@bongos/core 1.19.467 → 1.19.469

package/src/bongos/serve-internal.js

@@ -837,13 +837,25 @@ function mountInternalSurfaces(app) {
   // exact permission its data route (GET /scouting) checks — same posture as the
   // /government tab above (the page can never drift wider than the API it fronts).
   const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
-  // /scouting is the LEGACY twin of /people — the same /api/gds/scouting directory,
-  // left behind when task 1002577 graduated it into the hall. It has no nav entry
-  // and its own header claims "Archon-only", but it was never page-gated: the page
-  // rendered for anyone and leaned entirely on the data route's 403. Gated on the
-  // same atom as /people so the two can't drift apart (task 1002710). Deleting it
-  // in favour of /people is a separate call — it is walled, not removed, here.
-  const SCOUTING_PAGE_RE = /^\/builders\/scouting(?:\.html)?\/?$/;
+  // /scouting WAS the legacy twin of /people — the same /api/gds/scouting
+  // directory, left behind when task 1002577 graduated it into the hall. Task
+  // 1003470 had already made the two one page (scouting.html rendered people's
+  // body byte-for-byte and scouting.js was deleted); task 1003440 removes the
+  // door itself, because a second URL onto one directory is a surface to keep in
+  // sync for no reader. The URL survives as a 301 so an old bookmark lands on the
+  // directory instead of a 404. It carries no page gate: the redirect discloses
+  // nothing, and /people's wall applies the instant the browser follows it.
+  const SCOUTING_LEGACY_RE = /^\/builders\/scouting(?:\.html)?\/?$/;
+  app.use((req, res, next) => {
+    if (isModuleSurfaceHost(req)) return next();
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+    if (!SCOUTING_LEGACY_RE.test(path.posix.normalize(req.path))) return next();
+    const qs = req.url.includes('?') ? req.url.slice(req.url.indexOf('?')) : '';
+    // On the builders subdomain the /builders prefix is redundant (the canonical
+    // redirect above strips it), so emit the clean path and save a second hop.
+    return res.redirect(301, `${isBuildersHost(req) ? '' : '/builders'}/people${qs}`);
+  });
+
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (!req.path.startsWith('/builders')) return next();
@@ -862,7 +874,7 @@ function mountInternalSurfaces(app) {
     if (GOVERNMENT_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernmentPage(req, res, next);
     }
-    if (PEOPLE_PAGE_RE.test(norm) || SCOUTING_PAGE_RE.test(norm)) {
+    if (PEOPLE_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);
     }
     next();

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.467'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.469'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_page_gate_map.mjs

@@ -63,9 +63,11 @@ const ORACLE = {
   '/builders/sessions': 'requireGovernmentPage',
 
   // Metic+ via the `project.curate` atom — the exact permission GET /scouting
-  // checks, so neither page can drift wider than the API it fronts.
+  // checks, so the page can never drift wider than the API it fronts. Its
+  // legacy twin /builders/scouting is gone (task 1003440): the URL now 301s to
+  // /people before this dispatch runs, so it holds no gate and has no row —
+  // tests/hall_roster_world.mjs owns the proof that the redirect is there.
   '/builders/people': 'requireProjectCuratePage',
-  '/builders/scouting': 'requireProjectCuratePage',
 
   // Metic+ since R16 (goal 1000069): the Government page is three rooms —
   // Permissions · Board Room · Constitution (reordered, task 1003269) — and only

package/tests/hall_reading_world.mjs

@@ -364,8 +364,8 @@ test('no reading room carries an inline <style>, and none needs an audit excepti
   assert.ok(budgets, 'hall_audit.mjs still declares the ratchet');
   assert.doesNotMatch(budgets[1].replace(/\/\/[^\n]*/g, ''), /['"][a-z-]+\.html['"]\s*:/,
     'no page carries an inline-style exception any more');
-  // (scouting.html keeps a one-line block, comfortably inside the DEFAULT
-  // budget — an exception is what this asserts is gone, not every <style>.)
+  // (an exception is what this asserts is gone, not every <style>. scouting.html
+  // was the last page carrying a one-line block; task 1003440 deleted the page.)
 });
 
 test('roadmap\'s two sub-24px controls clear the floor, on both axes', () => {

package/tests/hall_roster_world.mjs

@@ -5,8 +5,8 @@
 // in the open and the rest behind the kit's disclosure, the readiness is the
 // family's figure band in the same dot language as the roll line, the view
 // toggle is a view and not a filter, the accent lands on the one live door; the
-// two directory pages are ONE page (the legacy door renders the same body from
-// the same script) and the directory shows the avatar, the name and the login
+// legacy /scouting door is deleted and its URL redirects onto the one directory
+// page (task 1003440), which shows the avatar, the name and the login
 // the API returns; the session ledger drops the nowrap + wrapper pair that broke
 // its sticky header, makes every id a door, and names its floor from the pack.
 import test from 'node:test';
@@ -165,17 +165,47 @@ test('goals.css and people.css spend only the fifteen, and every token they name
 });
 
 // =========================================================================
-// PEOPLE + SCOUTING — one directory, two doors
+// PEOPLE — one directory, one door
 // =========================================================================
 
-test('scouting is the same page as people: one body, one script, no script of its own', () => {
+// Task 1003470 made /scouting render people.html byte-for-byte; task 1003440
+// removes the door itself. Two URLs onto one directory is a surface to keep in
+// sync that no reader ever asked for — but the URL still has to answer, or a
+// bookmark on the old door 404s.
+test('the legacy /scouting door is deleted, and nothing scouting-shaped is left in the hall', () => {
+  for (const f of ['scouting.html', 'scouting.js', 'scouting.states.json', 'scouting.css']) {
+    assert.ok(!fs.existsSync(path.join(PUB, f)), f + ' is gone — one directory, one door');
+  }
+});
+
+test('the /scouting URL redirects to /people, and no dead gate dispatches to it', () => {
+  const serve = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'), 'utf8');
+  const i = serve.indexOf('const SCOUTING_LEGACY_RE');
+  assert.ok(i > 0, 'the retired URL keeps a matcher, so the bookmark still lands somewhere');
+  const block = serve.slice(i, i + 1200);
+  assert.ok(block.includes('res.redirect(301,'), 'and answers with a permanent redirect');
+  assert.ok(block.includes("/people"), 'pointing at the directory that replaced it');
+  // RUN the shipped matcher, rather than trusting that it reads right. Anchoring
+  // is the half that goes wrong: an unanchored twin would swallow the API route.
+  const decl = 'const SCOUTING_LEGACY_RE = ';
+  const j = serve.indexOf(decl);
+  const rx = eval(serve.slice(j + decl.length, serve.indexOf(';', j))); // eslint-disable-line no-eval
+  for (const p of ['/builders/scouting', '/builders/scouting/', '/builders/scouting.html']) {
+    assert.ok(rx.test(p), p + ' must reach the redirect');
+  }
+  for (const p of ['/api/gds/scouting', '/api/bongos/scouting', '/builders/people',
+    '/builders/scoutingfoo', '/builders/scouting/extra']) {
+    assert.ok(!rx.test(p), p + ' must NOT be redirected — the data route and the directory are not the door');
+  }
+  // The gate is the half that would rot silently: a page-gate branch still
+  // naming a deleted page is a wall guarding nothing.
+  assert.ok(!decomment(serve).includes('SCOUTING_PAGE_RE'),
+    'no page gate is left dispatching to a page that no longer exists');
+});
+
+test('the directory page loads its own script, sheet and toolkit', () => {
   const people = read('people.html');
-  const scouting = read('scouting.html');
-  const bodyOf = (html) => html.slice(html.indexOf('<body'));
-  assert.equal(bodyOf(scouting), bodyOf(people), 'the two bodies are byte-identical');
-  assert.ok(!fs.existsSync(path.join(PUB, 'scouting.js')), 'scouting.js is gone — the third rendering of one endpoint');
-  assert.doesNotMatch(scouting, /<style[^>]*>/, 'the legacy door carries no inline style');
-  for (const html of [people, scouting]) {
+  for (const html of [people]) {
     assert.match(html, /\/builders\/people\.js/);
     assert.match(html, /\/builders\/people\.css/);
     assert.match(html, /\/builders\/dom-utils\.js/, 'the toolkit the rank label and the number formats come from');
@@ -280,8 +310,6 @@ test('the states files exercise the redesign\'s new states', () => {
   assert.deepEqual(goals.states.cards.expect.value, [['#f-goal-view', 'cards']]);
   const people = JSON.parse(read('people.states.json'));
   assert.ok(people.states.search, 'people: a search is measured');
-  const scouting = JSON.parse(read('scouting.states.json'));
-  assert.deepEqual(scouting.states.board.expect.visible, ['#people-scroll'], 'scouting expects the People panel');
   const sessions = JSON.parse(read('sessions.states.json'));
   assert.deepEqual(sessions.states.ledger.expect.visible, ['#stats-scroll', '#sessions-scroll']);
 });

package/modules/hall-ui/public/scouting.html

@@ -1,69 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>People — {{worldName}}</title>
-  <meta name="description" content="The builder directory: everyone building across {{worldName}} projects, searchable and ranked by track record.">
-  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
-  <!-- /scouting is the LEGACY DOOR to the People directory (task 1002577
-       graduated it into the hall; task 1002710 walled it on the same
-       project.curate gate). Task 1003470 made it the SAME PAGE: the body below
-       is byte-identical to people.html and runs people.js — the one
-       /api/gds/scouting rollup used to be drawn three different ways, and a
-       door that renders a different page from the same data is the drift.
-       tests/hall_roster_world.mjs holds the two bodies equal. -->
-  <link rel="stylesheet" href="/builders/people.css">
-</head>
-<body data-page="people" data-page-title="People">
-
-<div class="app">
-  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
-  <div class="app-scrim" id="app-scrim" hidden></div>
-  <div class="app-body">
-    <header class="app-topbar" id="app-topbar"></header>
-    <div class="app-content">
-      <!-- The board page head (task 1003307): the label voice, because on a
-           working surface the page's own name is the least interesting thing on
-           it. The sub is rewritten by people.js once the directory has loaded. -->
-      <div class="page-head page-head--board">
-        <h1 class="page-head__h">People</h1>
-        <p class="page-head__sub" id="people-sub">Everyone building across hosted projects, ranked by track record. Descriptive only — cross-project numbers never carry authority here.</p>
-      </div>
-
-      <main id="hall-main">
-        <!-- task 1003470: ONE directory. /people and its legacy door /scouting
-             render this same page from the same script — the same
-             /api/gds/scouting rollup used to be drawn three different ways. -->
-        <section class="scroll" id="people-scroll" aria-labelledby="people-h">
-          <h2 id="people-h" class="scroll__h">Builder directory<span class="count-pill" id="people-count" hidden></span></h2>
-          <div id="people-filters"></div>
-          <div id="people-body">
-            <div class="profile__placeholder">Loading the directory…</div>
-          </div>
-        </section>
-      </main>
-
-      <footer class="app-foot" id="app-foot"></footer>
-    </div>
-  </div>
-</div>
-
-<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
-
-<!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
-     chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
-<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
-<script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
-     branding pack's currency label, loaded BEFORE people.js. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
-<script src="/builders/brand-apply.js"></script>
-<script src="/builders/hall-kit.js"></script>
-<script src="/builders/people.js"></script>
-</body>
-</html>

package/modules/hall-ui/public/scouting.states.json

@@ -1,59 +0,0 @@
-{
-  "_": "Scouting — the LEGACY DOOR to the People directory, on the same project.curate gate. Since task 1003470 it renders the People page itself (the same body, the same people.js), so this file measures the door, not a second design: the same floors at the same widths, with the People panel expected. The three-line inline <style> it used to carry went with the page it belonged to.",
-  "page": "/builders/scouting",
-  "surface": "hall-ui",
-  "stub": {
-    "prefix": "/builders/"
-  },
-  "modeQuery": false,
-  "_feeds": "The kit's own stub carries no feed for this page, so against it the page renders its EMPTY and SKELETON states — which is the point: those are states the floors must hold in. Against the hall-preview harness the same states render populated. Every declared 404 below is a fixture the harness does not carry, named rather than hidden.",
-  "ignoreRequests": [
-    "/api/(gds|bongos)/me$",
-    "/api/(gds|bongos)/me/",
-    "/api/(gds|bongos)/goals",
-    "/api/(gds|bongos)/inbox/",
-    "/api/(gds|bongos)/versions",
-    "/api/(gds|bongos)/scouting",
-    "/api/(gds|bongos)/builders"
-  ],
-  "ignoreConsole": [
-    "/api/(gds|bongos)/",
-    "\\b401\\b",
-    "\\b403\\b",
-    "\\b404\\b",
-    "\\b501\\b",
-    "Unauthorized",
-    "Forbidden",
-    "Not Found",
-    "Not Implemented",
-    "load failed"
-  ],
-  "states": {
-    "board": {
-      "auth": true,
-      "actions": [
-        [
-          "wait",
-          700
-        ]
-      ],
-      "expect": {
-        "visible": [
-          "#people-scroll"
-        ]
-      }
-    },
-    "out": {
-      "auth": false
-    }
-  },
-  "reducedMotion": {
-    "auth": true,
-    "actions": [
-      [
-        "wait",
-        600
-      ]
-    ]
-  }
-}