@bongos/core 1.20.17 → 1.20.18

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.17",
-  "core_contract": "1.20.17",
-  "source_commit": "4e92fa5764cf7041b99baefbf8d249edbba9159d",
+  "core_version": "1.20.18",
+  "core_contract": "1.20.18",
+  "source_commit": "e1841ec9f7044de186bb75988136b6dfb0835ef7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T13:31:15.089Z",
+  "built_at": "2026-09-30T13:46:50.940Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 556,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3210,
-  "tree_sha256": "4715c740ddb7d2c5cdfed3960679731b4a2cdef5b901f92945ba362f12f26570",
+  "tree_sha256": "34fda46e51438cef84700eb352c0f4dc3a8552cd8e8fc962864f4f500e09047d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1537,7 +1537,7 @@
     {
       "path": "docs/adr/0213-platform-terms-acceptance-is-the-hubs-own-witness.md",
       "mode": "0000644",
-      "sha256": "fd6c8d2e3868f2ba42262406b9fbd9ba12cb547a9eac61ddb7b9422afde6b3ab"
+      "sha256": "2e00d10ae548548bc8708058b0beb08fc0631aa29f27f6905ef630fdf4c6099b"
     },
     {
       "path": "docs/adr/0214-canonical-profile-url-one-resolver-dark-until-the-page-exists.md",
@@ -2267,12 +2267,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "f4485fd6eecabff171add19c577d0c94b90b1e5e4e90e71f0af23bbd84085791"
+      "sha256": "08ef6d32a1c5cfea14e7ddd54a4e7ab2e34818199a45e0422a4fce31b72567a7"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f8b6e13542de4d3fe03cbfc6a4873c8a7fd7c3ea29e9b535d80c70d2d986340a"
+      "sha256": "a405d02a6308a53e9322437f21daf86cb7e7f0d6d8b15a25639b7fdbcb7c2fd1"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c2490d5cdc3d8044ad02ba2ade0a9918e8c3d041e79f0ac0d61f3126152053d1"
+      "sha256": "99307d7bab261c46f7e80d768b014352d9f3c47ec2c72088acfac7bc700dd06f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2862,7 +2862,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "b959e7b3c6b623f81e4f5752fa6573621c79d6e8948d18b2b4c939101e65930b"
+      "sha256": "6ba44419e75dcb245e386e077eba647e744c56861b8b81c9002bbe7528369f0c"
     },
     {
       "path": "docs/project-context.template.md",
@@ -8032,7 +8032,7 @@
     {
       "path": "modules/public-landing/public/terms.html",
       "mode": "0000644",
-      "sha256": "639d96a2bf6b28fabbcad64a01e3b97aab83dabe8182455074f2845e053b2696"
+      "sha256": "39aae17cd14c496533f9a212f37378571d9d621c078353e41900a02c5355df5f"
     },
     {
       "path": "modules/render-deploy/deploys.js",
@@ -8862,12 +8862,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f04a559437cf80ab6eeb46905a8f943091dd4601e02b7d7ae58ca57aae35b050"
+      "sha256": "35d3b7a5f69caee9c6a98b7c34c02daec4289cd0548637d05ff41fd23d1926c4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b8cd817f9d22b1222c06404648c197080fce17573ce0c83f43b4f03f87fb06b4"
+      "sha256": "9807202c95ba59b5f8104eb0c6701241d989800e67fdddf8252bc569b9a74c96"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8887,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "06f6c8587835146b2f325adf518aca1e74699cb2f38f0313ad4bf7f5fe37577c"
+      "sha256": "19b0f5588a02e7517cc25668a59df836f8ee1a183e1f1ec4a2b63d79214b3808"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11002,7 +11002,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ae8085fdd1b2e41ff442de4a863b7b105bebaad915054a0cfa38bb57321289be"
+      "sha256": "3f49c56de113748d04529b5028e1ac2fca037cf00c1d6be6e531346dcfbea552"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15757,7 +15757,7 @@
     {
       "path": "tests/terms_acceptance.mjs",
       "mode": "0000644",
-      "sha256": "d73eea1d83bdf132f5973a67013bd01270b54253ef6eb979c801b019d6f67c6f"
+      "sha256": "80ea17a764ba05a05af0967e9951370b814c20c3518a37f1c3ca1a9ca0d044cf"
     },
     {
       "path": "tests/terms_grandfather_db.mjs",

package/docs/adr/0213-platform-terms-acceptance-is-the-hubs-own-witness.md

@@ -29,6 +29,8 @@ This is deliberately the ADR 0205 D3 property, reused. An acceptance record a ca
 
 > **Amended 2026-09-25 ([task 1003353](https://cloudbongos.com/builders#/task/1003353); [blocker 1000124](https://cloudbongos.com/builders#/blocker/1000124)) — what "the hub's own sign-in" means.** `GET /sso/authorize` is reached when a builder uses their platform account to sign in to a **project**; the only builder of that URL is a child instance's `idpAuthorizeUrl`. Signing in to the hub itself creates a hub session and never touches `platform_identity_accounts`, so it records no acceptance. `/terms` said "signed in here"; it now names a project sign-in. The owner chose to also capture the hub's own sign-in ([task 1003361](https://cloudbongos.com/builders#/task/1003361)), which will make this a second capture point rather than a wording fix. Two smaller corrections to the text above: the device poll does not go through `ensureAccount`, it is a non-activating `upsertAccount`, and so is `PATCH /me/handle`; `ensureAccount` is the federated membership check-in alone. The outcome was always the same (neither writes an acceptance), and both paths are now executed in `tests/terms_acceptance.mjs` rather than asserted as text.
 
+> **Amended 2026-09-30 ([task 1004265](https://cloudbongos.com/builders#/task/1004265)) — a project sign-in *in the browser*.** The CLI's project sign-in (`POST /sso/device/poll`) also uses the platform account, and it stays **non-activating on purpose**. The person approves it on GitHub's device page, never on a hub page, so these terms are never in front of them — and the same branch that stamps the acceptance also flips `profile_state` to active, which ADR 0171 D3 reserves for the one path "where a human is demonstrably at the hub" — and D3 names the device poll as `provisional` in so many words. Stamping it would record consent nobody was shown and re-decide D3 by implementation convenience. `/terms` therefore names a project sign-in **in your browser**, and says that a command-line sign-in records nothing and why, so a CLI-only builder is not left guessing why they are unpublished. `tests/terms_acceptance.mjs` §3 drives the real device-poll route (no acceptance, still provisional, the non-activating literal, a forged body refused before any write) and a later browser sign-in stamping that same account. The "next hub sign-in" wording under D4 is left for task 1003361, which makes it true.
+
 ### D2 — Written once. The first acceptance is the one that stands
 
 The conflict branch writes `COALESCE(platform_identity_accounts.terms_accepted_at, now())`. Signing in again re-reads the terms but does not restamp them, so the column keeps meaning *when consent was given* rather than *when this account was last seen*. `terms_version` is COALESCE'd the same way and always written in the same statement, so the pair cannot diverge.

package/docs/copy-inventory.md

@@ -4,7 +4,7 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2189 strings** across 3 surfaces · 1889 distinct pieces of copy · 2189 certain, 0 heuristic · 207 shown in more than one place.
+**2188 strings** across 3 surfaces · 1888 distinct pieces of copy · 2188 certain, 0 heuristic · 207 shown in more than one place.
 
 ## Surfaces
 
@@ -12,7 +12,7 @@
 |---|---|---|---|
 | `builders-hall` | `modules/hall-ui/public` | 109 | 1617 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
-| `landing` | `modules/public-landing/public` | 6 | 472 |
+| `landing` | `modules/public-landing/public` | 6 | 471 |
 
 ## Confidence, and why it is on every row
 
@@ -1805,7 +1805,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7667eb552781` | certain | {…}: {…}% ({…}/{…} checks) | `modules/status-ui/public/status.js:468` |
 | `6d0d64f10bd9` | certain | ‹ earlier page | `modules/status-ui/public/index.html:321` |
 
-## `landing` — 472 strings
+## `landing` — 471 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -1940,7 +1940,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `485c565b5745` | certain | How people join | `modules/public-landing/public/projects.html:910` |
 | `4b542b000afa` | certain | How this project is drawn: on the sky, in your list, at the top of this page and on its card. A planet is a | `modules/public-landing/public/projects.html:1030` |
 | `9f31eaed8252` | certain | If you grant repository access while creating a project, that permission is used to create or adopt your repos | `modules/public-landing/public/privacy.html:55` |
-| `3b1cbe9e33aa` | certain | If your account already existed when this version took effect, the platform accepted it on your behalf, rather | `modules/public-landing/public/terms.html:71` |
+| `d37e2fbde8c6` | certain | If your account already existed when this version took effect, the platform accepted it on your behalf, rather | `modules/public-landing/public/terms.html:71` |
 | `607551ae732b` | certain | Invite a builder | `modules/public-landing/public/projects.html:1003` |
 | `20786b02f47a` | certain | Invite builders | `modules/public-landing/public/projects.html:1492` |
 | `a1256030d879` | certain | Invite only | `modules/public-landing/public/projects.html:914` |
@@ -1979,7 +1979,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `837fdaa0936a` | certain | Nothing matches that. | `modules/public-landing/public/projects.html:707` |
 | `1bc11853e893` | certain | On the map | `modules/public-landing/public/projects.html:929` |
 | `b4ac8f44710c` | certain | On the public map | `modules/public-landing/public/projects.html:851` |
-| `7fe31ce20c09` | certain | Once you have signed in to a project with your platform account and accepted these terms, your profile and tha | `modules/public-landing/public/terms.html:68` |
+| `1fdda2903cf9` | certain | Once you have signed in to a project in your browser with your platform account and accepted these terms, your | `modules/public-landing/public/terms.html:68` |
 | `8329bb1a3693` | certain | One tap files the request and the platform starts standing your project up — server, database, address. Here's | `modules/public-landing/public/projects.html:1462` |
 | `86cde1930d84` | certain | Only mine | `modules/public-landing/public/projects.html:477` |
 | `f82fe1982ab3` | certain | Open an issue on the repository | `modules/public-landing/public/contact.html:52` |
@@ -2092,7 +2092,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fb416bf1a26b` | certain | The handle names your project on the platform — and its address comes with it. Once it stands up, a few GitHub | `modules/public-landing/public/projects.html:1355` |
 | `a954f0dce9a3` | certain | The platform | `modules/public-landing/public/contact.html:65` |
 | `4fd8f5746cc5` | certain | The platform is run as a non-profit, capture-resistant commons. | `modules/public-landing/public/terms.html:50` |
-| `dede132846fe` | certain | The platform stores the date you accepted these terms, and which version, on your account. It is written when  | `modules/public-landing/public/terms.html:70` |
 | `20fcebaa85c4` | certain | The project hub needs JavaScript — the map, your projects, and starting a new one all live here. You can read  | `modules/public-landing/public/projects.html:530` |
 | `4a740b5afe73` | certain | The project map | `modules/public-landing/public/projects.html:540` |
 | `345fec12e5d8` | certain | The repository | `modules/public-landing/public/contact.html:50` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2189,
-    "unique_ids": 1889,
-    "certain": 2189,
+    "strings": 2188,
+    "unique_ids": 1888,
+    "certain": 2188,
     "heuristic": 0,
     "duplicate_ids": 207
   },
@@ -23,7 +23,7 @@
     "landing": {
       "at": "modules/public-landing/public",
       "files": 6,
-      "strings": 472
+      "strings": 471
     }
   },
   "blind_spots": [
@@ -17936,9 +17936,9 @@
       "confidence": "certain"
     },
     {
-      "id": "3b1cbe9e33aa",
+      "id": "d37e2fbde8c6",
       "surface": "landing",
-      "text": "If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.",
+      "text": "If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.",
       "file": "modules/public-landing/public/terms.html",
       "line": 71,
       "origin": "html-text",
@@ -18287,9 +18287,9 @@
       "confidence": "certain"
     },
     {
-      "id": "7fe31ce20c09",
+      "id": "1fdda2903cf9",
       "surface": "landing",
-      "text": "Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.",
+      "text": "Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.",
       "file": "modules/public-landing/public/terms.html",
       "line": 68,
       "origin": "html-text",
@@ -19303,15 +19303,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "dede132846fe",
-      "surface": "landing",
-      "text": "The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once — signing in again does not change the date you accepted. This is version",
-      "file": "modules/public-landing/public/terms.html",
-      "line": 70,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "20fcebaa85c4",
       "surface": "landing",

package/docs/module-api-changelog.md

@@ -2691,5 +2691,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.15 with no explicit bump. run 36717488992. (task 1002620)
   1.20.17 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.16 with no explicit bump. run 36722139698. (task 1002620)
+  1.20.18 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.17 with no explicit bump. run 36724081934. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -5,7 +5,7 @@
   "adr": "0341 D3",
   "reread": "node scripts/gds/page-reader.js --stale",
   "how": ["Generated by node scripts/gds/page-reader.js (BV2.TW04, task 1004315; ADR 0341 D3). Do not hand-edit.","One entry per page of docs/page-inventory.json. Lines are in page order: the default state first, and a line only another state shows sits where that state shows it, with its state named.","placement: placed = a docs/copy-registry.json row renders it (file, line, string_id); shared = shell text every page of the surface carries (top bar, sidebar, footer), with its row when the registry has one; unplaced = the registry cannot place it (a rewrite becomes an engineer task, ADR 0341 D4).","text keeps {…} where the registry row has a hole, or where a value the page read from its API was filled in. A string that is only such data is counted under omitted.data, not listed.","reading_hash is over the non-shared lines (key, section, text); files_hash is over the page's inventory files. --check compares files_hash only and never opens a browser.","Rendered through the hall-preview harness (hall) and the ui-design kit stub (landing, status), at 1280x800 with the clock pinned, so a reading is the fixture world's page."],
-  "counts": {"pages":39,"lines":3791,"placed":1278,"shared":254,"unplaced":2259,"omitted_data":2054},
+  "counts": {"pages":39,"lines":3791,"placed":1277,"shared":254,"unplaced":2260,"omitted_data":2054},
   "pages": [
     {
       "id": "builders:atlas",
@@ -4132,9 +4132,9 @@
       "surface": "landing",
       "title": "{{productName}} — Terms",
       "states_read": ["default"],
-      "files_hash": "1523219e46cd7488",
-      "reading_hash": "a68fd4a222091122",
-      "counts": {"lines":45,"placed":29,"shared":9,"unplaced":7},
+      "files_hash": "5f1171d0ce6fb7d3",
+      "reading_hash": "007bea800099720b",
+      "counts": {"lines":45,"placed":28,"shared":9,"unplaced":8},
       "omitted": {"data":1},
       "notes": [],
       "lines": [
@@ -4158,13 +4158,13 @@
         {"key":"L0018","section":"Your work across projects","text":"These numbers describe; they do not govern.","placement":"placed","file":"modules/public-landing/public/terms.html","line":67,"string_id":"02e596cc4569"},
         {"key":"L0019","section":"Your work across projects","text":"Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and {…} may treat it as permission. A rank shown here is that project’s own standing for you, as that project reported it — the platform holds no rank of its own.","placement":"unplaced"},
         {"key":"L0020","section":"Your work across projects","text":"What is public.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"9b3312899fb1"},
-        {"key":"L0021","section":"Your work across projects","text":"Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"7fe31ce20c09"},
+        {"key":"L0021","section":"Your work across projects","text":"Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.","placement":"placed","file":"modules/public-landing/public/terms.html","line":68,"string_id":"1fdda2903cf9"},
         {"key":"L0022","section":"Your work across projects","text":"What you control.","placement":"placed","file":"modules/public-landing/public/terms.html","line":69,"string_id":"6130dcb60532"},
         {"key":"L0023","section":"Your work across projects","text":"From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform’s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.","placement":"placed","file":"modules/public-landing/public/terms.html","line":69,"string_id":"0808df6e434c"},
         {"key":"L0024","section":"Your work across projects","text":"Your acceptance is recorded.","placement":"placed","file":"modules/public-landing/public/terms.html","line":70,"string_id":"0f06f7e72ea7"},
-        {"key":"L0025","section":"Your work across projects","text":"The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once — signing in again does not change the date you accepted. This is version","placement":"placed","file":"modules/public-landing/public/terms.html","line":70,"string_id":"dede132846fe"},
+        {"key":"L0025","section":"Your work across projects","text":"The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once — signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub’s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version","placement":"unplaced"},
         {"key":"L0026","section":"Your work across projects","text":"Accounts from before these terms.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"9b02ec8a2e21"},
-        {"key":"L0027","section":"Your work across projects","text":"If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"3b1cbe9e33aa"},
+        {"key":"L0027","section":"Your work across projects","text":"If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.","placement":"placed","file":"modules/public-landing/public/terms.html","line":71,"string_id":"d37e2fbde8c6"},
         {"key":"L0028","section":"Fair use","text":"Fair use","placement":"placed","file":"modules/public-landing/public/terms.html","line":73,"string_id":"2585087f4873"},
         {"key":"L0029","section":"Fair use","text":"Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.","placement":"placed","file":"modules/public-landing/public/terms.html","line":74,"string_id":"8d812912c392"},
         {"key":"L0030","section":"Liability","text":"Liability","placement":"unplaced"},

package/modules/public-landing/public/terms.html

@@ -65,10 +65,10 @@
     <h2>Your work across projects</h2>
     <p>Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency}} you earned, the works you shipped, your karma, the rank that project gave you, the roles you worked in, and when you were last active. The platform adds these up across every project into one cross-project record. Projects report this themselves — the platform does not read their databases.</p>
     <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
-    <p><b>What is public.</b> Once you have signed in to a project with your platform account and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.</p>
+    <p><b>What is public.</b> Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.</p>
     <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
-    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project with your platform account, and only once &mdash; signing in again does not change the date you accepted. This is version <b>2026-08-29</b>.</p>
-    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once &mdash; signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub&rsquo;s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version <b>2026-08-29</b>.</p>
+    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.</p>
     <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.17",
+  "version": "1.20.18",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.17",
+      "version": "1.20.18",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.17",
+  "version": "1.20.18",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8158,5 +8158,11 @@
       "id": "1003540",
       "text": "Guessing someone's private profile name on the recruiting page is now speed-limited, so it can't be used to discover who is open to recruiting."
     }
+  ],
+  "1.20.18": [
+    {
+      "id": "1004265",
+      "text": "The terms page now says your agreement is recorded when you sign in to a project in your browser, and explains why a command-line-only sign-in doesn't publish your profile."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.17'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.18'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/terms_acceptance.mjs

@@ -118,20 +118,32 @@ t('the acceptance the page promises is the one the code actually keeps', () => {
 });
 
 // The capture point is GET /sso/authorize — reached when a builder uses their
-// platform account to sign in to a PROJECT. Signing in to the hub itself stamps
-// nothing (blocker 1000124, task 1003353), so the page must not say "here".
-// Task 1003361 adds the hub's own sign-in as a second capture point; when it
-// lands, this wording and §3 below change together.
-t('the page names the sign-in the code actually watches — a project sign-in, not "here" (blocker 1000124)', () => {
+// platform account to sign in to a PROJECT, IN A BROWSER. Signing in to the hub
+// itself stamps nothing (blocker 1000124, task 1003353), so the page must not say
+// "here"; and the CLI's project sign-in (the device poll) stamps nothing either
+// (task 1004265, executed in §3), so the page must say "in your browser" and tell a
+// command-line builder why. Task 1003361 adds the hub's own sign-in as a second
+// capture point; when it lands, this wording and §3 below change together.
+t('the page names the sign-in the code actually watches — a project sign-in in the browser, not "here" (blocker 1000124)', () => {
   const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
   assert.doesNotMatch(section, /sign(?:ed|ing)? in here/i,
     'the page promises that signing in to this site records acceptance — the code never stamps that sign-in');
-  assert.match(section, /Once you have signed in to a project with your platform account and accepted these terms/,
+  assert.match(section, /Once you have signed in to a project in your browser with your platform account and accepted these terms/,
     'what makes a profile public must name the moment the code captures');
   assert.match(section, /never signed in to a project that way stays provisional/,
     'and the provisional case must be the same moment, negated');
-  assert.match(section, /written when you sign in to a project with your platform account, and only once/,
+  assert.match(section, /written when you sign in to a project in your browser with your platform account, and only once/,
     'the acceptance paragraph must name the same capture point');
+  assert.doesNotMatch(section, /sign(?:ed)? in to a project with your platform account/,
+    'an unqualified "project sign-in" also covers the command line, which records nothing (task 1004265)');
+});
+
+t('the page tells a command-line-only builder that their sign-in records nothing, and why (task 1004265)', () => {
+  const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
+  assert.match(section, /Signing in from the command line does not record it/,
+    'a CLI-only builder stays unpublished, and the page must say so rather than leave them to guess');
+  assert.match(section, /on GitHub’s page, where these terms are not shown/,
+    'and why: the device approval never puts these terms in front of them');
 });
 
 t('the page says which acceptances were given on a builder’s behalf, and that the record marks them (task 1003360)', () => {
@@ -139,7 +151,7 @@ t('the page says which acceptances were given on a builder’s behalf, and that
     'the owner chose to grandfather AND to say so on the page — the page must tell a pre-existing builder what was recorded for them');
   assert.match(termsHtml, /marks that acceptance as grandfathered/i,
     'and that the record keeps it distinguishable from one they gave');
-  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project/i,
+  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project in your browser/i,
     'and what happens when they do sign in — the conflict branch below really does replace it');
   assert.doesNotMatch(termsHtml, /written only by signing in/i,
     'the page still says acceptance is written ONLY by signing in, which is false for every grandfathered account');
@@ -503,6 +515,100 @@ await ta('a session of an undeclared source (a leftover dev-box token) cannot mi
   assert.equal(pool.accounts.size, 0, 'a session of an undeclared source recorded a platform T&C acceptance');
 });
 
+// The CLI's project sign-in (POST /sso/device/poll) also uses the platform account,
+// and it deliberately records NOTHING (task 1004265). The approval happens on
+// GitHub's device page, never on a hub page, so these terms are never in front of
+// the person — and activation is ADR 0171 D3's "a human is demonstrably at the hub",
+// which the same branch stamps. So the page names a BROWSER sign-in and says why a
+// command-line one does not count; this drives the real route to hold that claim.
+function post(path_, body) {
+  const payload = JSON.stringify(body);
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      host: '127.0.0.1', port, method: 'POST', path: path_,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// GitHub's side of the device flow, answered as approved for `identity`. The route
+// reaches both modules through their exports objects, so this swaps the network leg
+// and the signing key only — the route, its upsert and the fake pool stay real.
+async function withApprovedDevice(identity, fn) {
+  const hubDevice = require('../modules/platform-identity/hub-device.js');
+  const hubKeys = require('../modules/platform-identity/hub-keys.js');
+  const saved = {
+    hubDeviceConfigured: hubDevice.hubDeviceConfigured,
+    pollHubGithubDevice: hubDevice.pollHubGithubDevice,
+    hubSigningConfigured: hubKeys.hubSigningConfigured,
+    mintHubAssertion: hubKeys.mintHubAssertion,
+  };
+  hubDevice.hubDeviceConfigured = () => true;
+  hubDevice.pollHubGithubDevice = async () => ({ state: 'ok', client_id: 'proj-a', identity });
+  hubKeys.hubSigningConfigured = () => true;
+  hubKeys.mintHubAssertion = () => 'ASSERTION';
+  try { return await fn(); } finally {
+    hubDevice.hubDeviceConfigured = saved.hubDeviceConfigured;
+    hubDevice.pollHubGithubDevice = saved.pollHubGithubDevice;
+    hubKeys.hubSigningConfigured = saved.hubSigningConfigured;
+    hubKeys.mintHubAssertion = saved.mintHubAssertion;
+  }
+}
+
+const CLI_IDENTITY = { github_id: '5151', github_login: 'cli-only', display_name: 'Cli Only', avatar_url: null };
+
+await ta('a CLI-only project sign-in (the device poll) signs the builder in and records NO acceptance (task 1004265)', async () => {
+  SESSION = null;
+  pool.accounts.clear();
+  pool.calls.length = 0;
+  pool.setClock(NOW);
+  const res = await withApprovedDevice(CLI_IDENTITY, () => post('/sso/device/poll', { device_code: 'dc-1' }));
+  assert.equal(res.status, 200, 'CONTROL: the device poll must succeed, or the absence below proves nothing');
+  assert.equal(res.json && res.json.assertion, 'ASSERTION', 'CONTROL: the CLI got its sign-in assertion');
+  const row = pool.accounts.get('5151');
+  assert.ok(row, 'CONTROL: the device poll writes the platform account — the absence below is of the stamp, not the row');
+  assert.equal(row.terms_accepted_at, null,
+    'a command-line sign-in stamped an acceptance — nobody was shown the terms on that path; if this is now intended, /terms and ADR 0213 change with it');
+  assert.equal(row.terms_version, null);
+  assert.equal(row.profile_state, 'provisional', 'and it activates nothing (ADR 0171 D3: activation is a human at the hub)');
+  const upserts = pool.calls.filter((c) => /INSERT INTO platform_identity_accounts/i.test(c.sql) && /DO UPDATE/i.test(c.sql));
+  assert.equal(upserts.length, 1);
+  assert.equal(upserts[0].params[4], false, 'the device poll must pass the non-activating literal');
+});
+
+await ta('the device poll takes no acceptance from its body either — an extra field is refused before any write', async () => {
+  pool.accounts.clear();
+  const res = await withApprovedDevice(CLI_IDENTITY, () => post('/sso/device/poll', {
+    device_code: 'dc-2', activate: true, terms_accepted_at: '1999-01-01T00:00:00.000Z', terms_version: 'FORGED',
+  }));
+  assert.equal(res.status, 400, 'the strict validator must refuse fields the route does not declare');
+  assert.equal(pool.accounts.size, 0, 'a refused poll still wrote an account');
+});
+
+await ta('a CLI-only builder who later signs in to a project in the browser IS stamped then', async () => {
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  await withApprovedDevice({ ...CLI_IDENTITY, github_id: '4242', github_login: 'octo' },
+    () => post('/sso/device/poll', { device_code: 'dc-3' }));
+  assert.equal(pool.accounts.get('4242').terms_accepted_at, null);
+  SESSION = HUB_SESSION;
+  pool.setClock(LATER);
+  assert.equal((await authorize()).status, 302);
+  const row = pool.accounts.get('4242');
+  assert.equal(row.terms_accepted_at, LATER, 'the browser sign-in the page names must stamp the account the CLI created');
+  assert.equal(row.profile_state, 'active');
+});
+
 // ===========================================================================
 // 4. Idempotence — executed, not asserted against a string
 // ===========================================================================