@bongos/core 1.21.174 → 1.21.176

package/scripts/gds/seed-bv1-profile-page-tasks.js

@@ -1,161 +1,6 @@
-// Seed the delta tasks the profile-page spike (task 1002783) surfaced, under
-// goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
-//
-// Source of truth: docs/specs/bongos-v1-builder-profile-page.md (status: final).
-// The Phase-1 spine (R01-R06) was already seeded by seed-bv1-profiles-tasks.js;
-// this file adds ONLY what that spec found on top of it, so the two seeders are
-// disjoint and both stay re-runnable.
-//
-// Idempotent on (source, source_ref) — re-running resolves to the existing rows
-// and re-asserts the dependency edges.
-//
-// Run: node scripts/gds/seed-bv1-profile-page-tasks.js
-
-const { apiCall } = require('./cli-lib');
-
-const VER = 'BONGOS-V1';
-const GOAL = 1000045;
-const SRC = 'planning-session';
-const SPEC = 'docs/specs/bongos-v1-builder-profile-page.md';
-
-// Tasks that already exist and that these depend on — referenced by id, since
-// they were seeded by the sibling seeder (or by the wave task 1002781).
-const R01 = 1002277;   // spike · design profile↔rollup join + consent model
-const R02 = 1002278;   // feature · profile API returns cross-project record
-const R03 = 1002279;   // feature · hide flag
-const R05 = 1002281;   // feature · shareable-by-login profile URL
-const SETTINGS_SPIKE = 1002784;   // spike · account settings page — inventory + placement
-const PRIVACY_SPIKE = 1002785;    // spike · account privacy model + invite inbox
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-// Throttled + 429-aware wrapper. The seeder makes ~20 writes in a burst, which
-// is exactly the shape the per-IP limiter is there to catch.
-async function api(method, path, body, _tries = 0) {
-  await sleep(400);
-  const r = await apiCall(method, `/api/bongos${path}`, body);
-  if (r.status === 429 && _tries < 8) {
-    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
-    console.log(`  …rate-limited, waiting ${wait}s`);
-    await sleep(wait * 1000);
-    return api(method, path, body, _tries + 1);
-  }
-  return r;
-}
-
-// deps entries are either a local ref ('P01') or a numeric id of an existing task.
-const TASKS = [
-  {
-    ref: 'P01', kind: 'feature', disc: 'engineer', prio: 5, est: 180, crit: ['C1'], deps: [R01],
-    title: 'P01 · Builder handle on platform accounts (seed, dedupe, reserved list, rename)',
-    desc: `Add a \`handle\` column to platform_identity_accounts: seeded from github_login at creation, deduped with a numeric suffix on collision, validated against a small reserved list (me, new, edit, settings, admin, api, u), builder-editable at a low rate limit, previous handle retained for a 301 window. github_id stays the join key everywhere — the handle is presentation only. WHY: github_login is mutable, so hanging the canonical profile URL on it means every GitHub rename silently 404s that builder's shared links. Namespaced module migration (ADR 0083). Spec: ${SPEC} (Decision 3).`,
-  },
-  {
-    ref: 'P02', kind: 'feature', disc: 'engineer', prio: 5, est: 180, crit: ['C1'], deps: [R01],
-    title: 'P02 · Profile fields: bio + typed links on the platform account',
-    desc: `Add \`bio\` (plain text, ~280 chars, NO markdown and no auto-linking) and \`links\` (a TYPED, capped set — website, X, LinkedIn, Discord; max 4) to platform_identity_accounts, plus the authenticated write. Server-side validation must enforce https-only AND reject non-http(s) schemes and userinfo/host tricks — do not rely on the client. Render with rel="nofollow ugc noopener". WHY typed-and-capped rather than a free-form link list: a public, indexable page with user-controlled links is an SEO-spam magnet, and this removes the incentive without a moderation queue. Spec: ${SPEC} (Decision 4).`,
-  },
-  {
-    ref: 'P03', kind: 'decision', disc: 'engineer', prio: 5, est: 60, crit: ['C1'], deps: [], ready: true,
-    title: 'P03 · Owner decision: provisional vs active profile state for check-in-created accounts',
-    desc: `Goal 1000045 justifies "public by default" as tied to having a platform account, "which already carries platform T&C consent". That premise is not currently true for every account: POST /sso/membership/check-in and POST /sso/activity/rollup cause the hub to upsert an account for a builder who has never visited the hub and never saw a platform T&C. Under auto-create (see task 1002783) those people would get a public, indexable, cross-project profile from a sign-in they performed on someone else's instance. RECOMMENDATION: a profile_state of 'provisional' (created by check-in — still counted in aggregates, but not publicly listed, not at the handle URL, not in the sitemap, not in hub search) vs 'active' (has signed in at the hub at least once). One column, one branch. This is an owner product/consent call, and it changes the shape of P09. Spec: ${SPEC}.`,
-  },
-  {
-    ref: 'P04', kind: 'feature', disc: 'ui', prio: 4, est: 180, crit: ['C1'], deps: ['P01', 'P02', SETTINGS_SPIKE],
-    title: 'P04 · Settings → Profile rail group (the single profile-edit surface)',
-    desc: `One edit surface for the profile, as a new rail group in the hall Settings page (the RAIL_GROUPS pattern in modules/hall-ui/public/settings.js) — not a separate edit page. Holds handle, bio, links alongside the display-name and disciplines controls that already live there. Account-global fields must be edited where they are stored; final hub-vs-per-project placement is task ${SETTINGS_SPIKE}'s call, which is why this waits on it. Spec: ${SPEC} (Decision 4).`,
-  },
-  {
-    ref: 'P05', kind: 'verify', disc: 'engineer', prio: 5, est: 120, crit: ['C1'], deps: [R02],
-    title: 'P05 · Leak test for the hub profile read (mirror of tests/profile_route.mjs)',
-    desc: `The instance route GET /builders/:id/profile projects an explicit public column whitelist and tests/profile_route.mjs proves the private columns (anthropic_email, anthropic_user_id, monthly_budget_usd, system_role, box_blocked*, deactivated_reason) never appear anywhere in the serialized response. The new cross-project read needs its OWN mirror test over the account + rollup projection before it is public — same sentinel-string technique, same 404-on-unknown-id assertion. Never spread a raw row. Spec: ${SPEC} (Constraints §1).`,
-  },
-  {
-    ref: 'P06', kind: 'feature', disc: 'ui', prio: 3, est: 120, crit: ['C1'], deps: ['P02'],
-    title: 'P06 · "Complete your profile" needs-attention inbox line item (dismissible)',
-    desc: `When bio or preferred_disciplines are empty, nudge the builder — as a DISMISSIBLE line item in the needs-attention inbox (goal-inbox.js / #attention-scroll), never a new Home card. That is the hall placement rule (modules/hall-ui/CLAUDE.md → Placement): an action awaiting the builder is an inbox line. This is the replacement for the profile-setup wizard that task 1002783 rejected. Spec: ${SPEC} (Decision 2).`,
-  },
-  {
-    ref: 'P07', kind: 'feature', disc: 'engineer', prio: 3, est: 210, crit: ['C1'], deps: [R02],
-    title: 'P07 · Hub recent works via push — recent_ships[] on the activity rollup',
-    desc: `The hub has no tasks table for other projects, so "recent works" cannot render there today. The existing PULL pattern (modules/platform-identity/project-stats.js) fans out to each project's public API — right for a builder count on a catalog page, wrong per-profile-view, and it cannot serve a CLI-only project at all. Extend the POST /sso/activity/rollup payload (which already carries credits/ships/karma/rank/disciplines per project) with a capped recent_ships[] — 3 per project: title, id, shipped_at, and a link into that instance — plus the instance-side reporter in core auth.js. Reuses a table and a reporter that already exist; costs no fan-out read; stays descriptive-analytics-only. Spec: ${SPEC} (page spec, section 4).`,
-  },
-  {
-    ref: 'P08', kind: 'feature', disc: 'ui', prio: 4, est: 150, crit: ['C1'], deps: ['P01', R05],
-    title: 'P08 · Canonical profile URL wiring (instance rel=canonical → hub; numeric id redirects)',
-    desc: `One canonical public profile, two render paths: the hub's server-rendered handle URL is canonical, and the hall's own profile page stays the LOCAL view and emits rel=canonical to it when the builder has a platform account. The numeric ?id= form never dies — it is stable and rename-proof, so keep it as a permanent fallback that redirects to the canonical handle URL. Coordinate with goal 1000048 R14 (public builder-profile SEO page) so only ONE page gets built. Spec: ${SPEC} (Decision 1).`,
-  },
-  {
-    ref: 'P09', kind: 'feature', disc: 'engineer', prio: 3, est: 150, crit: ['C1'], deps: ['P01', PRIVACY_SPIKE],
-    title: 'P09 · noindex until first ship + sitemap consent gate for builder profiles',
-    desc: `A public, indexable profile that anyone can mint is a backlink-farming surface. Gate indexing on the builder having at least one shipped work, and gate sitemap inclusion on consent (private accounts and — if the owner accepts P03 — provisional accounts are excluded). Coordinates with goal 1000048 R15 (builder profiles in sitemap, consent-gated). Shape depends on the P03 decision. Spec: ${SPEC} (Visibility rules).`,
-  },
-  {
-    ref: 'P10', kind: 'verify', disc: 'engineer', prio: 3, est: 90, crit: ['C2'], deps: [PRIVACY_SPIKE, R03],
-    title: 'P10 · PROOF: a private account\'s profile 404s to a stranger and renders to its owner',
-    desc: `Verify the profile page honours the privacy model: a private account's handle URL returns 404 — NOT 403, because a 403 confirms the handle exists — to everyone except the account itself, which sees its own profile with a "private" banner. Also assert the stats-hidden case renders no partial numbers (a count beside a hidden total is a leak by subtraction). The authoritative model is task ${PRIVACY_SPIKE}'s; if it lands a different rule, this proof follows it and the spec is the thing that is wrong. Spec: ${SPEC} (Visibility rules).`,
-  },
-];
-
-(async () => {
-  const idByRef = {};
-  let created = 0;
-  let existing = 0;
-  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
-  for (const t of TASKS) {
-    const r = await api('POST', '/tasks', {
-      version_id: VER,
-      goal_id: GOAL,
-      title: t.title,
-      description: t.desc,
-      kind: t.kind,
-      discipline: t.disc,
-      priority: t.prio,
-      est_minutes: t.est,
-      criterion_ids: t.crit,
-      source: SRC,
-      source_ref: `bv1-profile-page-${t.ref}`,
-    });
-    if (!r.ok) {
-      console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`);
-      continue;
-    }
-    const task = r.data.task || r.data;
-    idByRef[t.ref] = task.id;
-    if (r.data.idempotent || r.data.existing) existing++; else created++;
-    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
-  }
-
-  console.log('Wiring dependencies…');
-  let edges = 0;
-  for (const t of TASKS) {
-    if (!t.deps.length) continue;
-    const id = idByRef[t.ref];
-    // A dep is either a local ref (resolved from this run) or a literal task id.
-    const depIds = t.deps.map((d) => (typeof d === 'number' ? d : idByRef[d])).filter(Boolean);
-    if (!id || depIds.length !== t.deps.length) {
-      console.log(`  ${t.ref}: dep resolve gap, skipping`);
-      continue;
-    }
-    // PUT replaces the full set, so a re-run converges instead of erroring on
-    // an edge that already exists.
-    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
-    if (!r.ok) {
-      console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.data)}`);
-      continue;
-    }
-    edges += depIds.length;
-    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
-  }
-
-  console.log('Promoting zero-dep roots to ready…');
-  for (const t of TASKS.filter((x) => x.ready)) {
-    const id = idByRef[t.ref];
-    if (!id) continue;
-    const r = await api('POST', `/tasks/${id}/promote`, {});
-    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
-  }
-
-  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}.`);
-  console.log('ref→id:', JSON.stringify(idByRef));
-})();
+// scripts/gds/seed-bv1-profile-page-tasks.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/seed-bv1-profile-page-tasks.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'seed-bv1-profile-page-tasks.js');

package/scripts/gds/seed-bv1-profiles-tasks.js

@@ -1,135 +1,6 @@
-// DO NOT COPY THE `crit:` TOKENS FROM THIS FILE (task 1003108). Its positional
-// "Cn" refs were written when BONGOS-V1 held one goal, where they were unambiguous.
-// Cn ranks over the whole VERSION's criteria, so on a multi-goal version it resolves
-// to another goal's criterion silently — that is how all 15 tasks of goal 1000071 were
-// mislinked (learning 1000188). POST /tasks now refuses a positional ref on a
-// multi-goal version (400 ambiguous_criterion_ref). A new seed uses criterion_id
-// SLUGS. This file is kept as-is because it has already run and is idempotent on
-// source_ref — a re-run returns the existing rows before criterion resolution.
-//
-// Seed the tasks for goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
-// Source of truth: docs/specs/bongos-v1-public-builder-profiles.md (status: final).
-// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
-//
-// Run: node scripts/gds/seed-bv1-profiles-tasks.js
-const os = require('os');
-const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
-const BASE = sess.api_base.replace(/\/$/, '');
-const TOKEN = sess.token;
-const VER = 'BONGOS-V1';
-const GOAL = 1000045;
-const SRC = 'planning-session';
-const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-async function api(method, path, body, _tries = 0) {
-  await sleep(400); // base throttle to stay under the per-IP rate limit
-  const res = await fetch(`${BASE}/api/bongos${path}`, {
-    method, headers: H, body: body ? JSON.stringify(body) : undefined,
-  });
-  const text = await res.text();
-  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
-  if (res.status === 429 && _tries < 8) {
-    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
-    console.log(`  …rate-limited, waiting ${wait}s`);
-    await sleep(wait * 1000);
-    return api(method, path, body, _tries + 1);
-  }
-  return { status: res.status, ok: res.ok, json };
-}
-
-// disc: engineer (backend/API/spike) | ui (frontend). kind: spike | feature | verify (proofs).
-const TASKS = [
-  // Phase 1 — profile shows cross-project record + hide (C1,C2) — P5
-  { ref:'R01', kind:'spike',   disc:'engineer', prio:5, est:180, crit:['C1','C2'], deps:[],            title:'R01 · Design profile↔cross-project rollup join + consent model', desc:'Needs-exploration: how the public profile reads the platform-identity rollup (listScoutingRollup / platform_identity_builder_project_activity), public-by-default, and where the hide flag (C2) lives. Output an ADR + sub-tasks. See docs/specs/bongos-v1-public-builder-profiles.md.' },
-  { ref:'R02', kind:'feature', disc:'engineer', prio:5, est:240, crit:['C1'],      deps:['R01'],        title:'R02 · Profile API returns cross-project record + project names', desc:'Extend GET /builders/:id/profile to include aggregated cross-project credits/ships/karma/disciplines + the list of projects by name, from the platform-identity rollup; public by default; respects the whitelist + leak test (tests/profile_route.mjs). Done-when: another account sees the aggregate + project names, no private columns. Deps R01.' },
-  { ref:'R03', kind:'feature', disc:'engineer', prio:5, est:180, crit:['C2'],      deps:['R01'],        title:'R03 · Hide flag: builder hides cross-project stats (opt-out, live)', desc:'Self-serve opt-out that hides the cross-project record from the profile + applications, honored live everywhere. Default is shown. Deps R01.' },
-  { ref:'R04', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C1','C2'], deps:['R02','R03'],  title:'R04 · Profile UI: cross-project section + self hide-toggle', desc:'Render the cross-project section (totals + project names) on the profile; show the hide toggle to the profile owner. Deps R02,R03.' },
-  { ref:'R05', kind:'feature', disc:'ui',       prio:4, est:120, crit:['C1'],      deps:['R02'],        title:'R05 · Shareable-by-login profile URL (?builder=<login>)', desc:'Add a login-addressable profile URL alongside ?id=. Promotes idea #1000522. Deps R02.' },
-  { ref:'R06', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C1','C2'], deps:['R04','R03'],  title:'R06 · PROOF: cross-project record shows to a viewer; hide removes it live', desc:'Verify a 2-project builder\'s combined record shows to another account, and hiding removes it within one load. Extends tests/profile_route.mjs. Deps R04,R03.' },
-
-  // Phase 2 — apply from orbs + application carries profile (C3,C4) — P5
-  { ref:'R07', kind:'spike',   disc:'engineer', prio:5, est:180, crit:['C3','C4'], deps:[],             title:'R07 · Design application model + "project owner (registrant+delegates)" authz', desc:'Needs-exploration: extend access_requests vs a new cross-project applications record; how the profile snapshot travels hub→target; the owner (registrant + delegates) authz; pending queue + approve/decline. Output an ADR + sub-tasks. Deps none.' },
-  { ref:'R08', kind:'feature', disc:'engineer', prio:5, est:240, crit:['C3','C4'], deps:['R07'],        title:'R08 · Application API: apply / list-pending / approve / decline', desc:'Cross-project application flow reusing the join relay (/my-projects/join → target /access-requests). Deps R07.' },
-  { ref:'R09', kind:'feature', disc:'engineer', prio:5, est:150, crit:['C4'],      deps:['R08','R02'],  title:'R09 · Application carries the applicant\'s cross-project record (+note)', desc:'Attach the applicant\'s cross-project record (subject to the C2 hide, live) + optional note to the application the owner sees. Deps R08,R02.' },
-  { ref:'R10', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C3'],      deps:['R08'],        title:'R10 · "Apply" affordance on the in-core browse surface', desc:'Apply action + state (applied/pending/member) on the project cards / My Projects. Deps R08.' },
-  { ref:'R11', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C4'],      deps:['R08'],        title:'R11 · Owner pending-applications view (approve/decline)', desc:'A project owner sees pending applications for their project and approves/declines. Deps R08.' },
-  { ref:'R12', kind:'feature', disc:'ui',       prio:4, est:150, crit:['C3'],      deps:['R10'],        title:'R12 · Surface "Apply" on the orbs front door', desc:'Wire the Apply affordance onto the orbs page. NOTE: the orbs front door is a separate static site — this likely lands instance-side. Deps R10.' },
-  { ref:'R13', kind:'verify',  disc:'engineer', prio:5, est:90,  crit:['C3','C4'], deps:['R10','R11','R09'], title:'R13 · PROOF: apply → owner sees record → approves → applicant joins', desc:'End-to-end verify of the apply→approve flow carrying the profile. Deps R10,R11,R09.' },
-
-  // Phase 3 — owners browse builder profiles (C5) — P4
-  { ref:'R14', kind:'feature', disc:'engineer', prio:4, est:210, crit:['C5'],      deps:['R02'],        title:'R14 · Graduate /scouting to project-owner-facing + opt-out-of-recruiting flag', desc:'Widen the Archon-only /scouting to a project owner (registrant+delegates); add a builder opt-out-of-recruiting flag. Touches authz → Metic+ floor. Deps R02.' },
-  { ref:'R15', kind:'feature', disc:'ui',       prio:4, est:210, crit:['C5'],      deps:['R14'],        title:'R15 · Owner recruiting UI (search/filter/sort; honors hide + opt-out)', desc:'Owner-facing recruiting surface: search/filter by discipline, sort by track record; honors C2 hide + recruiting opt-out. Deps R14.' },
-  { ref:'R16', kind:'feature', disc:'ui',       prio:4, est:150, crit:['C5'],      deps:['R15','R08'],  title:'R16 · Browse → invite/recruit a builder to your project', desc:'Invite/recruit a builder from the browse surface, tying into the application/invite flow. Deps R15,R08.' },
-  { ref:'R17', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C5'],      deps:['R15','R16'],  title:'R17 · PROOF: non-Archon owner browses, filters, invites', desc:'Verify a non-Archon project owner browses builder profiles, filters by discipline, invites one. Deps R15,R16.' },
-
-  // Phase 4 — builder-to-builder connections + degrees (C6) — P4
-  { ref:'R18', kind:'spike',   disc:'engineer', prio:4, est:180, crit:['C6'],      deps:[],             title:'R18 · Design connections model incl. 1st/2nd/3rd-degree traversal', desc:'Needs-exploration: platform-level connections (account↔account) with request/accept/decline/remove; degree-of-separation traversal (1st/2nd/3rd); "people you may know" from native signals. Output an ADR + sub-tasks. Deps none.' },
-  { ref:'R19', kind:'feature', disc:'engineer', prio:4, est:240, crit:['C6'],      deps:['R18'],        title:'R19 · Connections API: request/accept/decline/remove/list + degree queries', desc:'The connection graph API incl. degree-of-separation queries. Deps R18.' },
-  { ref:'R20', kind:'feature', disc:'ui',       prio:4, est:180, crit:['C6'],      deps:['R19','R04'],  title:'R20 · Connections on the profile (with degree labels) + connect button', desc:'Show a builder\'s connections (public) with 1st/2nd/3rd-degree labels; connect/pending/accept from the profile. Deps R19,R04.' },
-  { ref:'R21', kind:'feature', disc:'engineer', prio:4, est:150, crit:['C6'],      deps:['R19'],        title:'R21 · "Builders you may know" from mutuals + shared projects/guilds', desc:'Suggest connections from mutual connections + shared projects/guilds (2nd/3rd degree). Deps R19.' },
-  { ref:'R22', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C6'],      deps:['R20','R21'],  title:'R22 · PROOF: two builders connect; each sees the other + a 2nd-degree suggestion', desc:'Verify request→accept, mutual visibility, and a 2nd-degree suggestion appears. Deps R20,R21.' },
-
-  // Phase 5 — guilds + apply/invite + guild map (C7,C8,C9) — P3
-  { ref:'R23', kind:'spike',   disc:'engineer', prio:3, est:210, crit:['C7','C8','C9'], deps:['R18','R07'], title:'R23 · Design guild model (tables, roles, public/unlisted, rollup, map ranking)', desc:'Needs-exploration: platform-level guilds + guild_members (multi-guild, distinct from goal_members); roles; public/unlisted visibility; collective rollup (excludes hidden members); guild↔project application reuse; map ranking. Output an ADR + sub-tasks. Deps R18,R07.' },
-  { ref:'R24', kind:'feature', disc:'engineer', prio:3, est:240, crit:['C7'],      deps:['R23'],        title:'R24 · Guild CRUD + membership API + public/unlisted visibility', desc:'Create guild, invite/accept/join-request, roster, leave; owner sets public/unlisted. Deps R23.' },
-  { ref:'R25', kind:'feature', disc:'ui',       prio:3, est:210, crit:['C7'],      deps:['R24'],        title:'R25 · Guild page UI (identity, roster, collective record)', desc:'Guild page: identity, roster, collective track record (N of M counted). Deps R24.' },
-  { ref:'R26', kind:'feature', disc:'engineer', prio:3, est:180, crit:['C7'],      deps:['R24','R02'],  title:'R26 · Guild collective track-record rollup (excludes hidden members)', desc:'Aggregate members\' cross-project stats into the guild total; exclude C2-hidden members ("N of M counted"). Deps R24,R02.' },
-  { ref:'R27', kind:'feature', disc:'engineer', prio:3, est:210, crit:['C8'],      deps:['R24','R08'],  title:'R27 · Guild → project applications + owner invites a guild (each-member-opt-in)', desc:'Guild applies to / is invited to a project (guild-level mirror of R08); each member opts in before being attached. Deps R24,R08.' },
-  { ref:'R28', kind:'feature', disc:'ui',       prio:3, est:150, crit:['C8'],      deps:['R27','R11'],  title:'R28 · Owner view: pending guild applications', desc:'Extends the owner application view (R11) to guild applications. Deps R27,R11.' },
-  { ref:'R29', kind:'spike',   disc:'engineer', prio:3, est:150, crit:['C9'],      deps:['R26'],        title:'R29 · Design guild map ranking + orb-sky viz approach', desc:'Needs-exploration: rank guilds by size/success; render on the orb-sky visual language (goal 1000044). Output design + sub-tasks. Deps R26.' },
-  { ref:'R30', kind:'feature', disc:'engineer', prio:3, est:150, crit:['C9'],      deps:['R26'],        title:'R30 · Guild map API (ranked; public guilds only; honors hide)', desc:'Ranked guilds by size/success; only public (not unlisted) guilds; honors member hide. Deps R26.' },
-  { ref:'R31', kind:'feature', disc:'ui',       prio:3, est:210, crit:['C9'],      deps:['R30','R29','R15'], title:'R31 · Guild map UI on the recruiting surface (orb-sky visual)', desc:'Visual guild map on the owner recruiting surface. Deps R30,R29,R15.' },
-  { ref:'R32', kind:'verify',  disc:'engineer', prio:3, est:120, crit:['C7','C8','C9'], deps:['R25','R27','R31'], title:'R32 · PROOF: form guild → applies (members opt in) → owner approves → ranked on map', desc:'End-to-end verify of the guild lifecycle incl. the map. Deps R25,R27,R31.' },
-
-  // Phase 6 — connection proximity via orb-sky physics (C10) — P3
-  { ref:'R33', kind:'spike',   disc:'engineer', prio:3, est:210, crit:['C10'],     deps:['R19','R23'],  title:'R33 · Design connection→orb-physics proximity + degree model', desc:'Needs-exploration: connection strength (direct + mutuals + shared projects/guilds + co-shipped; no time-decay) feeding orb-world physics (goals 1000044/1000049); cluster detection. NOTE cross-goal dependency on orb-physics infra. Output an ADR + sub-tasks. Deps R19,R23.' },
-  { ref:'R34', kind:'feature', disc:'engineer', prio:3, est:210, crit:['C10'],     deps:['R33'],        title:'R34 · Connection-strength + degree + cluster compute API', desc:'Compute connection strength + degrees + close-knit clusters; feeds orb physics + recruiting. Deps R33.' },
-  { ref:'R35', kind:'feature', disc:'ui',       prio:3, est:180, crit:['C10'],     deps:['R34','R25'],  title:'R35 · Builder-side: clusters in the orb sky → invite a close cluster to a guild', desc:'Close connections cluster in the orb sky; invite a cluster to form a guild from it. Deps R34,R25.' },
-  { ref:'R36', kind:'feature', disc:'ui',       prio:3, est:180, crit:['C10'],     deps:['R34','R16'],  title:'R36 · Project-side: recruit a close-knit cluster together', desc:'Surface close-knit clusters on the recruiting surface; recruit them together. Deps R34,R16.' },
-  { ref:'R37', kind:'verify',  disc:'engineer', prio:3, est:120, crit:['C10'],     deps:['R35','R36'],  title:'R37 · PROOF: cluster forms a guild from the sky; owner recruits a cluster', desc:'End-to-end verify of the proximity-driven guild-forming + cluster-recruiting. Deps R35,R36.' },
-];
-
-const ROOTS = ['R01', 'R07', 'R18']; // zero-dep entry spikes to open for claiming
-
-(async () => {
-  const idByRef = {};
-  let created = 0, existing = 0;
-  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
-  for (const t of TASKS) {
-    const r = await api('POST', '/tasks', {
-      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc,
-      kind: t.kind, discipline: t.disc, priority: t.prio, est_minutes: t.est,
-      criterion_ids: t.crit, source: SRC, source_ref: `bv1-profiles-${t.ref}`,
-    });
-    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
-    const task = r.json.task || r.json;
-    idByRef[t.ref] = task.id;
-    if (r.json.idempotent || r.json.existing) existing++; else created++;
-    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
-  }
-
-  console.log('Wiring dependencies…');
-  let edges = 0;
-  for (const t of TASKS) {
-    if (!t.deps.length) continue;
-    const id = idByRef[t.ref];
-    const depIds = t.deps.map((d) => idByRef[d]).filter(Boolean);
-    if (!id || depIds.length !== t.deps.length) { console.log(`  ${t.ref}: dep resolve gap, skipping`); continue; }
-    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
-    if (!r.ok) { console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
-    edges += (r.json.added || depIds.length);
-    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
-  }
-
-  console.log('Promoting root spikes to ready…');
-  for (const ref of ROOTS) {
-    const id = idByRef[ref];
-    if (!id) continue;
-    const r = await api('POST', `/tasks/${id}/promote`, {});
-    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.json).slice(0,120)}`);
-  }
-
-  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}. Roots opened: ${ROOTS.join(', ')}.`);
-  console.log('ref→id:', JSON.stringify(idByRef));
-})();
+// scripts/gds/seed-bv1-profiles-tasks.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/seed-bv1-profiles-tasks.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'seed-bv1-profiles-tasks.js');

package/scripts/gds/seed-bv1-r01-delta-tasks.js

@@ -1,154 +1,6 @@
-// Seed + amend the delta the R01 spike (task 1002277, ADR 0171) surfaced, under
-// goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
-//
-// Source of truth: docs/adr/0171-profile-rollup-join-and-consent.md.
-// Three things happen here, all idempotent / convergent on re-run:
-//   1. Four NEW tasks (idempotent on source_ref bv1-r01-delta-D0N).
-//   2. Dependency rewires ADR 0171 decides (R03 gains R02; P09 gains P03).
-//   3. Amendment sections APPENDED to affected task bodies (guarded by a
-//      marker string so a re-run never double-appends).
-//
-// Run: node scripts/gds/seed-bv1-r01-delta-tasks.js
-
-const { apiCall } = require('./cli-lib');
-
-const VER = 'BONGOS-V1';
-const GOAL = 1000045;
-const SRC = 'planning-session';
-const ADR = 'docs/adr/0171-profile-rollup-join-and-consent.md';
-const MARK = '— ADR 0171 amendments (R01, 2026-08-15) —';
-
-// Existing tasks referenced by id (seeded by seed-bv1-profiles-tasks.js and
-// seed-bv1-profile-page-tasks.js).
-const R01 = 1002277, R02 = 1002278, R03 = 1002279, R04 = 1002280, R05 = 1002281,
-      R06 = 1002282, P02 = 1002798, P03 = 1002799, P07 = 1002803, P08 = 1002804,
-      P09 = 1002805, P01_HANDLE = 1002797, PRIVACY_SPIKE = 1002785;
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-// Throttled + 429-aware wrapper (same shape as the sibling seeders).
-async function api(method, path, body, _tries = 0) {
-  await sleep(1500);
-  const r = await apiCall(method, `/api/bongos${path}`, body);
-  if (r.status === 429 && _tries < 8) {
-    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
-    console.log(`  …rate-limited, waiting ${wait}s`);
-    await sleep(wait * 1000);
-    return api(method, path, body, _tries + 1);
-  }
-  return r;
-}
-
-const NEW_TASKS = [
-  {
-    ref: 'D01', kind: 'bug', prio: 4, est: 60, crit: [], deps: [], ready: true,
-    title: 'listScoutingRollup inflates totals: LATERAL unnest fans rows out before GROUP BY',
-    desc: `modules/platform-identity/platform-identity.js:426-445 — \`LEFT JOIN LATERAL unnest(a.disciplines) AS d ON true\` multiplies each activity row by max(1, cardinality(disciplines)) BEFORE aggregation, so project_count and the credits/ships/karma sums are inflated for any builder with 2+ disciplines on a project row (0/1-discipline rows are correct; max(last_active) and the disciplines array are unaffected — do not "fix" those). Live today on /people and /scouting. Fix: aggregate scalars over un-fanned rows; compute the disciplines union in a separate array_agg(DISTINCT …) over a pre-aggregated CTE/subquery. Testing, honestly: module tests are DB-free (scripts/gds/run-unit-tests.js gate) and the existing test only regex-matches SQL text — either extract the aggregation into an assertable SQL-builder shape, or add real-SQL coverage (pg-mem devDep or an integration DSN) as part of this task. getRollupForBuilder (task ${R02}) builds on the corrected shape. Found by R01; see ${ADR}.`,
-  },
-  {
-    ref: 'D02', kind: 'feature', prio: 4, est: 30, crit: [], deps: [], ready: true,
-    title: 'Reserve `u` as a top-level slug so project slugs cannot shadow builder profiles',
-    desc: `docs/specs/bongos-v1-seo-public-discoverability.md:19 reserves bongos/api/sso/gate/create/explore/builders/status/assets/.well-known/sitemap.xml/robots.txt/favicon.ico as top-level project slugs — but NOT \`u\`. A project could claim slug \`u\` and shadow the entire canonical builder-profile namespace /u/<handle> (profile-page spec Decision 1; ${ADR} D8). Add \`u\` to the reserved list in that spec AND wherever slug validation enforces it (coordinate with goal 1000048). While there, flag the future guild namespace for the same treatment in spike R23 (task 1002299) — reserve, don't squat.`,
-  },
-  {
-    ref: 'D03', kind: 'feature', prio: 3, est: 120, crit: [], deps: [P03],
-    title: 'Platform T&C page + acceptance capture at hub sign-in (the consent artifact ADR 0141 assumes)',
-    desc: `ADR 0141 defers cross-project-analytics consent to "the platform T&C" and conditioned un-gating the scouting rollup on it — but no T&C document, route, page, or acceptance record exists anywhere in the tree (the only reference is a comment at modules/platform-identity/routes/scouting.js:6). Goal 1000045 now makes the same data public by default (owner decision), which makes the artifact overdue: create the T&C page on the hub, record acceptance (timestamp on the platform account) at hub-session sign-in, and tie profile_state 'active' semantics to it once it exists (${ADR} D3). The T&C wording itself is an owner input — draft it, then file a blocker if the owner wants different wording. Depends on P03 (task ${P03}) so the consent boundary is decided before the artifact bakes it in.`,
-  },
-  {
-    ref: 'D04', kind: 'cleanup', prio: 4, est: 20, crit: ['C1', 'C2'], deps: [P03], rank: 'archon',
-    title: 'Amend C1/C2 criterion texts per ADR 0171 + the P03 outcome',
-    desc: `Apply the criterion amendments ${ADR} enumerates (decision payload carried in task ${P03}'s body): C1 — resolve "public by default for any builder with a platform account" per P03's outcome, and ADD the hub surface + its P05 mirror leak test ALONGSIDE the existing route/test references (those are correct and stay — the cross_project section lands on exactly GET /builders/:id/profile, guarded by tests/profile_route.mjs). C2 — "(builder-settings)" becomes "self-serve in hall Settings, stored account-global on the platform account"; "falls back to local-project data" is scoped to the instance render path (the hub has no local data); add the residual note that hide removes the hub AGGREGATE, not the per-instance public numbers it is derived from. Archon: the criteria live on scope-protected goal 1000045.`,
-  },
-];
-
-// Body amendments appended to existing tasks. Each entry: [id, text].
-const AMEND = [
-  [R02, `Build brief from ${ADR} (decisions D1-D7):
-(1) Migration platform_identity_007_profile_consent.sql: profile_state text NOT NULL DEFAULT 'provisional' CHECK (IN 'provisional','active') + hide_stats boolean NOT NULL DEFAULT false, on platform_identity_accounts. NO backfill joining core builders (type-unsafe: 'system:bfg'-style text ids vs bigint; boundary-violating: module migration reading core state). All existing accounts start provisional; a hub-session /sso/authorize lazily upgrades to active. Device-poll and check-in create provisional; /sso/activity/rollup creates NO account (orphan activity rows are never publicly addressable).
-(2) getRollupForBuilder(github_id) + the memberships-to-projects join (client_id -> sso_clients.origin -> projects.origin) with CORRECTED aggregation — no LATERAL-unnest fan-out (bug task {{D01}}).
-(3) listScoutingRollup gains the profile_state='active' AND NOT hide_stats predicate + a whitelisted projection: /people and /scouting must honor hide BY CONSTRUCTION (they are live cross-project surfaces at Metic floor today).
-(4) Register the declared-but-unwired 'platform-identity.hub' port (hasProvider-guarded, route-factory pattern; module.json already declares provides). Port: getPublicProfileExtras(githubId) -> null unless active AND not hidden, else {totals:{projects,credits,works_shipped,karma}, disciplines, last_active, projects:[{name,origin,rank_held}], more_projects} — whitelist-shaped INSIDE the module (client_id never crosses); guard non-numeric github_id -> null (never a bigint cast error). getOwnProfileExtras(githubId) serves the self view regardless of flags.
-(5) Core GET /builders/:id/profile resolves the port beside 'reward', attaches cross_project; Cache-Control: no-store when the port resolves (hide must beat the 60s cache), unchanged max-age=60 elsewhere. Project names only where the catalog row is public; others counted in more_projects, never named.
-(6) Harden POST /sso/activity/rollup BEFORE anything publishes: require an existing membership row for (client_id, github_id); validate rank against the four core rank keys (else null); disciplines: string elements only, cap count (<=8) and element length (<=32). Sequence check-in BEFORE rollup in src/bongos/auth.js (await the check-in) so the membership requirement cannot race a first sign-in.
-(7) Extend tests/profile_route.mjs: a second PUBLIC/PRIVATE key list scoped to cross_project + sentinel strings planted on the port-stub fixture (a client_id, a fake private project name) so the raw-text scan bites.`],
-  [R03, `The hide_stats column and the read-path enforcement land with R02 (task ${R02} — now a declared dependency). R03's residual scope: the WRITE path — an own-scoped PATCH route in platform-identity keyed by req.builder.github_id (validateOrRespond-validated, '// rank: any-builder'), the hall Settings toggle (P04's Profile rail group) and the profile-page self-toggle handoff to R04, plus verification that /people, /scouting, and the profile all drop the numbers live on toggle. Public responses stay viewer-independent; a builder inspects their own hidden stats via the own-scoped read (getOwnProfileExtras), not the public route. See ${ADR} D4.`],
-  [R04, `Per ${ADR}: the self hide-toggle renders CLIENT-SIDE only, after comparing the /me identity to the profile id — the profile response stays viewer-independent (single response shape keeps the leak test honest). Hidden -> render the "keeps their track record private" line and NOTHING derived from the rollup (no partial numbers — a count plus a hidden total is a leak by subtraction). Keep the instance rank badge (the platform-rank ban applies to the hub identity band only — profile-page spec Decision 1). Reserve layout slots for connections/guilds/actions (spec Decision 5). Hub profile API responses are no-store (ADR 0171 D5) — do not build UI caching assumptions on them.`],
-  [R05, `Retarget per ${ADR} D8 — the ?builder=<login> brief is superseded (github_login is mutable; profile-page spec Decision 3). R05 now delivers HANDLE-BASED LOOKUP: resolve <handle> -> platform account (case rules + the previous-handle 301 window from P01, task ${P01_HANDLE}) and the profile read the hub's canonical page consumes. The page itself is goal 1000048 R14 (task 1002365) — coordinate; exactly one page gets built. The numeric-id 301 and instance-side rel=canonical stay with P08 (task ${P08}).`],
-  [R06, `Proof additions from ${ADR}: assert the hide toggle takes effect on immediate reload (no-store — the old public,max-age=60 would fail this); assert /people and /scouting also drop the hidden builder (the read-path enforcement, not just the profile); assert the extended leak test (cross_project key lists + sentinels) goes red when a private field is planted. State the residual in the proof notes: hide removes the hub's AGGREGATED view — per-instance public leaderboards remain public by design.`],
-  [P02, `Addition from ${ADR}: upsertAccount (modules/platform-identity/platform-identity.js:104-117) overwrites display_name/avatar_url unconditionally on every check-in — a hub-edited display_name would be silently clobbered by the builder's next federated sign-in anywhere. Mirror the ADR 0156 source-tracked guard (user-set wins) for the hub account fields as part of this task.`],
-  [P03, `Reframe from ${ADR} (read before deciding): (1) The fail-closed mechanics ship with R02 regardless of this decision: profile_state DEFAULT 'provisional'; ONLY a hub-session /sso/authorize upgrades to 'active' (the SSO device flow never shows a hub page and mints no hub session — it creates provisional; so does check-in). Backfill: ALL existing accounts start provisional and lazily upgrade on their next hub-session authorize. So this decision can only ever WIDEN exposure — nothing needs clawing back. (2) ACCEPT = ratify that boundary (recommended; it narrows the Phase-4 interview's "no extra consent gate" to accounts whose consent premise actually holds). REJECT (= all accounts public, the interview decision verbatim) has a hard precondition: check-in/device-created identities have NO self-serve hide path today (no hub builder session exists for them; hub admission is invite-gated) — rejecting requires first building an assertion-authenticated hide path or opening hub enrollment. (3) The C1/C2 criterion text amendments ride task {{D04}} (dep on this one); the replacement texts are enumerated there and in the ADR. (4) The T&C artifact rides task {{D03}} (dep on this one).`],
-  [P07, `Addition from ${ADR}: the rollup fires only on federated sign-in today, so hub numbers can be months stale with no indicator. Add a ship-time push (lifecycle ship path -> reportActivityRollup) alongside the sign-in trigger, and SEQUENCE check-in before rollup (await the check-in) so the membership-row requirement R02 adds to /sso/activity/rollup cannot race a first sign-in.`],
-  [P08, `Amendment from ${ADR} D1 (this AMENDS profile-page spec Decision 1): federated non-hub instances LINK OUT instead of inlining a cross-project section in V1 — an instance-side copy is either stale-on-hide (breaks C2's "live everywhere") or a per-view hub call (rejected: always-on dependency); the canonical page is one click away. P08 now owns the federated render path: the visible "see the cross-project record" link + rel=canonical emission (needs a server-side hub-origin stamp token — clientBranding()/serve-internal.js carry no hub origin today, and goal 1000048 R13 flags this Metic+) + the numeric-id 301. Coordinate with goal 1000048 R13/R14.`],
-];
-
-(async () => {
-  const idByRef = {};
-  let created = 0, existing = 0;
-
-  console.log(`Seeding ${NEW_TASKS.length} delta tasks under goal ${GOAL} (${VER})…`);
-  for (const t of NEW_TASKS) {
-    const r = await api('POST', '/tasks', {
-      version_id: VER,
-      goal_id: GOAL,
-      title: t.title,
-      description: t.desc,
-      kind: t.kind,
-      discipline: 'engineer',
-      priority: t.prio,
-      est_minutes: t.est,
-      criterion_ids: t.crit,
-      source: SRC,
-      source_ref: `bv1-r01-delta-${t.ref}`,
-    });
-    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`); continue; }
-    const task = r.data.task || r.data;
-    idByRef[t.ref] = Number(task.id);
-    if (r.data.idempotent || r.data.existing) existing++; else created++;
-    console.log(`  ${t.ref} → task ${task.id} (${t.kind}, P${t.prio})`);
-  }
-
-  console.log('Wiring dependencies…');
-  const DEP_SETS = [
-    ...NEW_TASKS.filter((t) => t.deps.length).map((t) => [idByRef[t.ref], t.deps]),
-    [R03, [R01, R02]],                              // ADR 0171: column+enforcement land in R02
-    [P09, [P01_HANDLE, PRIVACY_SPIKE, P03]],        // spec said P09's shape waits on P03 — make the edge real
-  ];
-  for (const [id, deps] of DEP_SETS) {
-    if (!id) continue;
-    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: deps });
-    console.log(`  task ${id} depends on [${deps.join(', ')}]: ${r.ok ? 'ok' : 'FAILED ' + r.status + ' ' + JSON.stringify(r.data).slice(0, 160)}`);
-  }
-
-  console.log('Setting requires_rank…');
-  for (const t of NEW_TASKS.filter((x) => x.rank)) {
-    const id = idByRef[t.ref];
-    if (!id) continue;
-    const r = await api('PATCH', `/tasks/${id}`, { requires_rank: t.rank });
-    console.log(`  ${t.ref}: requires_rank=${t.rank} ${r.ok ? 'ok' : 'FAILED ' + JSON.stringify(r.data).slice(0, 120)}`);
-  }
-
-  console.log('Appending ADR 0171 amendment sections…');
-  const sub = (s) => s.replace('{{D01}}', idByRef.D01 || '<D01>').replace('{{D03}}', idByRef.D03 || '<D03>').replace('{{D04}}', idByRef.D04 || '<D04>');
-  for (const [id, text] of AMEND) {
-    const g = await api('GET', `/tasks/${id}`);
-    if (!g.ok) { console.log(`  task ${id}: read FAILED ${g.status}`); continue; }
-    const task = g.data.task || g.data;
-    const body = task.description || '';
-    if (body.includes(MARK)) { console.log(`  task ${id}: already amended, skipping`); continue; }
-    const next = `${body}\n\n${MARK}\n${sub(text)}`;
-    const r = await api('PATCH', `/tasks/${id}`, { description: next });
-    console.log(`  task ${id}: ${r.ok ? 'amended' : 'FAILED ' + r.status + ' ' + JSON.stringify(r.data).slice(0, 160)}`);
-  }
-
-  console.log('Promoting zero-dep roots to ready…');
-  for (const t of NEW_TASKS.filter((x) => x.ready)) {
-    const id = idByRef[t.ref];
-    if (!id) continue;
-    const r = await api('POST', `/tasks/${id}/promote`, {});
-    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
-  }
-
-  console.log(`\nDONE. created=${created} existing=${existing}.`);
-  console.log('ref→id:', JSON.stringify(idByRef));
-})();
+// scripts/gds/seed-bv1-r01-delta-tasks.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/seed-bv1-r01-delta-tasks.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'seed-bv1-r01-delta-tasks.js');