@bongos/core 1.21.4 → 1.21.6

package/modules/lifecycle/governor-docket.js

@@ -0,0 +1,192 @@
+'use strict';
+
+// modules/lifecycle/governor-docket.js — lifecycle's sources for the governor's
+// docket (task 1004523, goal 1000125; the collector is
+// modules/government/docket.js).
+//
+// WHY. The Governor City reads one feed of every matter awaiting a governor. Four
+// of those matters live in this module — override requests, removal proposals,
+// criteria awaiting UAT and goal join requests — plus two of the six readings
+// (flow: finished work that is stuck, and promises: done-when criteria kept of
+// total). A module may not require a sibling (ADR 0083), so lifecycle contributes
+// them to the `governor.docket` contribution point instead of government reaching
+// in. Each source reads through the SAME db function its own list route serves,
+// and declares the SAME atom that route requires, so the city can never show a
+// viewer a matter the route would refuse them.
+//
+// Pure mappers (exported, unit-tested) + one registration function called from
+// the lifecycle route factory, the boot hook that runs live and in tests.
+
+const api = require('../../src/module-api');
+const db = require('./db');
+const doneWhen = require('./done-when');
+const removalProposals = require('./removal-proposals');
+
+const POINT = 'governor.docket';
+const OVERRIDE_LIMIT = 50;
+const STUCK_LIMIT = 100;
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+function overrideMatter(r, mayDecide) {
+  return {
+    id: r.id,
+    rule: 'decide',
+    state: mayDecide ? 'needs' : 'moving',
+    title: r.task_title ? `Override: ${r.task_title}` : `Override for task ${r.task_id}`,
+    short: 'override',
+    where: 'release · past a failed check or grade',
+    opened_at: r.created_at,
+    deadline: null,
+    proposer: { id: r.requested_by_builder_id, login: r.requester_login, name: r.requester_display_name },
+    tally: null,
+    href: `/task/${encodeURIComponent(r.task_id)}`,
+    ref: { type: 'override_request', id: r.id },
+  };
+}
+
+function removalMatter(r) {
+  return {
+    id: r.proposal_task_id,
+    rule: 'decide',
+    state: 'needs',
+    title: r.title,
+    short: 'removal',
+    where: r.goal_title ? `disputes · removal · ${r.goal_title}` : 'disputes · removal',
+    opened_at: r.filed_at,
+    deadline: null,
+    proposer: null,
+    tally: null,
+    href: `/task/${encodeURIComponent(r.proposal_task_id)}`,
+    ref: { type: 'task', id: r.proposal_task_id },
+  };
+}
+
+function uatMatter(c) {
+  return {
+    id: c.id,
+    rule: 'signoff',
+    state: 'needs',
+    title: c.criterion_md,
+    short: 'waiting for a tester',
+    where: c.goal_title ? `review · ${c.goal_title}` : 'review · a promise to sign off',
+    opened_at: null,
+    deadline: null,
+    proposer: null,
+    tally: { for: c.shipped_total, against: 0, open: 0, needs: 'one sign-off by someone who did not build it' },
+    href: c.goal_id ? `/goals#/goal/${encodeURIComponent(c.goal_id)}` : '/goals',
+    ref: { type: 'criterion', id: c.id },
+  };
+}
+
+function joinRequestMatter(r, mine) {
+  return {
+    id: r.id,
+    rule: 'decide',
+    state: mine ? 'moving' : 'needs',
+    title: mine
+      ? `Your request to join ${r.goal_title || `goal ${r.goal_id}`}`
+      : `${r.display_name || r.github_login || 'Someone'} asks to join ${r.goal_title || `goal ${r.goal_id}`}`,
+    short: 'join request',
+    where: 'people · goal teams',
+    opened_at: r.created_at,
+    deadline: null,
+    proposer: mine ? null : { id: r.builder_id, login: r.github_login, name: r.display_name },
+    tally: null,
+    href: r.goal_id ? `/goals#/goal/${encodeURIComponent(r.goal_id)}` : '/goals',
+    ref: { type: 'goal_membership_request', id: r.id },
+  };
+}
+
+// Flow: finished work that has not moved on. `completed` waits for its grade or
+// review; `confirmed` waits to land. Pure over the two task lists.
+function flowReading({ completed = [], confirmed = [] }, now = Date.now()) {
+  const stuck = [...completed, ...confirmed];
+  const n = stuck.length;
+  if (!n) return { value: 0, figure: 'all moving', line: 'no finished work is waiting', hot: false };
+  const ages = stuck.map((t) => now - Date.parse(t.updated_at || t.created_at)).filter(Number.isFinite);
+  const longest = ages.length ? Math.max(...ages) : 0;
+  const days = Math.floor(longest / DAY_MS);
+  const where = completed.length >= confirmed.length ? 'waiting for review' : 'waiting to go live';
+  return {
+    value: n,
+    figure: `${n} stuck`,
+    line: `longest wait ${days} ${days === 1 ? 'day' : 'days'}, ${where}`,
+    hot: true,
+  };
+}
+
+// Promises: the building version's done-when criteria, kept of total. Pure.
+function promisesReading(criteria) {
+  const total = criteria.length;
+  if (!total) return { value: null, figure: 'no promises yet', line: 'the version building now has no done-when criteria', hot: false };
+  const kept = criteria.filter((c) => c.satisfied === true).length;
+  return { value: { kept, total }, figure: `${kept} of ${total} kept`, line: 'what the goals say they deliver', hot: false };
+}
+
+function contributeLifecycleToDocket() {
+  api.contribute(POINT, {
+    source: 'override_requests',
+    building: 'release',
+    gate: { permission: 'override_request.decide' },
+    read: async (ctx) => (await db.listOverrideRequests({ status: 'open', limit: OVERRIDE_LIMIT }))
+      .map((r) => overrideMatter(r, ctx.has('override_request.decide'))),
+  });
+  api.contribute(POINT, {
+    source: 'removal_proposals',
+    building: 'disputes',
+    gate: { permission: 'task.promote' },
+    read: async () => (await removalProposals.listPending({ limit: removalProposals.MAX_PROPOSAL_ROWS })).map(removalMatter),
+  });
+  api.contribute(POINT, {
+    source: 'criteria_uat',
+    building: 'review',
+    gate: { permission: 'criterion.review' },
+    read: async () => (await doneWhen.listPendingReviewCriteria({})).filter((c) => c.awaiting_uat === true).map(uatMatter),
+  });
+  // Own-scoped by its read, like GET /goals/inbox: a goal's lead sees the requests
+  // to join their goals, and everyone sees their own pending ones. An Archon is
+  // deliberately NOT shown every goal's requests (listInboxFor's rule).
+  api.contribute(POINT, {
+    source: 'goal_join_requests',
+    building: 'people',
+    gate: { anyBuilder: true },
+    read: async (ctx) => {
+      const inbox = await db.listInboxFor(ctx.builderId);
+      return [
+        ...(inbox.joinRequests || []).map((r) => joinRequestMatter(r, false)),
+        ...(inbox.myPendingRequests || []).map((r) => joinRequestMatter(r, true)),
+      ];
+    },
+  });
+  // Readings. Flow reads the task board, which any builder may read (GET /tasks).
+  api.contribute(POINT, {
+    reading: 'flow',
+    gate: { anyBuilder: true },
+    read: async (_ctx, { now } = {}) => {
+      const [completed, confirmed] = await Promise.all([
+        db.listTasks({ status: 'completed', limit: STUCK_LIMIT }),
+        db.listTasks({ status: 'confirmed', limit: STUCK_LIMIT }),
+      ]);
+      return flowReading({ completed, confirmed }, now);
+    },
+  });
+  api.contribute(POINT, {
+    reading: 'promises',
+    gate: { anyBuilder: true },
+    read: async () => {
+      const versionId = await db.currentBuildingVersionId();
+      if (!versionId) return { value: null, figure: 'no version building', line: 'nothing is promised right now', hot: false };
+      return promisesReading(await doneWhen.listCriteria(versionId));
+    },
+  });
+}
+
+module.exports = {
+  contributeLifecycleToDocket,
+  overrideMatter,
+  removalMatter,
+  uatMatter,
+  joinRequestMatter,
+  flowReading,
+  promisesReading,
+};

package/modules/lifecycle/routes/gate-approvals.js

@@ -65,7 +65,84 @@ function summarizeGate(files) {
   return { verdict: r.verdict, reasons, surfaces: r.surfaces || [] };
 }
 
+// The awaiting list itself: open, non-draft PRs whose gate-review check is
+// COMPLETED and red, each with its verdict and reasons. Shared by GET
+// /gate-approvals and the governor's docket (task 1004523), so the two can never
+// disagree about what is waiting. `withFiles: false` skips the per-PR file read
+// (the docket needs only the count and the titles, not the per-file reasons).
+async function listAwaitingGateApprovals({ withFiles = true } = {}) {
+  const prs = await githubPush.listOpenPullRequests({});
+  const awaiting = [];
+  let checking = 0;
+  for (const pr of prs) {
+    if (pr.is_draft) continue;
+    const gate = findCheck(pr, 'gate-review');
+    if (!gate) continue; // not a gate-reviewed PR (or it hasn't run yet)
+    if (String(gate.status || '').toUpperCase() !== 'COMPLETED') { checking += 1; continue; }
+    if (!isFailure(gate)) continue; // green/neutral → not awaiting
+    // gate-review is red → blocked awaiting trust/owner approval. Render WHY.
+    let summary = { verdict: 'unknown', reasons: [], surfaces: [], files: [] };
+    if (withFiles) {
+      try {
+        const files = await githubPush.getPullRequestFiles({ number: pr.number });
+        summary = summarizeGate(files);
+        summary.files = files.map((f) => ({ path: f.path, status: f.status }));
+      } catch (_) {
+        summary.files = [];
+      }
+    }
+    awaiting.push({
+      number: pr.number,
+      title: pr.title,
+      url: pr.url,
+      task: taskIdFromPr(pr),
+      author: pr.author,
+      head_sha: pr.head_sha,
+      verdict: summary.verdict,
+      reasons: summary.reasons,
+      files: summary.files,
+      author_trusted: isSuccess(findCheck(pr, 'gate-author-trust')),
+      already_approved: isSuccess(findCheck(pr, githubPush.GATE_OWNER_APPROVED_CONTEXT)),
+      gate_review_url: gate.url || null,
+    });
+  }
+  return { prs, awaiting, checking };
+}
+
+// The governor's docket (task 1004523): a PR held at the gate stands at Release,
+// shown only to a viewer holding `gate_approval.read` (this list route's own atom)
+// and needing only a viewer who may clear it (`gate_approval.decide`). An
+// unconfigured server credential is a read error, so the docket reports the
+// source `unavailable` rather than an empty, falsely calm Release.
+function contributeGateApprovalsToDocket() {
+  api.contribute('governor.docket', {
+    source: 'gate_approvals',
+    building: 'release',
+    gate: { permission: 'gate_approval.read' },
+    read: async (ctx) => {
+      if (!githubPush.isConfigured()) throw new Error('publish_unconfigured');
+      const { awaiting } = await listAwaitingGateApprovals({ withFiles: false });
+      const mayDecide = ctx.has('gate_approval.decide');
+      return awaiting.filter((pr) => !pr.already_approved).map((pr) => ({
+        id: pr.number,
+        rule: 'decide',
+        state: mayDecide ? 'needs' : 'moving',
+        title: pr.title || `Pull request ${pr.number}`,
+        short: 'held at the gate',
+        where: 'release · held at the gate',
+        opened_at: null,
+        deadline: null,
+        proposer: pr.author ? { login: pr.author } : null,
+        tally: null,
+        href: '/gate',
+        ref: { type: 'pull_request', id: pr.number },
+      }));
+    },
+  });
+}
+
 module.exports = function buildGateApprovalsRouter() {
+  contributeGateApprovalsToDocket();
   const router = express.Router();
 
   // GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the
@@ -81,39 +158,7 @@ module.exports = function buildGateApprovalsRouter() {
       return res.fail('publish_unconfigured', { status: 503, message: 'No server GitHub credential configured — cannot read pull requests.' });
     }
     try {
-      const prs = await githubPush.listOpenPullRequests({});
-      const awaiting = [];
-      let checking = 0;
-      for (const pr of prs) {
-        if (pr.is_draft) continue;
-        const gate = findCheck(pr, 'gate-review');
-        if (!gate) continue; // not a gate-reviewed PR (or it hasn't run yet)
-        if (String(gate.status || '').toUpperCase() !== 'COMPLETED') { checking += 1; continue; }
-        if (!isFailure(gate)) continue; // green/neutral → not awaiting
-        // gate-review is red → blocked awaiting trust/owner approval. Render WHY.
-        let summary = { verdict: 'unknown', reasons: [], surfaces: [] };
-        try {
-          const files = await githubPush.getPullRequestFiles({ number: pr.number });
-          summary = summarizeGate(files);
-          summary.files = files.map((f) => ({ path: f.path, status: f.status }));
-        } catch (_) {
-          summary.files = [];
-        }
-        awaiting.push({
-          number: pr.number,
-          title: pr.title,
-          url: pr.url,
-          task: taskIdFromPr(pr),
-          author: pr.author,
-          head_sha: pr.head_sha,
-          verdict: summary.verdict,
-          reasons: summary.reasons,
-          files: summary.files,
-          author_trusted: isSuccess(findCheck(pr, 'gate-author-trust')),
-          already_approved: isSuccess(findCheck(pr, githubPush.GATE_OWNER_APPROVED_CONTEXT)),
-          gate_review_url: gate.url || null,
-        });
-      }
+      const { prs, awaiting, checking } = await listAwaitingGateApprovals();
       // The PR check rollup is unreadable when the server credential lacks `Checks: read`
       // (operator blocker): listOpenPullRequests then returns partialErrors and every PR's
       // `checks` is empty, so the awaiting list is silently empty. Surface that so the hall

package/modules/lifecycle/routes/lifecycle.js

@@ -31,6 +31,8 @@ const cascade = require('../cascade');
 const removalDerivation = require('../removal-derivation');
 const removalTargets = require('../removal-targets');
 const shipFiles = require('../ship-files');
+// task 1004523: lifecycle's sources + readings for the governor's docket.
+const governorDocket = require('../governor-docket');
 
 // task 1003549 — the cross-role cascade listener. `task.shipped` already exists
 // as a kernel event (emitted post-commit by the publish reconciler and the ship
@@ -136,6 +138,7 @@ function registerSeams() {
 
 module.exports = function buildLifecycleRouter() {
   registerSeams();
+  governorDocket.contributeLifecycleToDocket();
   // No HTTP surface — the lifecycle capability is a pure kernel port. The empty
   // router is only the loader's contributes.routes mount vehicle; returning a
   // valid express.Router() keeps mountModuleRoutes' `router.use(sub)` happy

package/modules/onboarding/routes/access-requests.js

@@ -187,7 +187,72 @@ async function clearHubNoticeIfUninvited(login) {
   }
 }
 
+// The access-request queue at one status, shaped as GET /access-requests serves
+// it (before the hub profiles are attached). One read, two callers: the route
+// and the governor's docket (task 1004523), so the two cannot disagree about
+// who is waiting to join.
+async function listAccessRequests(status) {
+  // `kind` + `invited_by_login` let the invited history tell an invite from
+  // an approved application (ADR 0335 D2) — descriptive, like the vouch.
+  // `expired` + `expires_at` mark an invite whose 30 days are up (task 1002969):
+  // still 'invited' in storage, but its door no longer opens.
+  const { rows } = await pool.query(
+    `SELECT ar.id, ar.github_login, ar.display_name, ar.note, ar.status,
+            ar.created_at, ar.resolved_at, ar.kind,
+            (ar.status = 'invited' AND ${inviteExpiredSql('ar')}) AS expired,
+            ${inviteExpiresAtSql('ar')} AS expires_at,
+            ar.applicant_github_id, ar.applicant_handle, ar.vouched_at,
+            (ar.applicant_github_id IS NOT NULL) AS vouched,
+            rb.github_login AS resolved_by_login,
+            ib.github_login AS invited_by_login
+       FROM access_requests ar
+       LEFT JOIN builders rb ON rb.id = ar.resolved_by_builder_id
+       LEFT JOIN builders ib ON ib.id = ar.created_by
+      WHERE ar.status = $1
+      ORDER BY ar.created_at DESC
+      LIMIT 200`,
+    [status]
+  );
+  // On an invite row the stored note is the INVITER's words, but this read's
+  // `note` has always meant the applicant's (the hall quotes it as theirs),
+  // so an invite's note travels as `invite_note` instead.
+  return rows.map(({ note, ...r }) => (r.kind === 'invite'
+    ? { ...r, note: null, invite_note: note }
+    : { ...r, note, invite_note: null }));
+}
+
+// One pending request as a docket matter. Pure; exported for tests.
+function accessRequestDocketMatter(r) {
+  return {
+    id: r.id,
+    rule: 'decide',
+    state: 'needs',
+    title: `Admit ${r.display_name || r.github_login} as a builder`,
+    short: `admit ${r.github_login}`,
+    where: r.vouched ? 'people · waiting to join · vouched' : 'people · waiting to join',
+    opened_at: r.created_at,
+    deadline: null,
+    proposer: { login: r.github_login, name: r.display_name },
+    tally: null,
+    href: '/watch',
+    ref: { type: 'access_request', id: r.id },
+  };
+}
+
+// The governor's docket: a pending request to join stands at People, shown only
+// to a viewer holding `access_request.review` (this queue's own atom, because it
+// exposes would-be builders' usernames) and needing that same viewer's act.
+function contributeAccessRequestsToDocket() {
+  api.contribute('governor.docket', {
+    source: 'access_requests',
+    building: 'people',
+    gate: { permission: 'access_request.review' },
+    read: async () => (await listAccessRequests('pending')).map(accessRequestDocketMatter),
+  });
+}
+
 module.exports = function buildAccessRequestsRouter() {
+  contributeAccessRequestsToDocket();
   const router = express.Router();
 
   // POST /access-requests — PUBLIC. A would-be builder asks to be admitted.
@@ -339,33 +404,7 @@ module.exports = function buildAccessRequestsRouter() {
       return res.fail('bad_status', 400);
     }
     try {
-      // `kind` + `invited_by_login` let the invited history tell an invite from
-      // an approved application (ADR 0335 D2) — descriptive, like the vouch.
-      // `expired` + `expires_at` mark an invite whose 30 days are up (task 1002969):
-      // still 'invited' in storage, but its door no longer opens.
-      const { rows } = await pool.query(
-        `SELECT ar.id, ar.github_login, ar.display_name, ar.note, ar.status,
-                ar.created_at, ar.resolved_at, ar.kind,
-                (ar.status = 'invited' AND ${inviteExpiredSql('ar')}) AS expired,
-                ${inviteExpiresAtSql('ar')} AS expires_at,
-                ar.applicant_github_id, ar.applicant_handle, ar.vouched_at,
-                (ar.applicant_github_id IS NOT NULL) AS vouched,
-                rb.github_login AS resolved_by_login,
-                ib.github_login AS invited_by_login
-           FROM access_requests ar
-           LEFT JOIN builders rb ON rb.id = ar.resolved_by_builder_id
-           LEFT JOIN builders ib ON ib.id = ar.created_by
-          WHERE ar.status = $1
-          ORDER BY ar.created_at DESC
-          LIMIT 200`,
-        [status]
-      );
-      // On an invite row the stored note is the INVITER's words, but this read's
-      // `note` has always meant the applicant's (the hall quotes it as theirs),
-      // so an invite's note travels as `invite_note` instead.
-      const shaped = rows.map(({ note, ...r }) => (r.kind === 'invite'
-        ? { ...r, note: null, invite_note: note }
-        : { ...r, note, invite_note: null }));
+      const shaped = await listAccessRequests(status);
       // C4's other half (privacy spec D7, task 1002972): the applicant's own
       // profile, as their OWN privacy rules would show it, resolved from the hub
       // at render. See attachApplicantProfiles — it is keyed on the vouch, never
@@ -610,3 +649,5 @@ module.exports = function buildAccessRequestsRouter() {
 
   return router;
 };
+
+module.exports.accessRequestDocketMatter = accessRequestDocketMatter;

package/modules/platform-identity/craft-rollup.js

@@ -0,0 +1,72 @@
+// modules/platform-identity/craft-rollup.js — each craft by its own work, on the
+// hub (task 1004440 / WA6.RP10, goal 1000095, criterion
+// wa6-roles-read-true-in-public).
+//
+// A reporting instance sends, per craft the builder has EARNED credits in, that
+// craft's headline counts (src/bongos/auth-admission.js readCraftRollup):
+//
+//   engineer  { shipped, credits }
+//   artist    { pages_approved, credits }
+//   ideator   { filed, full_ideas, ratified, credits }
+//
+// Two halves live here, next to each other so they cannot disagree on the shape:
+//
+//   sanitizeCrafts — what upsertActivity BINDS. The report is third-party
+//     self-report (ADR 0171 D7), so the shape and the caps are the hub's, not
+//     the sender's: only the three crafts, only the named counts, each a
+//     non-negative integer under a ceiling or null. Anything else is dropped.
+//     A count is never text, so nothing here can carry a title or wording.
+//
+//   sumCrafts — the cross-project aggregate getRollupForBuilder returns. Summed
+//     over EVERY project row, named or not, exactly as the totals are: "the
+//     aggregate is not the leak, the name is" (ADR 0171 D2). It adds no field a
+//     hidden or private account could reach — it rides the same rollup
+//     predicate as credits and works shipped (account-visibility.js), and the
+//     recruiter sliver is untouched (ADR 0215: a ceiling, not a step).
+//
+// A craft appears in the sum when any project reported it. A count is null in the
+// sum only when no project could report it ("could not ask"), never because one
+// project could not while another could.
+'use strict';
+
+const CRAFT_FIELDS = Object.freeze({
+  engineer: Object.freeze(['shipped', 'credits']),
+  artist: Object.freeze(['pages_approved', 'credits']),
+  ideator: Object.freeze(['filed', 'full_ideas', 'ratified', 'credits']),
+});
+// Far above any honest count, low enough that a sum over every project stays a
+// safe integer and a hostile report cannot dominate a profile by one number.
+const MAX_CRAFT_COUNT = 10_000_000;
+
+function cleanCount(v) {
+  return Number.isInteger(v) && v >= 0 && v <= MAX_CRAFT_COUNT ? v : null;
+}
+
+function sanitizeCrafts(raw) {
+  const out = {};
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return out;
+  for (const [craft, fields] of Object.entries(CRAFT_FIELDS)) {
+    const block = raw[craft];
+    if (!block || typeof block !== 'object' || Array.isArray(block)) continue;
+    const clean = {};
+    for (const f of fields) clean[f] = cleanCount(block[f]);
+    out[craft] = clean;
+  }
+  return out;
+}
+
+function sumCrafts(rows) {
+  const out = {};
+  for (const row of Array.isArray(rows) ? rows : []) {
+    const crafts = sanitizeCrafts(row);
+    for (const [craft, block] of Object.entries(crafts)) {
+      const acc = out[craft] || (out[craft] = Object.fromEntries(CRAFT_FIELDS[craft].map((f) => [f, null])));
+      for (const f of CRAFT_FIELDS[craft]) {
+        if (block[f] != null) acc[f] = (acc[f] || 0) + block[f];
+      }
+    }
+  }
+  return out;
+}
+
+module.exports = { sanitizeCrafts, sumCrafts };

package/modules/platform-identity/migrations/platform_identity_029_activity_crafts.sql

@@ -0,0 +1,23 @@
+-- platform_identity_029_activity_crafts.sql — each craft's own numbers on a
+-- builder's activity row (task 1004440 / WA6.RP10, goal 1000095).
+--
+-- WHY. A rollup carried one ship count and a "Roles" list taken from the declared
+-- preference, so on the hub profile an artist with forty approved pages, or an
+-- ideator whose ideas the board ratified, read as an engineer with nothing
+-- shipped. A reporting instance now sends, for each craft the builder has earned
+-- credits in, that craft's headline counts (an artist's approved pages; an
+-- ideator's filed, Full and ratified ideas; an engineer's shipped works).
+--
+-- WHAT. One jsonb column, the sanitised `crafts` object (craft-rollup.js shapes and
+-- caps it before it is bound — never the raw body). '{}' is "no craft numbers
+-- reported": every row written before this column, and every report from an
+-- instance too old to send them. Counts only, never a title or wording.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_builder_project_activity
+  ADD COLUMN IF NOT EXISTS crafts jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -27,6 +27,7 @@ const { urlWithinOrigin } = require('./origin-containment');
 // The windowed data plane's append-only snapshot history (task 1002977, community
 // spec D2) — one call from upsertActivity below; the mechanism itself lives there.
 const { recordActivitySnapshot } = require('./activity-snapshots');
+const { sanitizeCrafts, sumCrafts } = require('./craft-rollup');
 
 const { pool: defaultPool } = api;
 const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible, scoutingListableSql } = visibility;
@@ -665,7 +666,7 @@ function sanitizeRecentShips(raw, clientOrigin) {
 // origin-containment.js:urlWithinOrigin. `asOf` is when the instance read these
 // totals (task 1004268, migration 026): an older report never overwrites a newer
 // one; unstamped (an older instance) keeps last-writer-wins; a future stamp is clamped.
-async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [], recentShips = [], clientOrigin = null, asOf = null }, { pool = defaultPool } = {}) {
+async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [], recentShips = [], crafts = null, clientOrigin = null, asOf = null }, { pool = defaultPool } = {}) {
   // api.LIVE_RANK_LADDER is a published doorway export (src/module-api.js, a
   // lazy getter over db-kernel's canonical four-rank ladder).
   const safeRank = api.LIVE_RANK_LADDER.includes(rank) ? rank : null;
@@ -673,24 +674,26 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
     .filter((d) => typeof d === 'string' && d.length > 0 && d.length <= MAX_DISCIPLINE_LENGTH)
     .slice(0, MAX_ROLLUP_DISCIPLINES);
   const ships = sanitizeRecentShips(recentShips, clientOrigin);
+  // Each craft's own counts (task 1004440), shaped and capped here — see craft-rollup.js.
+  const craftCounts = sanitizeCrafts(crafts);
   // One transaction with the snapshot: the upsert's row lock queues racing reports (task 1004244).
   return api.withTx(async (client) => {
     const { rows } = await client.query(
       `INSERT INTO platform_identity_builder_project_activity
-         (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, recent_ships, last_active, updated_at, reported_as_of)
+         (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, recent_ships, last_active, updated_at, reported_as_of, crafts)
        VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, now(), now(),
-               CASE WHEN $9::timestamptz IS NULL THEN NULL ELSE LEAST($9::timestamptz, now()) END)
+               CASE WHEN $9::timestamptz IS NULL THEN NULL ELSE LEAST($9::timestamptz, now()) END, $10::jsonb)
        ON CONFLICT (client_id, github_id) DO UPDATE SET
          credits = EXCLUDED.credits, tasks_shipped = EXCLUDED.tasks_shipped, karma = EXCLUDED.karma,
          rank_held = EXCLUDED.rank_held, disciplines = EXCLUDED.disciplines,
-         recent_ships = EXCLUDED.recent_ships, reported_as_of = EXCLUDED.reported_as_of,
+         recent_ships = EXCLUDED.recent_ships, reported_as_of = EXCLUDED.reported_as_of, crafts = EXCLUDED.crafts,
          last_active = now(), updated_at = now()
        WHERE EXCLUDED.reported_as_of IS NULL OR platform_identity_builder_project_activity.reported_as_of IS NULL
           OR EXCLUDED.reported_as_of >= platform_identity_builder_project_activity.reported_as_of
        RETURNING id, client_id, github_id`,
       // jsonb is bound as a JSON STRING: node-postgres serializes a JS array as a
       // Postgres ARRAY literal, which the jsonb column would reject.
-      [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships), asOf],
+      [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships), asOf, JSON.stringify(craftCounts)],
     );
     // Windowed data plane (task 1002977) — best-effort, see activity-snapshots.js.
     await recordActivitySnapshot({ clientId, githubId }, { client });
@@ -804,7 +807,7 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
   );
   const agg = aggRows[0];
   const { rows: projRows } = await pool.query(
-    `SELECT p.name, p.origin, a.rank_held, a.recent_ships,
+    `SELECT p.name, p.origin, a.rank_held, a.recent_ships, a.crafts,
             (p.id IS NOT NULL AND ${onMapSql('p')} AND p.visibility = 'public') AS is_public
        FROM platform_identity_builder_project_activity a
        LEFT JOIN platform_identity_sso_clients c ON c.client_id = a.client_id
@@ -834,6 +837,9 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
       karma: agg.karma,
     },
     disciplines: agg.disciplines || [],
+    // Each craft's own numbers, summed over every project — named or not, like
+    // the totals above (task 1004440; craft-rollup.js says why that is safe).
+    crafts: sumCrafts(projRows.map((r) => r.crafts)),
     last_active: agg.last_active,
     projects: named,
     more_projects: projRows.length - named.length,

package/modules/platform-identity/routes/sso.js

@@ -580,6 +580,9 @@ module.exports = function ssoRoutes() {
       // here, like disciplines: the shape is checked and hard-capped in
       // upsertActivity, next to the data, so no route can forget it.
       recent_ships: {},
+      // Each craft's own counts (task 1004440): untyped here for the same reason,
+      // shaped and capped in upsertActivity (craft-rollup.js sanitizeCrafts).
+      crafts: {},
     })) return;
     const b = req.body || {};
     try {
@@ -617,6 +620,7 @@ module.exports = function ssoRoutes() {
         rank: b.rank || null,
         disciplines: Array.isArray(b.disciplines) ? b.disciplines : [],
         recentShips: b.recent_ships,
+        crafts: b.crafts,
         // The AUTHENTICATED client's registered origin — the bound every pushed
         // ship link must fall inside (task 1002803). Taken from the client row,
         // never from the body, for the same reason client_id is.

package/modules/platform-identity/tests/platform-identity.mjs

@@ -602,7 +602,7 @@ await ta('upsertActivity upserts per (client_id, github_id) with the talent snap
   // an empty list when the sender reported none, never NULL. Its own cap,
   // shape and link bound are covered by tests/hub_recent_ships.mjs. The last param
   // is the report's as-of stamp (task 1004268): null when the sender gave none.
-  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]', null]);
+  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]', null, '{}']);
 });
 
 await ta('upsertActivity sanitizes third-party self-report (ADR 0171 D7): off-ladder rank → null, disciplines validated + capped', async () => {