
+  );
+  return rows[0] || null;
+}
+
+// readSliverActivity(githubId, { pool }) — the rollup-derived half: the
+// disciplines union across every project, and whether ANY of them saw activity
+// inside the window. Aggregated over the UN-FANNED activity table with the
+// disciplines union computed separately, mirroring getRollupForBuilder (the
+// pre-GROUP-BY unnest fan-out was bug task 1002911).
+//
+// The comparison happens in SQL and only its BOOLEAN comes back — the timestamp
+// never enters this process, so no later refactor can accidentally serialize it.
+// A builder with no activity rows at all yields NULL, coerced to false by the
+// caller: "not known to be active" and "not active" are the same answer here.
+async function readSliverActivity(githubId, { pool }) {
+  const { rows } = await pool.query(
+    `WITH act AS (
+       SELECT max(a.last_active) AS last_active
+         FROM platform_identity_builder_project_activity a
+        WHERE a.github_id = $1
+     ), disc AS (
+       SELECT array_agg(DISTINCT x.d) AS disciplines
+         FROM (SELECT unnest(a.disciplines) AS d
+                 FROM platform_identity_builder_project_activity a
+                WHERE a.github_id = $1) x
+        WHERE x.d IS NOT NULL
+     )
+     SELECT (act.last_active > now() - make_interval(days => $2::int)) AS active_recently,
+            disc.disciplines
+       FROM act LEFT JOIN disc ON true`,
+    [githubId, ACTIVE_WINDOW_DAYS],
+  );
+  return rows[0] || null;
+}
+
+// projectSliver(account, activity) — the WHITELIST, built literally. Every key
+// is written out by hand; no row is ever spread, so a column added to either
+// query cannot ride along into a response. `activity` is null for a hidden
+// account, and the two rollup-derived keys are then absent entirely.
+function projectSliver(account, activity) {
+  const sliver = {
+    handle: account.handle ?? null,
+    display_name: account.display_name ?? null,
+    avatar_url: account.avatar_url ?? null,
+  };
+  if (!activity) return sliver;
+  return {
+    ...sliver,
+    disciplines: Array.isArray(activity.disciplines) ? activity.disciplines : [],
+    active_recently: activity.active_recently === true,
+  };
+}
+
+// sliverFor(account, { pool }) — shared tail of both entry points: decide the
+// shape, and for a hidden account DO NOT ISSUE the activity read at all. Not
+// merely dropping the fields after fetching them is the point — the cheapest way
+// for a future edit to leak a number is for the number to already be in hand.
+async function sliverFor(account, { pool }) {
+  if (!account) return null;
+  if (account.hide_stats) return projectSliver(account, null);
+  return projectSliver(account, await readSliverActivity(account.github_id, { pool }));
+}
+
+// getRecruiterSliver(githubId) — THE port the spec names (D3), keyed by the hub
+// account id. Null unless the account consents and is recruiter-reachable.
+// A non-numeric principal (core's 'system:bfg' shape) answers null rather than
+// throwing a bigint cast mid-request, like every other read in this module.
+async function getRecruiterSliver(githubId, { pool } = {}) {
+  if (!pi.isNumericGithubId(githubId)) return null;
+  return sliverFor(await readSliverAccount(BY_GITHUB_ID, String(githubId), { pool }), { pool });
+}
+
+// getRecruiterSliverByHandle(handle) — the same answer, addressed the way the
+// platform addresses a builder publicly (spec Decision 3). An unusable handle
+// answers null without a query.
+//
+// A PREVIOUS handle is deliberately NOT resolved here, unlike resolveHandle: the
+// public page answers 301 so a shared link survives a rename, and a recruiting
+// read has no shared links to keep working. Answering 404 instead of a redirect
+// also keeps this surface from confirming that a rename happened.
+async function getRecruiterSliverByHandle(handle, { pool } = {}) {
+  const norm = pi.normalizeHandle(handle);
+  if (!norm) return null;
+  return sliverFor(await readSliverAccount(BY_HANDLE, norm, { pool }), { pool });
+}
+
+module.exports = {
+  SLIVER_KEYS,
+  SLIVER_KEYS_HIDDEN,
+  ACTIVE_WINDOW_DAYS,
+  getRecruiterSliver,
+  getRecruiterSliverByHandle,
+};

package/modules/platform-identity/routes/scouting.js

@@ -16,6 +16,19 @@
 // surface honors both the hide flag and the recruiting opt-out by construction,
 // and widening WHO may read it could not widen WHAT is shown.
 //
+// TWO READS, TWO AUDIENCES — and the difference is the point (ADR 0215 D4, task
+// 1002968). `GET /scouting` is the DIRECTORY: the full rollup for builders who
+// are publicly visible, unhidden and reachable, read by a `project.curate` holder
+// OR a project owner. `GET /scouting/:handle` is the PRE-ACCEPT SLIVER: a bounded
+// projection (name, avatar, disciplines, a coarse activity boolean) of ONE
+// builder — including the private-but-discoverable account the directory
+// deliberately omits — and it is gated at the ARCHON floor, because it is the
+// first surface here that discloses a private account and privacy spec D3 pins it
+// to an archon-floor atom that has not been minted. Sharing one gate would have
+// been tidier; it would also have widened an owner-signed privacy decision by
+// implementation convenience. The blocker on the route below asks the owner
+// whether the wider recruiting audience is authorized.
+//
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
 
@@ -23,6 +36,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
+const recruiterSliver = require('../recruiter-sliver');
 
 const { pool, requireBuilder, parsePagination } = api;
 
@@ -64,6 +78,10 @@ module.exports = function scoutingRoutes() {
       const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
       try {
         const builders = await pi.listScoutingRollup({ limit, pool });
+        // Same rollup-derived data as the sliver, so the same rule: hide and the
+        // recruiting opt-out must beat any cache (ADR 0171 D5). This route
+        // predates that posture and was the only rollup read still missing it.
+        res.set('Cache-Control', 'no-store');
         res.json({ builders });
       } catch (err) {
         log.error(`GET /scouting failed: ${err && err.message}`);
@@ -72,5 +90,45 @@ module.exports = function scoutingRoutes() {
     },
   );
 
+  // rank: archon — the PRE-ACCEPT SLIVER for ONE builder (privacy spec D3, ADR
+  // 0215 D4, task 1002968). This is the FIRST surface on the platform that
+  // discloses a PRIVATE account, and its audience is deliberately NOT the
+  // directory's.
+  //
+  // WHY A RANK GATE AND NOT THE RECRUITING DOOR ABOVE. Spec D3 gates this read on
+  // `project.recruit`, an atom whose declared shape is FLOOR ARCHON, widenable
+  // per instance (spec D1). That atom does not exist — ADR 0201 D3 and ADR 0210
+  // both refuse to mint it outside the project-admin-console wave that defines it
+  // (spike 1002786 R3), and this task does not either. The directory's door
+  // (`project.curate` at metic, OR any project owner — ADR 0210 D2) is WIDER than
+  // the signed floor on both halves, so adopting it here would widen an
+  // owner-signed privacy decision by implementation convenience. Until the atom
+  // lands, the honest reading of D3 is its floor, held by rank. Whether the wider
+  // recruiting audience is authorized for this surface is the owner's call and is
+  // filed as a blocker, NOT resolved here; when it is answered, this one line
+  // moves and nothing else does.
+  //
+  // 404, never 403, for a builder who is not recruiter-reachable: a 403 would
+  // confirm the handle exists, which is the disclosure the opt-out removes. The
+  // sliver's own predicate does the deciding, inside the module.
+  router.get(
+    '/scouting/:handle',
+    requireBuilder,
+    api.requireRank('archon'),
+    async (req, res) => {
+      try {
+        const sliver = await recruiterSliver.getRecruiterSliverByHandle(req.params.handle, { pool });
+        // The rollup half is live-derived and hide must beat any cache
+        // (ADR 0171 D5) — the /profiles/:handle posture, for the same reason.
+        res.set('Cache-Control', 'no-store');
+        if (!sliver) return res.fail('builder_not_found', 404);
+        res.json({ sliver });
+      } catch (err) {
+        log.error(`GET /scouting/:handle failed: ${err && err.message}`);
+        res.fail('sliver_read_failed', { status: 500, message: 'internal error' });
+      }
+    },
+  );
+
   return router;
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.430",
+  "version": "1.19.431",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.430",
+      "version": "1.19.431",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.430",
+  "version": "1.19.431",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.430'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.431'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/account_privacy_flags.mjs

@@ -32,6 +32,12 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
+// The sliver's own key lists — the copy guard below is written against THESE,
+// not against a transcription of them, so a sixth granted field cannot be added
+// without the Settings copy being made to name it (privacy spec D3: the toggle's
+// copy "must state exactly this grant").
+import { SLIVER_KEYS, SLIVER_KEYS_HIDDEN } from '../modules/platform-identity/recruiter-sliver.js';
+
 const require = createRequire(import.meta.url);
 const express = require('express');
 
@@ -173,6 +179,51 @@ test('setAccountPrivacy accepts an explicit null discoverable — the reset to "
   assert.equal(calls[0].params[7], true, 'and it counts as sent');
 });
 
+/**
+ * Resolve what the UPDATE branch would store in `recruiter_discoverable`, from
+ * the statement's OWN text — the WHERE-derived-fake principle applied to a CASE.
+ * Each arm is recognised, and an arm this reader cannot see simply is not
+ * modelled, so deleting one from the SQL genuinely changes the answer here.
+ */
+function resolveStoredReach(sql, params, stored) {
+  const from = sql.indexOf('recruiter_discoverable = CASE');
+  assert.ok(from >= 0, 'the reach column lost its CASE entirely');
+  const body = sql.slice(from, sql.indexOf('END', from));
+  const [visibilityWritten, reachWritten, setVisibility, setReach] = params.slice(4, 8);
+  assert.match(body, /ELSE platform_identity_accounts\.recruiter_discoverable/,
+    'the CASE must still fall through to the STORED value — without the ELSE every PATCH would clear the flag');
+  if (/WHEN \$8::boolean THEN EXCLUDED\.recruiter_discoverable/.test(body) && setReach) return reachWritten;
+  if (/WHEN \$7::boolean AND EXCLUDED\.account_visibility = 'private' THEN NULL/.test(body)
+      && setVisibility && visibilityWritten === 'private') return null;
+  return stored;
+}
+
+test('GOING PRIVATE re-arms the reach default, so a consent given while public is not silently reused', async () => {
+  // THE DEFECT THIS CLOSES (found in adversarial review of task 1002968). A
+  // public builder toggles "Discoverable by recruiters" off and on again: the
+  // column is now an explicit `true`, not NULL. They later set the profile to
+  // Private, reading a row that promises the page "answers not found to every
+  // visitor". That stale `true` used to be INERT — every recruiting surface
+  // floored on the existence axis. The D3 sliver does not, by design, so it
+  // would have served them under a consent they gave to a different question.
+  //
+  // Each row is resolved from the statement's own CASE, so removing the new arm
+  // makes the first row answer `true` and this test red.
+  const cases = [
+    ['private, reach unnamed → RESET', { account_visibility: 'private' }, true, null],
+    ['private, reach named true → the owner re-consented, so it stands', { account_visibility: 'private', recruiter_discoverable: true }, true, true],
+    ['private, reach named false → explicit off', { account_visibility: 'private', recruiter_discoverable: false }, true, false],
+    ['public, reach unnamed → untouched', { account_visibility: 'public' }, true, true],
+    ['reach alone, no visibility change → untouched', { recruiter_discoverable: false }, true, false],
+    ['private on an account that never opted in → still the default', { account_visibility: 'private' }, null, null],
+  ];
+  for (const [name, fields, stored, want] of cases) {
+    expect({ rows: [row({ recruiter_discoverable: want })] });
+    await pi.setAccountPrivacy({ githubId: SESSION.github_id, fields }, { pool });
+    assert.equal(resolveStoredReach(calls[0].text, calls[0].params, stored), want, name);
+  }
+});
+
 test('setAccountPrivacy refuses a value outside the model, before any query', async () => {
   expect();
   assert.equal((await pi.setAccountPrivacy(
@@ -271,15 +322,45 @@ test('neither flag crosses a PUBLIC response — the /u/<handle> read stays a wh
 
 // ---- 5. the settings copy states the grant ---------------------------------
 
-test('the discoverable toggle names EXACTLY what it grants — the D3 sliver, name-only when hidden', () => {
+// How each granted FIELD has to read to a person. Keyed by the module's export,
+// so this map is the place a sixth key must be described before it can ship —
+// and the "every key is described" assertion below is what makes that binding.
+const GRANT_WORDS = {
+  handle: /your name/,
+  display_name: /your name/,
+  avatar_url: /your picture/,
+  disciplines: /your disciplines/,
+  active_recently: /active in the last 30 days/,
+};
+
+test('the discoverable toggle names EXACTLY what it grants — checked against SLIVER_KEYS itself', () => {
   const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
   const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
-  assert.match(js, /your name, your disciplines, and whether you have been active in the last 30 days/,
-    'the sliver is name + disciplines + a coarse activity signal — spelled out, not implied');
+  // Privacy spec D3 makes this a MUST: "The discoverable toggle's settings copy
+  // must state exactly this grant." It was checked against three transcribed
+  // phrases, and the transcription had gone stale in the direction that matters:
+  // the copy said the hidden sliver was "your name and nothing else" while
+  // SLIVER_KEYS_HIDDEN also ships avatar_url, and the shown branch never named
+  // the picture at all. A user was being told something false about their own
+  // privacy. It is now checked against the shipped key lists.
+  const shown = /: 'They will see ([^']+)'/.exec(js);
+  const hidden = /\? 'Because your cross-project record is hidden, ([^']+)'/.exec(js);
+  assert.ok(shown && hidden, 'both branches of the grant string must still be findable');
+
+  for (const key of SLIVER_KEYS) {
+    assert.ok(GRANT_WORDS[key], `SLIVER_KEYS grew "${key}" and nothing here says how to describe it — spec D3 says the copy must state the grant, so a new granted field cannot ship undescribed`);
+    assert.match(shown[1], GRANT_WORDS[key], `the toggle must name "${key}" — it is in the sliver a recruiter receives`);
+  }
+  for (const key of SLIVER_KEYS_HIDDEN) {
+    assert.match(hidden[1], GRANT_WORDS[key], `hidden, the sliver still ships "${key}", so the name-only copy must still name it`);
+  }
+  for (const key of SLIVER_KEYS.filter((k) => !SLIVER_KEYS_HIDDEN.includes(k))) {
+    assert.doesNotMatch(hidden[1], GRANT_WORDS[key], `"${key}" drops under hide_stats, so the copy must not keep promising it`);
+  }
   assert.match(js, /never your credits, works shipped, karma, or the projects you build on/,
     'and the copy says what it does NOT grant');
-  assert.match(js, /cross-project record is hidden, they will see your name and nothing else/,
-    'hide_stats shrinks the grant to name-only, because the rest is rollup-derived');
+  assert.match(js, /the one thing a recruiter can see while your profile page is private/,
+    'a private account is told the sliver is the exception to "not found to every visitor" — the surprising half of D2/D3');
   assert.match(html, /<section[^>]*id="privacy-scroll"[^>]*hidden>/,
     'the section ships hidden — it reveals only where the hub module answers');
 });
@@ -304,13 +385,38 @@ test('each toggle claims exactly what is enforced — and BOTH are now in force'
     'recruiting reach is enforced now (task 1002290), so the row promises it in the present tense');
   assert.doesNotMatch(js, /will be able to find you/,
     'the future tense outlived its truth the moment listScoutingRollup joined the reach predicate');
-  assert.match(js, /takes you out of the People directory straight away/,
-    'and the row names the ONE surface that reads the flag today — a promise you can go and check');
+  // WIDENED BY TASK 1002968, on the same rule that narrowed it. 1002290 cut this
+  // to "the People directory" because the D3 sliver was unbuilt and no guard here
+  // could hold a wider claim. The sliver is now built and gated, so BOTH
+  // recruiting reads join the reach axis and the row may name both — and the
+  // wider claim is held by the guard below rather than by this sentence.
+  assert.match(js, /removes you from both recruiting surfaces/,
+    'the row names both surfaces that read the flag today — a promise you can go and check');
   assert.doesNotMatch(js, /every recruiting view/,
-    'never a promise over surfaces that do not exist yet: the D3 recruiter sliver is unbuilt, so no '
-    + 'guard here could hold that claim, and the copy rule is that a toggle promises exactly what is enforced');
+    'still never an OPEN-ENDED promise: "both" is a claim a guard can hold, "every" is not — a third '
+    + 'recruiting read would make it false with nothing to notice');
   assert.match(html, /profile page setting applies now[\s\S]*Recruiter discoverability applies now too/,
     'the section note now says both are live, rather than splitting them');
   assert.doesNotMatch(html, /starts applying as the recruiting surfaces land/,
     'the "recorded and waiting" note must not outlive the surface that started reading it');
 });
+
+test('the recruiting surface really is exactly two reads, and each one joins REACH', () => {
+  // This is what makes the widened copy above checkable rather than a slogan.
+  // Both halves are enumerated from source: a third route on the recruiting
+  // surface, or either reader dropping the reach axis, reds here — which is the
+  // signal that the toggle's promise has stopped being true.
+  const route = readFileSync(join(ROOT, 'modules/platform-identity/routes/scouting.js'), 'utf8');
+  const mounted = route.match(/router\.get\(\s*\n?\s*'([^']+)'/g) || [];
+  assert.equal(mounted.length, 2,
+    `the recruiting surface mounts ${mounted.length} route(s), not 2 — the Settings copy promises "both recruiting surfaces" and can no longer name them`);
+  assert.match(route, /'\/scouting'/, 'the directory');
+  assert.match(route, /'\/scouting\/:handle'/, 'and the pre-accept sliver');
+
+  const av = readFileSync(join(ROOT, 'modules/platform-identity/account-visibility.js'), 'utf8');
+  for (const composed of ['scoutingListableSql', 'recruiterSliverVisibleSql']) {
+    const body = av.slice(av.indexOf(`function ${composed}(`));
+    assert.match(body.slice(0, body.indexOf('\n}')), /recruiterReachSql\(alias\)/,
+      `${composed} stopped composing the reach axis — opting out would no longer empty that surface`);
+  }
+});

package/tests/effective_visibility_predicate.mjs

@@ -79,6 +79,8 @@ import {
   isRecruiterDiscoverable,
   recruiterReachSql,
   scoutingListableSql,
+  recruiterSliverVisibleSql,
+  isRecruiterSliverVisible,
 } from '../modules/platform-identity/account-visibility.js';
 
 const require = createRequire(import.meta.url);
@@ -119,6 +121,10 @@ const SPELLING_EXEMPTIONS = [
       text: 'hide_stats = true',
       count: 1,
       why: "hiddenGithubIds asks the OPPOSITE question to visibility — 'which of these accounts have hidden themselves' — for the closeness-graph consent gate. It must stay fail-closed on hide alone (ADR 0171 D4), so it is not expressible as the shared predicate and is not a variant of it.",
+    }, {
+      text: "account_visibility = '",
+      count: 1,
+      why: "setAccountPrivacy's ON CONFLICT branch, and a WRITE rather than a read gate — it reads EXCLUDED, the value being written, to decide whether this PATCH re-arms recruiter_discoverable to its 'follow visibility' default. Going private without naming reach must clear an explicit true, because that true was set while PUBLIC and meant 'recruiters may see my public profile' (ADR 0215, task 1002968); the D3 sliver has no existence floor and would otherwise read that stale consent as fresh. It gates no read, so it cannot be expressed as the shared predicate and is not a variant of one — the SPELLINGS comment already excludes writes in principle, and this is the occurrence its regex cannot tell apart.",
     }],
     obligation: (code) => /require\(\s*'\.\/account-visibility'\s*\)/.test(code),
     demands: 'still imports the shared predicate rather than re-deriving one',
@@ -341,8 +347,14 @@ function accountStatements(code) {
  * recruiterReachSql inside the owner file, so a reader that joins it has adopted
  * the shared rule — but it must be named here, or wiring the recruiting reach in
  * would read as a reader that stopped adopting anything.
+ * recruiterSliverVisibleSql (task 1002968) is here on the same terms and one
+ * caveat: it is the ONE composed answer that deliberately omits the existence
+ * axis, because the private-but-discoverable account is the D3 sliver's subject.
+ * That is a decision recorded in the owner file and asserted above — not a
+ * reader quietly dropping a term, which is what this regex would otherwise let
+ * through unnoticed.
  */
-const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|isAccountVisible|isAccountActive|isRollupVisible)\s*\(/;
+const ADOPTS = /\b(?:accountVisibleSql|accountActiveSql|rollupVisibleSql|scoutingListableSql|recruiterSliverVisibleSql|isAccountVisible|isAccountActive|isRollupVisible|isRecruiterSliverVisible)\s*\(/;
 
 // ===========================================================================
 // Self-tests — the machinery is the guard, so it gets proved too.
@@ -513,6 +525,30 @@ t('the recruiter-reach predicate still lives here, and is still the only COALESC
     'reach never buys addressability — that is what the D3 sliver is for');
 });
 
+t('recruiterSliverVisibleSql is COMPOSED from consent AND reach, and omits existence ON PURPOSE (task 1002968)', () => {
+  // The pre-accept sliver is the one effective answer that must NOT floor on the
+  // existence axis: the privacy spec's D2 "private · discoverable" row is the
+  // account it exists to serve, and ANDing accountVisibleSql would empty it of
+  // exactly that account while leaving every test above still green.
+  assert.ok(recruiterSliverVisibleSql('pa').includes(accountActiveSql('pa')),
+    'the consent floor, literally contained — a provisional account is never recruiter-visible (spec D3)');
+  assert.ok(recruiterSliverVisibleSql('pa').includes(recruiterReachSql('pa')),
+    'and the reach axis, literally contained — the opt-out empties this surface too');
+  assert.ok(!recruiterSliverVisibleSql('pa').includes(accountVisibleSql('pa')),
+    'and NOT the existence axis: dropping it is safe only because reach is an explicit opt-IN for a private account');
+  assert.doesNotMatch(recruiterSliverVisibleSql(), /hide_stats/,
+    'hide changes the SHAPE of the sliver (name-only), never who appears in it');
+  // The JS twin, over the same D2 matrix the SQL is judged on.
+  const accepted = { terms_accepted_at: 'T1' };  // the T&C half of the consent floor (ADR 0213)
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'active', account_visibility: 'private', recruiter_discoverable: true }), true);
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'active', account_visibility: 'private', recruiter_discoverable: null }), false);
+  assert.equal(isRecruiterSliverVisible({ ...accepted, profile_state: 'provisional', account_visibility: 'public', recruiter_discoverable: true }), false);
+  assert.equal(isRecruiterSliverVisible({ profile_state: 'active', account_visibility: 'private', recruiter_discoverable: true }), false,
+    'and the sliver inherits the T&C floor by COMPOSITION — an account that never accepted is not recruiter-visible');
+  assert.equal(isRecruiterSliverVisible(null), false, 'fail-closed on an absent account');
+  assert.throws(() => recruiterSliverVisibleSql('pa; DROP TABLE x --'), /bare SQL identifier/);
+});
+
 // ===========================================================================
 // 2. The sole-owner rule — nothing else spells a variant
 // ===========================================================================
@@ -640,6 +676,27 @@ t('the shared predicate has real adopters (the wiring did not silently unwire it
   }
 });
 
+t('the EXISTENCE-LESS predicate has exactly one reader, and it is the sliver (task 1002968)', () => {
+  // recruiterSliverVisibleSql counts as adoption in ADOPTS above, which is what
+  // lets the sliver's own read pass the classification rule — and that is a hole
+  // unless the predicate is also PINNED to its one caller. It is the only shared
+  // answer that omits `account_visibility = 'public'`, so a future public read
+  // that joined it would look adopted while quietly serving private accounts.
+  // BOTH FORMS, because the same diff put both into ADOPTS. Pinning only the SQL
+  // one left the JS twin as an open door: a new module file doing
+  // `rows.filter(isRecruiterSliverVisible)` over an ungated
+  // `SELECT … FROM platform_identity_accounts WHERE handle ILIKE $1` passed this
+  // entire guard — that is the hub profile search this file's own header names
+  // as the read that must fail the build, sailing through on the one predicate
+  // that omits the existence axis (found in adversarial review, task 1002968).
+  // Enumerated from source, so a second reader fails here rather than in review.
+  const readers = scanned
+    .filter((f) => f.rel !== PREDICATE_OWNER && /\b(?:recruiterSliverVisibleSql|isRecruiterSliverVisible)\s*\(/.test(f.code))
+    .map((f) => f.rel);
+  assert.deepEqual(readers, ['modules/platform-identity/recruiter-sliver.js'],
+    'the pre-accept predicate is the recruiting sliver\'s alone — every other read must floor on the existence axis');
+});
+
 t('getPublicProfileExtras gates on the shared JS port (its SQL carries no predicate to join)', () => {
   const pi = scanned.find((f) => f.rel === 'modules/platform-identity/platform-identity.js');
   const span = functionSpans(pi.code).find((s) => s.name === 'getPublicProfileExtras');

package/tests/government_require_permission.mjs

@@ -352,6 +352,28 @@ test('every modules/*/routes gate is migrated, bar the one documented holdout',
     // worth doing — it means minting an atom over the write — but it is the
     // continuing R107/R108 migration's job, not this ADR's.
     'security/routes/scans.js',
+    // Still requireRank after BV1.R105 — and for a reason the other holdouts do
+    // not have: the atom this gate WANTS is specified, named, and deliberately
+    // owned by another wave. `GET /scouting/:handle` is the privacy spec's D3
+    // pre-accept recruiter sliver (task 1002968, ADR 0215 D4), and D3 gates it on
+    // `project.recruit` — declared in spec D1 as FLOOR ARCHON, widenable per
+    // instance. That atom does not exist: ADR 0201 D3 and ADR 0210 both refuse to
+    // mint it outside the project-admin-console wave that defines it (spike
+    // 1002786 R3), because a third definition before any had shipped is the drift
+    // they were avoiding.
+    //
+    // The three ways out are all worse. Minting it here forks its definition.
+    // Borrowing a different archon atom (`access_request.review`, say) would name
+    // the wrong authority on a privacy surface. And reusing the sibling route's
+    // `project.curate`-or-project-owner door — the tidy option, and what the first
+    // draft did — is WIDER than the signed floor on both halves, on the first
+    // surface on this platform that discloses a PRIVATE account.
+    //
+    // So the floor is held by rank until the atom lands, which is the one spelling
+    // that neither invents authority nor widens it. It is temporary by
+    // construction: blocker 1000126 carries the audience question to the owner,
+    // and spike 1002786 R3 mints the atom that removes this entry.
+    'platform-identity/routes/scouting.js',
   ].sort();
 
   const modulesDir = path.join(ROOT, 'modules');

package/tests/profile_route.mjs

@@ -159,6 +159,9 @@ require.cache[authPath] = {
     requireBuilder: (_req, _res, next) => next(),
     requireRank: () => (_req, _res, next) => next(),
     requirePermission: () => (_req, _res, next) => next(),
+    // ADR 0215 D4: the sliver route beside the directory gates on RANK, so the
+    // partial doorway must answer requireRank too or the router will not load.
+    requireRank: () => (_req, _res, next) => next(),
   },
 };
 
@@ -434,6 +437,9 @@ require.cache[moduleApiPath] = {
     pool: engine,
     requireBuilder: (_req, _res, next) => next(),
     requirePermission: () => (_req, _res, next) => next(),
+    // ADR 0215 D4: the sliver route beside the directory gates on RANK, so the
+    // partial doorway must answer requireRank too or the router will not load.
+    requireRank: () => (_req, _res, next) => next(),
     parsePagination: () => ({ limit: 100, offset: 0 }),
     corsPublicGet: () => (_req, _res, next) => next(),
   },