@bongos/core 1.19.578 → 1.19.580

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1707,
-    "unique_ids": 1476,
-    "certain": 1707,
+    "strings": 1709,
+    "unique_ids": 1478,
+    "certain": 1709,
     "heuristic": 0,
     "duplicate_ids": 162
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 78,
-      "strings": 1234
+      "strings": 1237
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -23,7 +23,7 @@
     "landing": {
       "at": "modules/public-landing/public",
       "files": 5,
-      "strings": 373
+      "strings": 372
     }
   },
   "blind_spots": [
@@ -159,7 +159,7 @@
         "modules/hall-ui/public/hall-render.js:605",
         "modules/hall-ui/public/idea.js:207",
         "modules/hall-ui/public/ideas.js:476",
-        "modules/hall-ui/public/watch.js:1137"
+        "modules/hall-ui/public/watch.js:1212"
       ]
     },
     {
@@ -243,7 +243,7 @@
         "modules/hall-ui/public/gate.js:219",
         "modules/hall-ui/public/government.js:1104",
         "modules/hall-ui/public/harbor.js:337",
-        "modules/hall-ui/public/watch.js:1166"
+        "modules/hall-ui/public/watch.js:1241"
       ]
     },
     {
@@ -504,7 +504,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/collab.js:41",
-        "modules/hall-ui/public/watch.js:389"
+        "modules/hall-ui/public/watch.js:464"
       ]
     },
     {
@@ -1134,7 +1134,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/drachmae.js:148",
-        "modules/hall-ui/public/watch.js:1027"
+        "modules/hall-ui/public/watch.js:1102"
       ]
     },
     {
@@ -1713,7 +1713,7 @@
       "text": "{…} {…}{…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/watch.js:379",
+        "modules/hall-ui/public/watch.js:450",
         "modules/hall-ui/public/work.js:223"
       ]
     },
@@ -2233,6 +2233,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "74cc57f76b42",
+      "surface": "builders-hall",
+      "text": "Active recently",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 411,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "524188fe0078",
       "surface": "builders-hall",
@@ -2454,7 +2463,7 @@
       "surface": "builders-hall",
       "text": "Asked {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 389,
+      "line": 464,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3453,7 +3462,7 @@
       "surface": "builders-hall",
       "text": "Could not change rank: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 720,
+      "line": 795,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3462,7 +3471,7 @@
       "surface": "builders-hall",
       "text": "Could not change standing: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 746,
+      "line": 821,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3678,7 +3687,7 @@
       "surface": "builders-hall",
       "text": "Could not load this page.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1212,
+      "line": 1287,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3750,7 +3759,7 @@
       "surface": "builders-hall",
       "text": "Could not read the report: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 541,
+      "line": 616,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4020,7 +4029,7 @@
       "surface": "builders-hall",
       "text": "Could not verify your access. Go back and try again.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1211,
+      "line": 1286,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7026,7 +7035,7 @@
       "surface": "builders-hall",
       "text": "Over the last {…} days",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1054,
+      "line": 1129,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7255,6 +7264,15 @@
       "origin": "html-title",
       "confidence": "certain"
     },
+    {
+      "id": "92d8fad6dc91",
+      "surface": "builders-hall",
+      "text": "Private account — this is all they share by applying.",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 412,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "2b88c01d1697",
       "surface": "builders-hall",
@@ -7431,7 +7449,7 @@
       "surface": "builders-hall",
       "text": "Rank set to {…}.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 714,
+      "line": 789,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7503,7 +7521,7 @@
       "surface": "builders-hall",
       "text": "Read it as a table",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1027,
+      "line": 1102,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7818,7 +7836,7 @@
       "surface": "builders-hall",
       "text": "Report {…}.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 475,
+      "line": 550,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7971,7 +7989,7 @@
       "surface": "builders-hall",
       "text": "Restricted.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1166,
+      "line": 1241,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8745,7 +8763,7 @@
       "surface": "builders-hall",
       "text": "System oversight: people, operations and security.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1225,
+      "line": 1300,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9442,6 +9460,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "b7c288328f79",
+      "surface": "builders-hall",
+      "text": "This builder hides their cross-project record.",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 393,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "ed313d96b419",
       "surface": "builders-hall",
@@ -11787,7 +11814,7 @@
       "surface": "builders-hall",
       "text": "task {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1137,
+      "line": 1212,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12417,7 +12444,7 @@
       "surface": "builders-hall",
       "text": "{…} {…}{…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 379,
+      "line": 450,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16093,15 +16120,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "78a1684630fa",
-      "surface": "landing",
-      "text": "— the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.",
-      "file": "modules/public-landing/public/projects.html",
-      "line": 828,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "b5bac008ba11",
       "surface": "landing",

package/docs/file-map.md

@@ -365,6 +365,7 @@ tests/
 ├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked three ways. DB-free `unit` lane.
 ├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
 ├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
+├── applicant_profile_boundary.mjs ← (task 1002972, goal 1000045 C4, privacy spec D7, ADR 0241): THE D7 BOUNDARY proof for the applicant view a reviewer sees. Whitelists read from the MODULES’ own exports — the private branch against `recruiter-sliver`’s `SLIVER_KEYS`/`SLIVER_KEYS_HIDDEN`, the public branch against the public-page payload’s key list — so a third shape (the “new disclosure class” D7 forbids) reds this file. Pins THE CONSENT SWAP in both directions on the same account: a private builder who never opted into recruiting gets an applicant view and gets `null` from `getRecruiterSliver`, so a refactor routing the port through the recruiter sliver cannot pass quietly. `hide_stats` beats the application in both branches; provisional and terms-never-accepted disclose nothing; planted sentinels asserted absent from the whole body with the avatar-embedded `github_id` pinned as the one honest exception. Plus the federated gate (ADR 0205): no echo → 404 and NO account row read (asserted on the statement log), the witness matched against the AUTHENTICATED client, an out-of-window echo stops working, and `Cache-Control: no-store`. Real router + real HTTP over in-memory tables filtered by each statement’s own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 ├── recruiter_sliver_boundary.mjs ← (task 1002968, goal 1000045 C2/C5, privacy spec D3, ADR 0215): THE PRE-ACCEPT BOUNDARY proof for the D3 recruiter sliver. A WHITELIST over the module's own exported key list (a sixth key fails whether or not this file was told about it), planted improbable sentinels asserted absent from the WHOLE response body with two controls against vacuity, the ceiling assertion (the handle a recruiter is handed 404s at `GET /profiles/:handle`, with a 200 control) and the gate (both recruiting routes admit the same two audiences and refuse byte-identically). Real router + real HTTP over an in-memory table filtered by each statement's own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 └── public_task_resolver.mjs      ← (#604): the public `/public/tasks/:id` projection — title/value_summary exposed only for shipped|confirmed; withheld for in-flight so unshipped/security task names can't leak.
 ```

package/docs/module-api-changelog.md

@@ -1605,5 +1605,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.576 with no explicit bump. run 34142767912. (task 1002620)
   1.19.578 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.577 with no explicit bump. run 34146835487. (task 1002620)
+  1.19.579 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.578 with no explicit bump. run 34149317186. (task 1002620)
+  1.19.580 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.579 with no explicit bump. run 34153217035. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -792,6 +792,8 @@ function createClient(opts = {}) {
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup
       postSsoActivityRollup: (args) => request("POST", "/sso/activity/rollup", { hasBody: true }, args),
+      // POST /sso/applicant-profile — rank: public — POST /sso/applicant-profile
+      postSsoApplicantProfile: (args) => request("POST", "/sso/applicant-profile", { hasBody: true }, args),
       // GET /sso/authorize — rank: public — GET /sso/authorize
       getSsoAuthorize: (args) => request("GET", "/sso/authorize", { hasBody: false }, args),
       // POST /sso/device/poll — rank: public — POST /sso/device/poll

package/modules/hall-ui/public/oversight.css

@@ -119,6 +119,13 @@ a.ov-row__title:hover { color: var(--accent-ink); text-decoration: underline; te
 .ov-row__sub { display: block; margin: 4px 0 0; font-size: 13.5px; line-height: 1.5; color: var(--ink-soft); max-width: var(--measure); overflow-wrap: anywhere; }
 .ov-row__facts { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 10px; margin: 10px 0 0; }
 .ov-row__sub + .ov-row__facts { margin-top: 8px; }
+/* The applicant's own profile inside an access-request row (task 1002972, D7).
+   A rule on the inline edge rather than a card: it is the APPLICANT speaking
+   through their own privacy settings, and it must read as evidence attached to
+   their ask — never as another decision surface competing with the buttons. */
+.ov-row__profile { margin: 10px 0 0; padding-left: 12px; border-left: 2px solid var(--rule); }
+.ov-row__profile .ov-row__sub { margin-top: 0; }
+.ov-row__profile .ov-row__facts { margin-top: 6px; }
 .ov-row__right { display: flex; flex-direction: column; align-items: flex-end; gap: 8px; text-align: right; }
 .ov-row__actions { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 8px; }
 .ov-row__when { font-size: 12.5px; color: var(--ink-faint); font-variant-numeric: tabular-nums; white-space: nowrap; }

package/modules/hall-ui/public/watch.js

@@ -350,6 +350,77 @@
       : '<span class="fact-pill fact-pill--warn" title="Nobody vouched for this name — anyone can file a request naming anyone. Confirm who is asking before you admit them.">Name unvouched</span>';
   }
 
+  // ---- the applicant's own profile, beside their ask (task 1002972, D7) -----
+  //
+  // The reviewer sees what the APPLICANT'S OWN privacy rules would show them —
+  // resolved live by the server on every render, never stored on the request. So
+  // this renderer decides nothing about disclosure: it draws whichever of the
+  // two shapes the server sent, and draws nothing at all when it sent null. A
+  // null covers "not vouched", "no hub", "hub unreachable", "account hidden" and
+  // "no such account" alike, and it must stay that way on screen too — the row
+  // simply carries no profile block, and the vouch pill above already says
+  // whether anyone confirmed the name.
+  //
+  // NOTHING HERE IS AUTHORITY (ADR 0016). A rich record is not a reason to admit
+  // and an empty one is not a reason to refuse; the two buttons are unchanged
+  // and the server's admission gate never reads any of this.
+
+  // The bio, under the applicant's name. ESCAPED AND NEVER LINKIFIED — the
+  // render contract the hub's own profile payload carries, because a bio is user
+  // content on a page an Archon reads. escapeHtml is the whole defence; do not
+  // "improve" this into anchor-building.
+  function profileBio(p) {
+    var bio = p.account && p.account.bio;
+    return bio ? '<p class="ov-row__sub">' + escapeHtml(bio) + '</p>' : '';
+  }
+
+  // Disciplines as pills — the one field both shapes carry, so it is read off
+  // whichever half is present rather than branched on twice.
+  function disciplinePills(list) {
+    if (!Array.isArray(list) || !list.length) return '';
+    return list.slice(0, 6).map(function (d) {
+      return '<span class="fact-pill fact-pill--quiet">' + escapeHtml(d) + '</span>';
+    }).join('');
+  }
+
+  // The PUBLIC shape: the cross-project rollup as one plain sentence. A null
+  // rollup is not an error and not an absence of the person — it is the builder
+  // having hidden their numbers, and saying so is what stops a reviewer reading
+  // the blank as "this applicant has done nothing".
+  function publicProfileFacts(p) {
+    var x = p.cross_project;
+    if (!x) {
+      return '<span class="ov-row__when">This builder hides their cross-project record.</span>';
+    }
+    var t = x.totals || {};
+    var parts = [];
+    if (num(t.projects)) parts.push(fmtInt(t.projects) + (t.projects === 1 ? ' project' : ' projects'));
+    if (num(t.works_shipped)) parts.push(fmtInt(t.works_shipped) + ' shipped');
+    if (num(t.credits)) parts.push(fmtCompact(t.credits) + ' credits');
+    return disciplinePills(x.disciplines)
+      + (parts.length ? '<span class="ov-row__when">' + escapeHtml(parts.join(' · ')) + '</span>' : '')
+      + (x.last_active ? '<span class="ov-row__when">Last active ' + escapeHtml(fmtDate(x.last_active)) + '</span>' : '');
+  }
+
+  // The SLIVER shape: a private account that chose to apply anyway. The sentence
+  // is there so a reviewer does not read the thinness as a poor record — it is a
+  // deliberate boundary, and applying is what opened even this much.
+  function sliverProfileFacts(p) {
+    var s = p.sliver || {};
+    return disciplinePills(s.disciplines)
+      + (s.active_recently ? '<span class="fact-pill fact-pill--ok">Active recently</span>' : '')
+      + '<span class="ov-row__when">Private account — this is all they share by applying.</span>';
+  }
+
+  function profileHtml(p) {
+    if (!p || (p.view !== 'public' && p.view !== 'sliver')) return '';
+    var facts = p.view === 'public' ? publicProfileFacts(p) : sliverProfileFacts(p);
+    return '<div class="ov-row__profile">'
+      + (p.view === 'public' ? profileBio(p) : '')
+      + (facts ? '<div class="ov-row__facts">' + facts + '</div>' : '')
+      + '</div>';
+  }
+
   // What this row still offers. A waiting request has two decisions; an admitted
   // one can still be rescinded (until they sign in, after which the server
   // refuses and says so); a declined one is terminal here — re-admitting is the
@@ -384,6 +455,10 @@
       '<div class="ov-row__main">' +
       `<span class="ov-row__title">${who}</span>` +
       note +
+      // The applicant's own profile sits between what THEY wrote and what the
+      // SYSTEM knows — their words first, their record second, the decision
+      // facts last. Empty string when the server resolved nothing.
+      profileHtml(r.profile) +
       '<div class="ov-row__facts">' +
       vouchPill(!!r.vouched) +
       `<span class="ov-row__when">Asked ${escapeHtml(fmtDate(r.created_at))}</span>` +

package/modules/onboarding/routes/access-requests.js

@@ -80,6 +80,57 @@ function normalizeLogin(raw) {
   return String(raw || '').trim().replace(/^@/, '');
 }
 
+// How many applicant profiles one queue render may resolve from the hub (privacy
+// spec D7, task 1002972). The list itself returns up to 200 rows, and a render
+// that fired 200 cross-instance round-trips would make a reviewer wait on the
+// hub to read a queue that is perfectly readable without it.
+//
+// The cap bites on VOUCHED rows only — an unvouched row has no account to
+// resolve and costs nothing — and it is applied to the list AS ORDERED, newest
+// first, so the rows a reviewer actually acts on are the ones that carry a
+// profile. Beyond it, `profile` is null and the row renders exactly as an
+// unvouched one does: the queue never degrades into an error, it degrades into
+// less detail. Raising this number buys detail and costs latency; it changes
+// nothing about WHAT may be disclosed.
+const MAX_LIVE_PROFILE_READS = 25;
+
+// attachApplicantProfiles(rows) — the LIVE half of D7, and "live" is the whole
+// design rather than a performance note. Nothing about the applicant is stored
+// on the access_requests row; the profile is resolved from the hub ON EVERY
+// RENDER, so an applicant who goes private, hides their stats, or loses their
+// account between applying and being reviewed is answered by the NEXT read of
+// this queue (criterion C2's "immediately"). A snapshot taken at apply time
+// would keep publishing a consent that had since been withdrawn.
+//
+// KEYED ON THE VOUCH, NEVER ON github_login. `applicant_github_id` is the hub's
+// own assertion about who filed this request (core_230); the login is a string
+// anybody may type into the one PUBLIC unauthenticated write on this API.
+// Resolving a cross-project record against an unvouched login is precisely the
+// impersonation surface the vouch exists to close — file a request naming a
+// well-known builder, let the owner read that builder's excellent record, and
+// walk in. So an unvouched row gets `profile: null`, always, and the queue's own
+// "Name unvouched" pill already tells the reviewer why.
+//
+// Each read fails soft to null independently (the doorway port swallows), so one
+// slow or missing account cannot fail the others or the listing.
+async function attachApplicantProfiles(rows) {
+  // The budget is spent UP FRONT, by index, rather than by decrementing a shared
+  // counter inside the concurrent callbacks. Both are correct today — `.map`
+  // invokes each async callback synchronously up to its first `await`, so the
+  // decrements happen in list order before any hub call starts — but resting a
+  // disclosure-shaped cap on that guarantee is the kind of correctness that
+  // breaks silently the day someone reaches for a concurrency helper here. This
+  // form is correct for a reason a reader can see without knowing that rule.
+  const resolvable = new Set();
+  rows.forEach((r, i) => {
+    if (r.applicant_github_id && resolvable.size < MAX_LIVE_PROFILE_READS) resolvable.add(i);
+  });
+  return Promise.all(rows.map(async (r, i) => ({
+    ...r,
+    profile: resolvable.has(i) ? await api.readApplicantProfileFromHub(r.applicant_github_id) : null,
+  })));
+}
+
 module.exports = function buildAccessRequestsRouter() {
   const router = express.Router();
 
@@ -235,7 +286,11 @@ module.exports = function buildAccessRequestsRouter() {
           LIMIT 200`,
         [status]
       );
-      res.json({ requests: rows });
+      // C4's other half (privacy spec D7, task 1002972): the applicant's own
+      // profile, as their OWN privacy rules would show it, resolved from the hub
+      // at render. See attachApplicantProfiles — it is keyed on the vouch, never
+      // on the login, and every row it cannot resolve carries `profile: null`.
+      res.json({ requests: await attachApplicantProfiles(rows) });
     } catch (err) {
       log.error('[gds] GET /access-requests', err);
       res.fail('list_failed', { status: 500, message: 'internal error' });

package/modules/platform-identity/applicant-profile.js

@@ -0,0 +1,158 @@
+// modules/platform-identity/applicant-profile.js — THE D7 RULE: what a reviewer
+// sees of the person who applied to their project (privacy spec D7, task
+// 1002972, goal 1000045).
+//
+// ONE RULE, NO NEW DISCLOSURE CLASS. That is D7's whole claim, and this file is
+// where it is true or not:
+//
+//   PUBLIC account   → the SAME payload GET /profiles/:handle already serves —
+//                      the identity band plus the cross-project rollup, which is
+//                      null when `hide_stats` is set. Not a copy of that shape:
+//                      the rollup half is getPublicProfileExtras, the very port
+//                      the public page calls.
+//   PRIVATE account  → the D3 sliver's projection, built by recruiter-sliver's
+//                      own sliverShapeFor — again the same code, not a similar
+//                      one. Name-only under `hide_stats`, by that file's rule.
+//   PROVISIONAL, or an account that never accepted the terms → NOTHING (null).
+//
+// So a reviewer never sees a field that some existing surface would not already
+// have shown them. A THIRD shape here would BE the new disclosure class D7
+// forbids, which is why neither branch builds its own object.
+//
+// EVALUATED LIVE, AND THAT IS A REQUIREMENT RATHER THAN AN IMPLEMENTATION NOTE
+// (spec C2, D7). Nothing here is stored, cached or snapshotted at apply time. An
+// applicant who flips `hide_stats`, goes private, or has their account
+// deactivated between applying and being reviewed is answered by the NEXT render
+// — because the next render is the only place the answer exists. A snapshot
+// taken at apply time would keep publishing a withdrawn consent for as long as
+// the request sat in the queue, which is exactly the failure C2's "immediately"
+// is written against.
+//
+// THE CONSENT IS THE APPLICATION, AND THAT IS THE ONE PLACE THIS DIFFERS FROM
+// THE RECRUITER SLIVER — stated out loud because it is the decision a reader
+// will want to check. getRecruiterSliver floors on recruiterSliverVisibleSql =
+// consent AND *recruiting reach*, because a recruiter browsing a directory has
+// been invited by nobody. An applicant has done something a browsing recruiter
+// has not: spec D7 says it in those words — "applying is an explicit act". So
+// reusing getRecruiterSliver verbatim here would be WRONG in the direction that
+// looks safe: `recruiter_discoverable` defaults to FALSE for a private account,
+// so a private builder who deliberately applied would show their reviewer
+// nothing at all, and criterion C4 would be satisfied by an empty box. The reach
+// opt-out governs the RECRUITING SURFACE (account-visibility.js says exactly
+// that of scoutingListableSql); it was never a gate on a door the account itself
+// knocked on.
+//
+// WHAT STILL FLOORS IT, so "the application is the consent" cannot be read as
+// "applying opts you into everything":
+//   * accountActiveSql — profile_state='active' AND terms_accepted_at IS NOT
+//     NULL. A provisional account (no human ever witnessed at the hub) and an
+//     account that never accepted the platform terms disclose NOTHING here, the
+//     same as on every other surface. This is the shared predicate, called, not
+//     re-spelled (tests/effective_visibility_predicate.mjs enforces that).
+//   * hide_stats — untouched, in both branches, by the two ports themselves.
+//   * the existence axis is deliberately NOT a floor, for the same reason the D3
+//     sliver drops it: the private account is precisely this rule's subject, and
+//     flooring on accountVisibleSql would empty the private branch of everything
+//     it exists to carry.
+//
+// NOT AUTHORITY (ADR 0016). A reviewer holding this view holds a description,
+// never a permission: nothing here says the applicant may enter, and admission
+// still reads status='invited' and nothing else (hasInvitedAccessRequest). It
+// does not even say they applied — the CALLER must prove that first; see
+// applicationBacksProfileRead in ./application-echo.js, which is the gate the
+// one route over this port is built on.
+//
+// WHO MAY CALL IT is not this file's question (routes/sso.js gates the one
+// surface). WHAT crosses is decided here, and by the two ports it composes.
+//
+// tests/applicant_profile_boundary.mjs is the proof.
+'use strict';
+
+const pi = require('./platform-identity');
+const recruiterSliver = require('./recruiter-sliver');
+const { accountActiveSql, isAccountVisible } = require('./account-visibility');
+
+// The two shapes this port may answer with, as a closed vocabulary. Exported so
+// the proof asserts against these constants rather than a copy of the strings —
+// a third view added here and quietly added to the test's own expectation is the
+// failure a whitelist is supposed to make impossible.
+const VIEW_PUBLIC = 'public';
+const VIEW_SLIVER = 'sliver';
+const APPLICANT_VIEWS = [VIEW_PUBLIC, VIEW_SLIVER];
+
+// readApplicantAccount — the ONE account read behind the port: the identity band
+// of an account that clears the CONSENT floor, plus the columns the branch below
+// needs to decide the shape. Null for anyone who does not clear it.
+//
+// It selects `account_visibility` and the consent columns deliberately: the
+// EXISTENCE decision is made in JS by isAccountVisible, on this row, rather than
+// by a second query with a second predicate — one read, one row, one branch.
+async function readApplicantAccount(githubId, { pool }) {
+  const { rows } = await pool.query(
+    `SELECT github_id, github_login, display_name, avatar_url, handle, bio, links,
+            created_at, profile_state, terms_accepted_at, account_visibility,
+            recruiter_discoverable, hide_stats
+       FROM platform_identity_accounts
+      WHERE ${accountActiveSql()} AND github_id = $1::bigint
+      LIMIT 1`,
+    [String(githubId)],
+  );
+  return rows[0] || null;
+}
+
+// publicApplicantView(account, { pool }) — the PUBLIC branch, assembled from the
+// same two pieces GET /profiles/:handle serves: the identity band off the row,
+// and the cross-project rollup off getPublicProfileExtras — which returns null
+// for a `hide_stats` account, so hiding is honoured by the port rather than by a
+// rule restated here.
+//
+// github_id and profile_state never cross, exactly as on the public page: the
+// join key stays internal and the answer itself is the addressability signal.
+async function publicApplicantView(account, { pool }) {
+  return {
+    view: VIEW_PUBLIC,
+    account: {
+      handle: account.handle ?? null,
+      github_login: account.github_login,
+      display_name: account.display_name ?? null,
+      avatar_url: account.avatar_url ?? null,
+      member_since: account.created_at,
+      // RENDER CONTRACT, inherited verbatim from getPublicProfileByHandle:
+      // escape the bio, never linkify it, and emit links with
+      // rel="nofollow ugc noopener". Validated at write; still user content.
+      bio: account.bio ?? null,
+      links: account.links ?? null,
+    },
+    cross_project: await pi.getPublicProfileExtras(account.github_id, { pool }),
+  };
+}
+
+// getApplicantProfileView(githubId, { pool }) — THE port D7 names.
+//
+// Answers null | { view:'public', account, cross_project } | { view:'sliver',
+// sliver }. A non-numeric principal (core's 'system:bfg' shape) answers null
+// rather than throwing a bigint cast mid-request, like every other read in this
+// module.
+//
+// FAIL-CLOSED IN ONE DIRECTION ONLY: everything that is not disclosable is the
+// SAME null — absent account, provisional account, terms never accepted, and an
+// unusable principal are indistinguishable to a caller, which is the ADR 0171 D4
+// rule. The caller renders "no record", never a reason.
+async function getApplicantProfileView(githubId, { pool } = {}) {
+  if (!pi.isNumericGithubId(githubId)) return null;
+  const account = await readApplicantAccount(githubId, { pool });
+  if (!account) return null;
+  if (isAccountVisible(account)) return publicApplicantView(account, { pool });
+  // PRIVATE: the D3 projection, built by the sliver's own code. sliverShapeFor
+  // takes the row this function already holds and applies the `hide_stats`
+  // shape rule — the CONSENT predicate is not re-applied there, which is why
+  // the floor above is this function's own responsibility and is not optional.
+  return { view: VIEW_SLIVER, sliver: await recruiterSliver.sliverShapeFor(account, { pool }) };
+}
+
+module.exports = {
+  APPLICANT_VIEWS,
+  VIEW_PUBLIC,
+  VIEW_SLIVER,
+  getApplicantProfileView,
+};