@bongos/core 1.19.579 → 1.19.580

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 358 endpoints across 58 route files.
+> **Generated from the live route files** — the route file is authoritative. 359 endpoints across 58 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -556,11 +556,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/sessions/mine` | `any-builder` | — | your OWN sessions (self-serve; no audit needed). |
 | GET | `/api/bongos/sessions/search` | `metic+archon` | — | cross-builder corpus search (BFG-principal posture until 6C.1). |
 
-## `sso` (7)
+## `sso` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | POST | `/api/bongos/sso/activity/rollup` | `public` | `client_id`, `client_secret`, `github_id`, `credits`, `tasks_shipped`, `karma`, `rank`, `disciplines`, `recent_ships` | POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). |
+| POST | `/api/bongos/sso/applicant-profile` | `public` | `client_id`, `client_secret`, `github_id` | POST /sso/applicant-profile — a federated instance resolves ONE applicant's profile view for its own reviewer queue, LIVE at render (priv… |
 | GET | `/api/bongos/sso/authorize` | `public` | — | GET /sso/authorize?client_id=&redirect_uri=&state= — the browser authorize leg. |
 | POST | `/api/bongos/sso/device/poll` | `public` | `device_code` | POST /sso/device/poll — poll the hub device flow. |
 | POST | `/api/bongos/sso/device/start` | `public` | `origin` | POST /sso/device/start — begin CLI federation. |

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1706 strings** across 3 surfaces · 1475 distinct pieces of copy · 1706 certain, 0 heuristic · 162 shown in more than one place.
+**1709 strings** across 3 surfaces · 1478 distinct pieces of copy · 1709 certain, 0 heuristic · 162 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 78 | 1234 |
+| `builders-hall` | `modules/hall-ui/public` | 78 | 1237 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 372 |
 
@@ -75,10 +75,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `996edffc1966` | 2x | Access requests | modules/hall-ui/public/watch.html:46, modules/hall-ui/public/watch.html:61 |
 | `a072071b893c` | 2x | All time | modules/status-ui/public/index.html:286, modules/status-ui/public/index.html:313 |
 | `490b73a0c6e8` | 2x | Approve your Dev Box app — {{worldName}} | modules/hall-ui/public/pair.html:6, modules/hall-ui/public/pair.html:6 |
-| `b2656d0b2402` | 2x | Asked {…} | modules/hall-ui/public/collab.js:41, modules/hall-ui/public/watch.js:389 |
+| `b2656d0b2402` | 2x | Asked {…} | modules/hall-ui/public/collab.js:41, modules/hall-ui/public/watch.js:464 |
 | … | | _122 more in the JSON registry_ | |
 
-## `builders-hall` — 1234 strings
+## `builders-hall` — 1237 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -138,6 +138,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1158` |
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:99` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:209` |
+| `74cc57f76b42` | certain | Active recently | `modules/hall-ui/public/watch.js:411` |
 | `524188fe0078` | certain | Active sessions | `modules/hall-ui/public/settings.html:162` |
 | `f6036360c90c` | certain | Activity, by craft | `modules/hall-ui/public/profile.html:133` |
 | `62eded408097` | certain | Add {…} | `modules/hall-ui/public/profile-nudge.js:68` |
@@ -162,7 +163,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `01a0f29ff406` | certain | As first filed | `modules/hall-ui/public/idea.js:252` |
 | `688cc6dd38ee` | certain | Asked of you | `modules/hall-ui/public/collab.html:37` |
 | `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/collab.js:41` |
-| `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/watch.js:389` |
+| `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/watch.js:464` |
 | `8c8ec2597036` | certain | Assigned {…} to builder {…}. | `modules/hall-ui/public/government.js:470` |
 | `46714066f2da` | certain | Audit log | `modules/hall-ui/public/watch.html:148` |
 | `1de02052abf2` | certain | Available from the {…} rank up. | `modules/hall-ui/public/gate.js:222` |
@@ -273,8 +274,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7bcaeffb742f` | certain | Could not approve: {…} | `modules/hall-ui/public/gate.js:108` |
 | `c922293e668c` | certain | Could not assign: {…} | `modules/hall-ui/public/government.js:475` |
 | `94763c4d5a94` | certain | Could not block: {…} | `modules/hall-ui/public/harbor.js:167` |
-| `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:720` |
-| `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:746` |
+| `e1fc7cedf4e7` | certain | Could not change rank: {…} | `modules/hall-ui/public/watch.js:795` |
+| `b9e53fbd90e6` | certain | Could not change standing: {…} | `modules/hall-ui/public/watch.js:821` |
 | `1ef1efc15b6c` | certain | Could not change that just now. | `modules/hall-ui/public/goals-render.js:1059` |
 | `78e18ea59b9f` | certain | Could not close: {…} | `modules/hall-ui/public/harbor.js:136` |
 | `c3f99e7c6e6b` | certain | Could not copy automatically — select and copy manually. ({…}) | `modules/hall-ui/public/settings.js:997` |
@@ -298,7 +299,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8b69e445592a` | certain | Could not load the question labels; showing the answers as stored. | `modules/hall-ui/public/idea.js:244` |
 | `edd5bafbe075` | certain | Could not load the queue just now. | `modules/hall-ui/public/ideas.js:550` |
 | `02bb0570996a` | certain | Could not load the ranks. | `modules/hall-ui/public/ranks.js:197` |
-| `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:1212` |
+| `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:1287` |
 | `4b0c8d94541c` | certain | Could not load your account. Reload the page to try again. | `modules/hall-ui/public/settings.js:1376` |
 | `2a9fb4046bc4` | certain | Could not load your rank. Return to the hall and try again. | `modules/hall-ui/public/ranks.js:196` |
 | `9d533e811dec` | certain | Could not load your sessions: {…} | `modules/hall-ui/public/settings-sessions.js:114` |
@@ -306,7 +307,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `de244c45d916` | certain | Could not load {…} | `modules/hall-ui/public/task.js:703` |
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:260` |
 | `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:297` |
-| `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:541` |
+| `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:616` |
 | `8b470cebf53d` | certain | Could not remove your key. Try again. | `modules/hall-ui/public/settings.js:1198` |
 | `4cf6bc8b377b` | certain | Could not remove. Try again. | `modules/hall-ui/public/settings.js:1197` |
 | `7a778d188e87` | certain | Could not remove: {…} | `modules/hall-ui/public/government.js:376` |
@@ -336,7 +337,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d4601887a058` | certain | Could not sign out everywhere: {…} | `modules/hall-ui/public/settings-sessions.js:102` |
 | `b1602d01f4bb` | certain | Could not unblock: {…} | `modules/hall-ui/public/harbor.js:187` |
 | `3db890b074a7` | certain | Could not update visibility just now. | `modules/hall-ui/public/goals-render.js:1043` |
-| `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1211` |
+| `112d12b24879` | certain | Could not verify your access. Go back and try again. | `modules/hall-ui/public/watch.js:1286` |
 | `6bd74fd20311` | certain | Could not verify your access. Try again. | `modules/hall-ui/public/sessions.js:280` |
 | `278e8281c82f` | certain | Could not vote: {…} | `modules/hall-ui/public/government.js:990` |
 | `a48e9f098392` | certain | Could not {…} just now. | `modules/hall-ui/public/goals-render.js:1029` |
@@ -670,7 +671,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d9c802f5d85e` | certain | Opening the studio… | `modules/hall-ui/public/studio.html:45` |
 | `569980a263ae` | certain | Optional. This is the ledger link — a copy change ships as a task like every other change. | `modules/hall-ui/public/copy-desk.html:130` |
 | `c78d7388ffd7` | certain | Or just stay in the online terminal | `modules/hall-ui/public/hall-render.js:750` |
-| `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1054` |
+| `d89d1923ecf9` | certain | Over the last {…} days | `modules/hall-ui/public/watch.js:1129` |
 | `695ffff13730` | certain | Over time | `modules/hall-ui/public/profile.html:72` |
 | `5ded44da0cc5` | certain | Override requests | `modules/hall-ui/public/watch.html:143` |
 | `15a49bf15007` | certain | Page {…} of {…} | `modules/hall-ui/public/hall-kit.js:112` |
@@ -696,6 +697,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `0ecbc4ee23f0` | certain | Primer required | `modules/hall-ui/public/work.html:42` |
 | `04f8740a0cb4` | certain | Primer — {{worldName}} | `modules/hall-ui/public/primer.html:6` |
 | `04f8740a0cb4` | certain | Primer — {{worldName}} | `modules/hall-ui/public/primer.html:6` |
+| `92d8fad6dc91` | certain | Private account — this is all they share by applying. | `modules/hall-ui/public/watch.js:412` |
 | `2b88c01d1697` | certain | Private — join is by invitation or an approved request | `modules/hall-ui/public/goals-render.js:797` |
 | `230e7677aad4` | certain | Profile privacy | `modules/hall-ui/public/settings.html:110` |
 | `f796836eac4e` | certain | Profile sections | `modules/hall-ui/public/profile.html:44` |
@@ -715,7 +717,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3f85bdc47099` | certain | Protected module scope — join by request; an Archon admits members | `modules/hall-ui/public/goals-render.js:803` |
 | `e5c292c8b361` | certain | Provides (seams) | `modules/hall-ui/public/atlas.js:288` |
 | `4de232a05888` | certain | Raise after | `modules/hall-ui/public/project-settings.js:113` |
-| `b9c6def6b120` | certain | Rank set to {…}. | `modules/hall-ui/public/watch.js:714` |
+| `b9c6def6b120` | certain | Rank set to {…}. | `modules/hall-ui/public/watch.js:789` |
 | `ff50a1395cbc` | certain | Rank: {…} | `modules/hall-ui/public/profile.js:50` |
 | `6824ec470f99` | certain | Ranks — {{worldName}} | `modules/hall-ui/public/ranks.html:6` |
 | `6824ec470f99` | certain | Ranks — {{worldName}} | `modules/hall-ui/public/ranks.html:6` |
@@ -723,7 +725,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `101a51902f53` | certain | Re-issue failed: {…} | `modules/hall-ui/public/settings.js:1001` |
 | `fae2f90927bd` | certain | Read an idea, then decide. An objection needs a reason and the section it faults. | `modules/hall-ui/public/government.html:66` |
 | `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/drachmae.js:148` |
-| `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1027` |
+| `b03e17693dcd` | certain | Read it as a table | `modules/hall-ui/public/watch.js:1102` |
 | `b6fcfdd652a7` | certain | Read it here | `modules/hall-ui/public/work.html:45` |
 | `c5f19a888a15` | certain | Read the handoff notes | `modules/hall-ui/public/task.js:441` |
 | `f9e998f4af3d` | certain | Read to the end and the button below unlocks. It is an honour system — nothing here checks your comprehension. | `modules/hall-ui/public/primer.html:100` |
@@ -758,7 +760,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7d4149cee474` | certain | Repo Atlas — a self-drawing map of the codebase | `modules/hall-ui/public/atlas.html:6` |
 | `4d40a68605e1` | certain | Repo atlas | `modules/hall-ui/public/atlas.html:30` |
 | `52d7d4309540` | certain | Repo health | `modules/hall-ui/public/watch.html:111` |
-| `e6629398d47c` | certain | Report {…}. | `modules/hall-ui/public/watch.js:475` |
+| `e6629398d47c` | certain | Report {…}. | `modules/hall-ui/public/watch.js:550` |
 | `ab456f09c0f6` | certain | Request access | `modules/hall-ui/public/hall-render.js:284` |
 | `ab456f09c0f6` | certain | Request access | `modules/hall-ui/public/hall-render.js:414` |
 | `967f6d1ac068` | certain | Request dev box | `modules/hall-ui/public/box-panel.js:357` |
@@ -775,7 +777,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/gate.js:219` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/government.js:1104` |
 | `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/harbor.js:337` |
-| `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/watch.js:1166` |
+| `0887725744f2` | certain | Restricted. | `modules/hall-ui/public/watch.js:1241` |
 | `feb48b0d462c` | certain | Return to the Dev Box app and click “Connect” again for a fresh code. | `modules/hall-ui/public/pair.js:32` |
 | `908a0d5d0685` | certain | Review how it judged this work, and teach it what good looked like. | `modules/hall-ui/public/studio.js:87` |
 | `f1b2b158c3b1` | certain | Review quality | `modules/hall-ui/public/watch.html:82` |
@@ -861,7 +863,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f79e1fb8ebd4` | certain | Suggested as you type; leave it on "no goal" and it waits for triage. | `modules/hall-ui/public/ideas.html:91` |
 | `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:386` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:74` |
-| `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1225` |
+| `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1300` |
 | `dfc967a63d57` | certain | Task lifecycle from backlog to shipped, showing states and transitions and the edge where credits are awarded. | `modules/hall-ui/public/diagrams.html:51` |
 | `10cc12f37636` | certain | Task sections | `modules/hall-ui/public/work.html:53` |
 | `0e636ea41b29` | certain | Task status | `modules/hall-ui/public/goals-render.js:331` |
@@ -939,6 +941,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `df316c3484de` | certain | Then drive it however you like: | `modules/hall-ui/public/hall-render.js:750` |
 | `5151cf635644` | certain | They have asked to connect. | `modules/hall-ui/public/profile-connections.js:203` |
 | `6e46811189db` | certain | This PR is held by the gate-review check. | `modules/hall-ui/public/gate.js:129` |
+| `b7c288328f79` | certain | This builder hides their cross-project record. | `modules/hall-ui/public/watch.js:393` |
 | `ed313d96b419` | certain | This builder keeps their track record private. | `modules/hall-ui/public/profile.js:270` |
 | `3f9e476e22db` | certain | This clears {…}. The gate check re-runs and the PR merges once it goes green. Your approval applies only to co | `modules/hall-ui/public/gate.js:94` |
 | `c2a0e726bd97` | certain | This goal is Archon-mediated — request to join instead. | `modules/hall-ui/public/goals-render.js:1025` |
@@ -1199,7 +1202,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/hall-render.js:605` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/idea.js:207` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/ideas.js:476` |
-| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/watch.js:1137` |
+| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/watch.js:1212` |
 | `a41659dc2bee` | certain | tasks remaining | `modules/hall-ui/public/roadmap.js:285` |
 | `bd3402efa59e` | certain | task{…} shipped | `modules/hall-ui/public/goals-render.js:748` |
 | `95854f8315ca` | certain | the page everyone else reads | `modules/hall-ui/public/profile.html:32` |
@@ -1269,7 +1272,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b2db97589086` | certain | {…} will not be able to open or wake a dev box until you unblock them. A box they already have running is left | `modules/hall-ui/public/harbor.js:148` |
 | `3ad8f32dd43b` | certain | {…} you have sent | `modules/hall-ui/public/profile-connections.js:137` |
 | `8186b562553a` | certain | {…} {…} waiting | `modules/hall-ui/public/work.js:359` |
-| `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/watch.js:379` |
+| `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/watch.js:450` |
 | `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/work.js:223` |
 | `b3757ba3bb46` | certain | {…} · Stored encrypted; never shown again after saving. | `modules/hall-ui/public/settings.js:1055` |
 | `94445e6ed5e8` | certain | {…} · code | `modules/hall-ui/public/pair.js:53` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1706,
-    "unique_ids": 1475,
-    "certain": 1706,
+    "strings": 1709,
+    "unique_ids": 1478,
+    "certain": 1709,
     "heuristic": 0,
     "duplicate_ids": 162
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 78,
-      "strings": 1234
+      "strings": 1237
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -159,7 +159,7 @@
         "modules/hall-ui/public/hall-render.js:605",
         "modules/hall-ui/public/idea.js:207",
         "modules/hall-ui/public/ideas.js:476",
-        "modules/hall-ui/public/watch.js:1137"
+        "modules/hall-ui/public/watch.js:1212"
       ]
     },
     {
@@ -243,7 +243,7 @@
         "modules/hall-ui/public/gate.js:219",
         "modules/hall-ui/public/government.js:1104",
         "modules/hall-ui/public/harbor.js:337",
-        "modules/hall-ui/public/watch.js:1166"
+        "modules/hall-ui/public/watch.js:1241"
       ]
     },
     {
@@ -504,7 +504,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/collab.js:41",
-        "modules/hall-ui/public/watch.js:389"
+        "modules/hall-ui/public/watch.js:464"
       ]
     },
     {
@@ -1134,7 +1134,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/drachmae.js:148",
-        "modules/hall-ui/public/watch.js:1027"
+        "modules/hall-ui/public/watch.js:1102"
       ]
     },
     {
@@ -1713,7 +1713,7 @@
       "text": "{…} {…}{…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/watch.js:379",
+        "modules/hall-ui/public/watch.js:450",
         "modules/hall-ui/public/work.js:223"
       ]
     },
@@ -2233,6 +2233,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "74cc57f76b42",
+      "surface": "builders-hall",
+      "text": "Active recently",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 411,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "524188fe0078",
       "surface": "builders-hall",
@@ -2454,7 +2463,7 @@
       "surface": "builders-hall",
       "text": "Asked {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 389,
+      "line": 464,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3453,7 +3462,7 @@
       "surface": "builders-hall",
       "text": "Could not change rank: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 720,
+      "line": 795,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3462,7 +3471,7 @@
       "surface": "builders-hall",
       "text": "Could not change standing: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 746,
+      "line": 821,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3678,7 +3687,7 @@
       "surface": "builders-hall",
       "text": "Could not load this page.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1212,
+      "line": 1287,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3750,7 +3759,7 @@
       "surface": "builders-hall",
       "text": "Could not read the report: {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 541,
+      "line": 616,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4020,7 +4029,7 @@
       "surface": "builders-hall",
       "text": "Could not verify your access. Go back and try again.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1211,
+      "line": 1286,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7026,7 +7035,7 @@
       "surface": "builders-hall",
       "text": "Over the last {…} days",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1054,
+      "line": 1129,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7255,6 +7264,15 @@
       "origin": "html-title",
       "confidence": "certain"
     },
+    {
+      "id": "92d8fad6dc91",
+      "surface": "builders-hall",
+      "text": "Private account — this is all they share by applying.",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 412,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "2b88c01d1697",
       "surface": "builders-hall",
@@ -7431,7 +7449,7 @@
       "surface": "builders-hall",
       "text": "Rank set to {…}.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 714,
+      "line": 789,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7503,7 +7521,7 @@
       "surface": "builders-hall",
       "text": "Read it as a table",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1027,
+      "line": 1102,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7818,7 +7836,7 @@
       "surface": "builders-hall",
       "text": "Report {…}.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 475,
+      "line": 550,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -7971,7 +7989,7 @@
       "surface": "builders-hall",
       "text": "Restricted.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1166,
+      "line": 1241,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8745,7 +8763,7 @@
       "surface": "builders-hall",
       "text": "System oversight: people, operations and security.",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1225,
+      "line": 1300,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9442,6 +9460,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "b7c288328f79",
+      "surface": "builders-hall",
+      "text": "This builder hides their cross-project record.",
+      "file": "modules/hall-ui/public/watch.js",
+      "line": 393,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "ed313d96b419",
       "surface": "builders-hall",
@@ -11787,7 +11814,7 @@
       "surface": "builders-hall",
       "text": "task {…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 1137,
+      "line": 1212,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12417,7 +12444,7 @@
       "surface": "builders-hall",
       "text": "{…} {…}{…}",
       "file": "modules/hall-ui/public/watch.js",
-      "line": 379,
+      "line": 450,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -365,6 +365,7 @@ tests/
 ├── scouting_owner_access_and_reach.mjs ← (task 1002290, goal 1000045 C5, ADR 0210): the R14 proof — WHO may read the cross-project recruiting directory, and WHO appears in it. A project owner (an instance-asserted, hub-witnessed `membership_kind='owner'`) reads `GET /scouting` with no rank at all; a builder who is neither owner nor `project.curate` holder gets the unchanged 403; an un-witnessed owner claim is refused; a broken ownership read falls closed onto the permission gate rather than admitting or 500ing. And the recruiting opt-out finally bites: a public, unhidden, active account that opted out is absent from `/scouting` and the hall's `/people` (the same endpoint), returns when it opts back in, and the opt-out grants and denies no permission — an opted-out owner still reads the directory while being absent from their own copy of it. Fake pool filtered by each statement's own WHERE clause, real route, real `requirePermission` over the real government catalog, real HTTP. Mutation-checked three ways. DB-free `unit` lane.
 ├── scouting_page_gate.mjs        ← (task 1002290, goal 1000045 C5, ADR 0210 D3): the OTHER half of R14 — the `/builders/people` SHELL must admit exactly the two audiences `GET /scouting` admits. A project owner holding no permission reaches it; everyone the route refuses gets the byte-identical `?denied=project.curate` redirect; and each of six ways the `alsoAdmits` door can fail (module absent, function absent, throw, reject, non-boolean, prototype-only) fails CLOSED. Also pins that the other four page gates never consult the seam at all, and that exactly ONE gate declares a second door. Its own file because the route proof's ESM imports pull `auth.js` in before a session double could be installed — this one installs it first, the `government_page_gates.mjs` pattern. DB-free `unit` lane.
 ├── terms_acceptance.mjs        ← (task 1002913, goal 1000045, ADR 0213): the platform T&C acceptance record. Proves the four properties that make it evidence rather than a claim — the /terms page carries the cross-project consent ADR 0141 §4 deferred to it and it is apex-only; acceptance is written ONLY by the hub's own /sso/authorize (driven over the real router with an attacker-controlled query string, so a forged timestamp/version/activate flag reaches nothing); it is written ONCE (the fake pool interprets the upsert's own column assignments, so COALESCE is executed, not string-matched, and an assignment shape it cannot read throws instead of reading as "unchanged"); and consent is two columns in the shared predicate, so an account the hub witnessed before the terms existed publishes nothing. Plus the projection rule — every read whose row a JS twin judges must select both consent columns, or the twin denies everyone silently. DB-free `unit` lane, asserts its own lane membership.
+├── applicant_profile_boundary.mjs ← (task 1002972, goal 1000045 C4, privacy spec D7, ADR 0241): THE D7 BOUNDARY proof for the applicant view a reviewer sees. Whitelists read from the MODULES’ own exports — the private branch against `recruiter-sliver`’s `SLIVER_KEYS`/`SLIVER_KEYS_HIDDEN`, the public branch against the public-page payload’s key list — so a third shape (the “new disclosure class” D7 forbids) reds this file. Pins THE CONSENT SWAP in both directions on the same account: a private builder who never opted into recruiting gets an applicant view and gets `null` from `getRecruiterSliver`, so a refactor routing the port through the recruiter sliver cannot pass quietly. `hide_stats` beats the application in both branches; provisional and terms-never-accepted disclose nothing; planted sentinels asserted absent from the whole body with the avatar-embedded `github_id` pinned as the one honest exception. Plus the federated gate (ADR 0205): no echo → 404 and NO account row read (asserted on the statement log), the witness matched against the AUTHENTICATED client, an out-of-window echo stops working, and `Cache-Control: no-store`. Real router + real HTTP over in-memory tables filtered by each statement’s own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 ├── recruiter_sliver_boundary.mjs ← (task 1002968, goal 1000045 C2/C5, privacy spec D3, ADR 0215): THE PRE-ACCEPT BOUNDARY proof for the D3 recruiter sliver. A WHITELIST over the module's own exported key list (a sixth key fails whether or not this file was told about it), planted improbable sentinels asserted absent from the WHOLE response body with two controls against vacuity, the ceiling assertion (the handle a recruiter is handed 404s at `GET /profiles/:handle`, with a 200 control) and the gate (both recruiting routes admit the same two audiences and refuse byte-identically). Real router + real HTTP over an in-memory table filtered by each statement's own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 └── public_task_resolver.mjs      ← (#604): the public `/public/tasks/:id` projection — title/value_summary exposed only for shipped|confirmed; withheld for in-flight so unshipped/security task names can't leak.
 ```

package/docs/module-api-changelog.md

@@ -1607,5 +1607,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.577 with no explicit bump. run 34146835487. (task 1002620)
   1.19.579 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.578 with no explicit bump. run 34149317186. (task 1002620)
+  1.19.580 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.579 with no explicit bump. run 34153217035. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -792,6 +792,8 @@ function createClient(opts = {}) {
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup
       postSsoActivityRollup: (args) => request("POST", "/sso/activity/rollup", { hasBody: true }, args),
+      // POST /sso/applicant-profile — rank: public — POST /sso/applicant-profile
+      postSsoApplicantProfile: (args) => request("POST", "/sso/applicant-profile", { hasBody: true }, args),
       // GET /sso/authorize — rank: public — GET /sso/authorize
       getSsoAuthorize: (args) => request("GET", "/sso/authorize", { hasBody: false }, args),
       // POST /sso/device/poll — rank: public — POST /sso/device/poll

package/modules/hall-ui/public/oversight.css

@@ -119,6 +119,13 @@ a.ov-row__title:hover { color: var(--accent-ink); text-decoration: underline; te
 .ov-row__sub { display: block; margin: 4px 0 0; font-size: 13.5px; line-height: 1.5; color: var(--ink-soft); max-width: var(--measure); overflow-wrap: anywhere; }
 .ov-row__facts { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 10px; margin: 10px 0 0; }
 .ov-row__sub + .ov-row__facts { margin-top: 8px; }
+/* The applicant's own profile inside an access-request row (task 1002972, D7).
+   A rule on the inline edge rather than a card: it is the APPLICANT speaking
+   through their own privacy settings, and it must read as evidence attached to
+   their ask — never as another decision surface competing with the buttons. */
+.ov-row__profile { margin: 10px 0 0; padding-left: 12px; border-left: 2px solid var(--rule); }
+.ov-row__profile .ov-row__sub { margin-top: 0; }
+.ov-row__profile .ov-row__facts { margin-top: 6px; }
 .ov-row__right { display: flex; flex-direction: column; align-items: flex-end; gap: 8px; text-align: right; }
 .ov-row__actions { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 8px; }
 .ov-row__when { font-size: 12.5px; color: var(--ink-faint); font-variant-numeric: tabular-nums; white-space: nowrap; }

package/modules/hall-ui/public/watch.js

@@ -350,6 +350,77 @@
       : '<span class="fact-pill fact-pill--warn" title="Nobody vouched for this name — anyone can file a request naming anyone. Confirm who is asking before you admit them.">Name unvouched</span>';
   }
 
+  // ---- the applicant's own profile, beside their ask (task 1002972, D7) -----
+  //
+  // The reviewer sees what the APPLICANT'S OWN privacy rules would show them —
+  // resolved live by the server on every render, never stored on the request. So
+  // this renderer decides nothing about disclosure: it draws whichever of the
+  // two shapes the server sent, and draws nothing at all when it sent null. A
+  // null covers "not vouched", "no hub", "hub unreachable", "account hidden" and
+  // "no such account" alike, and it must stay that way on screen too — the row
+  // simply carries no profile block, and the vouch pill above already says
+  // whether anyone confirmed the name.
+  //
+  // NOTHING HERE IS AUTHORITY (ADR 0016). A rich record is not a reason to admit
+  // and an empty one is not a reason to refuse; the two buttons are unchanged
+  // and the server's admission gate never reads any of this.
+
+  // The bio, under the applicant's name. ESCAPED AND NEVER LINKIFIED — the
+  // render contract the hub's own profile payload carries, because a bio is user
+  // content on a page an Archon reads. escapeHtml is the whole defence; do not
+  // "improve" this into anchor-building.
+  function profileBio(p) {
+    var bio = p.account && p.account.bio;
+    return bio ? '<p class="ov-row__sub">' + escapeHtml(bio) + '</p>' : '';
+  }
+
+  // Disciplines as pills — the one field both shapes carry, so it is read off
+  // whichever half is present rather than branched on twice.
+  function disciplinePills(list) {
+    if (!Array.isArray(list) || !list.length) return '';
+    return list.slice(0, 6).map(function (d) {
+      return '<span class="fact-pill fact-pill--quiet">' + escapeHtml(d) + '</span>';
+    }).join('');
+  }
+
+  // The PUBLIC shape: the cross-project rollup as one plain sentence. A null
+  // rollup is not an error and not an absence of the person — it is the builder
+  // having hidden their numbers, and saying so is what stops a reviewer reading
+  // the blank as "this applicant has done nothing".
+  function publicProfileFacts(p) {
+    var x = p.cross_project;
+    if (!x) {
+      return '<span class="ov-row__when">This builder hides their cross-project record.</span>';
+    }
+    var t = x.totals || {};
+    var parts = [];
+    if (num(t.projects)) parts.push(fmtInt(t.projects) + (t.projects === 1 ? ' project' : ' projects'));
+    if (num(t.works_shipped)) parts.push(fmtInt(t.works_shipped) + ' shipped');
+    if (num(t.credits)) parts.push(fmtCompact(t.credits) + ' credits');
+    return disciplinePills(x.disciplines)
+      + (parts.length ? '<span class="ov-row__when">' + escapeHtml(parts.join(' · ')) + '</span>' : '')
+      + (x.last_active ? '<span class="ov-row__when">Last active ' + escapeHtml(fmtDate(x.last_active)) + '</span>' : '');
+  }
+
+  // The SLIVER shape: a private account that chose to apply anyway. The sentence
+  // is there so a reviewer does not read the thinness as a poor record — it is a
+  // deliberate boundary, and applying is what opened even this much.
+  function sliverProfileFacts(p) {
+    var s = p.sliver || {};
+    return disciplinePills(s.disciplines)
+      + (s.active_recently ? '<span class="fact-pill fact-pill--ok">Active recently</span>' : '')
+      + '<span class="ov-row__when">Private account — this is all they share by applying.</span>';
+  }
+
+  function profileHtml(p) {
+    if (!p || (p.view !== 'public' && p.view !== 'sliver')) return '';
+    var facts = p.view === 'public' ? publicProfileFacts(p) : sliverProfileFacts(p);
+    return '<div class="ov-row__profile">'
+      + (p.view === 'public' ? profileBio(p) : '')
+      + (facts ? '<div class="ov-row__facts">' + facts + '</div>' : '')
+      + '</div>';
+  }
+
   // What this row still offers. A waiting request has two decisions; an admitted
   // one can still be rescinded (until they sign in, after which the server
   // refuses and says so); a declined one is terminal here — re-admitting is the
@@ -384,6 +455,10 @@
       '<div class="ov-row__main">' +
       `<span class="ov-row__title">${who}</span>` +
       note +
+      // The applicant's own profile sits between what THEY wrote and what the
+      // SYSTEM knows — their words first, their record second, the decision
+      // facts last. Empty string when the server resolved nothing.
+      profileHtml(r.profile) +
       '<div class="ov-row__facts">' +
       vouchPill(!!r.vouched) +
       `<span class="ov-row__when">Asked ${escapeHtml(fmtDate(r.created_at))}</span>` +