@bongos/core 1.19.430 → 1.19.432

package/tests/recruiter_sliver_boundary.mjs

@@ -0,0 +1,841 @@
+// tests/recruiter_sliver_boundary.mjs — THE PRE-ACCEPT BOUNDARY PROOF
+// (task 1002968, goal 1000045; privacy spec D3, ADR 0215, ADR 0171 D2/D4/D5,
+// ADR 0016).
+//
+// The sliver is a CONSENT BOUNDARY, so the thing worth proving is not that it
+// works — it is that it stops. Four claims, in the order that would hurt most:
+//
+//   1. IT CARRIES EXACTLY FIVE KEYS, AND NOTHING ELSE. Asserted as a WHITELIST:
+//      the response's own key set is compared to the module's exported
+//      SLIVER_KEYS, so a sixth key fails whether or not this file was told about
+//      it. A blacklist ("no credits key") passes forever against the field
+//      nobody thought to name.
+//
+//   2. NOTHING RIDES ALONG IN THE TEXT. Every value the sliver must not carry is
+//      an IMPROBABLE PLANTED SENTINEL, and the assertion is that none appears
+//      ANYWHERE in the raw response body — the task 1002806 technique. A regex
+//      like /"credits":null/ is satisfied by a stray sibling key and proves
+//      nothing; absence from the whole body is the claim.
+//
+//      THE SENTINELS SIT ON THE ROWS THE SLIVER'S OWN QUERIES RETURN, and that
+//      is load-bearing rather than incidental. In the first draft the numbers
+//      lived on rows those queries never touched, so "credits never leak" — the
+//      first thing spec D3 forbids — could not have failed under any projection
+//      change. The fake now returns MORE columns than each statement selects,
+//      exactly as a real row would if a query grew, so a row spread anywhere in
+//      the projection leaks a number and reds this file.
+//
+//      CONTROLS, so absence cannot pass vacuously: the same values DO reach a
+//      recruiter through the directory for a builder who consented to it, and
+//      the SAME hidden account, with hide_stats flipped, DOES get its
+//      disciplines from the real port. (The control that used to stand here ran
+//      SQL this file wrote against this file's own fake and compared a fixture
+//      to itself — it proved that an object equals itself.)
+//
+//      ONE HONEST EXCEPTION, asserted rather than glossed: `github_id` is NOT
+//      absent from the body. The avatar spec D3 grants is GitHub's own URL and
+//      embeds the id verbatim, so the proof pins where it may appear — inside
+//      that URL and nowhere else — instead of claiming a property the code does
+//      not have.
+//
+//   3. THE BOUNDARY IS A CEILING, NOT A STEP. A recruiter who holds a private
+//      builder's sliver holds their HANDLE — and the handle does not open the
+//      profile page: GET /profiles/:handle joins accountVisibleSql and answers
+//      404 for exactly that account, while answering 200 for a public one. That
+//      is what "pre-accept" means operationally, and it is the assertion that
+//      would catch someone "helpfully" relaxing resolveHandle later.
+//
+//   4. IT GRANTS NOTHING (ADR 0016). Structurally: the sliver module is required
+//      by exactly one first-party server file, the route that serializes it —
+//      nothing consults it to decide anything. And the response carries no rank,
+//      role, permission or membership under any name.
+//
+// PLUS the gate, because a bounded projection behind an open door is not
+// bounded. The sliver is ARCHON-gated and the DIRECTORY's audience is not the
+// sliver's (ADR 0215 D4): spec D3 pins this read to an archon-floor atom that has
+// not been minted, and the directory's door — `project.curate` at metic OR any
+// project owner — is wider on both halves. A metic operator and a project owner
+// both read the directory and are both refused here, which is asserted in both
+// directions so a later "tidy-up" onto one shared gate cannot pass quietly.
+//
+// MECHANISM (tests/profile_privacy_owner_view.mjs + tests/connections_ownership.mjs):
+// in-memory tables whose row filter is built FROM EACH STATEMENT'S OWN WHERE
+// CLAUSE, refusing any statement whose placeholders or literal comparisons it did
+// not consume — so a predicate this interpreter cannot read is a loud error and
+// never a silently absent filter. Above the pool everything is real: the real
+// router, the real module, real HTTP.
+//
+// AND IT READS BOOLEAN STRUCTURE, NOT ONLY TERMS. The house version of this
+// interpreter collects the terms it recognises and ANDs them, which re-imposes a
+// conjunction the SQL may no longer contain: rewriting the sliver predicate's
+// `AND` to `OR` would serve every active account on the platform, and the first
+// draft of this file stayed green through exactly that. Each term is now CONSUMED
+// from the WHERE text as it is matched and the residue must be pure conjunction.
+// (The same hole is still open in five sibling proofs — idea 1000877.)
+//
+// DB-free by construction. The last test proves this file runs in the lane that
+// actually executes (learning 1000218: three files declared INTEGRATION in their
+// headers, sat in NEITHER lane, and asserted nothing for months).
+//
+// Run:  node tests/recruiter_sliver_boundary.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// ESM so knip credits the module's test-only exports (a createRequire import
+// reads as unused — the CJS blind spot).
+import {
+  recruiterSliverVisibleSql,
+  isRecruiterSliverVisible,
+  accountActiveSql,
+  recruiterReachSql,
+  accountVisibleSql,
+} from '../modules/platform-identity/account-visibility.js';
+
+// The sliver module's own exports, imported as ESM for the same reason — and
+// SLIVER_KEYS is why: the whitelist assertions compare a response's key set to
+// the module's list, never to a copy of it kept here. A copy is the failure mode
+// a whitelist exists to remove (add a key to both and the proof still passes).
+// Loading it here also loads the real doorway; that is harmless because every
+// call below passes its pool explicitly, and the require.cache stub installed
+// further down still reaches the ROUTE files, which are required after it.
+import {
+  SLIVER_KEYS,
+  SLIVER_KEYS_HIDDEN,
+  ACTIVE_WINDOW_DAYS,
+  getRecruiterSliver,
+  getRecruiterSliverByHandle,
+} from '../modules/platform-identity/recruiter-sliver.js';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// ===========================================================================
+// The fixture — one account per row of the privacy-spec D2 matrix
+// ===========================================================================
+//
+// Sentinels are per-account improbable literals, so "absent from the body" means
+// absent rather than "did not collide with a 0". `github_login` is deliberately
+// NOT the handle: D3 names the handle and not the login, so the login is itself
+// a sentinel that must never cross.
+
+const DIR = '3110001';      // active · public  · shown   — the CONTROL: the directory carries them
+const PRIV = '3110002';     // active · PRIVATE · reach=true — THE D3 SUBJECT
+const OPTOUT = '3110003';   // active · public  · reach=FALSE — opted out of recruiting
+const SHY = '3110004';      // active · public  · HIDDEN  — the name-only sliver
+const PROV = '3110005';     // PROVISIONAL · reach=true    — never recruiter-visible
+const PRIVDEF = '3110006';  // active · PRIVATE · reach=null — private, never opted in
+
+// Every account column the tables hold. The queries select a SUBSET; the extra
+// columns are here on purpose, so a row spread leaks something loud.
+const ACCOUNTS = [
+  { github_id: DIR, handle: 'dir-handle', github_login: 'dir-login-990101', display_name: 'Dir Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${DIR}?v=4`, previous_handle: null, bio: 'dir-bio-990103',
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'public',
+    hide_stats: false, recruiter_discoverable: null, terms_accepted_at: 'T1' },
+  { github_id: PRIV, handle: 'priv-handle', github_login: 'priv-login-990201', display_name: 'Priv Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PRIV}?v=4`, previous_handle: 'priv-oldname-990204', bio: 'priv-bio-990203',
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'private',
+    hide_stats: false, recruiter_discoverable: true, terms_accepted_at: 'T1' },
+  { github_id: OPTOUT, handle: 'optout-handle', github_login: 'optout-login-990301', display_name: 'Optout Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${OPTOUT}?v=4`, previous_handle: null, bio: null,
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'public',
+    hide_stats: false, recruiter_discoverable: false, terms_accepted_at: 'T1' },
+  { github_id: SHY, handle: 'shy-handle', github_login: 'shy-login-990401', display_name: 'Shy Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${SHY}?v=4`, previous_handle: null, bio: null,
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'public',
+    hide_stats: true, recruiter_discoverable: null, terms_accepted_at: 'T1' },
+  { github_id: PROV, handle: 'prov-handle', github_login: 'prov-login-990501', display_name: 'Prov Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PROV}?v=4`, previous_handle: null, bio: null,
+    links: null, created_at: 'T0', profile_state: 'provisional', account_visibility: 'public',
+    hide_stats: false, recruiter_discoverable: true, terms_accepted_at: 'T1' },
+  { github_id: PRIVDEF, handle: 'privdef-handle', github_login: 'privdef-login-990601', display_name: 'Privdef Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PRIVDEF}?v=4`, previous_handle: null, bio: null,
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'private',
+    hide_stats: false, recruiter_discoverable: null, terms_accepted_at: 'T1' },
+];
+
+// The cross-project record behind each account. `disciplines` is the ONE
+// rollup-derived value the sliver may carry, so it is not a sentinel for a shown
+// account — but it IS one for the hidden account, whose sliver must be name-only.
+const ROLLUP = {
+  [DIR]: { credits: 880001, works_shipped: 880002, karma: 880003, project_count: 880004,
+    last_active: 'dir-lastactive-880005', disciplines: ['dir-craft'],
+    projects: [{ name: 'Dir-Project-880006', origin: 'https://dir.example', rank_held: 'metic', recent_ships: ['Dir-Ship-880007'], is_public: true }] },
+  [PRIV]: { credits: 881001, works_shipped: 881002, karma: 881003, project_count: 881004,
+    last_active: 'priv-lastactive-881005', disciplines: ['priv-craft'],
+    projects: [{ name: 'Priv-Project-881006', origin: 'https://priv.example', rank_held: 'archon', recent_ships: ['Priv-Ship-881007'], is_public: true }] },
+  [OPTOUT]: { credits: 882001, works_shipped: 882002, karma: 882003, project_count: 882004,
+    last_active: 'optout-lastactive-882005', disciplines: ['optout-craft'],
+    projects: [{ name: 'Optout-Project-882006', origin: 'https://optout.example', rank_held: 'metic', recent_ships: ['Optout-Ship-882007'], is_public: true }] },
+  [SHY]: { credits: 883001, works_shipped: 883002, karma: 883003, project_count: 883004,
+    last_active: 'shy-lastactive-883005', disciplines: ['shy-craft-883008'],
+    projects: [{ name: 'Shy-Project-883006', origin: 'https://shy.example', rank_held: 'metic', recent_ships: ['Shy-Ship-883007'], is_public: true }] },
+  [PROV]: { credits: 884001, works_shipped: 884002, karma: 884003, project_count: 884004,
+    last_active: 'prov-lastactive-884005', disciplines: ['prov-craft'],
+    projects: [] },
+  [PRIVDEF]: { credits: 885001, works_shipped: 885002, karma: 885003, project_count: 885004,
+    last_active: 'privdef-lastactive-885005', disciplines: ['privdef-craft'],
+    projects: [] },
+};
+
+// Whether each fixture is "active in the last 30 days" — the coarse boolean the
+// SQL derives. Modelled here because the comparison happens in the database.
+const ACTIVE_RECENTLY = { [DIR]: true, [PRIV]: true, [OPTOUT]: true, [SHY]: true, [PROV]: false, [PRIVDEF]: false };
+
+/**
+ * Everything about one account that the SLIVER must never disclose, as strings.
+ * The account's own `disciplines` are excluded for a shown account (they are
+ * granted) and added back by the caller for the hidden one.
+ */
+function forbiddenOf(githubId) {
+  const a = ACCOUNTS.find((x) => x.github_id === githubId);
+  const r = ROLLUP[githubId];
+  return [
+    // NOT githubId: the avatar D3 grants is GitHub's own URL and embeds the
+    // account id verbatim, so the id is DISCLOSED by an authorized field. That is
+    // asserted precisely below instead of pretended away here (ADR 0215).
+    a.github_login,                 // D3 names the handle, not the login
+    a.bio,                          // on the account row the sliver reads, and never granted
+    String(r.credits), String(r.works_shipped), String(r.karma), String(r.project_count),
+    r.last_active,                  // a timestamp is a trace; only the boolean crosses
+    ...(a.previous_handle ? [a.previous_handle] : []),  // a rename is itself a disclosure
+    ...r.projects.flatMap((p) => [p.name, p.origin, p.rank_held, ...p.recent_ships]),
+  ];
+}
+
+// ===========================================================================
+// The in-memory tables + their statement interpreter
+// ===========================================================================
+
+const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle', 'recruiter_discoverable']);
+
+/**
+ * Build a row test from a statement's own WHERE text. Literal comparisons carry
+ * as much weight as placeholders: the visibility predicates are made ENTIRELY of
+ * literal comparisons, so a fake modelling only $N filters would score every
+ * privacy term as absent and pass however the code changed.
+ *
+ * IT READS STRUCTURE, NOT JUST TERMS — and that is the whole reason this
+ * function is written as a consuming parse rather than a list of `.test()`
+ * calls. An interpreter that merely COLLECTS the terms it recognises and ANDs
+ * them re-imposes an `AND` the SQL may no longer contain: rewrite
+ * recruiterSliverVisibleSql's `AND` to `OR` and Postgres would serve the sliver
+ * for every active account on the platform, while a term-collecting fake keeps
+ * answering exactly as before and every assertion in this file stays green. So
+ * each recognised term is REMOVED from the text as it is matched, and whatever
+ * survives must be nothing but whitespace, parentheses and `AND`. An `OR`, a
+ * `NOT`, a `CASE` — anything this interpreter cannot faithfully model — is a
+ * loud error, on the same principle as the unread-placeholder guard below.
+ * (Found by adversarial review; the mutation is pinned in the calibration
+ * tests, and again on the real predicate.)
+ */
+function accountFilter(where, params) {
+  const tests = [];
+  const consumed = new Set();
+  let residue = where;
+
+  // Match a term, model it, and CONSUME its text so the leftovers can be judged.
+  const take = (re, make) => {
+    const m = re.exec(residue);
+    if (!m) return null;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    tests.push(make(m));
+    return m;
+  };
+
+  // The reach axis FIRST, because the COALESCE spells `account_visibility =
+  // 'public'` inside itself as its own fallback — consuming it first is what
+  // stops that fallback being scored as an existence check, which would filter
+  // out the private account the sliver exists to serve. The tri-state (null
+  // follows visibility, an explicit boolean overrides) is modelled exactly as
+  // recruiterReachSql spells it.
+  take(
+    /\bCOALESCE\(\s*(?:[a-z_]+\.)?recruiter_discoverable\s*,\s*(?:[a-z_]+\.)?account_visibility = 'public'\s*\)/,
+    () => (r) => (typeof r.recruiter_discoverable === 'boolean'
+      ? r.recruiter_discoverable
+      : r.account_visibility === 'public'),
+  );
+  take(/\b(?:[a-z_]+\.)?profile_state = 'active'/, () => (r) => r.profile_state === 'active');
+  // The T&C half of the CONSENT floor (task 1002913, ADR 0213). accountActiveSql
+  // grew it while this branch was in flight and the sliver predicate composes
+  // that helper, so the sliver inherited the tightening without a line changing
+  // here — and this interpreter refused the statement outright until it could
+  // model the new term, which is the structure guard doing its job.
+  take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
+  take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
+  take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+
+  take(/\b(?:[a-z_]+\.)?github_id = \$(\d+)/, (m) => {
+    consumed.add(m[1]);
+    const v = params[Number(m[1]) - 1];
+    return (r) => String(r.github_id) === String(v);
+  });
+
+  // The handle disjunction is the ONE legitimate OR in this repo's account
+  // reads (resolveHandle's rename window), so it is consumed as a single unit
+  // — leaving a bare `OR` behind would trip the structure check below.
+  const bothHandles = take(
+    /lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/,
+    (m) => {
+      consumed.add(m[1]); consumed.add(m[2]);
+      const v = String(params[Number(m[1]) - 1]);
+      return (r) => String(r.handle || '').toLowerCase() === v
+        || String(r.previous_handle || '').toLowerCase() === v;
+    },
+  );
+  if (!bothHandles) {
+    take(/lower\(handle\) = \$(\d+)/, (m) => {
+      consumed.add(m[1]);
+      const v = String(params[Number(m[1]) - 1]);
+      return (r) => String(r.handle || '').toLowerCase() === v;
+    });
+  }
+
+  // The two TERM guards run before the STRUCTURE guard, so an unreadable term
+  // is reported as the unreadable term it is rather than as leftover text.
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unread predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
+    }
+  }
+  for (const m of where.matchAll(/\b([a-z_]+)\s*(?:=|<>|!=)\s*'/g)) {
+    if (!KNOWN_COLUMNS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
+    }
+  }
+  // What is left must be a pure conjunction. Anything else and this interpreter
+  // would be inventing a predicate the database was never given.
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${where}" — every recognised term is ANDed here, so a predicate that is not a pure conjunction must be a loud error, never a silently different filter`);
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+/** The github_id an activity statement is scoped to, read from its own WHERE. */
+function activityScope(sql, params) {
+  const m = /\ba\.github_id = \$(\d+)/.exec(sql);
+  if (!m) throw new Error(`fake pool: an activity read with no github_id scope — ${sql.slice(0, 120)}`);
+  return String(params[Number(m[1]) - 1]);
+}
+
+let calls = [];
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    calls.push({ sql, params });
+
+    // The recruiting DIRECTORY: consent lives in an EXISTS subquery correlated to
+    // the activity table, so its predicate is lifted out and judged on its own.
+    if (/WITH agg AS/.test(sql) && /platform_identity_accounts pa/.test(sql)) {
+      const m = /pa\.github_id = a\.github_id AND ([\s\S]*?)\)\s*GROUP BY/.exec(sql);
+      if (!m) throw new Error(`fake pool: could not read the directory's consent predicate — ${sql.slice(0, 200)}`);
+      const rows = ACCOUNTS.filter(accountFilter(m[1], [])).map((a) => {
+        const r = ROLLUP[a.github_id];
+        return {
+          github_id: a.github_id, github_login: a.github_login, display_name: a.display_name,
+          avatar_url: a.avatar_url, project_count: r.project_count, total_credits: r.credits,
+          total_tasks_shipped: r.works_shipped, total_karma: r.karma, last_active: r.last_active,
+          disciplines: r.disciplines,
+        };
+      });
+      return { rows, rowCount: rows.length };
+    }
+
+    // The SLIVER's activity half: a boolean and a disciplines union, never a date.
+    if (/WITH act AS/.test(sql)) {
+      const r = ROLLUP[activityScope(sql, params)];
+      return {
+        rows: [{
+          active_recently: r ? ACTIVE_RECENTLY[activityScope(sql, params)] : null,
+          disciplines: r ? r.disciplines : null,
+          // NOT selected by the statement. Present because a real row grows
+          // columns, and a projection that spreads rather than whitelists would
+          // carry these straight into the response. Without them the sentinels
+          // for credits/karma/ships — the very fields D3 forbids — sit on rows
+          // the sliver's queries never touch, and "absent from the body" is
+          // unfalsifiable for exactly the values that matter most.
+          last_active: r ? r.last_active : null,
+          credits: r ? r.credits : null,
+          works_shipped: r ? r.works_shipped : null,
+          karma: r ? r.karma : null,
+          project_count: r ? r.project_count : null,
+          project_name: r ? (r.projects[0] || {}).name ?? null : null,
+        }],
+        rowCount: 1,
+      };
+    }
+
+    // The ownership door (scouting-authz): the REAL query, answered from the
+    // viewer's cast. Doubling the exported function instead would prove nothing —
+    // requireScoutingReader calls its module-local binding, so the export could be
+    // replaced with anything and the gate would never notice.
+    if (/platform_identity_project_memberships/.test(sql)) {
+      const [askedFor, kind, clientStatus] = params;
+      assert.equal(kind, 'owner', 'the ownership door asks only about owner memberships');
+      assert.equal(clientStatus, 'active', 'and only about projects still live on the platform (ADR 0210 D6)');
+      const owns = !!(viewer && viewer.owns && String(viewer.github_id) === String(askedFor));
+      return { rows: owns ? [{ membership_kind: 'owner', signin_verified_at: 'T0' }] : [], rowCount: owns ? 1 : 0 };
+    }
+
+    if (/FROM platform_identity_accounts/.test(sql)) {
+      const where = sql.includes(' WHERE ')
+        ? sql.slice(sql.indexOf(' WHERE ') + 7).replace(/ ORDER BY .*| LIMIT .*/g, '')
+        : '';
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      // The rollup scalars ride the account row as well — the hidden account
+      // never reaches the activity query, so this is the only branch whose
+      // widening could leak a number for a name-only sliver.
+      let rows = ACCOUNTS.filter(accountFilter(where, params)).map((a) => ({ ...a, ...ROLLUP[a.github_id] }));
+      if (/is_current/.test(cols)) {
+        const asked = String(params[0]).toLowerCase();
+        rows = rows
+          .map((r) => ({ ...r, is_current: String(r.handle || '').toLowerCase() === asked }))
+          .sort((a, b) => Number(b.is_current) - Number(a.is_current))
+          .slice(0, 1);
+      }
+      return { rows: rows.map((r) => ({ ...r })), rowCount: rows.length };
+    }
+
+    // The per-builder rollup aggregate behind GET /profiles/:handle.
+    if (/WITH agg AS/.test(sql) && /platform_identity_builder_project_activity/.test(sql)) {
+      const r = ROLLUP[activityScope(sql, params)] || { credits: 0, works_shipped: 0, karma: 0, project_count: 0, last_active: null, disciplines: null };
+      return { rows: [{ projects: r.project_count, credits: r.credits, works_shipped: r.works_shipped, karma: r.karma, last_active: r.last_active, disciplines: r.disciplines }], rowCount: 1 };
+    }
+
+    if (/platform_identity_builder_project_activity/.test(sql)) {
+      const r = ROLLUP[activityScope(sql, params)];
+      const rows = r ? r.projects.map((p) => ({ ...p })) : [];
+      return { rows, rowCount: rows.length };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql.slice(0, 140)}`);
+  },
+};
+
+// ===========================================================================
+// The real router over those tables
+// ===========================================================================
+
+// The viewer the stubbed session middleware presents, and what the two doors of
+// the recruiting gate answer for them. `curate` is the permission atom; `owns` is
+// the instance-asserted project ownership scouting-authz reads.
+let viewer = null;
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+const DENIED_BODY = { ok: false, error: 'forbidden', required: ['project.curate'] };
+
+require.cache[moduleApiPath] = {
+  id: moduleApiPath,
+  filename: moduleApiPath,
+  loaded: true,
+  exports: {
+    pool,
+    parsePagination: helpers.parsePagination,
+    corsPublicGet: () => (_req, _res, next) => next(),
+    logger: () => ({ error: () => {} }),
+    requireBuilder: (req, res, next) => {
+      if (!viewer) return res.fail('unauthenticated', 401);
+      req.builder = { github_id: viewer.github_id };
+      next();
+    },
+    // The REAL gates are core auth over a real session; standing them up here
+    // would drag the whole auth graph in. What must be proved is their OUTPUT —
+    // WHO each of the two recruiting reads admits — so each is doubled by a gate
+    // answering the shape core sends. The two are DIFFERENT on purpose: the
+    // directory's permission door, and the sliver's archon floor.
+    requirePermission: () => (req, res, next) => {
+      if (viewer && viewer.curate) return next();
+      return res.status(403).json(DENIED_BODY);
+    },
+    requireRank: (...allowed) => (req, res, next) => {
+      if (viewer && allowed.includes(viewer.rank)) return next();
+      return res.fail('rank_forbidden', 403, { required: [...allowed], actual: (viewer && viewer.rank) || null });
+    },
+  },
+};
+
+const buildScoutingRoutes = require('../modules/platform-identity/routes/scouting.js');
+const buildPublicProfileRoutes = require('../modules/platform-identity/routes/public-profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildScoutingRoutes());
+app.use('/api/bongos', buildPublicProfileRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function get(path_) {
+  calls = [];
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: path_ }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        resolve({ status: res.statusCode, text, json });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// `rank` is the caller's rank ON THE HUB; `curate`/`owns` are the directory's two
+// doors. The split is the point: a project owner is typically a bare xenos here
+// and a metic operator holds `project.curate` without being an archon — so
+// neither reaches the sliver, which is the whole of ADR 0215 D4.
+const ARCHON = { github_id: '7000004', rank: 'archon', curate: false, owns: false };
+const RECRUITER = { github_id: '7000001', rank: 'metic', curate: true, owns: false };
+const OWNER = { github_id: '7000002', rank: 'xenos', curate: false, owns: true };
+const STRANGER = { github_id: '7000003', rank: 'xenos', curate: false, owns: false };
+
+const sliverOf = (handle) => get(`/api/bongos/scouting/${handle}`);
+const handleOf = (githubId) => ACCOUNTS.find((a) => a.github_id === githubId).handle;
+
+// ===========================================================================
+// 0. The instrument is calibrated before it is trusted
+// ===========================================================================
+
+test('the interpreter refuses a predicate it cannot read, rather than ignoring it', () => {
+  assert.throws(() => accountFilter('github_id = $1 AND some_new_flag = $2', [DIR, true]), /unread predicate on \$2/);
+  assert.throws(() => accountFilter("github_id = $1 AND tier = 'gold'", [DIR]), /unrecognised literal comparison on tier/);
+});
+
+test('the interpreter really does model the reach tri-state, in both spellings', () => {
+  const bare = accountFilter(recruiterReachSql(), []);
+  const aliased = accountFilter(recruiterReachSql('pa'), []);
+  for (const f of [bare, aliased]) {
+    assert.equal(f({ account_visibility: 'public', recruiter_discoverable: null }), true, 'null follows a public visibility');
+    assert.equal(f({ account_visibility: 'private', recruiter_discoverable: null }), false, 'and follows a private one');
+    assert.equal(f({ account_visibility: 'private', recruiter_discoverable: true }), true, 'an explicit true overrides');
+    assert.equal(f({ account_visibility: 'public', recruiter_discoverable: false }), false, 'an explicit false overrides');
+  }
+  // ...and the reach COALESCE must not be mistaken for the EXISTENCE axis, which
+  // is spelled with the same two words inside it.
+  const reachOnly = accountFilter(recruiterReachSql(), []);
+  assert.equal(reachOnly({ account_visibility: 'private', recruiter_discoverable: true }), true,
+    'a private, discoverable account passes reach — if the interpreter read the COALESCE as an existence check it would not');
+});
+
+// ===========================================================================
+// 1. The predicate: consent AND reach, and deliberately NOT existence
+// ===========================================================================
+
+test('recruiterSliverVisibleSql is COMPOSED from the consent floor and the reach axis', () => {
+  assert.ok(recruiterSliverVisibleSql('pa').includes(accountActiveSql('pa')), 'the consent floor, literally contained');
+  assert.ok(recruiterSliverVisibleSql('pa').includes(recruiterReachSql('pa')), 'and the reach axis, literally contained');
+  assert.ok(!recruiterSliverVisibleSql('pa').includes(accountVisibleSql('pa')),
+    'and NOT the existence axis: the private, discoverable account is the row D3 exists to serve');
+  assert.match(recruiterSliverVisibleSql(), /profile_state = 'active'/, 'a provisional account is never recruiter-visible');
+  assert.doesNotMatch(recruiterSliverVisibleSql(), /hide_stats/, 'hide changes the SHAPE of the sliver, never who appears in it');
+  assert.throws(() => recruiterSliverVisibleSql("pa; DROP TABLE x --"), /bare SQL identifier/);
+});
+
+test('the JS twin answers the D2 matrix exactly as the SQL asks it', () => {
+  const rows = [
+    [{ terms_accepted_at: 'T1', profile_state: 'active', account_visibility: 'private', recruiter_discoverable: true }, true],
+    [{ terms_accepted_at: 'T1', profile_state: 'active', account_visibility: 'private', recruiter_discoverable: null }, false],
+    [{ terms_accepted_at: 'T1', profile_state: 'active', account_visibility: 'public', recruiter_discoverable: null }, true],
+    [{ terms_accepted_at: 'T1', profile_state: 'active', account_visibility: 'public', recruiter_discoverable: false }, false],
+    [{ terms_accepted_at: 'T1', profile_state: 'provisional', account_visibility: 'public', recruiter_discoverable: true }, false],
+  ];
+  for (const [row, want] of rows) {
+    assert.equal(isRecruiterSliverVisible(row), want, JSON.stringify(row));
+    assert.equal(accountFilter(recruiterSliverVisibleSql(), [])(row), want, `the SQL fragment agrees for ${JSON.stringify(row)}`);
+  }
+  for (const bad of [null, undefined, {}, { profile_state: 'active' }]) {
+    assert.equal(isRecruiterSliverVisible(bad), false, 'fail-closed on an absent or unreadable account');
+  }
+});
+
+// ===========================================================================
+// 2. The WHITELIST — exactly these keys, and nothing else
+// ===========================================================================
+
+test('a full sliver carries EXACTLY the five keys D3 names', async () => {
+  viewer = ARCHON;
+  const res = await sliverOf(handleOf(PRIV));
+  assert.equal(res.status, 200, 'a private, explicitly-discoverable account IS the sliver subject');
+  assert.deepEqual(Object.keys(res.json.sliver).sort(), [...SLIVER_KEYS].sort(),
+    'the response key set is compared to the module\'s own list — a sixth key fails whether or not this file was told about it');
+  assert.deepEqual(Object.keys(res.json).sort(), ['sliver'], 'and nothing rides beside it at the top level');
+  assert.equal(res.json.sliver.handle, 'priv-handle');
+  assert.equal(res.json.sliver.display_name, 'Priv Person');
+  assert.deepEqual(res.json.sliver.disciplines, ['priv-craft']);
+  assert.equal(res.json.sliver.active_recently, true, 'the activity signal is a BOOLEAN, never a date');
+  assert.equal(ACTIVE_WINDOW_DAYS, 30, 'the window is the privacy parameter D3 names, not a tuning knob');
+  const activity = calls.find((c) => /WITH act AS/.test(c.sql));
+  assert.ok(activity.params.includes(ACTIVE_WINDOW_DAYS),
+    'and it is BOUND to the statement, so the constant and the query cannot drift apart');
+  assert.match(activity.sql, /make_interval\(days => \$2::int\)/,
+    'the window comparison happens in SQL — the timestamp never enters this process');
+});
+
+test('hide_stats shrinks the sliver to NAME-ONLY, and the activity read is never issued', async () => {
+  viewer = ARCHON;
+  const res = await sliverOf(handleOf(SHY));
+  assert.equal(res.status, 200, 'hiding the record does not remove the person from the recruiting surface');
+  assert.deepEqual(Object.keys(res.json.sliver).sort(), [...SLIVER_KEYS_HIDDEN].sort(),
+    'the two rollup-derived keys are ABSENT, not null — there is no empty box where a number used to be');
+  assert.ok(!calls.some((c) => /platform_identity_builder_project_activity/.test(c.sql)),
+    'and the numbers are never fetched at all: the cheapest way for a later edit to leak one is for it to already be in hand');
+});
+
+test('the port answers the same shapes as the route, keyed by github_id', async () => {
+  assert.deepEqual(Object.keys(await getRecruiterSliver(PRIV, { pool })).sort(),
+    [...SLIVER_KEYS].sort());
+  assert.deepEqual(Object.keys(await getRecruiterSliver(SHY, { pool })).sort(),
+    [...SLIVER_KEYS_HIDDEN].sort());
+  assert.equal(await getRecruiterSliver('system:bfg', { pool }), null,
+    'a non-numeric principal answers null rather than throwing a bigint cast mid-request');
+  assert.equal(await getRecruiterSliverByHandle('NOT A HANDLE', { pool }), null,
+    'and an unusable handle answers null without a query');
+});
+
+// ===========================================================================
+// 3. LEAK BY SUBTRACTION — planted sentinels, absent from the whole body
+// ===========================================================================
+
+test('no forbidden value appears ANYWHERE in a full sliver response', async () => {
+  viewer = ARCHON;
+  const res = await sliverOf(handleOf(PRIV));
+  for (const sentinel of forbiddenOf(PRIV)) {
+    assert.ok(!res.text.includes(sentinel),
+      `"${sentinel}" leaked into the sliver body — the whitelist must be built literally, never spread from a row`);
+  }
+});
+
+test('github_id is never a FIELD — and it reaches a recruiter ONLY inside the avatar D3 grants', async () => {
+  // The honest version of a claim this file used to overstate. `github_id` was
+  // a plain sentinel asserted absent from the body, and it passed only because
+  // the fixture avatars were invented URLs. A real avatar is GitHub's own —
+  // https://avatars.githubusercontent.com/u/<github_id>?v=4 — so granting the
+  // avatar (spec D3 does, explicitly) grants the id inside it, and that id
+  // resolves through api.github.com to a login. Pretending otherwise in a
+  // comment does not make it false; asserting exactly where it may appear does.
+  viewer = ARCHON;
+  const res = await sliverOf(handleOf(PRIV));
+  for (const key of ['github_id', 'github_login', 'id', 'login']) {
+    assert.ok(!(key in res.json.sliver), `${key} must never be a KEY of the sliver`);
+  }
+  assert.ok(res.text.includes(PRIV),
+    'CONTROL: the id really is in this body — otherwise the "only inside the avatar" claim below proves nothing');
+  assert.match(res.json.sliver.avatar_url, /^https:\/\/avatars\.githubusercontent\.com\/u\/\d+/,
+    'the fixture must carry the SHAPE a real row carries, or this whole test is theatre');
+  const withoutAvatar = res.text.split(res.json.sliver.avatar_url).join('');
+  assert.ok(!withoutAvatar.includes(PRIV),
+    'the id may ride the avatar and NOTHING else — a second appearance is a field that should not exist');
+});
+
+test('a hidden builder leaks neither their numbers NOR their disciplines', async () => {
+  viewer = ARCHON;
+  const res = await sliverOf(handleOf(SHY));
+  for (const sentinel of [...forbiddenOf(SHY), ...ROLLUP[SHY].disciplines]) {
+    assert.ok(!res.text.includes(sentinel), `"${sentinel}" leaked into a name-only sliver`);
+  }
+});
+
+test('CONTROL: those same values DO reach a recruiter for a builder who consented', async () => {
+  // Without this, "absent" could mean the sentinels were never in play at all and
+  // every assertion above would pass vacuously.
+  viewer = RECRUITER;
+  const dir = await get('/api/bongos/scouting');
+  assert.equal(dir.status, 200);
+  for (const sentinel of [String(ROLLUP[DIR].credits), String(ROLLUP[DIR].karma), String(ROLLUP[DIR].works_shipped), ROLLUP[DIR].last_active]) {
+    assert.ok(dir.text.includes(sentinel), `the directory must carry ${sentinel} — otherwise the absence tests prove nothing`);
+  }
+});
+
+test('CONTROL: the SAME builder, unhidden, DOES get those disciplines from the real port', async () => {
+  // The control this replaced ran a query THIS FILE wrote against its own fake
+  // and compared the fixture to itself — it never entered production code, so it
+  // proved only that an object equals itself. What has to be shown is that the
+  // name-only sliver is `hide_stats` doing its job and not an empty fixture, and
+  // the only honest way to show it is to flip that one flag on that one account
+  // and watch the REAL port hand the values over.
+  const shy = ACCOUNTS.find((a) => a.github_id === SHY);
+  shy.hide_stats = false;
+  try {
+    const full = await getRecruiterSliver(SHY, { pool });
+    assert.deepEqual(Object.keys(full).sort(), [...SLIVER_KEYS].sort(),
+      'unhidden, the same account yields the FULL five-key sliver');
+    assert.deepEqual(full.disciplines, ROLLUP[SHY].disciplines,
+      'and its disciplines really are reachable — so their absence above is the hide flag, not an empty fixture');
+    assert.equal(full.active_recently, true);
+  } finally {
+    shy.hide_stats = true;
+  }
+});
+
+// ===========================================================================
+// 4. WHO APPEARS — the opt-out empties the recruiting surface, both halves
+// ===========================================================================
+
+test('an opted-out builder is absent from the recruiting surface ENTIRELY', async () => {
+  viewer = ARCHON;
+  const one = await sliverOf(handleOf(OPTOUT));
+  assert.equal(one.status, 404, 'the sliver refuses them');
+  assert.equal(one.json.error.code, 'builder_not_found', '404, never 403 — a 403 would confirm the handle exists');
+  const dir = await get('/api/bongos/scouting');
+  assert.ok(!dir.text.includes(String(ROLLUP[OPTOUT].credits)), 'and so does the directory');
+  assert.ok(!dir.text.includes(ACCOUNTS.find((a) => a.github_id === OPTOUT).display_name));
+  assert.equal(await getRecruiterSliver(OPTOUT, { pool }), null, 'and the port itself, not merely the route');
+});
+
+test('a PRIVATE account never appears unless its owner opted in by hand', async () => {
+  viewer = ARCHON;
+  // The default: private + no explicit flag = not reachable.
+  assert.equal((await sliverOf(handleOf(PRIVDEF))).status, 404);
+  assert.equal(await getRecruiterSliver(PRIVDEF, { pool }), null);
+  // And a private account is absent from the DIRECTORY even when it IS
+  // discoverable — the full rollup is never its disclosure, the sliver is.
+  const dir = await get('/api/bongos/scouting');
+  assert.ok(!dir.text.includes('Priv Person'), 'the private, discoverable account stays out of the directory');
+  assert.ok(!dir.text.includes(String(ROLLUP[PRIV].credits)), 'with none of its numbers');
+});
+
+test('a PROVISIONAL account is never recruiter-visible, however its flags read', async () => {
+  viewer = ARCHON;
+  assert.equal((await sliverOf(handleOf(PROV))).status, 404,
+    'recruiter_discoverable=true does not survive the consent floor (spec D3)');
+  assert.equal(await getRecruiterSliver(PROV, { pool }), null);
+});
+
+// ===========================================================================
+// 5. THE BOUNDARY IS A CEILING — the handle opens no page
+// ===========================================================================
+
+test('the handle a recruiter is given does NOT open the profile page', async () => {
+  viewer = ARCHON;
+  const sliver = await sliverOf(handleOf(PRIV));
+  assert.equal(sliver.status, 200);
+  const page = await get(`/api/bongos/profiles/${sliver.json.sliver.handle}`);
+  assert.equal(page.status, 404,
+    'the pre-accept sliver is a CEILING, not a step: the public page joins the EXISTENCE axis and this account is private');
+  for (const sentinel of forbiddenOf(PRIV)) {
+    assert.ok(!page.text.includes(sentinel), `"${sentinel}" reached a recruiter through the profile page instead`);
+  }
+});
+
+test('a PREVIOUS handle opens nothing — the sliver does not confirm a rename', async () => {
+  viewer = ARCHON;
+  const stale = await sliverOf('priv-oldname-990204');
+  assert.equal(stale.status, 404,
+    'unlike the public page, which answers 301 so a SHARED LINK survives a rename, a recruiting read has '
+    + 'no shared links to keep working — and resolving one would confirm to a recruiter that this account '
+    + 'renamed, a disclosure the sliver never grants');
+  assert.equal((await sliverOf(handleOf(PRIV))).status, 200,
+    'CONTROL: the CURRENT handle still resolves — otherwise the 404 above proves only that the route is broken');
+});
+
+test('CONTROL: that same page DOES render for a builder who is publicly visible', async () => {
+  viewer = RECRUITER;
+  const page = await get(`/api/bongos/profiles/${handleOf(DIR)}`);
+  assert.equal(page.status, 200, 'otherwise the 404 above proves only that the route is broken');
+  assert.ok(page.text.includes(String(ROLLUP[DIR].credits)), 'and it carries the post-accept record the sliver withholds');
+});
+
+// ===========================================================================
+// 6. THE GATE — a bounded projection behind an open door is not bounded
+// ===========================================================================
+
+test('the sliver is ARCHON-gated, and the directory audience does not reach it', async () => {
+  // ADR 0215 D4. Privacy spec D3 pins this read to `project.recruit`, floor
+  // ARCHON. The directory's door — `project.curate` at metic, OR any project
+  // owner (ADR 0210 D2) — is WIDER on both halves, so reusing it would widen an
+  // owner-signed privacy decision by implementation convenience. This is the
+  // first surface that discloses a private account, so it holds the signed floor
+  // until the atom exists; a blocker asks the owner about the wider audience.
+  viewer = ARCHON;
+  assert.equal((await sliverOf(handleOf(PRIV))).status, 200, 'an archon reads the sliver');
+  for (const who of [RECRUITER, OWNER]) {
+    viewer = who;
+    assert.equal((await sliverOf(handleOf(PRIV))).status, 403,
+      `a ${who.rank} holding the directory's door must NOT reach the sliver`);
+    assert.equal((await get('/api/bongos/scouting')).status, 200,
+      'while still reading the directory — two audiences, not one narrowed');
+  }
+});
+
+test('the refusal names the RANK it wanted, and no session reaches either door', async () => {
+  viewer = STRANGER;
+  const one = await sliverOf(handleOf(PRIV));
+  assert.equal(one.status, 403);
+  assert.deepEqual(one.json.error.details, { required: ['archon'], actual: 'xenos' },
+    'a rank refusal says which floor it wanted, so the hall can render why — it must not degrade to a bare 403');
+  assert.equal((await get('/api/bongos/scouting')).status, 403, 'and the directory refuses them too');
+  viewer = null;
+  assert.equal((await sliverOf(handleOf(PRIV))).status, 401, 'no session reaches either door');
+});
+
+test('a refusal happens BEFORE any builder data is read', async () => {
+  viewer = STRANGER;
+  await sliverOf(handleOf(PRIV));
+  assert.ok(!calls.some((c) => /platform_identity_accounts/.test(c.sql)),
+    'the gate refuses without touching the subject account at all');
+});
+
+test('each route spells its OWN gate in its OWN middleware list', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/scouting.js'), 'utf8');
+  assert.equal((src.match(/requirePermission\('project\.curate'\)/g) || []).length, 1,
+    'the directory names its atom where route-rank-check.js and gen-api-docs.js can see it — a gate hidden in a helper records a privileged route as any-builder');
+  assert.equal((src.match(/api\.requireRank\('archon'\)/g) || []).length, 1,
+    'and the sliver names its floor the same way, so the generated docs record archon and not the directory metic');
+  const sliverBlock = src.slice(src.indexOf("'/scouting/:handle'"));
+  assert.doesNotMatch(sliverBlock.slice(0, sliverBlock.indexOf('async (req, res)')), /requireScoutingReader/,
+    'and the sliver must never pick up the directory wider door by accident');
+});
+
+// ===========================================================================
+// 7. IT GRANTS NOTHING (ADR 0016)
+// ===========================================================================
+
+test('the sliver module is read by exactly one first-party server file — the one that serializes it', () => {
+  const files = [];
+  const walk = (dir) => {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      const p = path.join(dir, e.name);
+      if (e.isDirectory()) { if (e.name !== 'node_modules') walk(p); }
+      else if (e.name.endsWith('.js')) files.push(p);
+    }
+  };
+  for (const d of ['src', 'modules', 'scripts']) walk(path.join(ROOT, d));
+  assert.ok(files.length > 300, `only ${files.length} files scanned — the sweep went vacuous`);
+  const readers = files
+    .filter((f) => /require\(\s*['"][^'"]*recruiter-sliver['"]\s*\)/.test(fs.readFileSync(f, 'utf8')))
+    .map((f) => path.relative(ROOT, f).split(path.sep).join('/'));
+  assert.deepEqual(readers, ['modules/platform-identity/routes/scouting.js'],
+    'nothing may consult the sliver to DECIDE anything: cross-project numbers are descriptive analytics, never authority (ADR 0016)');
+});
+
+test('no rank, role, permission or membership travels with the sliver, under any name', async () => {
+  viewer = ARCHON;
+  const res = await sliverOf(handleOf(PRIV));
+  for (const word of ['rank', 'role', 'permission', 'membership', 'archon', 'metic', 'credits', 'karma', 'project']) {
+    assert.ok(!res.text.toLowerCase().includes(word),
+      `"${word}" appears in a sliver body — being visible to a recruiter must confer and reveal nothing`);
+  }
+});
+
+// ===========================================================================
+// 8. This file runs in the lane that executes
+// ===========================================================================
+
+test('this proof runs in the DB-free unit lane', () => {
+  const runner = fs.readFileSync(path.join(ROOT, 'scripts/gds/run-unit-tests.js'), 'utf8');
+  assert.ok(!/recruiter_sliver_boundary/.test(runner),
+    'named in run-unit-tests.js it would be parked into INTEGRATION or KNOWN_FAILING and gate nothing (learning 1000218)');
+});