@bongos/core 1.21.118 → 1.21.119

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.118",
-  "core_contract": "1.21.118",
-  "source_commit": "dcd72a0708a97d3f7456fa0a81107290b96735e1",
+  "core_version": "1.21.119",
+  "core_contract": "1.21.119",
+  "source_commit": "e45da330efcf6e68ae4775165b5025cbb4903372",
   "source_ref": "HEAD",
-  "built_at": "2026-10-14T10:48:05.194Z",
+  "built_at": "2026-10-14T13:43:35.449Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 605,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3750,
-  "tree_sha256": "b11512b16cdfc9e1d2262db9dd14ef853c0e50f162acb1d37d7a5dcde00624af",
+  "tree_sha256": "ab4ca3dcbd21d9cc55a93db106532caca2363b955e5c205e9f69d3992547742e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0bca8168d0f2d10c8d83bb1af215cb20c58dd4567d03ae883736a0f41f04599a"
+      "sha256": "9273e8ea9033856fb3df24625de22515aa4129046a17c41c65bc5d3f71ec8e24"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10467,12 +10467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8e4eea79cadc227a61eae2aa188d59b77164d48bb6ced42f3a12fdc0337d3552"
+      "sha256": "6469337696b64177fd52f7466f9ac81a7944f2095f16b3d0f7689569038efd02"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d80da007318c57a326aade4c46f86611e2b4c880238ce41b6687fc0eb16ccb58"
+      "sha256": "90f1c32901b1026f763dc05ee48aa2e1a6aa09727fbe360f49fbb4d21e5126a6"
     },
     {
       "path": "public-docs/index.html",
@@ -10492,7 +10492,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "1d8eee0dd66972332df040258a793f718f61d157d519942957e85269e04413f6"
+      "sha256": "ef8c6938bb9e62be346bd1a44b2a590a7ff503bbbc0b44fc7ad2a4d112e96910"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11742,7 +11742,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "b57b79a2c32798f7f8f1479b06dd9994ffafdd13e01fd80e7bfa758e02b2d317"
+      "sha256": "d6d81c3bb8017122cb6b5a46355b637f7986ec324132bcd583f0c02d2725b6d0"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -12802,7 +12802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4bd32a9182893767f8c604f943ca6a760dd6907894107bee785f51ae6c39d559"
+      "sha256": "9d6d6c4c7cbec83c8655f8299d3700b0810cb2d6e0cf5b7a06757e33cd756263"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15632,7 +15632,7 @@
     {
       "path": "tests/hub_profile_leak.mjs",
       "mode": "0000644",
-      "sha256": "e9609a8adad0c460c24db69211f02beef3699e3e841d44c1385105c4f5c93385"
+      "sha256": "298afa1c71a485c3c64d90a3976c1a7147f1e888a9362a84502d5a9a94611d56"
     },
     {
       "path": "tests/hub_recent_ships.mjs",

package/docs/module-api-changelog.md

@@ -3073,5 +3073,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.116 with no explicit bump. run 38548762428. (task 1002620)
   1.21.118 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.117 with no explicit bump. run 38552002742. (task 1002620)
+  1.21.119 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.118 with no explicit bump. run 38574092141. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.118",
+  "version": "1.21.119",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.118",
+      "version": "1.21.119",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.118",
+  "version": "1.21.119",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9690,5 +9690,11 @@
       "id": "1004729",
       "text": "Hosted projects now take released core updates on their own, one at a time, by each project's update rule (pinned projects never move), with a platform-wide off switch."
     }
+  ],
+  "1.21.119": [
+    {
+      "id": "1004664",
+      "text": "A profile privacy test that had been switched off because it failed on a fresh database is fixed and switched back on, so it guards the public profile page again."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -465,7 +465,7 @@ const INTEGRATION_PARKED = new Set([
   'bfg', 'bfg_write',
   'claim_gate_open_blocker', 'claim_gate_rebase',
   'clawback_confirmed_backlog', 'copy_desk_flags_db',
-  'government_board_membership_db', 'handle_machinery', 'hub_profile_leak',
+  'government_board_membership_db', 'handle_machinery',
   'idea_credit_streams_db', 'memory_isolation', 'memory_pull', 'needs_rebase',
   'profile_fields', 'project_visibility_db', 'reward_mode_cost_plus_only',
   'session_earnings_mirror_db', 'setup_smoke', 'status-probe',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.118'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.119'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hub_profile_leak.mjs

@@ -68,7 +68,8 @@ const SECRET_HASH = 'HASH-DO-NOT-LEAK-p05';
 const SECRET_PROJECT = 'P05-PRIVATE-DO-NOT-LEAK';
 const SECRET_PREV = 'p05-prev-sentinel';
 const PUB_ORIGIN = 'https://p05-pub.example', PRIV_ORIGIN = 'https://p05-priv.example';
-const CP_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+// crafts: each craft's own summed numbers (task 1004440), named or not like the totals.
+const CP_KEYS = ['totals', 'disciplines', 'crafts', 'last_active', 'projects', 'more_projects'];
 const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since', 'bio', 'links'];
 
 const q = (sql, params) => pool.query(sql, params);
@@ -128,6 +129,16 @@ try {
   // 42703 "column does not exist" instead of a 404-vs-200 assertion.
   await q(migrationSql('platform_identity_012_account_privacy.sql'));
   await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
+  // getRollupForBuilder reads four more (task 1004664 — this file failed 3 of 7 on a FRESH
+  // database: every check that reaches the rollup answered 42703, while an old shared
+  // database that already had the columns hid it). It names a project only when it is ON
+  // THE MAP (projects-feed.js onMapSql: status, the publish gate's description, a known
+  // door) AND its door is public — 011 + 020 — and serializes a.recent_ships (012) and
+  // a.crafts (029).
+  await q(migrationSql('platform_identity_011_project_visibility.sql'));
+  await q(migrationSql('platform_identity_012_recent_ships.sql'));
+  await q(migrationSql('platform_identity_020_visibility_pull.sql'));
+  await q(migrationSql('platform_identity_029_activity_crafts.sql'));
   await cleanup();
 
   // The active account carries the P02 fields + a user-set name source, so the
@@ -150,9 +161,13 @@ try {
      VALUES ($1, $3, 'P05 Pub Proj', $4), ($2, $3, $5, $6)`,
     [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, PUB_ORIGIN, SECRET_PROJECT, PRIV_ORIGIN],
   );
+  // Both projects are on the map — active, described, door known — so the ONLY thing that
+  // keeps the second one unnamed is its private door. A fixture that left out the
+  // description would pass the "never named" check for the wrong reason (unpublishable).
   await q(
-    `INSERT INTO platform_identity_projects (origin, name, featured, status)
-     VALUES ($1, 'P05 Pub Proj', true, 'active'), ($2, $3, false, 'active')`,
+    `INSERT INTO platform_identity_projects (origin, name, featured, status, description, visibility, visibility_source)
+     VALUES ($1, 'P05 Pub Proj', true, 'active', 'A public P05 project.', 'public', 'control-plane'),
+            ($2, $3, false, 'active', 'A private P05 project.', 'private', 'control-plane')`,
     [PUB_ORIGIN, PRIV_ORIGIN, SECRET_PROJECT],
   );
   await q(
@@ -180,7 +195,7 @@ try {
     assert.equal(r.json.cross_project.totals.projects, 2, 'both projects count');
     assert.equal(r.json.cross_project.projects.length, 1, 'only the publicly listed project is named');
     assert.equal(r.json.cross_project.projects[0].name, 'P05 Pub Proj');
-    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held'].sort());
+    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held', 'recent_ships'].sort());
     assert.equal(r.json.cross_project.more_projects, 1, 'the non-public project is counted, never named');
     assert.equal(r.json.account.bio, 'Builds things.', 'bio serializes (P02)');
     assert.deepEqual(r.json.account.links, { website: 'https://p05.example/' }, 'links serialize (P02)');