@bongos/core 1.19.430 → 1.19.432

package/modules/platform-identity/recruiter-sliver.js

@@ -0,0 +1,197 @@
+// modules/platform-identity/recruiter-sliver.js — THE PRE-ACCEPT BOUNDARY: what
+// a recruiter may see of a builder BEFORE that builder has accepted anything
+// (privacy spec D3, owner-signed 2026-08-16; ADR 0215, task 1002968).
+//
+// WHAT IT IS. One bounded projection — handle, display name, avatar, the
+// disciplines union, and a COARSE "active in the last 30 days" boolean — and
+// nothing else. It exists so a recruiter has enough to decide whether to reach
+// out, and so a builder who has decided nothing yet gives up no more than that.
+// Under `hide_stats` the last two drop (they are rollup-derived) and the sliver
+// is NAME-ONLY, exactly as the Settings toggle promises.
+//
+// NEVER IN IT, and each absence is load-bearing rather than an oversight:
+//   credits / works shipped / karma  — the numbers are the post-accept record.
+//   project names / project count    — "the aggregate is not the leak, the name
+//                                       is" (ADR 0171 D6), and a count beside a
+//                                       hidden total is a leak by subtraction,
+//                                       so there is no count either.
+//   last_active as a TIMESTAMP       — the signal is coarse ON PURPOSE; a date
+//                                       is a behavioural trace, a boolean is a
+//                                       yes/no. Only the boolean crosses.
+//   github_id / github_login as FIELDS — neither is a key of the sliver. Note
+//                                       the LIMIT, stated rather than glossed:
+//                                       the avatar D3 grants is GitHub's own URL
+//                                       and embeds the account id verbatim, so
+//                                       granting the avatar grants the id inside
+//                                       it. Recorded in ADR 0215's honest limits
+//                                       and asserted precisely in the proof (the
+//                                       id may ride the avatar and nothing else).
+//   a profile-page link              — spec D3 forbids it outright. The handle
+//                                       is an ADDRESS, not a door: for a private
+//                                       account GET /profiles/:handle joins
+//                                       accountVisibleSql and answers 404, so
+//                                       handing a recruiter the handle hands
+//                                       them no page. That is the whole meaning
+//                                       of "pre-accept": the sliver is the
+//                                       ceiling, not a step toward the rollup.
+//
+// WHY ITS OWN FILE. The spec says "a port beside getPublicProfileExtras", and
+// platform-identity.js sits ON the 1500-line ratchet with no headroom — the
+// account-visibility.js / scouting-authz.js / application-echo.js precedent.
+// Beside in the module, not in the file.
+//
+// WHO MAY READ IT is not this file's question — routes/scouting.js gates the one
+// surface, on the same door the recruiting directory uses. WHO MAY APPEAR IN IT
+// is enforced HERE, in the query, by the shared recruiterSliverVisibleSql:
+// consent (profile_state='active' — a provisional account is never
+// recruiter-visible) AND recruiting reach. Deliberately NOT the existence axis:
+// the private, explicitly-discoverable account is the row D3 exists to serve,
+// and reach for a private account is an opt-IN the owner had to set by hand.
+//
+// NOT AUTHORITY (ADR 0016). Appearing here confers nothing on the builder and
+// buys the recruiter nothing but a name to write to; nothing in this repo reads
+// the sliver to decide anything. The rollup it is derived from is descriptive
+// analytics, and a projection of descriptive data is still descriptive.
+//
+// Fail-closed everywhere: an absent row, an unreachable account, a non-numeric
+// principal and an unusable handle all answer the SAME null, so a caller cannot
+// tell "no such builder" from "not discoverable" (the ADR 0171 D4 rule).
+//
+// tests/recruiter_sliver_boundary.mjs is the proof — a whitelist over the exact
+// key set, planted sentinels asserted absent from the whole response body, and
+// the 404 that shows the boundary holds.
+'use strict';
+
+const pi = require('./platform-identity');
+const { recruiterSliverVisibleSql } = require('./account-visibility');
+
+// The complete, closed key set of a FULL sliver, in the order D3 names them.
+// Exported because the proof asserts against this list rather than a copy of it:
+// a key added to the projection and quietly added to the test's own expectation
+// is the failure mode a whitelist is supposed to make impossible.
+const SLIVER_KEYS = ['handle', 'display_name', 'avatar_url', 'disciplines', 'active_recently'];
+
+// The key set that survives `hide_stats`. The other two are rollup-derived, so
+// hiding the cross-project record hides them too — and they are ABSENT, not
+// null: the sliver does not carry an empty box where a number used to be.
+const SLIVER_KEYS_HIDDEN = ['handle', 'display_name', 'avatar_url'];
+
+// "Recently" is 30 days (spec D3). A named constant because it is a privacy
+// parameter, not a tuning knob — widening it widens what the boolean discloses.
+const ACTIVE_WINDOW_DAYS = 30;
+
+// The two columns a sliver may be addressed BY, as a closed vocabulary. The
+// lookup key is the one thing interpolated into the statement below, so it may
+// never come from a caller's string: a route passes one of these constants or
+// nothing at all (the account-visibility.js alias-guard posture).
+const BY_GITHUB_ID = 'github_id';
+const BY_HANDLE = 'lower(handle)';
+const ADDRESSABLE_BY = [BY_GITHUB_ID, BY_HANDLE];
+
+// readSliverAccount(by, value, { pool }) — the ONE account read behind both
+// entry points: the identity columns of an account that passes the shared
+// pre-accept predicate, or null. `hide_stats` is fetched because it decides the
+// SHAPE of the answer; it never crosses into one.
+async function readSliverAccount(by, value, { pool }) {
+  if (!ADDRESSABLE_BY.includes(by)) {
+    throw new Error('readSliverAccount: unknown lookup column');
+  }
+  const { rows } = await pool.query(
+    `SELECT github_id, handle, display_name, avatar_url, hide_stats
+       FROM platform_identity_accounts
+      WHERE ${recruiterSliverVisibleSql()} AND ${by} = $1
+      LIMIT 1`,
+    [value],
+  );
+  return rows[0] || null;
+}
+
+// readSliverActivity(githubId, { pool }) — the rollup-derived half: the
+// disciplines union across every project, and whether ANY of them saw activity
+// inside the window. Aggregated over the UN-FANNED activity table with the
+// disciplines union computed separately, mirroring getRollupForBuilder (the
+// pre-GROUP-BY unnest fan-out was bug task 1002911).
+//
+// The comparison happens in SQL and only its BOOLEAN comes back — the timestamp
+// never enters this process, so no later refactor can accidentally serialize it.
+// A builder with no activity rows at all yields NULL, coerced to false by the
+// caller: "not known to be active" and "not active" are the same answer here.
+async function readSliverActivity(githubId, { pool }) {
+  const { rows } = await pool.query(
+    `WITH act AS (
+       SELECT max(a.last_active) AS last_active
+         FROM platform_identity_builder_project_activity a
+        WHERE a.github_id = $1
+     ), disc AS (
+       SELECT array_agg(DISTINCT x.d) AS disciplines
+         FROM (SELECT unnest(a.disciplines) AS d
+                 FROM platform_identity_builder_project_activity a
+                WHERE a.github_id = $1) x
+        WHERE x.d IS NOT NULL
+     )
+     SELECT (act.last_active > now() - make_interval(days => $2::int)) AS active_recently,
+            disc.disciplines
+       FROM act LEFT JOIN disc ON true`,
+    [githubId, ACTIVE_WINDOW_DAYS],
+  );
+  return rows[0] || null;
+}
+
+// projectSliver(account, activity) — the WHITELIST, built literally. Every key
+// is written out by hand; no row is ever spread, so a column added to either
+// query cannot ride along into a response. `activity` is null for a hidden
+// account, and the two rollup-derived keys are then absent entirely.
+function projectSliver(account, activity) {
+  const sliver = {
+    handle: account.handle ?? null,
+    display_name: account.display_name ?? null,
+    avatar_url: account.avatar_url ?? null,
+  };
+  if (!activity) return sliver;
+  return {
+    ...sliver,
+    disciplines: Array.isArray(activity.disciplines) ? activity.disciplines : [],
+    active_recently: activity.active_recently === true,
+  };
+}
+
+// sliverFor(account, { pool }) — shared tail of both entry points: decide the
+// shape, and for a hidden account DO NOT ISSUE the activity read at all. Not
+// merely dropping the fields after fetching them is the point — the cheapest way
+// for a future edit to leak a number is for the number to already be in hand.
+async function sliverFor(account, { pool }) {
+  if (!account) return null;
+  if (account.hide_stats) return projectSliver(account, null);
+  return projectSliver(account, await readSliverActivity(account.github_id, { pool }));
+}
+
+// getRecruiterSliver(githubId) — THE port the spec names (D3), keyed by the hub
+// account id. Null unless the account consents and is recruiter-reachable.
+// A non-numeric principal (core's 'system:bfg' shape) answers null rather than
+// throwing a bigint cast mid-request, like every other read in this module.
+async function getRecruiterSliver(githubId, { pool } = {}) {
+  if (!pi.isNumericGithubId(githubId)) return null;
+  return sliverFor(await readSliverAccount(BY_GITHUB_ID, String(githubId), { pool }), { pool });
+}
+
+// getRecruiterSliverByHandle(handle) — the same answer, addressed the way the
+// platform addresses a builder publicly (spec Decision 3). An unusable handle
+// answers null without a query.
+//
+// A PREVIOUS handle is deliberately NOT resolved here, unlike resolveHandle: the
+// public page answers 301 so a shared link survives a rename, and a recruiting
+// read has no shared links to keep working. Answering 404 instead of a redirect
+// also keeps this surface from confirming that a rename happened.
+async function getRecruiterSliverByHandle(handle, { pool } = {}) {
+  const norm = pi.normalizeHandle(handle);
+  if (!norm) return null;
+  return sliverFor(await readSliverAccount(BY_HANDLE, norm, { pool }), { pool });
+}
+
+module.exports = {
+  SLIVER_KEYS,
+  SLIVER_KEYS_HIDDEN,
+  ACTIVE_WINDOW_DAYS,
+  getRecruiterSliver,
+  getRecruiterSliverByHandle,
+};

package/modules/platform-identity/routes/scouting.js

@@ -16,6 +16,19 @@
 // surface honors both the hide flag and the recruiting opt-out by construction,
 // and widening WHO may read it could not widen WHAT is shown.
 //
+// TWO READS, TWO AUDIENCES — and the difference is the point (ADR 0215 D4, task
+// 1002968). `GET /scouting` is the DIRECTORY: the full rollup for builders who
+// are publicly visible, unhidden and reachable, read by a `project.curate` holder
+// OR a project owner. `GET /scouting/:handle` is the PRE-ACCEPT SLIVER: a bounded
+// projection (name, avatar, disciplines, a coarse activity boolean) of ONE
+// builder — including the private-but-discoverable account the directory
+// deliberately omits — and it is gated at the ARCHON floor, because it is the
+// first surface here that discloses a private account and privacy spec D3 pins it
+// to an archon-floor atom that has not been minted. Sharing one gate would have
+// been tidier; it would also have widened an owner-signed privacy decision by
+// implementation convenience. The blocker on the route below asks the owner
+// whether the wider recruiting audience is authorized.
+//
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
 
@@ -23,6 +36,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
+const recruiterSliver = require('../recruiter-sliver');
 
 const { pool, requireBuilder, parsePagination } = api;
 
@@ -64,6 +78,10 @@ module.exports = function scoutingRoutes() {
       const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
       try {
         const builders = await pi.listScoutingRollup({ limit, pool });
+        // Same rollup-derived data as the sliver, so the same rule: hide and the
+        // recruiting opt-out must beat any cache (ADR 0171 D5). This route
+        // predates that posture and was the only rollup read still missing it.
+        res.set('Cache-Control', 'no-store');
         res.json({ builders });
       } catch (err) {
         log.error(`GET /scouting failed: ${err && err.message}`);
@@ -72,5 +90,45 @@ module.exports = function scoutingRoutes() {
     },
   );
 
+  // rank: archon — the PRE-ACCEPT SLIVER for ONE builder (privacy spec D3, ADR
+  // 0215 D4, task 1002968). This is the FIRST surface on the platform that
+  // discloses a PRIVATE account, and its audience is deliberately NOT the
+  // directory's.
+  //
+  // WHY A RANK GATE AND NOT THE RECRUITING DOOR ABOVE. Spec D3 gates this read on
+  // `project.recruit`, an atom whose declared shape is FLOOR ARCHON, widenable
+  // per instance (spec D1). That atom does not exist — ADR 0201 D3 and ADR 0210
+  // both refuse to mint it outside the project-admin-console wave that defines it
+  // (spike 1002786 R3), and this task does not either. The directory's door
+  // (`project.curate` at metic, OR any project owner — ADR 0210 D2) is WIDER than
+  // the signed floor on both halves, so adopting it here would widen an
+  // owner-signed privacy decision by implementation convenience. Until the atom
+  // lands, the honest reading of D3 is its floor, held by rank. Whether the wider
+  // recruiting audience is authorized for this surface is the owner's call and is
+  // filed as a blocker, NOT resolved here; when it is answered, this one line
+  // moves and nothing else does.
+  //
+  // 404, never 403, for a builder who is not recruiter-reachable: a 403 would
+  // confirm the handle exists, which is the disclosure the opt-out removes. The
+  // sliver's own predicate does the deciding, inside the module.
+  router.get(
+    '/scouting/:handle',
+    requireBuilder,
+    api.requireRank('archon'),
+    async (req, res) => {
+      try {
+        const sliver = await recruiterSliver.getRecruiterSliverByHandle(req.params.handle, { pool });
+        // The rollup half is live-derived and hide must beat any cache
+        // (ADR 0171 D5) — the /profiles/:handle posture, for the same reason.
+        res.set('Cache-Control', 'no-store');
+        if (!sliver) return res.fail('builder_not_found', 404);
+        res.json({ sliver });
+      } catch (err) {
+        log.error(`GET /scouting/:handle failed: ${err && err.message}`);
+        res.fail('sliver_read_failed', { status: 500, message: 'internal error' });
+      }
+    },
+  );
+
   return router;
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.430",
+  "version": "1.19.432",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.430",
+      "version": "1.19.432",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.430",
+  "version": "1.19.432",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.430'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.432'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/account_privacy_flags.mjs

@@ -32,6 +32,12 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
+// The sliver's own key lists — the copy guard below is written against THESE,
+// not against a transcription of them, so a sixth granted field cannot be added
+// without the Settings copy being made to name it (privacy spec D3: the toggle's
+// copy "must state exactly this grant").
+import { SLIVER_KEYS, SLIVER_KEYS_HIDDEN } from '../modules/platform-identity/recruiter-sliver.js';
+
 const require = createRequire(import.meta.url);
 const express = require('express');
 
@@ -173,6 +179,51 @@ test('setAccountPrivacy accepts an explicit null discoverable — the reset to "
   assert.equal(calls[0].params[7], true, 'and it counts as sent');
 });
 
+/**
+ * Resolve what the UPDATE branch would store in `recruiter_discoverable`, from
+ * the statement's OWN text — the WHERE-derived-fake principle applied to a CASE.
+ * Each arm is recognised, and an arm this reader cannot see simply is not
+ * modelled, so deleting one from the SQL genuinely changes the answer here.
+ */
+function resolveStoredReach(sql, params, stored) {
+  const from = sql.indexOf('recruiter_discoverable = CASE');
+  assert.ok(from >= 0, 'the reach column lost its CASE entirely');
+  const body = sql.slice(from, sql.indexOf('END', from));
+  const [visibilityWritten, reachWritten, setVisibility, setReach] = params.slice(4, 8);
+  assert.match(body, /ELSE platform_identity_accounts\.recruiter_discoverable/,
+    'the CASE must still fall through to the STORED value — without the ELSE every PATCH would clear the flag');
+  if (/WHEN \$8::boolean THEN EXCLUDED\.recruiter_discoverable/.test(body) && setReach) return reachWritten;
+  if (/WHEN \$7::boolean AND EXCLUDED\.account_visibility = 'private' THEN NULL/.test(body)
+      && setVisibility && visibilityWritten === 'private') return null;
+  return stored;
+}
+
+test('GOING PRIVATE re-arms the reach default, so a consent given while public is not silently reused', async () => {
+  // THE DEFECT THIS CLOSES (found in adversarial review of task 1002968). A
+  // public builder toggles "Discoverable by recruiters" off and on again: the
+  // column is now an explicit `true`, not NULL. They later set the profile to
+  // Private, reading a row that promises the page "answers not found to every
+  // visitor". That stale `true` used to be INERT — every recruiting surface
+  // floored on the existence axis. The D3 sliver does not, by design, so it
+  // would have served them under a consent they gave to a different question.
+  //
+  // Each row is resolved from the statement's own CASE, so removing the new arm
+  // makes the first row answer `true` and this test red.
+  const cases = [
+    ['private, reach unnamed → RESET', { account_visibility: 'private' }, true, null],
+    ['private, reach named true → the owner re-consented, so it stands', { account_visibility: 'private', recruiter_discoverable: true }, true, true],
+    ['private, reach named false → explicit off', { account_visibility: 'private', recruiter_discoverable: false }, true, false],
+    ['public, reach unnamed → untouched', { account_visibility: 'public' }, true, true],
+    ['reach alone, no visibility change → untouched', { recruiter_discoverable: false }, true, false],
+    ['private on an account that never opted in → still the default', { account_visibility: 'private' }, null, null],
+  ];
+  for (const [name, fields, stored, want] of cases) {
+    expect({ rows: [row({ recruiter_discoverable: want })] });
+    await pi.setAccountPrivacy({ githubId: SESSION.github_id, fields }, { pool });
+    assert.equal(resolveStoredReach(calls[0].text, calls[0].params, stored), want, name);
+  }
+});
+
 test('setAccountPrivacy refuses a value outside the model, before any query', async () => {
   expect();
   assert.equal((await pi.setAccountPrivacy(
@@ -271,15 +322,45 @@ test('neither flag crosses a PUBLIC response — the /u/<handle> read stays a wh
 
 // ---- 5. the settings copy states the grant ---------------------------------
 
-test('the discoverable toggle names EXACTLY what it grants — the D3 sliver, name-only when hidden', () => {
+// How each granted FIELD has to read to a person. Keyed by the module's export,
+// so this map is the place a sixth key must be described before it can ship —
+// and the "every key is described" assertion below is what makes that binding.
+const GRANT_WORDS = {
+  handle: /your name/,
+  display_name: /your name/,
+  avatar_url: /your picture/,
+  disciplines: /your disciplines/,
+  active_recently: /active in the last 30 days/,
+};
+
+test('the discoverable toggle names EXACTLY what it grants — checked against SLIVER_KEYS itself', () => {
   const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
   const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
-  assert.match(js, /your name, your disciplines, and whether you have been active in the last 30 days/,
-    'the sliver is name + disciplines + a coarse activity signal — spelled out, not implied');
+  // Privacy spec D3 makes this a MUST: "The discoverable toggle's settings copy
+  // must state exactly this grant." It was checked against three transcribed
+  // phrases, and the transcription had gone stale in the direction that matters:
+  // the copy said the hidden sliver was "your name and nothing else" while
+  // SLIVER_KEYS_HIDDEN also ships avatar_url, and the shown branch never named
+  // the picture at all. A user was being told something false about their own
+  // privacy. It is now checked against the shipped key lists.
+  const shown = /: 'They will see ([^']+)'/.exec(js);
+  const hidden = /\? 'Because your cross-project record is hidden, ([^']+)'/.exec(js);
+  assert.ok(shown && hidden, 'both branches of the grant string must still be findable');
+
+  for (const key of SLIVER_KEYS) {
+    assert.ok(GRANT_WORDS[key], `SLIVER_KEYS grew "${key}" and nothing here says how to describe it — spec D3 says the copy must state the grant, so a new granted field cannot ship undescribed`);
+    assert.match(shown[1], GRANT_WORDS[key], `the toggle must name "${key}" — it is in the sliver a recruiter receives`);
+  }
+  for (const key of SLIVER_KEYS_HIDDEN) {
+    assert.match(hidden[1], GRANT_WORDS[key], `hidden, the sliver still ships "${key}", so the name-only copy must still name it`);
+  }
+  for (const key of SLIVER_KEYS.filter((k) => !SLIVER_KEYS_HIDDEN.includes(k))) {
+    assert.doesNotMatch(hidden[1], GRANT_WORDS[key], `"${key}" drops under hide_stats, so the copy must not keep promising it`);
+  }
   assert.match(js, /never your credits, works shipped, karma, or the projects you build on/,
     'and the copy says what it does NOT grant');
-  assert.match(js, /cross-project record is hidden, they will see your name and nothing else/,
-    'hide_stats shrinks the grant to name-only, because the rest is rollup-derived');
+  assert.match(js, /the one thing a recruiter can see while your profile page is private/,
+    'a private account is told the sliver is the exception to "not found to every visitor" — the surprising half of D2/D3');
   assert.match(html, /<section[^>]*id="privacy-scroll"[^>]*hidden>/,
     'the section ships hidden — it reveals only where the hub module answers');
 });
@@ -304,13 +385,38 @@ test('each toggle claims exactly what is enforced — and BOTH are now in force'
     'recruiting reach is enforced now (task 1002290), so the row promises it in the present tense');
   assert.doesNotMatch(js, /will be able to find you/,
     'the future tense outlived its truth the moment listScoutingRollup joined the reach predicate');
-  assert.match(js, /takes you out of the People directory straight away/,
-    'and the row names the ONE surface that reads the flag today — a promise you can go and check');
+  // WIDENED BY TASK 1002968, on the same rule that narrowed it. 1002290 cut this
+  // to "the People directory" because the D3 sliver was unbuilt and no guard here
+  // could hold a wider claim. The sliver is now built and gated, so BOTH
+  // recruiting reads join the reach axis and the row may name both — and the
+  // wider claim is held by the guard below rather than by this sentence.
+  assert.match(js, /removes you from both recruiting surfaces/,
+    'the row names both surfaces that read the flag today — a promise you can go and check');
   assert.doesNotMatch(js, /every recruiting view/,
-    'never a promise over surfaces that do not exist yet: the D3 recruiter sliver is unbuilt, so no '
-    + 'guard here could hold that claim, and the copy rule is that a toggle promises exactly what is enforced');
+    'still never an OPEN-ENDED promise: "both" is a claim a guard can hold, "every" is not — a third '
+    + 'recruiting read would make it false with nothing to notice');
   assert.match(html, /profile page setting applies now[\s\S]*Recruiter discoverability applies now too/,
     'the section note now says both are live, rather than splitting them');
   assert.doesNotMatch(html, /starts applying as the recruiting surfaces land/,
     'the "recorded and waiting" note must not outlive the surface that started reading it');
 });
+
+test('the recruiting surface really is exactly two reads, and each one joins REACH', () => {
+  // This is what makes the widened copy above checkable rather than a slogan.
+  // Both halves are enumerated from source: a third route on the recruiting
+  // surface, or either reader dropping the reach axis, reds here — which is the
+  // signal that the toggle's promise has stopped being true.
+  const route = readFileSync(join(ROOT, 'modules/platform-identity/routes/scouting.js'), 'utf8');
+  const mounted = route.match(/router\.get\(\s*\n?\s*'([^']+)'/g) || [];
+  assert.equal(mounted.length, 2,
+    `the recruiting surface mounts ${mounted.length} route(s), not 2 — the Settings copy promises "both recruiting surfaces" and can no longer name them`);
+  assert.match(route, /'\/scouting'/, 'the directory');
+  assert.match(route, /'\/scouting\/:handle'/, 'and the pre-accept sliver');
+
+  const av = readFileSync(join(ROOT, 'modules/platform-identity/account-visibility.js'), 'utf8');
+  for (const composed of ['scoutingListableSql', 'recruiterSliverVisibleSql']) {
+    const body = av.slice(av.indexOf(`function ${composed}(`));
+    assert.match(body.slice(0, body.indexOf('\n}')), /recruiterReachSql\(alias\)/,
+      `${composed} stopped composing the reach axis — opting out would no longer empty that surface`);
+  }
+});

package/tests/application_echo.mjs

@@ -111,9 +111,18 @@ function seed() {
     { github_id: ME, client_id: 'proj-joined', applied_at: now - 5 * DAY },
     { github_id: ME, client_id: 'proj-stale', applied_at: now - 40 * DAY },
     { github_id: 9999, client_id: 'proj-someone-elses', applied_at: now - DAY },
+    // Applied to a project that has since INVITED them — a pending membership,
+    // which is not building on it. The echo must survive.
+    { github_id: ME, client_id: 'proj-invited', applied_at: now - 3 * DAY },
   ];
   memberships = [
     { client_id: 'proj-joined', membership_kind: 'builder', joined_at: now - 4 * DAY, last_active: now, project_name: 'Joined', project_origin: 'https://joined.example', owner_github_id: null },
+    // The row `listMembershipsForAccount`'s `membership_kind <> 'pending'` exists
+    // to exclude. Without it a pending INVITE would read as membership, and the
+    // card would flip to "you build here" for a project the person never joined
+    // — so this fixture is what makes that term observable rather than merely
+    // modelled (task 1003354).
+    { client_id: 'proj-invited', membership_kind: 'pending', joined_at: now - DAY, last_active: null, project_name: 'Invited', project_origin: 'https://invited.example', owner_github_id: null },
   ];
   echoFails = false;
   statements = [];
@@ -140,6 +149,11 @@ function predicateFor(rawWhere, params) {
   if ((m = /\bclient_id = \$(\d+)/.exec(where))) {
     const v = p(m[1]); tests.push((r) => r.client_id === v); eat();
   }
+  // listMembershipsForAccount's pending exclusion. Modelled rather than stripped
+  // before interpreting, so deleting it from the real query changes this answer.
+  if ((m = /\bm\.membership_kind <> 'pending'/.exec(where))) {
+    tests.push((r) => r.membership_kind !== 'pending'); eat();
+  }
 
   for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(ph[1])) {
@@ -155,12 +169,16 @@ function predicateFor(rawWhere, params) {
   // had already hidden one real filter, so the residual is swept too: this is
   // what makes "refuses a predicate it cannot read" true of ALL predicates
   // rather than only parameterised ones.
-  const residual = where
-    .replace(/\bTRUE\b/gi, ' ')
-    .replace(/\b(?:AND|OR)\b/gi, ' ')
-    .replace(/[()\s]/g, '');
-  if (residual) {
-    throw new Error(`fake pool: unmodelled predicate "${residual}" in "${rawWhere}" — a filter the interpreter cannot read must be a loud error, not a silent no-op`);
+  //
+  // AND THE JOINER IS PART OF THE PREDICATE (task 1003354, idea 1000877). This
+  // sweep used to erase `OR` alongside `AND`, so an `AND` rewritten to `OR` left
+  // the fake still ANDing its collected terms and every test green — while the
+  // real query would return a row matching ANY one of its terms, i.e. every
+  // other account's applications. What survives must therefore be a PURE
+  // CONJUNCTION: whitespace, parentheses and `AND`, nothing else.
+  const residual = where.replace(/\bTRUE\b/gi, ' ');
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residual)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residual.trim()}" in "${rawWhere}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, not a silent no-op`);
   }
   return (r) => tests.every((fn) => fn(r));
 }
@@ -182,7 +200,11 @@ const pool = {
 
     if (/FROM platform_identity_project_memberships m/.test(sql)) {
       m = /WHERE (.+?) ORDER BY/.exec(sql);
-      return { rows: memberships.filter(predicateFor(m[1].replace(/ AND m\.membership_kind <> 'pending'/, ''), params)) };
+      // The pending exclusion is MODELLED, not stripped. It used to be deleted
+      // from the clause before interpreting, which meant dropping it from the
+      // real query would have been invisible here — the `.replace` would simply
+      // no-op and the residual sweep would never see the term (task 1003354).
+      return { rows: memberships.filter(predicateFor(m[1], params)) };
     }
 
     if (/^DELETE FROM platform_identity_project_memberships WHERE client_id = \$1 AND github_id = \$2$/.test(sql)) {
@@ -296,8 +318,11 @@ const join = (note) => call('POST', '/api/gds/my-projects/join', { origin: 'http
 
 test('the interpreter refuses a predicate it cannot read — parameterised or not', () => {
   assert.throws(() => predicateFor('github_id = $1::bigint AND something = $2', [1, 2]), /unread predicate on \$2/);
-  assert.throws(() => predicateFor("github_id = $1::bigint AND client_id <> 'x'", [1]), /unmodelled predicate/,
+  assert.throws(() => predicateFor("github_id = $1::bigint AND status <> 'x'", [1]), /unmodelled boolean structure/,
     'a literal-only filter binds nothing, so the placeholder sweep alone would miss it');
+  assert.throws(() => predicateFor('github_id = $1::bigint OR client_id = $2', [1, 'p']), /unmodelled boolean structure/,
+    'and an AND rewritten to OR: the real query would then return every OTHER account\'s rows, '
+    + 'while an interpreter that re-imposed the AND would stay green (idea 1000877, task 1003354)');
 });
 
 // ── the echo is written only for an application the project actually took ────
@@ -369,7 +394,8 @@ test('GET /my-projects reports what was applied to and when — and no status',
   const r = await call('GET', '/api/gds/my-projects');
   assert.equal(r.status, 200);
   const applied = r.json.applied;
-  assert.deepEqual(applied.map((a) => a.client_id), ['proj-open']);
+  assert.deepEqual(applied.map((a) => a.client_id), ['proj-open', 'proj-invited'],
+    'newest first, and proj-invited is here because a PENDING membership is an invitation, not a join');
   assert.equal(applied[0].name, 'Target', 'a client_id alone is not renderable');
   assert.equal(applied[0].origin, 'https://target.example');
   assert.ok(applied[0].applied_at);
@@ -383,6 +409,14 @@ test('a project the applicant now BUILDS on drops out of applied — membership
   assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined']);
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-joined'),
     'an approval becomes visible by the card flipping to member, never by the echo claiming it');
+  // The other side of that same term: a PENDING row is an invitation, not a
+  // membership, so the project stays in `applied` and out of `building`. Delete
+  // `membership_kind <> 'pending'` from listMembershipsForAccount and both
+  // halves flip — which is what makes the read's own exclusion provable here.
+  assert.ok(!r.json.building.some((b) => b.client_id === 'proj-invited'),
+    'a pending invite is not building on the project');
+  assert.ok(r.json.applied.some((a) => a.client_id === 'proj-invited'),
+    'and their application is still on file — nothing has approved it');
 });
 
 test('an echo older than the window is invisible, not deleted', async () => {

package/tests/application_lifecycle.mjs

@@ -126,12 +126,17 @@ function predicateFor(rawWhere, params) {
   // had already hidden one real filter, so the residual is swept too: this is
   // what makes "refuses a predicate it cannot read" true of ALL predicates
   // rather than only parameterised ones.
-  const residual = where
-    .replace(/\bTRUE\b/gi, ' ')
-    .replace(/\b(?:AND|OR)\b/gi, ' ')
-    .replace(/[()\s]/g, '');
-  if (residual) {
-    throw new Error(`fake pool: unmodelled predicate "${residual}" in "${rawWhere}" — a filter the interpreter cannot read must be a loud error, not a silent no-op`);
+  //
+  // AND THE JOINER IS PART OF THE PREDICATE (task 1003354, idea 1000877). This
+  // sweep used to erase `OR` alongside `AND`, so an `AND` rewritten to `OR` left
+  // the fake still ANDing its collected terms and every test green — while the
+  // real UPDATE would resolve a row matching ANY one of its terms. What survives
+  // must therefore be a PURE CONJUNCTION: whitespace, parentheses and `AND`. The
+  // transition guard's legitimate `OR` is consumed as a whole unit above, which
+  // is what lets it survive this tightening.
+  const residual = where.replace(/\bTRUE\b/gi, ' ');
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residual)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residual.trim()}" in "${rawWhere}" — every recognised term is ANDed here, so a predicate the interpreter cannot read as a pure conjunction must be a loud error, not a silent no-op`);
   }
   return (r) => tests.every((fn) => fn(r));
 }
@@ -312,9 +317,15 @@ test('the interpreter refuses a predicate it cannot read, rather than ignoring i
 test('the interpreter refuses a LITERAL-ONLY predicate too — the hole review found', () => {
   assert.throws(
     () => predicateFor("id = $1 AND resolved_at IS NULL", [1]),
-    /unmodelled predicate/,
+    /unmodelled boolean structure/,
     'a filter that binds nothing is invisible to the placeholder sweep, so the residual is swept as well'
   );
+  assert.throws(
+    () => predicateFor("id = $1 OR status = 'pending'", [1]),
+    /unmodelled boolean structure/,
+    'and an AND rewritten to OR: the resolve UPDATE would then act on a row matching ANY one of its '
+    + 'terms, while an interpreter that re-imposed the AND stays green (idea 1000877, task 1003354)'
+  );
   // and the modelled shapes still parse clean
   assert.doesNotThrow(() => predicateFor("lower(github_login) = lower($1) AND status = 'invited'", ['ada']));
 });