@bongos/core 1.21.52 → 1.21.54

package/tests/privacy_matrix.mjs

@@ -0,0 +1,689 @@
+// tests/privacy_matrix.mjs — PROOF: the privacy matrix as a test (task 1002973,
+// goal 1000110; privacy spec docs/specs/bongos-v1-privacy-and-invites.md D2/D3/D4,
+// ADR 0171 D4, ADR 0215, ADR 0356).
+//
+// WHAT THIS FILE IS. Every row of the spec's D2 table — states × who sees what —
+// is already proved somewhere, one surface at a time: the profile 404 in
+// tests/effective_visibility_predicate.mjs, the owner's side door in
+// tests/profile_privacy_owner_view.mjs, the sliver in
+// tests/recruiter_sliver_boundary.mjs, search and the leaderboard in their own
+// route files, the invite window in tests/invite_expiry_db.mjs. What none of
+// them is, is THE TABLE. This file is: one fixture account per D2 row, every
+// viewer column, every cross-project surface that exists today, run through the
+// real routers in one process, and asserted against a literal transcription of
+// the spec's cells (MATRIX below). A cell that drifts — a surface added without
+// the predicate, a predicate loosened for one reader — reds here as the cell it
+// is, beside the six it should still agree with.
+//
+// The four claims the task names, each asserted across the whole table rather
+// than on one route:
+//   1. a private account's PUBLIC read 404s to a stranger AND to its own session,
+//      and the owner's own record comes from the own-scope door instead (both
+//      halves; the D2 "public responses stay viewer-independent" rule);
+//   2. hidden stats never appear in ANY response to anyone but the account
+//      itself — planted sentinels, checked against every recorded body, with
+//      controls so absence cannot pass vacuously;
+//   3. the recruiter sliver is exactly D3's shape (the module's own key lists);
+//   4. an expired invite refuses sign-in, through the real admission read.
+// The fifth clause the task was filed with — "a declined invite's door is
+// closed instance-side" — is NOT asserted here: that relay does not exist yet.
+// It moved to task 1004444, which builds it and adds the row to this file
+// (owner decision, 2026-10-04).
+//
+// CELLS WITH NO SURFACE TODAY are named, not dropped: the /u/<handle> page
+// (canonical-profile.js keeps it switched off — a tripwire test below reds when
+// it is switched on, so its cells get added), the sitemap and an Explore people
+// surface (not built), and the Ops column (internal only, never a response).
+//
+// MECHANISM (tests/recruiter_sliver_boundary.mjs's, generalised to every route):
+// in-memory tables whose row filter is parsed FROM EACH STATEMENT'S OWN WHERE
+// TEXT, consuming each recognised term and refusing whatever is left unless it
+// is pure conjunction — so a predicate this interpreter cannot read, or one
+// whose AND became an OR, is a loud error rather than a silently different
+// filter. Above the pool everything is real: the routers, the module, HTTP. The
+// interpreter is calibrated against the module's own JS twins before any cell
+// is trusted.
+//
+// DB-free by construction; the last test proves it runs in the unit lane.
+//
+// Run:  node tests/privacy_matrix.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// The pure predicate module only — it has no doorway dependency, so importing it
+// before the stubs below is safe. Everything that reaches the doorway is
+// REQUIRED after them (an ESM import is hoisted and would load the real one).
+import {
+  accountVisibleSql,
+  isAccountVisible,
+  rollupVisibleSql,
+  isRollupVisible,
+  recruiterSliverVisibleSql,
+  isRecruiterSliverVisible,
+  scoutingListableSql,
+  scoutingNameOnlySql,
+} from '../modules/platform-identity/account-visibility.js';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// ===========================================================================
+// The fixture — one account per D2 row
+// ===========================================================================
+//
+// Every value is an improbable per-account literal, so "absent from the body"
+// means absent. The provisional account carries the MOST permissive flags on
+// purpose (public, shown, discoverable, terms accepted): D2 says provisional
+// dominates every flag, so nothing else may let it through.
+
+const KEYS = ['PROV', 'PUB', 'SHY', 'PRIV', 'PRIVD', 'PRIVDH', 'OPTOUT'];
+const STATE = {
+  PROV: { label: 'provisional (any flags)', profile_state: 'provisional', account_visibility: 'public', hide_stats: false, recruiter_discoverable: true },
+  PUB: { label: 'active · public · stats shown', profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  SHY: { label: 'active · public · hide_stats', profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+  PRIV: { label: 'active · private (not discoverable)', profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: null },
+  PRIVD: { label: 'active · private · discoverable', profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
+  PRIVDH: { label: 'active · private · discoverable · hide_stats', profile_state: 'active', account_visibility: 'private', hide_stats: true, recruiter_discoverable: true },
+  OPTOUT: { label: 'active · public · opted out of recruiting', profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: false },
+};
+
+const ACCOUNTS = KEYS.map((k, i) => {
+  const id = String(3120001 + i);
+  const low = k.toLowerCase();
+  return {
+    key: k,
+    github_id: id,
+    handle: `${low}-mx`,
+    github_login: `${low}-login-${id}`,
+    display_name: `${k} Matrix ${id}`,
+    avatar_url: `https://avatars.githubusercontent.com/u/${id}?v=4`,
+    previous_handle: null,
+    bio: `${low}-bio-${id}`,
+    links: null,
+    created_at: 'T0',
+    terms_accepted_at: 'T1',
+    ...STATE[k],
+  };
+});
+const ACCT = Object.fromEntries(ACCOUNTS.map((a) => [a.key, a]));
+
+// The cross-project record behind each account: every number a sentinel.
+const ROLLUP = Object.fromEntries(ACCOUNTS.map((a, i) => {
+  const n = 960000 + i * 1000;
+  const low = a.key.toLowerCase();
+  return [a.github_id, {
+    credits: n + 1, works_shipped: n + 2, karma: n + 3, project_count: n + 4,
+    last_active: `${low}-lastactive-${n + 5}`,
+    disciplines: [`${low}-craft-${n + 8}`],
+    projects: [{ name: `${a.key}-Project-${n + 6}`, origin: `https://${low}.example`, rank_held: 'metic', recent_ships: [`${a.key}-Ship-${n + 7}`], is_public: true }],
+  }];
+}));
+
+/** Every rollup-derived string an account's record could leak. */
+function rollupSentinels(acct) {
+  const r = ROLLUP[acct.github_id];
+  return [
+    String(r.credits), String(r.works_shipped), String(r.karma), String(r.project_count),
+    r.last_active, ...r.disciplines,
+    ...r.projects.flatMap((p) => [p.name, p.origin, ...p.recent_ships]),
+  ];
+}
+/** Every string that names an account — what "absent" must mean for it. */
+function identitySentinels(acct) {
+  return [acct.handle, acct.github_login, acct.display_name, acct.bio];
+}
+
+// ===========================================================================
+// THE MATRIX — spec D2, transcribed cell by cell for the surfaces that exist
+// ===========================================================================
+//
+//   profile    GET /profiles/:handle        Anon · Builder · Self's PUBLIC read (viewer-independent)
+//                404 | 'full' (record shown) | 'identity' (renders, record null)
+//   search     GET /community/search        Anon · Builder — "findable by name/handle"
+//                'listed' | 'name-only' (listed, disciplines null) | 'absent'
+//   board      GET /community/leaderboard   Anon · Builder — the cross-project leaderboard
+//                'listed' | 'absent'
+//   directory  GET /scouting                Recruiter — 'full' | 'name-only' | 'absent'
+//   sliver     GET /scouting/:handle        Recruiter — 'full' (D3) | 'name-only' (D3, hidden) | 404
+//   self       GET /me/cross-project        Self — 'own' (own numbers, any flags) | 'n/a' (no session exists)
+const MATRIX = {
+  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a' },
+  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own' },
+  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own' },
+  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own' },
+  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own' },
+  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own' },
+  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own' },
+};
+
+// ===========================================================================
+// The in-memory tables + their statement interpreter
+// ===========================================================================
+
+const KNOWN_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'github_id', 'handle', 'previous_handle', 'recruiter_discoverable']);
+
+/**
+ * A row test built from a statement's own WHERE text (the
+ * tests/recruiter_sliver_boundary.mjs interpreter). Each recognised term is
+ * CONSUMED as it is matched; whatever survives must be whitespace, parentheses
+ * and AND, or this throws — an OR, a NOT it cannot read, an unread placeholder
+ * or an unknown literal comparison is never degraded to "no filter".
+ */
+function accountFilter(where, params) {
+  const tests = [];
+  const consumed = new Set();
+  let residue = where;
+  // an alias may carry a digit (the search's pa2), so A is [a-z_][a-z0-9_]*
+  const take = (re, make) => {
+    const m = re.exec(residue);
+    if (!m) return null;
+    residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+    tests.push(make(m));
+    return m;
+  };
+
+  // reach FIRST: its COALESCE spells `account_visibility = 'public'` as its own
+  // fallback, which must not be scored as an existence check
+  take(
+    /\bCOALESCE\(\s*(?:[a-z_][a-z0-9_]*\.)?recruiter_discoverable\s*,\s*(?:[a-z_][a-z0-9_]*\.)?account_visibility = 'public'\s*\)/,
+    () => (r) => (typeof r.recruiter_discoverable === 'boolean' ? r.recruiter_discoverable : r.account_visibility === 'public'),
+  );
+  take(/\b(?:[a-z_][a-z0-9_]*\.)?profile_state = 'active'/, () => (r) => r.profile_state === 'active');
+  take(/\b(?:[a-z_][a-z0-9_]*\.)?terms_accepted_at IS NOT NULL/, () => (r) => r.terms_accepted_at != null);
+  take(/\b(?:[a-z_][a-z0-9_]*\.)?account_visibility = 'public'/, () => (r) => r.account_visibility === 'public');
+  take(/\bNOT (?:[a-z_][a-z0-9_]*\.)?hide_stats\b/, () => (r) => !r.hide_stats);
+  take(/\b(?:[a-z_][a-z0-9_]*\.)?hide_stats\b/, () => (r) => !!r.hide_stats);
+  take(/\b(?:[a-z_][a-z0-9_]*\.)?github_id = \$(\d+)/, (m) => {
+    consumed.add(m[1]);
+    const v = params[Number(m[1]) - 1];
+    return (r) => String(r.github_id) === String(v);
+  });
+  // resolveHandle's rename window is the one legitimate OR, consumed whole
+  const both = take(/lower\(handle\) = \$(\d+) OR lower\(previous_handle\) = \$(\d+)/, (m) => {
+    consumed.add(m[1]); consumed.add(m[2]);
+    const v = String(params[Number(m[1]) - 1]);
+    return (r) => String(r.handle || '').toLowerCase() === v || String(r.previous_handle || '').toLowerCase() === v;
+  });
+  if (!both) {
+    take(/lower\(handle\) = \$(\d+)/, (m) => {
+      consumed.add(m[1]);
+      const v = String(params[Number(m[1]) - 1]);
+      return (r) => String(r.handle || '').toLowerCase() === v;
+    });
+  }
+
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) throw new Error(`fake pool: unread predicate on $${m[1]} in "${where}"`);
+  }
+  for (const m of where.matchAll(/\b([a-z_]+)\s*(?:=|<>|!=)\s*'/g)) {
+    if (!KNOWN_COLUMNS.has(m[1])) throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
+  }
+  if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) {
+    throw new Error(`fake pool: unmodelled boolean structure "${residue.trim()}" in "${where}"`);
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+/** Lift one predicate out of a statement by the text around it, or fail loudly. */
+function lift(sql, re, what) {
+  const m = re.exec(sql);
+  if (!m) throw new Error(`fake pool: could not read the ${what} predicate — the statement moved; update this fake alongside it: ${sql.slice(0, 200)}`);
+  return m[1];
+}
+function activityScope(sql, params) {
+  const m = /\ba\.github_id = \$(\d+)/.exec(sql);
+  if (!m) throw new Error(`fake pool: an activity read with no github_id scope — ${sql.slice(0, 120)}`);
+  return String(params[Number(m[1]) - 1]);
+}
+
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+
+    // THE LEADERBOARD's totals: the rollup floor sits on the act CTE's join.
+    if (/platform_identity_activity_snapshots/.test(sql)) {
+      const where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = a\.github_id WHERE (.+?) \), per_project AS/, 'leaderboard totals');
+      const rows = ACCOUNTS.filter(accountFilter(where, [])).map((a) => {
+        const r = ROLLUP[a.github_id];
+        return { github_id: a.github_id, credits: String(r.credits), tasks_shipped: String(r.works_shipped), karma: String(r.karma), disciplines: r.disciplines };
+      });
+      return { rows, rowCount: rows.length };
+    }
+    // ... and its eligibility re-read, scoped to the candidate ids.
+    if (/= ANY\(\$1::bigint\[\]\)/.test(sql)) {
+      const where = lift(sql, /WHERE pa\.github_id = ANY\(\$1::bigint\[\]\) AND (.+)$/, 'leaderboard eligibility');
+      const ids = new Set((params[0] || []).map(String));
+      const rows = ACCOUNTS.filter((a) => ids.has(a.github_id)).filter(accountFilter(where, []))
+        .map((a) => ({ github_id: a.github_id, handle: a.handle, github_login: a.github_login, display_name: a.display_name, avatar_url: a.avatar_url }));
+      return { rows, rowCount: rows.length };
+    }
+
+    // HUB SEARCH: the name match floors on existence, the disciplines on the rollup.
+    if (/WITH matches AS/.test(sql)) {
+      const names = accountFilter(lift(sql, /FROM platform_identity_accounts pa WHERE (.+?) AND \( lower\(pa\.handle\) LIKE/, 'search name-match'), []);
+      const disc = accountFilter(lift(sql, /WHERE pa2\.github_id = a\.github_id AND (.+?)\)\) x WHERE/, 'search discipline'), []);
+      const [rawQ, likePattern, discipline, limit, offset] = params;
+      const q = String(rawQ).toLowerCase();
+      const prefix = String(likePattern).replace(/\\(.)/g, '$1').replace(/%$/, '').toLowerCase();
+      const rows = ACCOUNTS.filter(names)
+        .filter((a) => [a.handle, a.display_name].some((s) => s.toLowerCase().startsWith(prefix) || s.toLowerCase().includes(q)))
+        .map((a) => ({ handle: a.handle, github_login: a.github_login, display_name: a.display_name, avatar_url: a.avatar_url, disciplines: disc(a) ? ROLLUP[a.github_id].disciplines : null }))
+        .filter((r) => !discipline || (r.disciplines || []).includes(discipline))
+        .slice(offset, offset + limit);
+      return { rows, rowCount: rows.length };
+    }
+
+    // THE RECRUITING DIRECTORY: consent lives in an EXISTS correlated to activity.
+    if (/WITH agg AS/.test(sql) && /platform_identity_accounts pa/.test(sql)) {
+      const where = lift(sql, /pa\.github_id = a\.github_id AND ([\s\S]*?)\)\s*GROUP BY/, 'directory');
+      const rows = ACCOUNTS.filter(accountFilter(where, [])).map((a) => {
+        const r = ROLLUP[a.github_id];
+        return { github_id: a.github_id, github_login: a.github_login, display_name: a.display_name, avatar_url: a.avatar_url, project_count: r.project_count, total_credits: r.credits, total_tasks_shipped: r.works_shipped, total_karma: r.karma, last_active: r.last_active, disciplines: r.disciplines };
+      });
+      return { rows, rowCount: rows.length };
+    }
+
+    // THE SLIVER's activity half — with columns the statement never selects, so
+    // a projection that spreads instead of whitelisting leaks a number here.
+    if (/WITH act AS/.test(sql)) {
+      const r = ROLLUP[activityScope(sql, params)];
+      return {
+        rows: [{
+          active_recently: r ? true : null, disciplines: r ? r.disciplines : null,
+          last_active: r ? r.last_active : null, credits: r ? r.credits : null, works_shipped: r ? r.works_shipped : null,
+          karma: r ? r.karma : null, project_count: r ? r.project_count : null, project_name: r ? r.projects[0].name : null,
+        }],
+        rowCount: 1,
+      };
+    }
+
+    // The directory's ownership door (scouting-authz): nobody here owns a project.
+    if (/platform_identity_project_memberships/.test(sql)) return { rows: [], rowCount: 0 };
+
+    // Account reads — the public profile, the sliver, the own-scope read, the
+    // directory's name-only tier. Rollup scalars ride the row so a spread leaks.
+    if (/FROM platform_identity_accounts/.test(sql)) {
+      const where = sql.includes(' WHERE ') ? sql.slice(sql.indexOf(' WHERE ') + 7).replace(/ ORDER BY .*| LIMIT .*/g, '') : '';
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      let rows = ACCOUNTS.filter(accountFilter(where, params)).map((a) => ({ ...a, ...ROLLUP[a.github_id] }));
+      if (/is_current/.test(cols)) {
+        const asked = String(params[0]).toLowerCase();
+        rows = rows.map((r) => ({ ...r, is_current: r.handle.toLowerCase() === asked }))
+          .sort((a, b) => Number(b.is_current) - Number(a.is_current)).slice(0, 1);
+      }
+      return { rows, rowCount: rows.length };
+    }
+
+    // The per-builder rollup behind the profile's record and the own-scope door.
+    if (/WITH agg AS/.test(sql) && /platform_identity_builder_project_activity/.test(sql)) {
+      const r = ROLLUP[activityScope(sql, params)];
+      return { rows: [{ projects: r.project_count, credits: r.credits, works_shipped: r.works_shipped, karma: r.karma, last_active: r.last_active, disciplines: r.disciplines }], rowCount: 1 };
+    }
+    if (/platform_identity_builder_project_activity/.test(sql)) {
+      const r = ROLLUP[activityScope(sql, params)];
+      return { rows: r.projects.map((p) => ({ ...p })), rowCount: r.projects.length };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql.slice(0, 140)}`);
+  },
+};
+
+// ===========================================================================
+// The real routers over those tables
+// ===========================================================================
+
+// Who the stubbed session presents. `rank` is the hub rank (the sliver's floor),
+// `curate` the directory's permission door.
+let viewer = null;
+const ANON = null;
+const STRANGER = { name: 'Builder', github_id: '7100001', rank: 'xenos', curate: false };
+const RECRUITER = { name: 'Recruiter', github_id: '7100002', rank: 'archon', curate: true };
+const selfOf = (k) => ({ name: 'Self', github_id: ACCT[k].github_id, rank: 'xenos', curate: false });
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath,
+  filename: moduleApiPath,
+  loaded: true,
+  exports: {
+    pool,
+    parsePagination: helpers.parsePagination,
+    validateOrRespond: helpers.validateOrRespond,
+    corsPublicGet: () => (_req, _res, next) => next(),
+    logger: () => ({ error: () => {}, info: () => {}, warn: () => {} }),
+    requireBuilder: (req, res, next) => {
+      if (!viewer) return res.fail('unauthenticated', 401);
+      req.builder = { github_id: viewer.github_id };
+      next();
+    },
+    requirePermission: () => (req, res, next) => (viewer && viewer.curate ? next() : res.status(403).json({ ok: false, error: 'forbidden' })),
+    requireRank: (...allowed) => (req, res, next) => (viewer && allowed.includes(viewer.rank) ? next() : res.fail('rank_forbidden', 403)),
+  },
+};
+
+// db-kernel reaches Postgres through ./pool: the access_requests table behind the
+// sign-in gate's invited-check (section 5). Stubbed before anything loads it.
+const DAY_MS = 24 * 60 * 60 * 1000;
+const NOW = Date.now();
+const ACCESS_REQUESTS = [
+  { github_login: 'fresh-invitee', status: 'invited', kind: 'invite', created_at: NOW - 29 * DAY_MS },
+  { github_login: 'stale-invitee', status: 'invited', kind: 'invite', created_at: NOW - 31 * DAY_MS },
+  { github_login: 'approved-applicant', status: 'invited', kind: 'application', created_at: NOW - 400 * DAY_MS },
+  { github_login: 'waiting-applicant', status: 'pending', kind: 'application', created_at: NOW - 1 * DAY_MS },
+];
+const admissionPool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    if (!/^SELECT 1 FROM access_requests WHERE (.+) LIMIT 1$/.test(sql)) throw new Error(`admission pool: unsupported statement — ${sql.slice(0, 140)}`);
+    let residue = sql.replace(/^SELECT 1 FROM access_requests WHERE /, '').replace(/ LIMIT 1$/, '');
+    const tests = [];
+    const take = (re, make) => {
+      const m = re.exec(residue);
+      if (!m) throw new Error(`admission pool: expected ${re} in "${residue}"`);
+      residue = residue.slice(0, m.index) + residue.slice(m.index + m[0].length);
+      tests.push(make(m));
+    };
+    take(/lower\(github_login\) = lower\(\$1\)/, () => (r) => r.github_login.toLowerCase() === String(params[0]).toLowerCase());
+    take(/status = 'invited'/, () => (r) => r.status === 'invited');
+    // the expiry unit, whole — the window is read from the statement, not assumed
+    take(/NOT \(kind = 'invite' AND created_at <= now\(\) - interval '(\d+) days'\)/, (m) => (r) => !(r.kind === 'invite' && r.created_at <= NOW - Number(m[1]) * DAY_MS));
+    if (!/^[\s()]*(?:AND[\s()]*)*$/.test(residue)) throw new Error(`admission pool: unmodelled structure "${residue.trim()}"`);
+    const rows = ACCESS_REQUESTS.filter((r) => tests.every((fn) => fn(r))).map(() => ({ '?column?': 1 }));
+    return { rows, rowCount: rows.length };
+  },
+};
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: admissionPool } };
+
+const { SLIVER_KEYS, SLIVER_KEYS_HIDDEN } = require('../modules/platform-identity/recruiter-sliver.js');
+const { CANONICAL_PROFILE_PAGE_LIVE } = require('../modules/platform-identity/canonical-profile.js');
+const { clearTotalsMemo } = require('../modules/platform-identity/community-leaderboard.js');
+const { INVITE_EXPIRY_DAYS } = require('../src/bongos/invite-expiry.js');
+const dbKernel = require('../src/bongos/db-kernel.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+for (const file of ['public-profile', 'profile', 'community-search', 'community-leaderboard', 'scouting']) {
+  app.use('/api/bongos', require(`../modules/platform-identity/routes/${file}.js`)());
+}
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+// Every response the matrix walk sees, so the cross-cutting claims (section 3)
+// can be checked against ALL of them, not only the ones a cell looked at.
+const SEEN = [];
+function get(who, path_) {
+  viewer = who;
+  // a signed-in viewer's browser sends its credentials on a public read too
+  const headers = who ? { Authorization: `Bearer viewer-${who.github_id}`, Cookie: `bongos_session=viewer-${who.github_id}` } : {};
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: path_, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        const out = { who: who ? who.name : 'Anon', whoId: who ? who.github_id : null, path: path_, status: res.statusCode, text, json };
+        SEEN.push(out);
+        resolve(out);
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// ===========================================================================
+// 0. The instrument is calibrated before it is trusted
+// ===========================================================================
+
+test('the interpreter refuses what it cannot read, and reads each real predicate as the module’s own JS twin does', () => {
+  assert.throws(() => accountFilter('github_id = $1 AND tier = $2', ['1', 'x']), /unread predicate on \$2/);
+  assert.throws(() => accountFilter("github_id = $1 AND tier = 'gold'", ['1']), /unrecognised literal comparison on tier/);
+  assert.throws(() => accountFilter(accountVisibleSql('pa').replace(' AND pa.account_visibility', ' OR pa.account_visibility'), []), /unmodelled boolean structure/,
+    'an AND turned OR must be refused, never read as the conjunction it used to be');
+  for (const [sql, twin, name] of [
+    [accountVisibleSql('pa'), isAccountVisible, 'existence'],
+    [rollupVisibleSql('pa2'), isRollupVisible, 'rollup'],
+    [recruiterSliverVisibleSql(), isRecruiterSliverVisible, 'sliver'],
+  ]) {
+    const f = accountFilter(sql, []);
+    for (const a of ACCOUNTS) assert.equal(f(a), twin(a), `${name} predicate, ${a.key}: the interpreter and the module disagree`);
+  }
+  // the two directory tiers have no twin; pin them to the D2 cells directly
+  assert.deepEqual(ACCOUNTS.filter(accountFilter(scoutingListableSql('pa'), [])).map((a) => a.key), ['PUB']);
+  assert.deepEqual(ACCOUNTS.filter(accountFilter(scoutingNameOnlySql('pa'), [])).map((a) => a.key), ['SHY']);
+});
+
+// ===========================================================================
+// 1. The cells, row by row
+// ===========================================================================
+
+clearTotalsMemo();
+const PUBLIC_VIEWERS = (k) => [ANON, STRANGER, RECRUITER, selfOf(k)];
+const NOBODY = 'nobody-mx'; // a handle no account has ever held
+
+for (const k of KEYS) {
+  const a = ACCT[k];
+  const cell = MATRIX[k];
+
+  test(`${STATE[k].label} — the public profile read: ${cell.profile}, the same bytes to Anon, Builder, Recruiter and Self`, async () => {
+    const seen = [];
+    for (const who of PUBLIC_VIEWERS(k)) seen.push(await get(who, `/api/bongos/profiles/${a.handle}`));
+    for (const r of seen.slice(1)) {
+      assert.equal(r.status, seen[0].status, `${r.who} got a different status — the public read must not vary by viewer (D2)`);
+      assert.equal(r.text, seen[0].text, `${r.who} got a different body — the public read must not vary by viewer (D2)`);
+    }
+    const [r] = seen;
+    if (cell.profile === 404) {
+      assert.equal(r.status, 404, 'a 404, never a 403: a refusal would confirm the account exists');
+      const none = await get(ANON, `/api/bongos/profiles/${NOBODY}`);
+      assert.equal(r.text.replaceAll(a.handle, 'H'), none.text.replaceAll(NOBODY, 'H'), 'byte-identical to a handle nobody holds: no existence oracle');
+      return;
+    }
+    assert.equal(r.status, 200);
+    assert.equal(r.json.account.handle, a.handle);
+    if (cell.profile === 'full') {
+      assert.notEqual(r.json.cross_project, null);
+      assert.ok(r.text.includes(String(ROLLUP[a.github_id].credits)), 'the record renders');
+    } else {
+      assert.equal(r.json.cross_project, null, 'identity renders, the record does not');
+    }
+  });
+
+  test(`${STATE[k].label} — Self, through the own-scope door: ${cell.self}`, async () => {
+    if (cell.self === 'n/a') {
+      // D2: a provisional account has never had a hub session, so there is no
+      // Self to ask. Nothing to call; the cell is stated rather than invented.
+      assert.equal(a.profile_state, 'provisional');
+      return;
+    }
+    const r = await get(selfOf(k), '/api/bongos/me/cross-project');
+    assert.equal(r.status, 200);
+    assert.equal(r.json.handle, a.handle);
+    assert.equal(r.json.account_visibility, a.account_visibility, 'the page gets what it needs to say "your page is private"');
+    assert.equal(r.json.hide_stats, a.hide_stats);
+    assert.notEqual(r.json.cross_project, null, 'the owner always sees their own record, whatever the flags (ADR 0171 D4 side door)');
+    assert.ok(r.text.includes(String(ROLLUP[a.github_id].credits)));
+  });
+
+  test(`${STATE[k].label} — the recruiter sliver: ${cell.sliver}`, async () => {
+    const r = await get(RECRUITER, `/api/bongos/scouting/${a.handle}`);
+    if (cell.sliver === 404) {
+      assert.equal(r.status, 404);
+      return;
+    }
+    assert.equal(r.status, 200);
+    const want = cell.sliver === 'full' ? SLIVER_KEYS : SLIVER_KEYS_HIDDEN;
+    assert.deepEqual(Object.keys(r.json.sliver).sort(), [...want].sort(), 'exactly D3’s keys — the module’s own list, never a copy');
+    assert.equal(r.json.sliver.handle, a.handle);
+    for (const s of [a.github_login, a.bio, String(ROLLUP[a.github_id].credits), ROLLUP[a.github_id].last_active, ROLLUP[a.github_id].projects[0].name]) {
+      assert.ok(!r.text.includes(s), `the sliver carries "${s}" — D3 grants handle, name, avatar, disciplines and a boolean, nothing else`);
+    }
+  });
+}
+
+test('the sliver’s key lists are D3’s, transcribed: handle, name, avatar, disciplines, a recent-activity boolean — or the first three', () => {
+  // The cells above compare a response to the MODULE's lists; this pins those
+  // lists to the spec, so a sixth key added to the module cannot pass with them.
+  assert.deepEqual([...SLIVER_KEYS], ['handle', 'display_name', 'avatar_url', 'disciplines', 'active_recently']);
+  assert.deepEqual([...SLIVER_KEYS_HIDDEN], ['handle', 'display_name', 'avatar_url'], 'hide_stats drops the two rollup-derived keys');
+});
+
+test('search — "findable by name": listed, name-only (no disciplines) or absent, the same for every viewer', async () => {
+  const seen = [];
+  for (const who of [ANON, STRANGER, RECRUITER]) seen.push(await get(who, '/api/bongos/community/search?q=-mx&limit=50'));
+  for (const r of seen.slice(1)) assert.equal(r.text, seen[0].text, `${r.who} got a different search body`);
+  const byHandle = new Map(seen[0].json.results.map((x) => [x.handle, x]));
+  for (const k of KEYS) {
+    const hit = byHandle.get(ACCT[k].handle);
+    if (MATRIX[k].search === 'absent') { assert.equal(hit, undefined, `${k} must not be found`); continue; }
+    assert.ok(hit, `${k} must be findable by name`);
+    assert.deepEqual(hit.disciplines, MATRIX[k].search === 'listed' ? ROLLUP[ACCT[k].github_id].disciplines : null);
+  }
+  // a stats-derived filter drops the hidden account; the control finds a shown one
+  const shy = await get(ANON, `/api/bongos/community/search?q=-mx&discipline=${ROLLUP[ACCT.SHY.github_id].disciplines[0]}`);
+  assert.deepEqual(shy.json.results, [], 'D2: a hidden account is absent from any stats-derived filter');
+  const pub = await get(ANON, `/api/bongos/community/search?q=-mx&discipline=${ROLLUP[ACCT.PUB.github_id].disciplines[0]}`);
+  assert.deepEqual(pub.json.results.map((x) => x.handle), [ACCT.PUB.handle]);
+});
+
+test('the cross-project leaderboard — only shown, public, active accounts, the same for every viewer', async () => {
+  const seen = [];
+  for (const who of [ANON, STRANGER, RECRUITER]) seen.push(await get(who, '/api/bongos/community/leaderboard?limit=50'));
+  for (const r of seen.slice(1)) assert.equal(r.text, seen[0].text, `${r.who} got a different leaderboard body`);
+  const listed = new Set(seen[0].json.results.map((x) => x.handle));
+  for (const k of KEYS) {
+    assert.equal(listed.has(ACCT[k].handle), MATRIX[k].board === 'listed', `${k}: expected ${MATRIX[k].board}`);
+  }
+});
+
+test('the recruiting directory — the recruiter sees the full and name-only tiers; Anon and Builder are refused', async () => {
+  const r = await get(RECRUITER, '/api/bongos/scouting');
+  assert.equal(r.status, 200);
+  const full = new Set(r.json.builders.map((b) => b.github_login));
+  const nameOnly = new Set(r.json.name_only.map((b) => b.github_login));
+  for (const k of KEYS) {
+    const login = ACCT[k].github_login;
+    const got = full.has(login) ? 'full' : nameOnly.has(login) ? 'name-only' : 'absent';
+    assert.equal(got, MATRIX[k].directory, `${k} in the directory`);
+  }
+  for (const b of r.json.name_only) {
+    assert.deepEqual(Object.keys(b).sort(), ['avatar_url', 'display_name', 'github_login'], 'the name-only tier carries a name and nothing else');
+  }
+  assert.equal((await get(ANON, '/api/bongos/scouting')).status, 401);
+  assert.equal((await get(STRANGER, '/api/bongos/scouting')).status, 403);
+  assert.equal((await get(ANON, `/api/bongos/scouting/${ACCT.PRIVD.handle}`)).status, 401);
+  assert.equal((await get(STRANGER, `/api/bongos/scouting/${ACCT.PRIVD.handle}`)).status, 403, 'the sliver is the recruiter’s surface, not a signed-in builder’s');
+});
+
+// ===========================================================================
+// 3. The rules the matrix encodes, checked against EVERY response seen above
+// ===========================================================================
+
+const isOwnRead = (r, a) => r.whoId === a.github_id && r.path === '/api/bongos/me/cross-project';
+// What a response DISCLOSES: its body minus the fields that only echo the
+// caller's own request back (search's `query` and `discipline`). A discipline
+// the caller typed into the URL is not the server revealing it; the results
+// beside it still are, and stay in.
+const ECHO = { '/api/bongos/community/search': ['query', 'discipline'] };
+function disclosed(r) {
+  const echo = ECHO[r.path.split('?')[0]];
+  if (!echo || !r.json) return r.text;
+  const rest = { ...r.json };
+  for (const key of echo) delete rest[key];
+  return JSON.stringify(rest);
+}
+
+test('the walk covered every surface for every row (so the claims below are about something)', () => {
+  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting']) {
+    assert.ok(SEEN.some((r) => r.path.includes(p) && r.status === 200), `no 200 from ${p} — the sweep below would be vacuous for it`);
+  }
+  assert.ok(SEEN.length >= KEYS.length * 6, `only ${SEEN.length} responses recorded`);
+});
+
+test('hide_stats beats everything: no hidden account’s numbers reach anyone but the account itself', () => {
+  for (const k of KEYS.filter((x) => ACCT[x].hide_stats)) {
+    const a = ACCT[k];
+    for (const r of SEEN.filter((x) => !isOwnRead(x, a))) {
+      for (const s of rollupSentinels(a)) {
+        assert.ok(!disclosed(r).includes(s), `${k}'s "${s}" reached ${r.who} through GET ${r.path}`);
+      }
+    }
+    // control: the numbers exist and DO come back through the side door
+    const own = SEEN.find((x) => isOwnRead(x, a));
+    assert.ok(own && own.text.includes(String(ROLLUP[a.github_id].credits)), `${k}'s own read must carry its record, or this sweep proves nothing`);
+  }
+  // control: a shown account's numbers are on the public surfaces
+  assert.ok(SEEN.some((r) => r.who === 'Anon' && r.text.includes(String(ROLLUP[ACCT.PUB.github_id].credits))), 'a shown record must reach Anon, or absence above is vacuous');
+});
+
+test('provisional and private (not discoverable) are absent from every cross-project surface, for every viewer but Self', () => {
+  for (const k of ['PROV', 'PRIV']) {
+    const a = ACCT[k];
+    for (const r of SEEN.filter((x) => !isOwnRead(x, a) && !x.path.endsWith(`/profiles/${a.handle}`) && !x.path.endsWith(`/scouting/${a.handle}`))) {
+      for (const s of identitySentinels(a)) assert.ok(!disclosed(r).includes(s), `${k}'s "${s}" reached ${r.who} through GET ${r.path}`);
+    }
+  }
+});
+
+test('private · discoverable reaches the recruiter’s sliver and nowhere else', () => {
+  for (const k of ['PRIVD', 'PRIVDH']) {
+    const a = ACCT[k];
+    const leaks = SEEN.filter((r) => !isOwnRead(r, a) && identitySentinels(a).some((s) => disclosed(r).includes(s)));
+    assert.deepEqual(leaks.map((r) => `${r.who} ${r.path}`), [`Recruiter /api/bongos/scouting/${a.handle}`],
+      `${k} may be named only by the sliver, to the recruiter (D3)`);
+  }
+});
+
+// ===========================================================================
+// 4. Cells with no surface today — named, with a tripwire
+// ===========================================================================
+
+test('the cells with no surface today are stated, and the /u/<handle> page cannot land unnoticed', () => {
+  // When this flips, the page exists: add its column to MATRIX above (404 for a
+  // private account to everyone, rendered to its owner from the own-scope door).
+  assert.equal(CANONICAL_PROFILE_PAGE_LIVE, false, 'the /u/<handle> page is live — give it its cells in this matrix');
+  for (const line of [
+    'N/A not-yet-built: the /u/<handle> page (canonical-profile.js keeps it switched off)',
+    'N/A not-yet-built: the sitemap, and an Explore people surface',
+    'N/A by design: the Ops column (internal only, never a response)',
+    'N/A moved: a declined invite closes the project’s door — task 1004444 adds that row with the relay',
+  ]) console.log(`  ${line}`);
+});
+
+// ===========================================================================
+// 5. An expired invite refuses sign-in (D4)
+// ===========================================================================
+
+test('an expired invite refuses sign-in through the real admission read; a live one and an approved application do not', async () => {
+  assert.equal(INVITE_EXPIRY_DAYS, 30, 'the owner-signed window (spec D4)');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('stale-invitee'), false, 'day 31: the door has closed');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('STALE-INVITEE'), false, 'and no casing reopens it');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('fresh-invitee'), true, 'control: day 29 still admits');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('Fresh-Invitee'), true);
+  assert.equal(await dbKernel.hasInvitedAccessRequest('approved-applicant'), true, 'only an INVITE expires; an approved application never does');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('waiting-applicant'), false, 'a pending request was never a door');
+});
+
+// ===========================================================================
+// 6. This file runs in the lane that executes
+// ===========================================================================
+
+test('this proof runs in the DB-free unit lane', () => {
+  const runner = fs.readFileSync(path.join(ROOT, 'scripts/gds/run-unit-tests.js'), 'utf8');
+  assert.ok(!/privacy_matrix/.test(runner),
+    'named in run-unit-tests.js it would be parked into INTEGRATION or KNOWN_FAILING and gate nothing (learning 1000218)');
+});