@bongos/core 1.19.476 → 1.19.478

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.476",
-  "core_contract": "1.19.476",
-  "source_commit": "631886be90fa74af3353170d0f5e351a5cf100c7",
+  "core_version": "1.19.478",
+  "core_contract": "1.19.478",
+  "source_commit": "68f2bd02a4d1e4136b9469fb80d16e6b97896aac",
   "source_ref": "HEAD",
-  "built_at": "2026-09-02T16:34:36.724Z",
+  "built_at": "2026-09-02T17:55:45.973Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 413,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2275,
-  "tree_sha256": "06f67b13e31a022107f61818ab5b0dbc693fcd5c8fd30d8f58e27e16e4b7a113",
+  "tree_sha256": "616c87783ecd91c37264dc29f95012b4fc50fc2746b7df6340ea87522e180eea",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -252,7 +252,7 @@
     {
       "path": ".claude/skills/session-handoff/SKILL.md",
       "mode": "0000644",
-      "sha256": "ceca875c997081dda2692a1319f78dded07383b9b1645914a68dac09020e2035"
+      "sha256": "ddce51865985491a71bf89f734de3589cf2bb4f1ee76ac828b0c3905844db75f"
     },
     {
       "path": ".claude/skills/status/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "6e1ae5c410c8796df7efcdcd9cbd0ccebe1075da8bc18d503c50196d0e7db683"
+      "sha256": "df45c050cb2b49cf1862ffa595122041600eab26808e74f0ca1b6cdabc99c5eb"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1667,7 +1667,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "fa675542b54c8bbd96530ecaac630deaf9873cc9091714eb9fde660e5af2ad4e"
+      "sha256": "e0c405c9d3de164ae6cfc5796eb96068a36613130bfc4ea6459d2b2311a60107"
     },
     {
       "path": "docs/architecture.md",
@@ -2147,7 +2147,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e8957fb9ba93280d840032cdfd55ac8e8aaaf8fc7bc7a80df4e1e78a3cc9bcd1"
+      "sha256": "048ba70f31e863597acf8c21aecd13ea1a2966a58c14064266e0af68a8208d45"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4752,7 +4752,7 @@
     {
       "path": "modules/lifecycle/closeness.js",
       "mode": "0000644",
-      "sha256": "f5668020c115a6d356a74603dc4a7229ddfdb8d5015a22f871a35386a869fe58"
+      "sha256": "4ea4fe1c93ffe6d6f42af31d96dfe402d7dbccb4a5825b71c571024548a87c25"
     },
     {
       "path": "modules/lifecycle/conflict-resolve.js",
@@ -4962,7 +4962,7 @@
     {
       "path": "modules/lifecycle/routes/closeness.js",
       "mode": "0000644",
-      "sha256": "1950ba9d20f925fa1ecbe7fb37d35a5b80045c556c6f76caa90b82e213b7db88"
+      "sha256": "1ad8e353ead5c3fe39fadc1d48a2fc65725762cc298e206464ef242f7fdd292d"
     },
     {
       "path": "modules/lifecycle/routes/dependencies.js",
@@ -5312,7 +5312,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "1542edccc61a1cdb77540f5b6521a91477234af03cdde9178a1ed5516363e1fd"
+      "sha256": "c43bda216cc9c6ec1788dd5d6ef4978594c1ab6db61ad6af33ed8ce451594899"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -6692,12 +6692,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "66d0470b8bbef92b19fb646d6f7d03a07dbccdc43159a4a10cbfa7ef9edf234e"
+      "sha256": "6f770aa63ab58c0ce96f86e9b905b68dfba4c562b0c67d9233dfbbc4c0992ed5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eeae6c47ef2d23504ee84eaf0681717f9f78aee6e87ebd02af794e235b9127d7"
+      "sha256": "ab2302189b57d998f1004827eb9fc2b35e25e4bffb829b410d3c02ec024eeb47"
     },
     {
       "path": "public-docs/index.html",
@@ -8352,7 +8352,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e679812470446860395dcbc799ef21b0459c86f89e954ed9d50b4428f26be6ff"
+      "sha256": "5234d5effd57b6b2f8a0a4b41fa0357e6e081d57ead831943f08e634077decbb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8917,7 +8917,7 @@
     {
       "path": "tests/closeness.mjs",
       "mode": "0000644",
-      "sha256": "b5c4791d84aa3126714c7b3188320dc4df984e282a086196ded2394f825295d1"
+      "sha256": "be10e63b6a424914ba71537dbfa653dcb247b28b3e6a9a8caf4696268e4500cf"
     },
     {
       "path": "tests/cloud_bongos_pack.mjs",

package/.claude/skills/session-handoff/SKILL.md

@@ -16,10 +16,10 @@ Use it at the end of a working session, or mid-session when the context is getti
 
 Emit **exactly one fenced code block** (so it's trivially copy-pasteable) containing the prompt below. Write it for a reader — and a future Claude session — that has **none** of this conversation's context: be specific, name files by path, and spell out task ids as hall links, never a bare `#NNN`.
 
-Keep it **short and curated** — a prompt, not a transcript. Include only what the next session needs to act. Use these sections, dropping any that are genuinely empty:
+Keep it **short and curated** — a prompt, not a transcript. Include only what the next session needs to act. Target **under ~60 lines** inside the block: every line is context the fresh session pays for before it does anything. If it runs long, cut history first, then pointers — never the next steps or the first action. Use these sections, dropping any that are genuinely empty:
 
 1. **Goal / where things stand** — one or two lines: the overall objective and the current state.
-2. **Done this session** — a few bullets of what actually landed, each tagged `verified-prod` | `verified-smoke` | `implemented-not-verified` so the next session trusts the right things.
+2. **Done this session** — optional, and capped: **at most three one-line bullets**, each tagged `verified-prod` | `verified-smoke` | `implemented-not-verified`, and only for a fact the next session must TRUST before it builds — a behaviour it will rely on, a state it must not redo. The record of what landed already exists twice (the dated file under `docs/session-logs/` and the ship notes in the ledger), so point at that file by path rather than repeating it here. Drop the section when nothing needs trusting.
 3. **Next steps** — the ordered, concrete actions to take next. Name the exact files, functions, and task ids (as hall links). Lead with the single most important one.
 4. **Manual checks to run first** — anything the next session should verify before building on this work (a test to run, a page to load, a status to confirm).
 5. **Gotchas / watch-outs** — traps you hit or foresee (a stale-tooling merge, a flaky step, a gated path, a decision still open).
@@ -28,7 +28,7 @@ Keep it **short and curated** — a prompt, not a transcript. Include only what
 
 ## How to compose it
 
-- **Ground it in this session.** Pull the "Done" + "Next steps" from what actually happened here — the claims you worked, the files you touched, the decisions you made. If you hold an active claim, name it and its status.
+- **Ground it in this session.** Pull the "Next steps" (and the few "Done" facts worth trusting) from what actually happened here — the claims you worked, the files you touched, the decisions you made. If you hold an active claim, name it and its status. History belongs in the session log, not in the prompt.
 - **Mirror `docs/handoff-template.md`** for the section shape, but condense: a starter prompt is a fraction of a full session log.
 - **Self-contained.** Assume the fresh session starts cold. Every reference (file, task, ADR, URL) must be resolvable without this chat.
 - **Improvable.** If the builder edits the draft, keep their changes — this is their prompt to reuse and refine, not a fixed artifact.

package/clients/bongos-client/index.d.ts

@@ -37,7 +37,7 @@ export interface GetBuildersIdOnboardingResponse { builder_id: unknown; onboardi
 export interface GetBuildersIdProfileResponse { builder: unknown; shipped_count: unknown; recent_ships: unknown; achievements: unknown; cross_project?: unknown; handle?: unknown }
 export interface GetBuildersMePendingRankChangeResponse { change: unknown; greeting?: unknown }
 export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unknown; stale_hours_source: unknown }
-export interface GetClosenessForMeResponse { closeness: unknown; count: unknown }
+export interface GetClosenessForMeResponse { closeness: unknown; count: unknown; returned: unknown }
 export interface GetClosenessWeightsResponse { weights: unknown; window_days: unknown; note: unknown }
 export interface GetClosenessWithBuilderIdResponse { closeness: unknown; why: unknown }
 export interface GetConnectionsDegreeHandleResponse { handle: unknown; degree: unknown; mutuals: unknown; mutual_count: unknown; truncated: unknown }

package/docs/api/openapi.json

@@ -15912,11 +15912,13 @@
         "type": "object",
         "properties": {
           "closeness": {},
-          "count": {}
+          "count": {},
+          "returned": {}
         },
         "required": [
           "closeness",
-          "count"
+          "count",
+          "returned"
         ]
       },
       "GetClosenessWeightsResponse": {

package/docs/module-api-changelog.md

@@ -1389,5 +1389,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.474 with no explicit bump. run 33653632532. (task 1002620)
   1.19.476 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.475 with no explicit bump. run 33655706909. (task 1002620)
+  1.19.477 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.476 with no explicit bump. run 33662059275. (task 1002620)
+  1.19.478 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.477 with no explicit bump. run 33664027105. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/closeness.js

@@ -24,13 +24,18 @@
 // dropped and the remaining weights are renormalised, and the breakdown names what
 // was excluded and why.
 //
-// CONSENT. ADR 0171's posture is fail-closed account state with the hide flag
-// enforced in the READ path (task 1002277) — a builder who hid their profile must
-// not reappear as a node in someone else's graph. This file routes EVERY graph
-// read through one gate, `applyConsent`, rather than filtering at each call site,
-// so C05 (task 1003175, "consent is the read path, not a filter bolted on after")
-// has a single structural place to make it so. The gate FAILS CLOSED on error:
-// a consent read that throws drops the graph to empty rather than serving it.
+// CONSENT (task 1003175 / C05). ADR 0171's posture is INHERITED, not reinvented:
+// fail-closed account state, the hide flag enforced in the READ path (task
+// 1002277) — a builder who hid their profile must not reappear as a node in
+// someone else's graph. What C05 adds is WHERE the gate sits. `consentedIds` gates
+// candidate IDS, and `readConsentedSignals` applies it to the signal maps
+// themselves, so the graph is ASSEMBLED FROM CONSENTED DATA rather than assembled
+// and then filtered. Nothing downstream — score, rank, total, page, hydrate — can
+// see a hidden builder, because they were never in the set those are derived from.
+// That is the difference the criterion asks for: an assembled-then-filtered graph
+// still leaks through counts, ranks and totals even when the row itself is gone.
+// The gate FAILS CLOSED: a consent read that throws or returns null yields the
+// empty set, and so the empty graph.
 //
 // A KNOWN PERFORMANCE GAP, measured rather than assumed. The signal joins key on
 // tasks.goal_id (NO index), claims.builder_id and claims.task_id (indexed only
@@ -243,11 +248,21 @@ function toCountMap(rows) {
 }
 
 // ---------------------------------------------------------------------------
-// Consent — ONE gate, fail-closed
+// Consent — ONE gate, fail-closed, and UPSTREAM of everything derived
 // ---------------------------------------------------------------------------
 //
-// Every graph read passes through here, so C05 has a single structural place to
-// make consent the read path rather than a filter bolted on at each call site.
+// C05 (task 1003175) is "consent is the READ PATH, not a filter bolted on after",
+// and the distinction is structural rather than stylistic. The gate takes a set of
+// candidate builder IDS and returns the ones that may be seen — it never takes
+// assembled rows. Consent is therefore resolved before a score, a rank, a total or
+// a page exists, so there is no derived quantity that could have been computed
+// while a hidden builder was still in the set.
+//
+// A gate that filtered assembled entries leaves every present and future aggregate
+// one forgetful line away from leaking: "you have 4 close collaborators" over a
+// list of 3 is a leak by subtraction even though the node itself is absent, and so
+// is a page that comes back one short, and so is a rank with a gap in it. Removing
+// the row is the easy half; never having counted it is the guarantee.
 //
 // `hiddenIdsFor` is injected: the platform-identity hub owns the hide flag
 // (ADR 0171 D2/D4) and lifecycle must not reach across a module boundary to read
@@ -255,19 +270,49 @@ function toCountMap(rows) {
 // is enabled there is no hub-level hide flag to honour, and NOTHING is suppressed
 // by this mechanism — which is correct, not a hole: on such an instance nobody has
 // been offered the switch. What is NOT tolerated is an ERROR being read as
-// "nobody is hidden", so a throwing reader empties the graph.
-async function applyConsent(entries, hiddenIdsFor) {
-  if (typeof hiddenIdsFor !== 'function') return entries;
+// "nobody is hidden", so a throwing reader yields the empty set.
+async function consentedIds(candidateIds, hiddenIdsFor) {
+  const ids = [...candidateIds].map(String);
+  if (typeof hiddenIdsFor !== 'function') return new Set(ids);
+  if (!ids.length) return new Set();
   let hidden;
   try {
-    hidden = await hiddenIdsFor(entries.map((e) => e.builder_id));
+    hidden = await hiddenIdsFor(ids);
   } catch (_) {
     // FAIL CLOSED. An unreadable consent state is not permission.
-    return [];
+    return new Set();
   }
-  if (!hidden) return [];                       // ditto: null is not "nobody"
+  if (!hidden) return new Set();                // ditto: null is not "nobody"
   const set = hidden instanceof Set ? hidden : new Set((hidden || []).map(String));
-  return entries.filter((e) => !set.has(String(e.builder_id)));
+  return new Set(ids.filter((id) => !set.has(id)));
+}
+
+// THE READ PATH. Reads the three signals and hands back count maps that have
+// ALREADY passed the consent gate — a hidden builder is not a key in any of them.
+// Every graph read goes through this one function, so consent is not a step a
+// caller performs but a property of the data a caller is given.
+async function readConsentedSignals(builderId, { otherId = null, hiddenIdsFor } = {}, deps = {}) {
+  const activePool = deps.pool || pool;
+  const [coClaim, coSession, shipped] = await Promise.all([
+    coClaimCounts(builderId, { otherId }, { pool: activePool }),
+    coSessionCounts(builderId, { otherId }, { pool: activePool }),
+    shippedTogetherCounts(builderId, { otherId }, { pool: activePool }),
+  ]);
+
+  const candidates = new Set([...coClaim.keys(), ...coSession.keys(), ...shipped.keys()]);
+  const allowed = await consentedIds(candidates, hiddenIdsFor);
+  return {
+    ids: allowed,
+    co_claim: keepOnly(coClaim, allowed),
+    co_build_session: keepOnly(coSession, allowed),
+    shipped_together_goal: keepOnly(shipped, allowed),
+  };
+}
+
+function keepOnly(counts, allowed) {
+  const m = new Map();
+  for (const id of allowed) if (counts.has(id)) m.set(id, counts.get(id));
+  return m;
 }
 
 // ---------------------------------------------------------------------------
@@ -275,28 +320,30 @@ async function applyConsent(entries, hiddenIdsFor) {
 // ---------------------------------------------------------------------------
 
 // Everyone this builder has any measurable closeness to, scored and explained,
-// strongest first. `hiddenIdsFor` is the consent gate above.
-// `otherId` narrows every signal query to one pair at the DATABASE, so the pair
-// read does not fetch a hundred rows to keep one. It is threaded through rather
-// than filtered afterwards — see the note above the signal reads.
+// strongest first. `otherId` narrows every signal query to one pair at the
+// DATABASE, so the pair read does not fetch a hundred rows to keep one.
+//
+// Returns `{ entries, total }`. `total` is the size of the CONSENTED graph before
+// paging — the honest answer to "how many people am I close to", counted here,
+// downstream of the gate. It is returned rather than left to the caller because
+// both ways a caller could work it out are wrong: counting pre-gate rows is the
+// "you have 4 close collaborators" leak itself, and counting the page answers 100
+// for a builder with 300.
 async function closenessFor(builderId, { limit = MAX_ROWS, hiddenIdsFor, otherId = null } = {}, deps = {}) {
   const activePool = deps.pool || pool;
-  const [coClaim, coSession, shipped] = await Promise.all([
-    coClaimCounts(builderId, { otherId }, { pool: activePool }),
-    coSessionCounts(builderId, { otherId }, { pool: activePool }),
-    shippedTogetherCounts(builderId, { otherId }, { pool: activePool }),
-  ]);
+  // Nothing below this line can see a builder who hid: they are not a key in any
+  // of these maps, so no score, rank, total or page is ever computed with them in.
+  const signals = await readConsentedSignals(builderId, { otherId, hiddenIdsFor }, { pool: activePool });
 
-  const ids = new Set([...coClaim.keys(), ...coSession.keys(), ...shipped.keys()]);
-  let entries = [...ids].map((otherId) => {
+  const entries = [...signals.ids].map((id) => {
     const counts = {
-      co_claim: coClaim.get(otherId) || 0,
-      co_build_session: coSession.get(otherId) || 0,
-      shipped_together_goal: shipped.get(otherId) || 0,
+      co_claim: signals.co_claim.get(id) || 0,
+      co_build_session: signals.co_build_session.get(id) || 0,
+      shipped_together_goal: signals.shipped_together_goal.get(id) || 0,
     };
     const scored = scoreCloseness(counts);
     return {
-      builder_id: otherId,
+      builder_id: id,
       score: scored.score,
       // The explanation travels WITH the score, on every surface, rather than
       // behind a second call a caller may not make. That is the decision.
@@ -304,11 +351,14 @@ async function closenessFor(builderId, { limit = MAX_ROWS, hiddenIdsFor, otherId
     };
   }).filter((e) => e.score > 0);
 
-  entries = await applyConsent(entries, hiddenIdsFor);
+  // Ranking and paging run over the consented set, so positions are dense — a
+  // hidden builder leaves no gap at the top of someone's graph — and the page is
+  // filled from the rest rather than coming back short. A short page announces a
+  // removal as loudly as the row would have.
   entries.sort((a, b) => b.score - a.score || String(a.builder_id).localeCompare(String(b.builder_id)));
-  entries = entries.slice(0, capRows(limit));
+  const total = entries.length;
 
-  return hydrate(entries, activePool);
+  return { entries: await hydrate(entries.slice(0, capRows(limit)), activePool), total };
 }
 
 // One pair, with the same breakdown the graph carries. Separate from closenessFor
@@ -323,7 +373,7 @@ async function closenessBetween(builderId, otherId, { hiddenIdsFor } = {}, deps
   // into the same queries, so there is still exactly one definition of each
   // signal and the pair read costs a pair.
   const graph = await closenessFor(builderId, { limit: 1, hiddenIdsFor, otherId }, { pool: activePool });
-  const found = graph.find((e) => String(e.builder_id) === String(otherId));
+  const found = graph.entries.find((e) => String(e.builder_id) === String(otherId));
   if (found) return found;
 
   // Not in the graph. That is either "no measurable closeness" or "consent says
@@ -359,5 +409,5 @@ module.exports = {
   weightsModel, availableSignals, unavailableSignals,
   scoreCloseness, explainInWords,
   coClaimCounts, coSessionCounts, shippedTogetherCounts,
-  applyConsent, closenessFor, closenessBetween,
+  consentedIds, readConsentedSignals, closenessFor, closenessBetween,
 };

package/modules/lifecycle/routes/closeness.js

@@ -15,10 +15,13 @@
 // a caller may simply not make is how a score ends up on a page with nothing to
 // point at. So `why` rides in the same payload as the number, always.
 //
-// CONSENT is resolved here and passed INTO the read as a gate (see
-// closeness.js applyConsent), never applied to the output afterwards. The hub owns
-// the hide flag (ADR 0171 D2/D4) and lifecycle must not read another module's
-// table (ADR 0083), so the port is resolved optionally and a reader is handed down.
+// CONSENT is resolved here and passed INTO the read as a gate (closeness.js
+// `consentedIds`, applied by `readConsentedSignals` to the signal maps), never to
+// the output afterwards — these handlers receive a graph that was assembled from
+// consented data, and so have no filtering left to forget. That is C05 (task
+// 1003175). The hub owns the hide flag (ADR 0171 D2/D4) and lifecycle must not
+// read another module's table (ADR 0083), so the port is resolved optionally and a
+// reader is handed down.
 //
 // Reaches core only through the doorway (ADR 0083).
 
@@ -36,8 +39,9 @@ const { asyncHandler, parseId } = api;
 // hub-level hide flag to honour, because nobody on that instance has been offered
 // the switch — suppressing everyone would not be consent, it would be an outage.
 // What must never happen is an ERROR being read as "nobody is hidden", and that is
-// why the reader THROWS rather than swallowing: applyConsent catches and empties
-// the graph, which is the fail-closed direction ADR 0171 asks for.
+// why the reader THROWS rather than swallowing: consentedIds catches and yields
+// the empty set, so the graph is empty — the fail-closed direction ADR 0171 asks
+// for.
 function consentReader(pool) {
   const hub = api.resolveOptional('platform-identity.hub');
   if (!hub || typeof hub.hiddenGithubIds !== 'function') return null;
@@ -85,10 +89,15 @@ module.exports = function buildClosenessRouter() {
   // Reading another builder's graph would expose who THEY are close to, which is
   // a fact about third parties they did not consent to share.
   router.get('/closeness/for-me', api.requireBuilder, asyncHandler('GET /closeness/for-me', async (req, res) => {
-    const rows = await closeness.closenessFor(req.builder.id, {
+    const { entries, total } = await closeness.closenessFor(req.builder.id, {
       hiddenIdsFor: consentReader(api.pool),
     });
-    return res.json({ closeness: rows, count: rows.length });
+    // `count` is the CONSENTED total the read counted for us, never `entries.length`.
+    // Counting the page here would be wrong twice over: it is the surface that says
+    // "you have N close collaborators", so counting rows that were assembled before
+    // the gate is the leak this criterion is about, and counting the page after it
+    // answers 100 for a builder with 300.
+    return res.json({ closeness: entries, count: total, returned: entries.length });
   }, { errorCode: 'closeness_failed' }));
 
   // One pair — "why am I close to THEM", asked directly rather than by paging the

package/modules/platform-identity/platform-identity.js

@@ -886,7 +886,7 @@ async function getPublicProfileExtras(githubId, { pool = defaultPool } = {}) {
 // FAIL-CLOSED is the CALLER's job here, and deliberately so: this function
 // THROWS on a bad read rather than returning an empty set, because an empty set
 // means "nobody is hidden" and a database error must never be able to say that.
-// modules/lifecycle/closeness.js applyConsent catches and empties the graph.
+// modules/lifecycle/closeness.js consentedIds catches and empties the graph.
 async function hiddenGithubIds(githubIds, { pool = defaultPool } = {}) {
   const ids = (Array.isArray(githubIds) ? githubIds : []).filter(isNumericGithubId).map(String);
   if (!ids.length) return new Set();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.476",
+  "version": "1.19.478",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.476",
+      "version": "1.19.478",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.476",
+  "version": "1.19.478",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -34,7 +34,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.476'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.478'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/closeness.mjs

@@ -9,9 +9,10 @@
 //   3. a hidden builder appears in no graph.
 //
 // The scorer is pure, so 1 and 2 are driven with real inputs rather than asserted
-// over source. 3 is a consent property of the read, and is driven through the
-// real applyConsent gate with stub readers — including the failure modes, which
-// are the ones that actually matter.
+// over source. 3 is a consent property of the read, and since task 1003175 (C05)
+// it is driven through the REAL graph read against a stub pool — the leak tests
+// need a graph that was actually assembled, not a gate called in isolation —
+// including the failure modes, which are the ones that actually matter.
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
@@ -152,55 +153,174 @@ test('effective weights always sum to 1 over the available subset', () => {
   assert.ok(Math.abs(summed - 1) < 1e-3, `effective weights sum to ${summed}`);
 });
 
-// ── 3. CONSENT: a hidden builder appears in NO graph ────────────────────────
-
-const entries = () => [
-  { builder_id: '10', score: 0.9 },
-  { builder_id: '20', score: 0.5 },
-  { builder_id: '30', score: 0.1 },
-];
-
-test('THE CONSENT RULE: a hidden builder is removed from the graph', () => {
-  return closeness.applyConsent(entries(), async () => new Set(['20']))
-    .then((out) => assert.deepEqual(out.map((e) => e.builder_id), ['10', '30']));
+// ── 3. CONSENT IS THE READ PATH (task 1003175 / C05) ────────────────────────
+//
+// C04 gated the graph by filtering assembled rows. C05's criterion says that is
+// not enough: "the hide cannot be a post-filter over an already-assembled graph —
+// an assembled-then-filtered graph leaks through counts, ranks and 'you have 4
+// close collaborators' totals even when the node itself is hidden. Test the leak,
+// not just the absence of the row."
+//
+// So these drive the REAL closenessFor against a stub pool and assert on the four
+// things a post-filter gets wrong — the total, the identity read, the ranking and
+// the page — rather than only on the missing row. Every one of them fails if the
+// gate is moved back downstream of assembly.
+
+// A pool that answers the three signal queries and the hydrate, keyed off the SQL
+// each read actually sends. It also RECORDS which ids were hydrated, which is how
+// "a hidden builder's identity is never read" becomes an observation rather than a
+// claim about source order.
+function fakePool({ coClaim = {}, coSession = {}, shipped = {} } = {}) {
+  const seen = { hydrated: null };
+  const toRows = (obj) => Object.entries(obj).map(([other_id, n]) => ({ other_id, n }));
+  return {
+    seen,
+    async query(sql, params) {
+      if (/FROM claims mine/.test(sql)) return { rows: toRows(coClaim) };
+      if (/FROM session_logs mine/.test(sql)) return { rows: toRows(coSession) };
+      if (/FROM tasks t_mine/.test(sql)) return { rows: toRows(shipped) };
+      if (/FROM builders WHERE id/.test(sql)) {
+        seen.hydrated = (params[0] || []).map(String);
+        return {
+          rows: seen.hydrated.map((id) => ({
+            id, github_login: `u${id}`, display_name: `B${id}`, avatar_url: null,
+          })),
+        };
+      }
+      throw new Error(`unexpected query: ${sql.slice(0, 70)}`);
+    },
+  };
+}
+
+// Four collaborators of clearly separated strength. '40' is the STRONGEST, so
+// hiding them is the case that moves the top of the ranking.
+const GRAPH = { coClaim: { 10: 1, 20: 2, 30: 3, 40: 9 } };
+const hides = (...ids) => async () => new Set(ids.map(String));
+
+test('THE CONSENT RULE: a hidden builder is no node in anyone else\'s graph', async () => {
+  const pool = fakePool(GRAPH);
+  const { entries } = await closeness.closenessFor(1, { hiddenIdsFor: hides(40) }, { pool });
+  assert.deepEqual(entries.map((e) => e.builder_id).sort(), ['10', '20', '30']);
+});
+
+test('THE COUNTS LEAK: the total counts the CONSENTED graph, not the assembled one', async () => {
+  // This is the criterion's own example. Four candidates, one hidden — a surface
+  // that says "you have 4 close collaborators" over a list of 3 has leaked the
+  // hidden builder by subtraction, without ever showing their row.
+  const pool = fakePool(GRAPH);
+  const { entries, total } = await closeness.closenessFor(1, { hiddenIdsFor: hides(40) }, { pool });
+  assert.equal(total, 3, 'the total is counted after the gate, not before it');
+  assert.equal(entries.length, 3);
+});
+
+test('THE IDENTITY LEAK: a hidden builder\'s name is never even fetched', async () => {
+  // Not fetched and then dropped — never asked for. A post-filter that ran after
+  // hydrate would still have read the row.
+  const pool = fakePool(GRAPH);
+  await closeness.closenessFor(1, { hiddenIdsFor: hides(40) }, { pool });
+  assert.ok(pool.seen.hydrated, 'the graph was hydrated');
+  assert.ok(!pool.seen.hydrated.includes('40'), 'the hidden builder was never looked up');
+});
+
+test('THE RANK LEAK: hiding the top scorer leaves no gap at the top', async () => {
+  // Ranking runs over the consented set, so the #1 slot is the strongest VISIBLE
+  // collaborator. Ranked before the gate, the top slot belongs to the hidden
+  // builder and is then removed — so "who am I closest to" comes back EMPTY for a
+  // builder who has three collaborators, which tells them precisely that someone
+  // was taken out from above them. Asked for one, you get the real one.
+  const pool = fakePool(GRAPH);
+  const { entries, total } = await closeness.closenessFor(1, { limit: 1, hiddenIdsFor: hides(40) }, { pool });
+  assert.equal(entries.length, 1, 'the #1 slot is filled, not vacated by the hidden builder');
+  assert.equal(entries[0].builder_id, '30', 'and it is the top VISIBLE builder');
+  assert.equal(total, 3);
+
+  // Ordering over the whole consented graph is dense and monotonic — no rank a
+  // reader could subtract from.
+  const all = await closeness.closenessFor(1, { hiddenIdsFor: hides(40) }, { pool });
+  const scores = all.entries.map((e) => e.score);
+  assert.deepEqual(scores, [...scores].sort((a, b) => b - a));
+});
+
+test('THE PAGE LEAK: a page is refilled from the rest, never returned short', async () => {
+  // Gating after the slice would hand back one row for a limit of two, and a page
+  // that comes back short announces a removal as loudly as the row would have.
+  const pool = fakePool(GRAPH);
+  const { entries, total } = await closeness.closenessFor(1, { limit: 2, hiddenIdsFor: hides(40) }, { pool });
+  assert.equal(entries.length, 2, 'the page is full');
+  assert.deepEqual(entries.map((e) => e.builder_id), ['30', '20']);
+  assert.equal(total, 3, 'and the total still describes the whole consented graph, not the page');
 });
 
 test('FAIL CLOSED: a consent read that THROWS empties the graph', async () => {
   // An unreadable consent state is not permission. This is the direction that
   // matters: the opposite default would serve a hidden builder on any hiccup.
-  const out = await closeness.applyConsent(entries(), async () => { throw new Error('hub down'); });
-  assert.deepEqual(out, []);
+  const pool = fakePool(GRAPH);
+  const { entries, total } = await closeness.closenessFor(1, {
+    hiddenIdsFor: async () => { throw new Error('hub down'); },
+  }, { pool });
+  assert.deepEqual(entries, []);
+  assert.equal(total, 0);
+  assert.equal(pool.seen.hydrated, null, 'and nobody was looked up on the way out');
 });
 
 test('FAIL CLOSED: a consent read returning null empties the graph too', async () => {
   // null is not "nobody is hidden".
-  const out = await closeness.applyConsent(entries(), async () => null);
-  assert.deepEqual(out, []);
+  const pool = fakePool(GRAPH);
+  const { entries, total } = await closeness.closenessFor(1, { hiddenIdsFor: async () => null }, { pool });
+  assert.deepEqual(entries, []);
+  assert.equal(total, 0);
 });
 
 test('no consent reader at all leaves the graph intact — that is not a hole', async () => {
   // Where the hub module is off there is no hub-level hide flag to honour,
   // because nobody on that instance has been offered the switch. Suppressing
   // everyone would not be consent, it would be an outage.
-  const out = await closeness.applyConsent(entries(), null);
-  assert.equal(out.length, 3);
+  const pool = fakePool(GRAPH);
+  const { entries, total } = await closeness.closenessFor(1, {}, { pool });
+  assert.equal(entries.length, 4);
+  assert.equal(total, 4);
 });
 
-test('consent is ONE gate the reads pass through, not a filter at each call site', () => {
-  // C05 (task 1003175) is "consent is the read path, not a filter bolted on
-  // after" — it needs a single structural place, and this is it.
-  assert.equal((SRC.match(/await applyConsent\(/g) || []).length, 1,
-    'exactly one call site applies consent');
-  assert.match(SRC, /entries = await applyConsent\(entries, hiddenIdsFor\);/);
+// ── the gate's own shape ────────────────────────────────────────────────────
+
+test('THE GATE TAKES IDS, NEVER ASSEMBLED ROWS — that is what makes it the read path', () => {
+  // The whole of C05 is this signature. A gate over ids can only be applied before
+  // there is anything to derive; a gate over rows invites being applied after.
+  const fn = SRC.slice(SRC.indexOf('async function consentedIds'));
+  const body = fn.slice(0, fn.indexOf('\n}'));
+  assert.ok(!/\.score|\.builder_id|entries/.test(body),
+    'the gate never touches a scored row');
 });
 
-test('a suppressed builder\'s identity is never even read', () => {
-  // hydrate() runs AFTER applyConsent, so a hidden builder\'s name and avatar are
-  // not fetched at all — not fetched and then dropped.
+test('consent is applied to the SIGNALS, so the graph is built from consented data', async () => {
+  // readConsentedSignals is the single structural place. The maps it returns do
+  // not contain a hidden builder, so nothing assembled from them can.
+  const pool = fakePool(GRAPH);
+  const signals = await closeness.readConsentedSignals(1, { hiddenIdsFor: hides(40) }, { pool });
+  assert.deepEqual([...signals.ids].sort(), ['10', '20', '30']);
+  assert.ok(!signals.co_claim.has('40'), 'the hidden builder is not a key in the signal map');
+});
+
+test('consent is ONE gate, and the graph read never re-implements it', () => {
+  assert.equal((SRC.match(/await consentedIds\(/g) || []).length, 1,
+    'exactly one call site applies the gate');
+  const fn = SRC.slice(SRC.indexOf('async function closenessFor'));
+  const body = fn.slice(0, fn.indexOf('\n}'));
+  assert.ok(!/consentedIds|\.filter\([^)]*hidden/i.test(body),
+    'closenessFor does not filter on consent itself — it reads already-consented data');
+  assert.match(body, /await readConsentedSignals\(/);
+});
+
+test('everything derived comes AFTER the gate', () => {
+  // Source order is the backstop for the behavioural tests above: the read, then
+  // the scoring, then the total. A future aggregate added below this line inherits
+  // the guarantee; one added above it would not.
   const fn = SRC.slice(SRC.indexOf('async function closenessFor'));
   const body = fn.slice(0, fn.indexOf('\n}'));
-  assert.ok(body.indexOf('applyConsent') < body.indexOf('return hydrate'),
-    'consent is applied before hydration');
+  const gate = body.indexOf('readConsentedSignals');
+  for (const derived of ['scoreCloseness(', 'entries.sort(', 'const total', 'hydrate(']) {
+    assert.ok(gate < body.indexOf(derived), `${derived} is computed after the gate`);
+  }
 });
 
 test('the pair read cannot be used to detect that someone hid themselves', () => {