@bongos/core 1.19.473 → 1.19.475

package/modules/hall-ui/public/roster.js

@@ -0,0 +1,227 @@
+// roster.js — the Builders page: who builds on THIS project, ranked.
+//
+// Task 1003441 (goal 1000075, criterion community-is-one-builders-page). This
+// was the `#leaderboard` HASH VIEW on index.html, which is why the hall's
+// Community nav group read as one real page plus a link into the home page. It
+// is a page now, and `/#leaderboard` redirects here (shell.js VIEW_REDIRECTS).
+//
+// PROJECT-OWN, not cross-project. /people is the cross-project directory behind
+// `project.curate`; this is the project's own ledger and is deliberately
+// ungated, because its one data source — GET /leaderboard
+// (modules/economy/routes/leaderboard.js) — is deliberately unauthenticated and
+// mirrors the public status surface. No visibility predicate is applied and that
+// is CORRECT: privacy suppresses cross-project surfaces only, so a builder
+// marked `private` still appears on the roster of a project they build on
+// (owner, 2026-08-30; ADR 0225, task 1003443).
+//
+// The laurels (ACH_EMOJI + achRowHtml) and the sort lenses MOVED here from
+// hall-render.js rather than being copied — the leaderboard row was their only
+// caller, so the home page is left carrying no dead renderer.
+(function () {
+  'use strict';
+  var kit = window.OTBKit;
+  var OTB = window.OTB;
+  var esc = kit.esc;
+  var body = document.getElementById('roster-body');
+  var sub = document.getElementById('roster-sub');
+  var countPill = document.getElementById('roster-count');
+
+  var fmtInt = function (n) { return OTB && OTB.fmtInt ? OTB.fmtInt(n) : String(n == null ? 0 : n); };
+  var rankLabel = function (r) { return OTB && OTB.rankLabel ? OTB.rankLabel(r) : r; };
+  var currencyLabel = function () {
+    var b = window.OTBBranding;
+    return (b && b.currencyLabel && b.currencyLabel({ caps: true })) || 'Credits';
+  };
+
+  // Local, the way builders.js and goals-render.js each keep their own — a
+  // four-entry ladder constant, not a shared module's worth of behaviour.
+  var RANK_ORDER = { archon: 4, metic: 3, thetes: 2, xenos: 1 };
+  function rankWeight(r) { return RANK_ORDER[r] != null ? RANK_ORDER[r] : -1; }
+  function rankBadgeHtml(rank) {
+    var variant = RANK_ORDER[rank] ? 'rank-badge--' + rank : 'rank-badge--unknown';
+    var aria = rank ? 'Rank: ' + rankLabel(rank) : 'Rank not yet recorded';
+    return '<span class="rank-badge ' + variant + '" aria-label="' + esc(aria) + '">' + esc(rankLabel(rank)) + '</span>';
+  }
+
+  var ACH_EMOJI = {
+    'first-ship': '\u{1F6A2}',
+    'first-claim': '\u{1FA99}',
+    'first-parallel-claim': '⚓',
+    'streak-3': '\u{1F525}',
+    'streak-7': '\u{1F30B}',
+    'art-pipeline-shipper': '\u{1F3A8}',
+    'gds-shipper': '⚙️',
+    'breaking-the-100c-bar': '\u{1F4AF}',
+  };
+  function achRowHtml(ids) {
+    if (!Array.isArray(ids) || !ids.length) return '';
+    var inner = ids.map(function (id) {
+      var emoji = ACH_EMOJI[id];
+      // Title is the achievement id (kebab) — terse enough that hover discloses
+      // the laurel without overstating the prose.
+      return emoji ? '<span class="lb-ach" title="' + esc(id) + '" aria-label="' + esc(id) + '">' + emoji + '</span>' : '';
+    }).join('');
+    return inner ? '<span class="lb-ach-row" aria-label="achievements">' + inner + '</span>' : '';
+  }
+
+  function builderName(b) { return b.display_name || b.github_login || ('#' + b.id); }
+  function initialOf(b) {
+    var n = String(builderName(b)).replace(/^[@#]/, '');
+    return (n.charAt(0) || '?').toUpperCase();
+  }
+  // Defence in depth on the avatar src. Escaping alone cannot stop a non-http
+  // scheme reaching an attribute the browser resolves; <img> would not execute
+  // javascript: in any current browser, but the allowlist costs one test and
+  // removes the question. Falls back to the initial rather than rendering a
+  // src the page did not vouch for.
+  function httpUrl(u) {
+    return /^https?:\/\//i.test(String(u || '')) ? String(u) : null;
+  }
+  // The identity cell, shared with /people through people.css. The name opens
+  // the builder's profile PAGE here: this is a project surface, so a local
+  // profile id exists — unlike the cross-project directory, which can only
+  // offer GitHub. Guarded on b.id so a row without one degrades to plain text
+  // rather than a broken /profile?id=undefined link (task 1467).
+  function whoHtml(b) {
+    var name = esc(builderName(b));
+    var src = httpUrl(b.avatar_url);
+    var avatar = src
+      ? '<img class="dir-avatar" src="' + esc(src) + '" alt="" loading="lazy">'
+      : '<span class="dir-avatar dir-avatar--initial" aria-hidden="true">' + esc(initialOf(b)) + '</span>';
+    var nameHtml = b.id != null
+      ? '<a class="lb-name dir-name" href="/profile?id=' + encodeURIComponent(b.id) + '">' + name + '</a>'
+      : '<span class="dir-name">' + name + '</span>';
+    var login = b.github_login ? '<span class="dir-login">@' + esc(b.github_login) + '</span>' : '';
+    return '<span class="dir-who">' + avatar + '<span class="dir-who__t">' + nameHtml + login + '</span></span>';
+  }
+
+  var all = [];
+  var query = '';
+  var sortBy = '';
+
+  // PLACE IS CANONICAL, not the row's position in the current sort.
+  // hall-render's leaderboardPlace() already defines a builder's place as
+  // credits-descending "independent of whatever column the table is currently
+  // sorted by", and the Standing card still says "#N on the leaderboard" from
+  // that definition — so a Place column that renumbered itself under the karma
+  // lens disagreed with the card about the same builder. Stamped once, at load.
+  function stampPlaces(rows) {
+    rows.slice()
+      .sort(function (a, b) { return (Number(b.total_credits) || 0) - (Number(a.total_credits) || 0); })
+      .forEach(function (b, i) { b.__place = i + 1; });
+    // The efficiency title is stamped here too, so the division and the string
+    // work happen ONCE per load rather than per visible row per render (every
+    // sort, search keystroke and page turn re-renders).
+    rows.forEach(function (b) { b.__eff = efficiencyTitle(b); });
+    return rows;
+  }
+
+  function matches(b) {
+    if (!query) return true;
+    var hay = ((b.github_login || '') + ' ' + (b.display_name || '')).toLowerCase();
+    return hay.indexOf(query) !== -1;
+  }
+  // The server returns credits-DESC, which is also the default lens; the others
+  // re-order the loaded set client-side, ties keeping the server's order so
+  // equal-value rows do not jitter between renders.
+  var SORTS = {
+    '': null,
+    rank: function (b) { return -rankWeight(b.rank); },
+    karma: function (b) { return -(Number(b.karma) || 0); },
+    tokens: function (b) { return -(Number(b.tokens_used) || 0); },
+  };
+  function ordered(rows) {
+    var key = SORTS[sortBy];
+    if (!key) return rows;
+    return rows.map(function (b, i) { return { b: b, i: i }; })
+      .sort(function (x, y) { return (key(x.b) - key(y.b)) || (x.i - y.i); })
+      .map(function (x) { return x.b; });
+  }
+
+  var pager = kit.makePager('roster', 'hall-roster-per-page', { defaultPerPage: 25 });
+  var ledger = null;
+
+  function efficiencyTitle(b) {
+    var credits = Number(b.total_credits) || 0;
+    var one = currencyLabel().toLowerCase().replace(/s$/, '');
+    if (credits <= 0) return 'no ' + currencyLabel().toLowerCase() + ' earned yet';
+    return fmtInt(Math.round((Number(b.tokens_used) || 0) / credits)) + ' tokens per ' + one;
+  }
+
+  function rowHtml(b) {
+    return '<tr>'
+      + '<td class="ledger__num">' + esc(String(b.__place || '—')) + '</td>'
+      + '<td>' + whoHtml(b) + achRowHtml(b.achievements) + '</td>'
+      + '<td class="ledger__rank">' + rankBadgeHtml(b.rank) + '</td>'
+      + '<td class="ledger__num">' + esc(fmtInt(b.total_credits)) + '</td>'
+      + '<td class="ledger__num">' + esc(fmtInt(b.karma)) + '</td>'
+      + '<td class="ledger__num" title="' + esc(b.__eff || '') + '">' + esc(fmtInt(b.tokens_used)) + '</td>'
+      + '</tr>';
+  }
+
+  function rerender() {
+    if (ledger) ledger.render(ordered(all.filter(matches)));
+  }
+
+  function notice(msg) {
+    body.innerHTML = '';
+    body.className = 'note';
+    body.textContent = msg;
+  }
+
+  function mountRoster(rows) {
+    all = stampPlaces(Array.isArray(rows) ? rows : []);
+    if (!all.length) {
+      notice('Nobody has earned anything on this project yet. A builder joins the roster the '
+        + 'first time they ship a claimed task.');
+      return;
+    }
+    if (countPill) { countPill.textContent = String(all.length); countPill.hidden = false; }
+    if (sub) {
+      sub.textContent = fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's')
+        + ' on this project, ranked by ' + currencyLabel().toLowerCase() + ' earned. This '
+        + 'project’s own ledger — everyone who builds here is listed.';
+    }
+    kit.makeFilterBar({
+      mount: document.getElementById('roster-filters'),
+      search: { id: 'roster-q', label: 'Search', placeholder: 'name or login' },
+      primary: [
+        { id: 'roster-sort',
+          label: 'Sort',
+          options: [
+            { value: '', label: 'place' },
+            { value: 'rank', label: 'rank' },
+            { value: 'karma', label: 'most karma' },
+            { value: 'tokens', label: 'most tokens' },
+          ] },
+      ],
+      onChange: function (vals) {
+        query = String(vals['roster-q'] || '').trim().toLowerCase();
+        sortBy = String(vals['roster-sort'] || '');
+        pager.page = 1;
+        rerender();
+      },
+    });
+    body.textContent = '';
+    body.className = '';
+    ledger = kit.makeLedger({
+      mount: body,
+      columns: ['Place', 'Builder', 'Rank',
+        { label: currencyLabel(), class: 'ledger__num' },
+        { label: 'Karma', class: 'ledger__num' },
+        { label: 'Tokens', class: 'ledger__num' }],
+      rowHtml: rowHtml,
+      emptyMsg: 'No builder on the roster matches that search.',
+      pager: pager,
+    });
+    rerender();
+  }
+
+  fetch('/api/gds/leaderboard', { headers: { Accept: 'application/json' } })
+    .then(function (r) {
+      if (!r.ok) throw new Error('http ' + r.status);
+      return r.json();
+    })
+    .then(function (data) { mountRoster(data && data.leaderboard); })
+    .catch(function () { notice('Couldn’t load the roster right now.'); });
+}());

package/modules/hall-ui/public/roster.states.json

@@ -0,0 +1,100 @@
+{
+  "_": "Builders — this project's OWN roster, ranked by credits earned (task 1003441, goal 1000075). Was the #leaderboard hash view on index.html; /#leaderboard now redirects here. Deliberately UNGATED, because its one data source (GET /leaderboard) is deliberately unauthenticated and mirrors the public status surface — so unlike people.states.json the `out` state below renders the real page rather than a seal. Populated look: the hall-preview harness (scripts/hall-preview/fixtures/leaderboard.json carries thirteen builders with avatars, ranks, karma and tokens).",
+  "page": "/builders/roster",
+  "surface": "hall-ui",
+  "stub": {
+    "prefix": "/builders/"
+  },
+  "modeQuery": false,
+  "_feeds": "The kit's own stub carries no feed for this page, so against it the page renders its EMPTY and SKELETON states — which is the point: those are states the floors must hold in. Against the hall-preview harness the same states render populated. Every declared 404 below is a fixture the harness does not carry, named rather than hidden.",
+  "ignoreRequests": [
+    "/api/(gds|bongos)/me$",
+    "/api/(gds|bongos)/me/",
+    "/api/(gds|bongos)/goals",
+    "/api/(gds|bongos)/inbox/",
+    "/api/(gds|bongos)/versions",
+    "/api/(gds|bongos)/builders",
+    "/api/(gds|bongos)/leaderboard",
+    "/api/(gds|bongos)/public/"
+  ],
+  "ignoreConsole": [
+    "/api/(gds|bongos)/",
+    "\\b401\\b",
+    "\\b403\\b",
+    "\\b404\\b",
+    "\\b501\\b",
+    "Unauthorized",
+    "Forbidden",
+    "Not Found",
+    "Not Implemented",
+    "load failed"
+  ],
+  "states": {
+    "roster": {
+      "auth": true,
+      "actions": [
+        [
+          "wait",
+          700
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#roster-scroll"
+        ]
+      }
+    },
+    "search": {
+      "auth": true,
+      "actions": [
+        [
+          "wait",
+          700
+        ],
+        [
+          "fill",
+          "#roster-q",
+          "prev"
+        ],
+        [
+          "wait",
+          200
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#roster-scroll"
+        ],
+        "value": [
+          [
+            "#roster-q",
+            "prev"
+          ]
+        ]
+      }
+    },
+    "out": {
+      "auth": false,
+      "actions": [
+        [
+          "wait",
+          700
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#roster-scroll"
+        ]
+      }
+    }
+  },
+  "reducedMotion": {
+    "auth": true,
+    "actions": [
+      [
+        "wait",
+        600
+      ]
+    ]
+  }
+}

package/modules/hall-ui/public/shell.js

@@ -13,8 +13,9 @@
 //     (#app-sidebar / #app-topbar / #app-foot) every hall page carries;
 //   - rank-gate nav items COSMETICALLY (server-side page gates remain the real
 //     access control — serve-internal.js requireGovernmentPage etc.);
-//   - on the index (body[data-page="home"]) route the three views (#home,
-//     #standing, #leaderboard) plus the #achievements alias into Standing. The
+//   - on the index (body[data-page="home"]) route the two views (#home,
+//     #standing) plus the #achievements alias into Standing, and REDIRECT the
+//     retired #leaderboard hash to the /roster page (task 1003441). The
 //     `#/task|idea|blocker/N` deep-link hashes belong to builders.js and are
 //     deliberately ignored here;
 //   - expose window.OTBShell.applyAccess(...) so builders.js (index) or the
@@ -30,7 +31,10 @@
   var brand = window.__BRANDING__ || {};
   var PAGE = (document.body && document.body.dataset.page) || '';
   var IS_INDEX = PAGE === 'home';
-  var VIEWS = ['home', 'standing', 'leaderboard'];
+  // task 1003441: 'leaderboard' left this list — the Roll is the /roster PAGE
+  // now. Its hash is not an alias (there is no host view to land on) but a
+  // REDIRECT, declared in VIEW_REDIRECTS below.
+  var VIEWS = ['home', 'standing'];
   // task 2174: #achievements retired as a view — the achievements grid folded
   // into Standing's Achievements rail section; task 2175 then retired its nav
   // entry. Old links (bookmarks, the stat tiles) keep working: the hash resolves
@@ -47,6 +51,16 @@
     'standing-progress': { view: 'standing', anchor: 'standing-progress' },
     'standing-achievements': { view: 'standing', anchor: 'standing-achievements' },
   };
+  // A retired view whose content moved to its OWN PAGE, so there is no host
+  // view to alias onto. Every existing #leaderboard link — bookmarks, the
+  // Standing card's stat tiles, profile.js's prose link — lands on the roster
+  // instead of silently falling through to Home (task 1003441).
+  // Object.create(null): the key is an attacker-controlled hash string, so a
+  // plain object would answer for "constructor"/"toString" as well as the real
+  // entries. Harmless with one literal key, wrong to leave as the pattern.
+  var VIEW_REDIRECTS = Object.assign(Object.create(null), {
+    leaderboard: '/roster',
+  });
   // builders.js owns these hashes (deep-link overlay) — never route them.
   var DEEPLINK_RE = /^#\/(task|idea|blocker)\/(\d+)$/;
 
@@ -157,7 +171,11 @@
       // Community because the group is picked by WHOSE data it is, and this is
       // other builders reaching you — not your own numbers (that is You).
       { id: 'collab', label: 'Collab', icon: 'leaderboard', href: '/collab', gate: 'member' },
-      { id: 'leaderboard', label: 'Leaderboard', icon: 'leaderboard', href: '/#leaderboard', view: 'leaderboard', gate: 'member' },
+      // task 1003441: was the #leaderboard hash view on the home page, which is
+      // why this group read as one real page plus a link into index.html. Now a
+      // page, so no `view` key. Labelled Builders — 'roster' is the word
+      // modules/hall-ui/CLAUDE.md uses, but Builders is what a reader scans for.
+      { id: 'roster', label: 'Builders', icon: 'leaderboard', href: '/roster', gate: 'member' },
       // task 1002577: the cross-project builder directory (/scouting graduated
       // into the hall). Gated to MATCH its data — /api/gds/scouting checks
       // `project.curate`, whose catalog floor is METIC. This read 'archon' until
@@ -566,6 +584,12 @@
   }
 
   function route(opts) {
+    // The redirect runs BEFORE the view lookup: #leaderboard is no longer a
+    // view, so viewFromHash would return nothing and route() would leave the
+    // page on Home — a dead link that looks like it worked. replace() rather
+    // than assign() so Back does not bounce the reader between the two.
+    var redirect = IS_INDEX && VIEW_REDIRECTS[String(window.location.hash || "").replace(/^#/, "")];
+    if (redirect) { window.location.replace(redirect); return; }
     var target = viewFromHash(window.location.hash);
     if (target) {
       // An aliased hash owns its scroll position, so suppress setView's

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.473",
+  "version": "1.19.475",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.473",
+      "version": "1.19.475",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.473",
+  "version": "1.19.475",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -34,7 +34,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.473'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.475'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_nav.mjs

@@ -42,11 +42,17 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
     return el;
   };
 
+  // replace() is recorded, not ignored: task 1003441 retired the #leaderboard
+  // VIEW and route() answers that hash with location.replace('/roster'). A stub
+  // without it throws the moment a boot carries that hash, which is precisely
+  // why the redirect shipped untested the first time.
+  const replaced = [];
   const location = {
     hostname: 'builders.cloudbongos.com',
     origin: 'https://builders.cloudbongos.com',
     pathname, hash,
     assign() {},
+    replace(target) { replaced.push(String(target)); },
   };
 
   const documentObj = {
@@ -90,6 +96,7 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
     sidebarHtml: documentObj.getElementById('app-sidebar').innerHTML,
     viewHidden: (v) => documentObj.getElementById('view-' + v).hidden,
     shell: windowObj.OTBShell,
+    replaced,
   };
 }
 
@@ -155,7 +162,11 @@ test('sidebar groups read by audience, in order', () => {
   // First within the group because it is the one page here you ACT on; the
   // leaderboard and the directory are browsing surfaces. Updating this oracle is
   // the reviewed decision the pin exists to force.
-  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'leaderboard', 'people'], 'Community = everyone else');
+  // task 1003441: `leaderboard` → `roster`. The id changed because the THING
+  // changed: it was a hash view on index.html (href /#leaderboard, view:
+  // 'leaderboard') and is now a real page at /roster labelled Builders. That is
+  // what made this group read as one real page plus a link into the home page.
+  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'roster', 'people'], 'Community = everyone else');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');
   // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.
@@ -194,6 +205,30 @@ test('group-gate check actually CATCHES a head gated wider than its items', () =
   assert.equal(headOutOfRange({ label: 'X', headGate: 'archon', items: [{ gate: 'archon' }] }), false);
 });
 
+test('#leaderboard REDIRECTS to /roster from the index, and only from the index', () => {
+  // task 1003441: the Roll became a page, so its hash has no host view to
+  // alias onto. Without the redirect viewFromHash returns nothing and route()
+  // leaves the reader on Home — a dead link that looks like it worked, which
+  // is the failure this pins. The nav item points at the page, not the hash.
+  const ids = parseNav(boot().sidebarHtml).flatMap((g) => g.items.map((i) => i.id));
+  assert.ok(!ids.includes('leaderboard'), 'the hash-view nav entry retired with the view');
+  assert.ok(ids.includes('roster'), 'the page took its place');
+
+  const onIndex = boot({ page: 'home', hash: '#leaderboard', pathname: '/' });
+  assert.deepEqual(onIndex.replaced, ['/roster'],
+    'the index answers the retired hash with a replace() to the page');
+
+  // The guard matters: the hash is not this shell’s to interpret on a page
+  // that has no views, and hijacking it there would break an in-page anchor
+  // that happens to be spelled the same.
+  const offIndex = boot({ page: 'settings', hash: '#leaderboard', pathname: '/settings' });
+  assert.deepEqual(offIndex.replaced, [], 'a non-index page redirects nothing');
+
+  // And a hash the map does not name is still left alone entirely.
+  const unknown = boot({ page: 'home', hash: '#nope', pathname: '/' });
+  assert.deepEqual(unknown.replaced, [], 'an unknown hash is not a redirect');
+});
+
 test('Achievements has no nav entry, but #achievements still routes to Standing', () => {
   const ids = parseNav(boot().sidebarHtml).flatMap((g) => g.items.map((i) => i.id));
   assert.ok(!ids.includes('achievements'), 'the nav entry retired with task 2175');

package/tests/hall_page_gate_map.mjs

@@ -79,6 +79,14 @@ const ORACLE = {
 
   // Deliberately UNGATED — the landing card, the rank ladder, the reward
   // schedule and a builder's public portfolio all render for a stranger.
+  //
+  // /roster joins them (task 1003441): it is this project’s own ledger, and its
+  // one data source — GET /leaderboard — is deliberately unauthenticated,
+  // mirroring the public status surface. The page must not be gated tighter than
+  // the API it fronts, which is the same rule that puts /people at
+  // project.curate. It was reachable to a stranger as the #leaderboard view on
+  // the ungated index, so this preserves the audience rather than widening it.
+  '/builders/roster': null,
   '/builders/': null,
   '/builders/ranks': null,
   '/builders/drachmae': null,