@bongos/core 1.19.579 → 1.19.581

package/tests/applicant_profile_boundary.mjs

@@ -0,0 +1,641 @@
+// tests/applicant_profile_boundary.mjs — THE D7 BOUNDARY PROOF (task 1002972,
+// goal 1000045; privacy spec D7 + C2/C4, ADR 0215, ADR 0205, ADR 0171 D4/D5,
+// ADR 0016).
+//
+// D7's claim is "ONE RULE, NO NEW DISCLOSURE CLASS": a reviewer sees what the
+// applicant's OWN profile rules would already show, and nothing that any
+// existing surface would not have shown them. So the things worth proving are
+// not that the port returns data — they are the four ways that claim could
+// quietly stop being true:
+//
+//   1. THE TWO SHAPES ARE THE EXISTING TWO, NOT LOOKALIKES. The private branch's
+//      key set is compared to recruiter-sliver's OWN exported SLIVER_KEYS /
+//      SLIVER_KEYS_HIDDEN, and the public branch's to the key list the public
+//      page's payload carries. Both are WHITELISTS read from the modules, never
+//      copies kept here: a sixth key fails whether or not this file was told
+//      about it. If someone builds a third shape, that IS the new disclosure
+//      class D7 forbids, and it reds this file.
+//
+//   2. THE CONSENT SWAP IS DELIBERATE AND STILL BOUNDED — the one place D7
+//      differs from the recruiter sliver, and therefore the assertion most worth
+//      writing down. getRecruiterSliver floors on recruiting REACH; the
+//      applicant view floors on the APPLICATION ("applying is an explicit act",
+//      D7). So a PRIVATE account that never opted into recruiting DOES get an
+//      applicant view and DOES NOT get a recruiter sliver — asserted in BOTH
+//      directions on the SAME account, so a later "tidy-up" that routes this
+//      port through getRecruiterSliver cannot pass quietly. It would look like a
+//      simplification and would silently empty C4 for most private applicants.
+//
+//      And the swap is bounded: what it does NOT relax is asserted beside it —
+//      a PROVISIONAL account and an account that never accepted the terms
+//      disclose NOTHING, applying or not.
+//
+//   3. hide_stats BEATS THE APPLICATION, in both branches. A public applicant
+//      with hidden stats has a null rollup; a private one is name-only. Applying
+//      is consent to be SEEN, never consent to be COUNTED — and C2 says a hide
+//      takes effect on the next render, which is only meaningful if the render
+//      reads it.
+//
+//   4. NOTHING RIDES ALONG. Every value the private branch must not carry is an
+//      IMPROBABLE PLANTED SENTINEL and the assertion is absence from the whole
+//      serialized body — the recruiter_sliver_boundary technique. The sentinels
+//      sit on the rows this port's OWN queries return (the fake returns MORE
+//      columns than each statement selects), so a projection that spreads a row
+//      instead of whitelisting leaks a number and reds this file.
+//
+// PLUS THE GATE, because a bounded projection behind an open door is not
+// bounded — and here the door is the entire security story (ADR 0205, security
+// report 1000027). POST /sso/applicant-profile is authenticated by client
+// credentials, which prove WHICH PROJECT is calling and NOTHING about who the
+// github_id in the body is. Without a per-subject witness it is a bulk
+// disclosure oracle over every account on the platform, private ones included.
+// So: a client with no echo for that account gets 404 AND NO ACCOUNT IS READ AT
+// ALL (asserted on the statement log, not just the response — a gate that
+// refuses after reading has already done the disclosure work), the echo is
+// matched against the AUTHENTICATED client_id rather than the body's, and an
+// echo older than the window stops working.
+//
+// NOT AUTHORITY (ADR 0016), asserted structurally: the response carries no rank,
+// role, permission or membership under any name.
+//
+// MECHANISM (the tests/recruiter_sliver_boundary.mjs harness): in-memory tables
+// whose row filter is built FROM EACH STATEMENT'S OWN WHERE CLAUSE, refusing any
+// statement whose placeholders or literal comparisons it did not consume — so a
+// predicate this interpreter cannot read is a loud error and never a silently
+// absent filter. Each recognised term is CONSUMED and the residue must be pure
+// conjunction, so rewriting an AND to an OR cannot stay green. Above the pool
+// everything is real: the real module, the real router, real HTTP.
+//
+// DB-free by construction.
+//
+// Run:  node tests/applicant_profile_boundary.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+// Imported as ESM so the whitelists come from the MODULES rather than from
+// copies kept here — the whole point of asserting against them.
+import {
+  SLIVER_KEYS,
+  SLIVER_KEYS_HIDDEN,
+  getRecruiterSliver,
+} from '../modules/platform-identity/recruiter-sliver.js';
+import {
+  APPLICANT_VIEWS,
+  VIEW_PUBLIC,
+  VIEW_SLIVER,
+  getApplicantProfileView,
+} from '../modules/platform-identity/applicant-profile.js';
+import { applicationBacksProfileRead } from '../modules/platform-identity/application-echo.js';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+// ===========================================================================
+// The fixture — one account per row of the privacy-spec D2 matrix that can APPLY
+// ===========================================================================
+
+const PUB = '4110001';      // active · public  · shown   — the public branch
+const PUBSHY = '4110002';   // active · public  · HIDDEN  — public, no numbers
+const PRIVIN = '4110003';   // active · PRIVATE · reach=true  — private, opted in
+const PRIVOUT = '4110004';  // active · PRIVATE · reach=null  — private, NEVER opted in: the swap's subject
+const PRIVSHY = '4110005';  // active · PRIVATE · HIDDEN      — name-only sliver
+const PROV = '4110006';     // PROVISIONAL                    — discloses nothing
+const NOTERMS = '4110007';  // active · public · terms NEVER accepted — discloses nothing
+
+// Every account column the table holds. The queries select a SUBSET; the extras
+// are here on purpose, so a row spread leaks something loud.
+const ACCOUNTS = [
+  { github_id: PUB, handle: 'pub-handle', github_login: 'pub-login-770101', display_name: 'Pub Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PUB}?v=4`, previous_handle: null, bio: 'pub-bio-770103',
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'public',
+    hide_stats: false, recruiter_discoverable: null, terms_accepted_at: 'T1' },
+  { github_id: PUBSHY, handle: 'pubshy-handle', github_login: 'pubshy-login-770201', display_name: 'Pubshy Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PUBSHY}?v=4`, previous_handle: null, bio: null,
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'public',
+    hide_stats: true, recruiter_discoverable: null, terms_accepted_at: 'T1' },
+  { github_id: PRIVIN, handle: 'privin-handle', github_login: 'privin-login-770301', display_name: 'Privin Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PRIVIN}?v=4`, previous_handle: null, bio: 'privin-bio-770303',
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'private',
+    hide_stats: false, recruiter_discoverable: true, terms_accepted_at: 'T1' },
+  { github_id: PRIVOUT, handle: 'privout-handle', github_login: 'privout-login-770401', display_name: 'Privout Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PRIVOUT}?v=4`, previous_handle: 'privout-oldname-770404', bio: 'privout-bio-770403',
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'private',
+    hide_stats: false, recruiter_discoverable: null, terms_accepted_at: 'T1' },
+  { github_id: PRIVSHY, handle: 'privshy-handle', github_login: 'privshy-login-770501', display_name: 'Privshy Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PRIVSHY}?v=4`, previous_handle: null, bio: null,
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'private',
+    hide_stats: true, recruiter_discoverable: true, terms_accepted_at: 'T1' },
+  { github_id: PROV, handle: 'prov-handle', github_login: 'prov-login-770601', display_name: 'Prov Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${PROV}?v=4`, previous_handle: null, bio: null,
+    links: null, created_at: 'T0', profile_state: 'provisional', account_visibility: 'public',
+    hide_stats: false, recruiter_discoverable: true, terms_accepted_at: 'T1' },
+  { github_id: NOTERMS, handle: 'noterms-handle', github_login: 'noterms-login-770701', display_name: 'Noterms Person',
+    avatar_url: `https://avatars.githubusercontent.com/u/${NOTERMS}?v=4`, previous_handle: null, bio: null,
+    links: null, created_at: 'T0', profile_state: 'active', account_visibility: 'public',
+    hide_stats: false, recruiter_discoverable: true, terms_accepted_at: null },
+];
+
+const ROLLUP = {};
+for (const [i, a] of ACCOUNTS.entries()) {
+  const b = 990000 + i * 100;
+  ROLLUP[a.github_id] = {
+    credits: b + 1, works_shipped: b + 2, karma: b + 3, project_count: b + 4,
+    last_active: `lastactive-${b + 5}`, disciplines: [`craft-${b + 8}`],
+    projects: [{ name: `Project-${b + 6}`, origin: `https://p${b}.example`, rank_held: 'metic', recent_ships: [`Ship-${b + 7}`], is_public: true }],
+  };
+}
+
+const ACTIVE_RECENTLY = {
+  [PUB]: true, [PUBSHY]: true, [PRIVIN]: true, [PRIVOUT]: true, [PRIVSHY]: true, [PROV]: false, [NOTERMS]: false,
+};
+
+const account = (id) => ACCOUNTS.find((a) => a.github_id === id);
+
+/** Everything about one account the SLIVER shape must never disclose. */
+function forbiddenOf(id) {
+  const a = account(id);
+  const r = ROLLUP[id];
+  return [
+    // NOT the github_id: the avatar D3 grants is GitHub's own URL and embeds it
+    // verbatim, so it is disclosed by an authorized field (ADR 0215's honest
+    // limit). Pinned precisely below rather than pretended away here.
+    a.github_login,
+    a.bio,
+    String(r.credits), String(r.works_shipped), String(r.karma), String(r.project_count),
+    r.last_active,
+    ...(a.previous_handle ? [a.previous_handle] : []),
+    ...r.projects.flatMap((p) => [p.name, p.origin, p.rank_held, ...p.recent_ships]),
+  ].filter(Boolean);
+}
+
+// ===========================================================================
+// The in-memory tables + their statement interpreter
+// ===========================================================================
+
+const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'client_id', 'recruiter_discoverable', 'status']);
+
+/**
+ * Build a row test from a statement's own WHERE text, CONSUMING each term it
+ * models so the residue can be judged. Literal comparisons carry as much weight
+ * as placeholders: the visibility predicates are made ENTIRELY of literal
+ * comparisons, so a fake modelling only $N filters would score every privacy
+ * term as absent and pass however the code changed.
+ *
+ * The residue check is what makes this a STRUCTURE reader rather than a term
+ * collector: rewriting accountActiveSql's `AND` to `OR` would disclose every
+ * account the port can reach, and a fake that merely ANDs the terms it
+ * recognised keeps answering exactly as before. Anything left that is not
+ * whitespace, parentheses or `AND` is a loud error.
+ */
+function accountFilter(where, params) {
+  const tests = [];
+  const consumed = new Set();
+  let residue = where;
+
+  const take = (re, make) => {
+    const m = re.exec(residue);
+    if (!m) return null;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    tests.push(make(m));
+    return m;
+  };
+
+  // Reach FIRST — the COALESCE spells `account_visibility = 'public'` inside
+  // itself as its own fallback, and consuming it first stops that fallback being
+  // scored as an existence check.
+  take(
+    /\bCOALESCE\(\s*(?:[a-z_]+\.)?recruiter_discoverable\s*,\s*(?:[a-z_]+\.)?account_visibility = 'public'\s*\)/,
+    () => (r) => (typeof r.recruiter_discoverable === 'boolean'
+      ? r.recruiter_discoverable
+      : r.account_visibility === 'public'),
+  );
+  take(/\b(?:[a-z_]+\.)?profile_state = 'active'/, () => (r) => r.profile_state === 'active');
+  take(/\b(?:[a-z_]+\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
+  take(/\b(?:[a-z_]+\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
+  take(/\bNOT (?:[a-z_]+\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+  take(/\b(?:[a-z_]+\.)?github_id = \$(\d+)(?:::bigint)?/, (m) => {
+    consumed.add(m[1]);
+    const v = params[Number(m[1]) - 1];
+    return (r) => String(r.github_id) === String(v);
+  });
+
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unread predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
+    }
+  }
+  for (const m of where.matchAll(/\b([a-z_]+)\s*(?:=|<>|!=)\s*'/g)) {
+    if (!KNOWN_COLUMNS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
+    }
+  }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${where}" — every recognised term is ANDed here, so a predicate that is not a pure conjunction must be a loud error, never a silently different filter`);
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+function activityScope(sql, params) {
+  const m = /\ba\.github_id = \$(\d+)/.exec(sql);
+  if (!m) throw new Error(`fake pool: an activity read with no github_id scope — ${sql.slice(0, 120)}`);
+  return String(params[Number(m[1]) - 1]);
+}
+
+// The SSO client registry + the echo table the gate reads.
+const CLIENT = { client_id: 'client-alpha', secret_hash: null, name: 'Alpha', redirect_uris: [], origin: 'https://alpha.example', owner_github_id: '1', status: 'active' };
+const OTHER_CLIENT = { client_id: 'client-beta', secret_hash: null, name: 'Beta', redirect_uris: [], origin: 'https://beta.example', owner_github_id: '2', status: 'active' };
+// (github_id, client_id) pairs the HUB witnessed, and whether they are inside
+// the read-time window. Only PUB and PRIVOUT applied to alpha.
+let ECHOES = [];
+
+let calls = [];
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    calls.push({ sql, params });
+
+    if (/FROM platform_identity_sso_clients/.test(sql)) {
+      const hit = [CLIENT, OTHER_CLIENT].find((c) => c.client_id === params[0]);
+      return { rows: hit ? [{ ...hit }] : [], rowCount: hit ? 1 : 0 };
+    }
+
+    // The GATE's own read. The window term is modelled explicitly rather than
+    // waved through: an echo outside it must stop working, and a fake that
+    // ignored `applied_at` would make that untestable.
+    if (/FROM platform_identity_application_echoes/.test(sql)) {
+      assert.match(sql, /applied_at > now\(\) - make_interval\(days => \$3::int\)/,
+        'the gate must be window-scoped — an echo that never expires re-opens the read forever');
+      assert.equal(params[2], 30, 'the gate reuses the 30-day echo window, not a second number');
+      const rows = ECHOES.filter((e) => String(e.github_id) === String(params[0])
+        && e.client_id === params[1] && e.in_window);
+      return { rows: rows.map(() => ({ '?column?': 1 })), rowCount: rows.length };
+    }
+
+    // The SLIVER's activity half: a boolean and a disciplines union, never a date.
+    if (/WITH act AS/.test(sql)) {
+      const id = activityScope(sql, params);
+      const r = ROLLUP[id];
+      return {
+        rows: [{
+          active_recently: r ? ACTIVE_RECENTLY[id] : null,
+          disciplines: r ? r.disciplines : null,
+          // NOT selected by the statement. Present because a real row grows
+          // columns, so a projection that spreads rather than whitelists carries
+          // these straight into the response.
+          last_active: r ? r.last_active : null,
+          credits: r ? r.credits : null,
+          works_shipped: r ? r.works_shipped : null,
+          karma: r ? r.karma : null,
+          project_count: r ? r.project_count : null,
+        }],
+        rowCount: 1,
+      };
+    }
+
+    // The per-builder rollup aggregate behind the PUBLIC branch.
+    if (/WITH agg AS/.test(sql) && /platform_identity_builder_project_activity/.test(sql)) {
+      const r = ROLLUP[activityScope(sql, params)] || { credits: 0, works_shipped: 0, karma: 0, project_count: 0, last_active: null, disciplines: null };
+      return { rows: [{ projects: r.project_count, credits: r.credits, works_shipped: r.works_shipped, karma: r.karma, last_active: r.last_active, disciplines: r.disciplines }], rowCount: 1 };
+    }
+
+    if (/platform_identity_builder_project_activity/.test(sql)) {
+      const r = ROLLUP[activityScope(sql, params)];
+      const rows = r ? r.projects.map((p) => ({ ...p })) : [];
+      return { rows, rowCount: rows.length };
+    }
+
+    if (/FROM platform_identity_accounts/.test(sql)) {
+      const where = sql.includes(' WHERE ')
+        ? sql.slice(sql.indexOf(' WHERE ') + 7).replace(/ ORDER BY .*| LIMIT .*/g, '')
+        : '';
+      // The rollup scalars ride the account row too, so a widened account
+      // projection leaks a number even for a name-only sliver.
+      const rows = ACCOUNTS.filter(accountFilter(where, params)).map((a) => ({ ...a, ...ROLLUP[a.github_id] }));
+      return { rows: rows.map((r) => ({ ...r })), rowCount: rows.length };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql.slice(0, 140)}`);
+  },
+};
+
+const view = (id) => getApplicantProfileView(id, { pool });
+
+// ===========================================================================
+// 1. The two shapes are the EXISTING two
+// ===========================================================================
+
+test('the port answers only the two declared views (a third shape IS the new disclosure class)', async () => {
+  for (const id of [PUB, PUBSHY, PRIVIN, PRIVOUT, PRIVSHY]) {
+    const v = await view(id);
+    assert.ok(v, `${id} should be disclosable`);
+    assert.ok(APPLICANT_VIEWS.includes(v.view), `${id} answered an undeclared view "${v.view}"`);
+  }
+  assert.deepEqual(APPLICANT_VIEWS, [VIEW_PUBLIC, VIEW_SLIVER],
+    'the declared vocabulary grew — a new view is a new disclosure class and needs its own owner sign-off, not a passing test');
+});
+
+test('the PUBLIC branch carries exactly the public page payload, key for key', async () => {
+  const v = await view(PUB);
+  assert.equal(v.view, VIEW_PUBLIC);
+  assert.deepEqual(Object.keys(v).sort(), ['account', 'cross_project', 'view']);
+  // The identity band the canonical /u/<handle> payload carries — and NOT
+  // github_id or profile_state, which stay internal there and must stay
+  // internal here.
+  assert.deepEqual(
+    Object.keys(v.account).sort(),
+    ['avatar_url', 'bio', 'display_name', 'github_login', 'handle', 'links', 'member_since'],
+    'the public applicant view grew or lost a key relative to the public profile payload — D7 says it IS that payload',
+  );
+  assert.ok(!('github_id' in v.account), 'the join key must stay internal, exactly as on the public page');
+  assert.ok(!('profile_state' in v.account), 'the answer itself is the addressability signal');
+});
+
+test('the PRIVATE branch is the D3 sliver projection — asserted against the module’s own whitelist', async () => {
+  const v = await view(PRIVIN);
+  assert.equal(v.view, VIEW_SLIVER);
+  assert.deepEqual(Object.keys(v).sort(), ['sliver', 'view']);
+  assert.deepEqual(Object.keys(v.sliver).sort(), [...SLIVER_KEYS].sort(),
+    'the private applicant view is not the D3 sliver’s key set — a second pre-accept projection is exactly what D7 forbids');
+});
+
+// ===========================================================================
+// 2. The consent swap — deliberate, and bounded
+// ===========================================================================
+
+test('THE SWAP: a private account that never opted into recruiting gets an applicant view and NO recruiter sliver', async () => {
+  const a = account(PRIVOUT);
+  assert.equal(a.account_visibility, 'private');
+  assert.equal(a.recruiter_discoverable, null, 'the fixture must be the never-opted-in row or this proves nothing');
+
+  // The recruiting surface refuses them — the reach opt-out, working.
+  assert.equal(await getRecruiterSliver(PRIVOUT, { pool }), null,
+    'a private account with no recruiting opt-in must stay invisible to the DIRECTORY');
+
+  // The application does not. "Applying is an explicit act" (D7).
+  const v = await view(PRIVOUT);
+  assert.ok(v, 'a private builder who deliberately applied must not show their reviewer nothing — that is C4 satisfied by an empty box');
+  assert.equal(v.view, VIEW_SLIVER);
+  assert.deepEqual(Object.keys(v.sliver).sort(), [...SLIVER_KEYS].sort());
+  assert.equal(v.sliver.handle, 'privout-handle');
+});
+
+test('the swap relaxes REACH only — provisional and terms-never-accepted still disclose NOTHING', async () => {
+  assert.equal(await view(PROV), null,
+    'a provisional account has no witnessed human behind it; applying cannot manufacture one');
+  assert.equal(await view(NOTERMS), null,
+    'terms_accepted_at is half the consent floor (ADR 0213) — applying is not accepting the platform terms');
+});
+
+test('an unknown account and a non-numeric principal are the SAME null as a refused one (ADR 0171 D4)', async () => {
+  assert.equal(await view('4119999'), null);
+  assert.equal(await view('system:bfg'), null);
+  assert.equal(await view(null), null);
+});
+
+// ===========================================================================
+// 3. hide_stats beats the application, in both branches
+// ===========================================================================
+
+test('hide_stats: the PUBLIC branch keeps the name and drops the record', async () => {
+  const v = await view(PUBSHY);
+  assert.equal(v.view, VIEW_PUBLIC);
+  assert.equal(v.cross_project, null,
+    'applying is consent to be seen, never consent to be counted — and C2 says the hide takes effect on the NEXT render');
+  assert.equal(v.account.handle, 'pubshy-handle', 'hiding removes the numbers, not the person');
+});
+
+test('hide_stats: the PRIVATE branch collapses to the name-only sliver', async () => {
+  const v = await view(PRIVSHY);
+  assert.equal(v.view, VIEW_SLIVER);
+  assert.deepEqual(Object.keys(v.sliver).sort(), [...SLIVER_KEYS_HIDDEN].sort(),
+    'a hidden private applicant must be name-only — the two rollup-derived keys are ABSENT, not null');
+  // CONTROL, so the absence above cannot pass vacuously: the same shape with
+  // hide_stats off really does carry them.
+  const shown = await view(PRIVIN);
+  assert.ok('disciplines' in shown.sliver && 'active_recently' in shown.sliver);
+});
+
+// ===========================================================================
+// 4. Nothing rides along
+// ===========================================================================
+
+test('no forbidden value appears ANYWHERE in a private applicant view’s body', async () => {
+  for (const id of [PRIVIN, PRIVOUT, PRIVSHY]) {
+    const body = JSON.stringify(await view(id));
+    const leaked = forbiddenOf(id).filter((s) => body.includes(s));
+    // The hidden account's own disciplines are forbidden too — it is name-only.
+    if (id === PRIVSHY) {
+      for (const d of ROLLUP[id].disciplines) {
+        if (body.includes(d)) leaked.push(d);
+      }
+    }
+    assert.deepEqual(leaked, [], `${id} leaked ${leaked.join(', ')} into the sliver body`);
+  }
+});
+
+test('the ONE honest exception: github_id may ride the avatar URL and nothing else', async () => {
+  const v = await view(PRIVIN);
+  const body = JSON.stringify(v);
+  assert.ok(body.includes(PRIVIN), 'the avatar embeds the id — if this stops being true, delete the exception rather than the assertion');
+  const withoutAvatar = JSON.stringify({ ...v, sliver: { ...v.sliver, avatar_url: null } });
+  assert.ok(!withoutAvatar.includes(PRIVIN),
+    'the account id reached the body somewhere OTHER than the avatar URL — that is a new disclosure, not the documented limit');
+});
+
+// The authority-shaped field names, as a closed list. `rank_held` is excluded
+// and pinned separately below — see the public-branch test.
+const AUTHORITY_WORDS = ['rank', 'role', 'permission', 'permissions', 'membership', 'membership_kind', 'invited', 'admitted', 'status'];
+
+test('it grants nothing (ADR 0016): the PRIVATE branch carries no authority-shaped field at all', async () => {
+  for (const id of [PRIVIN, PRIVOUT, PRIVSHY]) {
+    const body = JSON.stringify(await view(id)).toLowerCase();
+    for (const word of AUTHORITY_WORDS) {
+      assert.ok(!body.includes(`"${word}"`),
+        `the sliver applicant view carries a "${word}" field — this surface is descriptive, never authority`);
+    }
+  }
+});
+
+test('it grants nothing (ADR 0016): the PUBLIC branch carries exactly one rank-shaped field, and it is the public page’s own', async () => {
+  const v = await view(PUB);
+  // THE HONEST FACT, asserted rather than glossed. `rank_held` DOES appear —
+  // inside cross_project.projects[], because the canonical /u/<handle> payload
+  // publishes it there and D7's rule is that this view IS that payload. It is
+  // descriptive ("they held metic on that project"), it is already world-
+  // readable for a public account, and no admission path reads it. Pinning WHERE
+  // it may appear is the assertion; claiming it is absent would be false.
+  assert.ok(v.cross_project.projects.every((p) => 'rank_held' in p),
+    'the public payload lost rank_held — if the public page stopped publishing it, this view must stop too');
+  const withoutProjects = JSON.stringify({ ...v, cross_project: { ...v.cross_project, projects: [] } }).toLowerCase();
+  for (const word of AUTHORITY_WORDS) {
+    assert.ok(!withoutProjects.includes(`"${word}"`),
+      `an authority-shaped "${word}" field reached the public applicant view OUTSIDE the public page's own per-project record — that is a new disclosure, not the inherited one`);
+  }
+  // And nothing at the top level of either half grants anything.
+  assert.deepEqual(Object.keys(v).sort(), ['account', 'cross_project', 'view']);
+});
+
+// ===========================================================================
+// 5. The gate — the whole security story of the federated route
+// ===========================================================================
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath,
+  filename: moduleApiPath,
+  loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: require('../src/bongos/routes/_helpers.js').validateOrRespond,
+    resolveSession: async () => null,
+    logger: () => ({ error: () => {}, info: () => {} }),
+    requireBuilder: (_req, res) => res.fail('unauthenticated', 401),
+    requireRank: () => (_req, res) => res.fail('rank_forbidden', 403),
+    requirePermission: () => (_req, res) => res.status(403).json({ ok: false, error: 'forbidden' }),
+    // The route factory registers this module's seam providers on build.
+    // Answering "already registered" skips that wiring: none of it is on the
+    // path under test, and standing it up would drag the seam registry in.
+    hasProvider: () => true,
+    registerProvider: () => {},
+    on: () => {},
+  },
+};
+
+const buildSsoRoutes = require('../modules/platform-identity/routes/sso.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+// The real secret check, over a real hash produced by the MODULE'S OWN hasher —
+// doubling clientSecretValid, or hashing with a copy of its algorithm kept here,
+// would prove nothing about the route that calls it.
+const SECRET = 'alpha-secret-770801';
+CLIENT.secret_hash = pi.sha256hex(SECRET);
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildSsoRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function post(path_, body) {
+  calls = [];
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, method: 'POST', path: path_,
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        resolve({ status: res.statusCode, text, json, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+const creds = { client_id: CLIENT.client_id, client_secret: SECRET };
+const readAccounts = () => calls.filter((c) => /FROM platform_identity_accounts/.test(c.sql));
+
+test('the echo gate: a project with NO application for this account gets 404 and reads NO account row', async () => {
+  ECHOES = [{ github_id: PUB, client_id: OTHER_CLIENT.client_id, in_window: true }];
+  const r = await post('/api/bongos/sso/applicant-profile', { ...creds, github_id: PUB });
+  assert.equal(r.status, 404, 'a 403 would confirm the account exists — the disclosure the rule withholds');
+  assert.equal(r.json.error.code, 'no_application');
+  assert.deepEqual(readAccounts(), [],
+    'the route read an account row before refusing — a gate that refuses AFTER reading has already done the disclosure work, and the next refactor that logs or caches that row leaks it');
+});
+
+test('the echo gate: the witness is matched against the AUTHENTICATED client, not the body', async () => {
+  ECHOES = [{ github_id: PUB, client_id: OTHER_CLIENT.client_id, in_window: true }];
+  // Alpha's credentials, beta's client_id in the body: if the route trusted the
+  // body, alpha would inherit beta's applicants.
+  const r = await post('/api/bongos/sso/applicant-profile', { ...creds, client_id: CLIENT.client_id, github_id: PUB });
+  assert.equal(r.status, 404);
+  const echoReads = calls.filter((c) => /application_echoes/.test(c.sql));
+  assert.equal(echoReads.length, 1);
+  assert.equal(echoReads[0].params[1], CLIENT.client_id,
+    'the gate must ask about the client that proved its secret');
+});
+
+test('the echo gate: an echo OUTSIDE the 30-day window stops opening the read', async () => {
+  ECHOES = [{ github_id: PUB, client_id: CLIENT.client_id, in_window: false }];
+  const r = await post('/api/bongos/sso/applicant-profile', { ...creds, github_id: PUB });
+  assert.equal(r.status, 404,
+    'when the platform stops vouching for the link between the row and the account, the profile must stop rendering');
+});
+
+test('a real applicant resolves, uncacheable, through the gate', async () => {
+  ECHOES = [{ github_id: PUB, client_id: CLIENT.client_id, in_window: true }];
+  const r = await post('/api/bongos/sso/applicant-profile', { ...creds, github_id: PUB });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.profile.view, VIEW_PUBLIC);
+  assert.equal(r.headers['cache-control'], 'no-store',
+    'a cached applicant view is a snapshot, which is the one thing "live at review time" forbids');
+});
+
+test('bad credentials are refused before anything is read', async () => {
+  ECHOES = [{ github_id: PUB, client_id: CLIENT.client_id, in_window: true }];
+  const r = await post('/api/bongos/sso/applicant-profile', { client_id: CLIENT.client_id, client_secret: 'wrong', github_id: PUB });
+  assert.equal(r.status, 401);
+  assert.deepEqual(readAccounts(), []);
+  const echoReads = calls.filter((c) => /application_echoes/.test(c.sql));
+  assert.deepEqual(echoReads, [], 'even the witness read must wait until the caller has authenticated');
+});
+
+test('the route is rate-limited, and a refused probe costs no database work', async () => {
+  // DEFENCE IN DEPTH behind the echo gate (grade advisory on this task). The echo
+  // already closes the enumeration oracle; the ceiling bounds the cost of GUESSING
+  // for a caller holding a stolen secret or simply looping. Asserted on the
+  // statement log as well as the status, because a limiter that refuses AFTER
+  // querying has not saved the database anything.
+  ECHOES = [];
+  let limited = null;
+  for (let i = 0; i < 340; i++) {
+    const r = await post('/api/bongos/sso/applicant-profile', { ...creds, github_id: PUB });
+    if (r.status === 429) { limited = r; break; }
+  }
+  assert.ok(limited, 'the applicant read has no ceiling — a scripted walk of the github_id space is unbounded');
+  assert.equal(limited.json.error.code, 'rate_limited');
+  assert.equal(limited.headers['x-ratelimit-scope'], 'applicant-profile-read',
+    'the 429 must name its OWN budget — sharing the account-existence scope would let a busy project close the stranger admission check');
+  assert.ok(limited.headers['retry-after'], 'a refused caller is told when to come back');
+  assert.deepEqual(calls, [],
+    'the limiter must run BEFORE the client lookup — a refused probe that still queries has not saved the database anything');
+});
+
+test('applicationBacksProfileRead is fail-closed on a non-numeric principal and an empty client', async () => {
+  ECHOES = [{ github_id: PUB, client_id: CLIENT.client_id, in_window: true }];
+  assert.equal(await applicationBacksProfileRead({ githubId: 'system:bfg', clientId: CLIENT.client_id }, { pool }), false);
+  assert.equal(await applicationBacksProfileRead({ githubId: PUB, clientId: '' }, { pool }), false);
+  assert.equal(await applicationBacksProfileRead({ githubId: PUB, clientId: CLIENT.client_id }, { pool }), true);
+});
+
+// ===========================================================================
+// 6. The lane check (learning 1000218 — a file in neither lane asserts nothing)
+// ===========================================================================
+
+test('this proof runs in a lane that actually executes', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const self = 'applicant_profile_boundary.mjs';
+  const runners = fs.readdirSync(path.join(process.cwd(), 'tests'))
+    .filter((f) => /^run-|^unit|lane/i.test(f));
+  const listed = runners.some((f) => {
+    try { return fs.readFileSync(path.join(process.cwd(), 'tests', f), 'utf8').includes(self); } catch { return false; }
+  });
+  const globbed = fs.existsSync(path.join(process.cwd(), 'package.json'))
+    && /tests\/\*|tests\/\*\*|\*\.mjs/.test(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8'));
+  assert.ok(listed || globbed,
+    `${self} is in no runner list and no glob — it would assert nothing forever (learning 1000218)`);
+});