@bongos/core 1.23.22 → 1.24.2

package/modules/platform-identity/account-logins.js

@@ -0,0 +1,192 @@
+// modules/platform-identity/account-logins.js — the ways a person signs in to
+// their platform account: GitHub, Google, or both (task 1004992, ADR 0393).
+//
+// WHAT CHANGED. A platform account used to BE a GitHub account: keyed on GitHub's
+// user id, so a person without GitHub could not exist on the hub. Now an account
+// is a person, and `platform_identity_account_logins` (migration 034) lists the
+// provider identities that reach it. The column every table and every federated
+// instance joins on keeps its name, `github_id`, and becomes the PERSON KEY:
+//
+//   positive — the GitHub user id of a person who arrived through GitHub. Every
+//              account before this change, unchanged; their 'github' row is
+//              backfilled, and the migration's trigger writes it for every
+//              GitHub-born account after, with no change to any writer.
+//   negative — minted from platform_identity_person_key_seq for a person who
+//              arrived WITHOUT GitHub. Never a GitHub id, and never rewritten
+//              when GitHub is linked later.
+//
+// So a key says who the person is, never which provider they used. Code that
+// needs to talk to GitHub asks for the linked GitHub login; it never assumes the
+// key is a GitHub id.
+//
+// THE ONE RULE THE TABLE ENFORCES. A provider identity belongs to exactly one
+// account, and an account holds at most one per provider — both UNIQUE in the
+// database, so a race or a buggy route cannot give one Google account two
+// owners. An email is shown, never looked up: owning a matching address must not
+// reach anyone's account (owner, 2026-10-29: suggest a link, never join one).
+//
+// NOT AUTHORITY (ADR 0016 / ADR 0141). Nothing here reads or writes a rank, a
+// credit or an admission. Linking ways in changes how a person signs in, never
+// what they may do.
+//
+// WHY ITS OWN FILE: platform-identity.js sits at its 1500-line size ratchet (the
+// account-visibility.js precedent, ADR 0202 D4).
+'use strict';
+
+const { pool: defaultPool, withTx } = require('../../src/module-api');
+const pi = require('./platform-identity');
+
+// The providers a person may sign in with. Mirrors migration 034's CHECK; a new
+// one is a decision (ADR 0393), not a string someone passes in.
+const LOGIN_PROVIDERS = Object.freeze(['github', 'google']);
+
+// A provider identity as this file stores it, or null when it can't be one.
+// GitHub's id is a positive integer; Google's `sub` is an opaque string of at
+// most 255 characters. Never an email or a login: both can change hands.
+function normalizeLogin({ provider, subject } = {}) {
+  if (!LOGIN_PROVIDERS.includes(provider)) return null;
+  const s = typeof subject === 'number' ? String(subject) : subject;
+  if (typeof s !== 'string' || s.length < 1 || s.length > 255) return null;
+  if (provider === 'github' && !/^[1-9]\d*$/.test(s)) return null;
+  if (provider !== 'github' && !/^[\x21-\x7e]+$/.test(s)) return null;
+  return { provider, subject: s };
+}
+
+// Was this person key minted for someone who arrived without GitHub? (It is
+// still their key after they link GitHub — a key never changes.)
+function isMintedPersonKey(key) {
+  return /^-\d+$/.test(String(key ?? ''));
+}
+
+// An email as a provider vouched for it, trimmed and capped, or null. Shown to
+// the person in their own settings and nothing else.
+function cleanEmail(email) {
+  if (typeof email !== 'string') return null;
+  const e = email.trim();
+  return e && e.length <= 320 && e.includes('@') ? e : null;
+}
+
+// The seed a new account's handle grows from when there is no GitHub login: the
+// name the provider gave, else the part of the email before the @. ensureHandle
+// squeezes it into the handle charset and falls back to builder-<key>.
+function handleSeedFor({ displayName, email }) {
+  return displayName || (cleanEmail(email) || '').split('@')[0] || '';
+}
+
+// Who signs in with this provider identity? → { accountId, personKey } or null.
+// The lookup every sign-in through a non-GitHub provider starts from.
+async function findPersonByLogin(login, { pool = defaultPool } = {}) {
+  const l = normalizeLogin(login);
+  if (!l) return null;
+  const { rows } = await pool.query(
+    `SELECT a.id AS account_id, a.github_id::text AS person_key
+       FROM platform_identity_account_logins l
+       JOIN platform_identity_accounts a ON a.id = l.account_id
+      WHERE l.provider = $1 AND l.subject = $2`,
+    [l.provider, l.subject],
+  );
+  return rows[0] ? { accountId: rows[0].account_id, personKey: rows[0].person_key } : null;
+}
+
+// Create the account for a person arriving through a provider other than
+// GitHub, with a minted (negative) person key → { accountId, personKey, created }.
+// If that provider identity already has an account — including one a racing
+// request created a moment ago — that account is returned with created: false,
+// so a double-click never makes two people.
+//
+// GitHub is refused here on purpose: a GitHub-born account is keyed on its
+// GitHub id and is born by upsertAccount, so there is one birth path per kind.
+//
+// The account starts 'provisional', like every account no hub browser sign-in
+// has activated yet (ADR 0171 D3); the sign-in route that calls this decides
+// activation, exactly as it does for GitHub.
+async function createAccountForLogin({ provider, subject, email, displayName, avatarUrl } = {}, { pool = defaultPool } = {}) {
+  const l = normalizeLogin({ provider, subject });
+  if (!l) throw new Error('createAccountForLogin: not a valid provider identity');
+  if (l.provider === 'github') throw new Error('createAccountForLogin: a GitHub account is born keyed on its GitHub id (upsertAccount)');
+
+  const existing = await findPersonByLogin(l, { pool });
+  if (existing) return { ...existing, created: false };
+
+  const name = typeof displayName === 'string' && displayName.trim() ? displayName.trim().slice(0, 100) : null;
+  let born;
+  try {
+    born = await withTx(async (client) => {
+      const { rows } = await client.query(
+        `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state)
+         VALUES (-nextval('platform_identity_person_key_seq'), NULL, $1, $2, 'provisional')
+         RETURNING id, github_id::text AS person_key`,
+        [name, pi.safeAvatarUrl(avatarUrl)],
+      );
+      await client.query(
+        `INSERT INTO platform_identity_account_logins (account_id, provider, subject, email, last_used_at)
+         VALUES ($1, $2, $3, $4, now())`,
+        [rows[0].id, l.provider, l.subject, cleanEmail(email)],
+      );
+      return { accountId: rows[0].id, personKey: rows[0].person_key };
+    }, { pool });
+  } catch (err) {
+    // Another request created this person between our lookup and our insert:
+    // our transaction rolled back whole, so theirs is the one account.
+    if (err && err.code === '23505') {
+      const raced = await findPersonByLogin(l, { pool });
+      if (raced) return { ...raced, created: false };
+    }
+    throw err;
+  }
+  await pi.ensureHandle({ githubId: born.personKey, githubLogin: handleSeedFor({ displayName: name, email }) }, { pool });
+  return { ...born, created: true };
+}
+
+// A sign-in through a provider other than GitHub (task 1004993: Google) →
+// { personKey, handle, githubLogin, created }. The person is found by the
+// provider's own id, or born now; never by an email. A returning person's way in
+// is stamped as used, and its email refreshed to the one the provider vouched for
+// this time. `githubLogin` is the person's LINKED GitHub login or null: the hub's
+// builder row shows that when there is one, and a stand-in otherwise (ADR 0396).
+async function signInWithLogin({ provider, subject, email, displayName, avatarUrl } = {}, { pool = defaultPool } = {}) {
+  const person = await createAccountForLogin({ provider, subject, email, displayName, avatarUrl }, { pool });
+  if (!person.created) {
+    await pool.query(
+      `UPDATE platform_identity_account_logins SET last_used_at = now(), email = COALESCE($3, email)
+        WHERE provider = $1 AND subject = $2`,
+      [provider, String(subject), cleanEmail(email)],
+    );
+  }
+  const { rows } = await pool.query(
+    `SELECT handle, github_login FROM platform_identity_accounts WHERE id = $1`,
+    [person.accountId],
+  );
+  return {
+    personKey: person.personKey,
+    handle: rows[0]?.handle || null,
+    githubLogin: rows[0]?.github_login || null,
+    created: person.created,
+  };
+}
+
+// The ways in a person has, for their OWN settings → [{ provider, email,
+// created_at, last_used_at }], GitHub first. The provider's user id never leaves
+// this file: the person needs to know WHICH ways they have, not the ids.
+async function listLoginsForPerson(personKey, { pool = defaultPool } = {}) {
+  if (!pi.isNumericGithubId(personKey)) return [];
+  const { rows } = await pool.query(
+    `SELECT l.provider, l.email, l.created_at, l.last_used_at
+       FROM platform_identity_account_logins l
+       JOIN platform_identity_accounts a ON a.id = l.account_id
+      WHERE a.github_id = $1
+      ORDER BY array_position($2::text[], l.provider)`,
+    [personKey, LOGIN_PROVIDERS],
+  );
+  return rows;
+}
+
+module.exports = {
+  LOGIN_PROVIDERS,
+  normalizeLogin,
+  isMintedPersonKey,
+  findPersonByLogin,
+  createAccountForLogin,
+  signInWithLogin,
+  listLoginsForPerson,
+};

package/modules/platform-identity/migrations/platform_identity_034_account_logins.sql

@@ -0,0 +1,96 @@
+-- platform_identity_034_account_logins.sql — a platform account is a PERSON, and
+-- GitHub is one way in, no longer the only one (task 1004992, ADR 0393).
+--
+-- Before this, platform_identity_accounts was keyed on GitHub's user id, so a
+-- person without a GitHub account could not exist on the hub at all. Three
+-- changes, all additive or relaxing:
+--
+--   1. platform_identity_account_logins — the ways a person signs in. One row per
+--      (provider, provider's own user id). A person holds at most one of each
+--      provider, and a provider identity belongs to exactly one person; both are
+--      UNIQUE constraints, so the database, not a route, refuses a second owner.
+--
+--   2. github_id keeps its name and its job as the federation key every other
+--      table and every federated instance already joins on — but it now means
+--      "the person key". A person who arrived through GitHub keeps their GitHub
+--      user id as the key (every existing row, unchanged). A person who arrived
+--      WITHOUT GitHub gets a NEGATIVE key from platform_identity_person_key_seq:
+--      GitHub ids are positive, so a minted key can never collide with one, and
+--      it never changes when GitHub is linked later.
+--
+--   3. github_login is now NULL for a person with no GitHub linked. A login is a
+--      GitHub fact; inventing one would let a real GitHub user of that name be
+--      mistaken for this person by the invite-by-login path.
+--
+-- The trigger keeps every GitHub-born account's login row in step without a
+-- change to any writer: an account inserted with a positive key is, by
+-- construction, a GitHub sign-in, so its 'github' row is written beside it.
+--
+-- Identity only, never authority (ADR 0016 / ADR 0141): nothing here carries a
+-- rank, a credit or an admission.
+--
+-- Idempotent: safe to re-run.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS platform_identity_account_logins (
+  id            bigserial PRIMARY KEY,
+  account_id    bigint NOT NULL REFERENCES platform_identity_accounts (id) ON DELETE CASCADE,
+
+  -- 'github' | 'google'. A new provider is a decision (ADR 0393), so it is a
+  -- CHECK and not a free string.
+  provider      text NOT NULL CHECK (provider IN ('github', 'google')),
+
+  -- The provider's own stable user id: GitHub's numeric id, Google's `sub`.
+  -- Never an email or a login — both can change hands.
+  subject       text NOT NULL CHECK (length(subject) BETWEEN 1 AND 255),
+
+  -- The address the provider vouched for at the last sign-in, shown to the
+  -- person in their own settings. Descriptive only: no lookup keys on it, so
+  -- owning a matching address never reaches an account.
+  email         text CHECK (email IS NULL OR length(email) <= 320),
+
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  last_used_at  timestamptz,
+
+  UNIQUE (provider, subject),
+  UNIQUE (account_id, provider)
+);
+
+COMMENT ON TABLE platform_identity_account_logins IS
+  'The ways a platform account signs in (task 1004992, ADR 0393): one row per provider identity. A provider identity belongs to exactly one account and an account holds at most one per provider. Identity only, never authority.';
+
+-- Keys minted for people who arrive without GitHub: the account key is
+-- -nextval(), so it is always negative and never a GitHub id.
+CREATE SEQUENCE IF NOT EXISTS platform_identity_person_key_seq;
+
+ALTER TABLE platform_identity_accounts ALTER COLUMN github_login DROP NOT NULL;
+
+COMMENT ON COLUMN platform_identity_accounts.github_id IS
+  'The PERSON key the federation joins on (ADR 0393). Positive = the GitHub user id of a person who arrived through GitHub; negative = minted for a person who arrived without it. It never changes when a way in is linked or removed.';
+COMMENT ON COLUMN platform_identity_accounts.github_login IS
+  'The linked GitHub login, or NULL when this person has no GitHub linked (ADR 0393).';
+
+-- Every account that exists today arrived through GitHub.
+INSERT INTO platform_identity_account_logins (account_id, provider, subject, created_at)
+SELECT id, 'github', github_id::text, created_at
+  FROM platform_identity_accounts
+ WHERE github_id > 0
+ON CONFLICT DO NOTHING;
+
+CREATE OR REPLACE FUNCTION platform_identity_github_born_login() RETURNS trigger AS $$
+BEGIN
+  INSERT INTO platform_identity_account_logins (account_id, provider, subject)
+  VALUES (NEW.id, 'github', NEW.github_id::text)
+  ON CONFLICT DO NOTHING;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS platform_identity_github_born_login ON platform_identity_accounts;
+CREATE TRIGGER platform_identity_github_born_login
+  AFTER INSERT ON platform_identity_accounts
+  FOR EACH ROW WHEN (NEW.github_id > 0)
+  EXECUTE FUNCTION platform_identity_github_born_login();
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -173,9 +173,10 @@ async function ensureAccount({ githubId, githubLogin, displayName, avatarUrl },
 async function upsertAccount({ githubId, githubLogin, displayName, avatarUrl, activate = false }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `INSERT INTO platform_identity_accounts (github_id, github_login, display_name, avatar_url, profile_state${terms.acceptanceInsertColumns()})
-     VALUES ($1, $2, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END${terms.acceptanceInsertValues('$5', '$6')})
+     VALUES ($1, CASE WHEN $1::bigint < 0 THEN NULL ELSE $2 END, $3, $4, CASE WHEN $5::boolean THEN 'active' ELSE 'provisional' END${terms.acceptanceInsertValues('$5', '$6')})
      ON CONFLICT (github_id) DO UPDATE SET
-       github_login = EXCLUDED.github_login,
+       -- A minted (negative) key's login is GitHub's, set only by linking (ADR 0393/0396).
+       github_login = CASE WHEN platform_identity_accounts.github_id < 0 THEN platform_identity_accounts.github_login ELSE EXCLUDED.github_login END,
        display_name = CASE WHEN platform_identity_accounts.display_name_source = 'user'
                            THEN platform_identity_accounts.display_name
                            ELSE EXCLUDED.display_name END,
@@ -764,9 +765,9 @@ async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
 // Is this a value we can safely bind against the bigint github_id column?
 // Core builders include 'system:bfg'-style TEXT principals; binding one would
 // throw a bigint cast error mid-request, so every profile read guards here and
-// returns null instead (ADR 0171 D2).
+// returns null instead (ADR 0171 D2). Negative = a person with no GitHub (ADR 0393).
 function isNumericGithubId(githubId) {
-  return /^\d+$/.test(String(githubId ?? ''));
+  return /^-?\d+$/.test(String(githubId ?? ''));
 }
 
 // One builder's cross-project record (ADR 0171 D2/D6/D7, task 1002278) — the

package/modules/platform-identity/routes/my-projects.js

@@ -28,6 +28,7 @@ const pi = require('../platform-identity');
 const projectStats = require('../project-stats');
 const applicationEcho = require('../application-echo');
 const guilds = require('../guilds');
+const { isMintedPersonKey } = require('../account-logins');
 const guildEngagements = require('../guild-engagements');
 const inviteNotices = require('../invite-notices');
 const hubKeys = require('../hub-keys');
@@ -226,6 +227,11 @@ module.exports = function myProjectsRoutes() {
       note: { type: 'string', maxLength: APPLICANT_NOTE_MAX },
       guild: { type: 'string', maxLength: 39 },
     })) return;
+    // A Google-only person (a minted key) cannot be relayed to a project yet:
+    // halls learn to take one in task 1004994 (ADR 0393). Refuse before relaying.
+    if (isMintedPersonKey(req.builder.github_id)) {
+      return res.fail('google_join_not_yet', { status: 409, message: 'Projects can’t be joined with a Google sign-in yet. That is coming soon.' });
+    }
     try {
       const client = await pi.getClientByOrigin(req.body.origin, { pool });
       if (!client || client.status !== 'active' || !client.origin) {

package/modules/platform-identity/routes/profile.js

@@ -30,6 +30,8 @@
 //                             plain-text bio); setting display_name stamps
 //                             display_name_source='user' so federated re-syncs
 //                             stop overwriting it (the ADR 0156 mirror).
+//   GET   /me/sign-in-methods — the ways the account signs in (GitHub, Google;
+//                             task 1004992, ADR 0393), for account settings.
 //
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
@@ -37,6 +39,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
+const logins = require('../account-logins');
 
 const { pool, requireBuilder, validateOrRespond } = api;
 
@@ -232,5 +235,20 @@ module.exports = function profileRoutes() {
     }
   });
 
+  // rank: any-builder — the ways the caller's OWN account signs in (task 1004992,
+  // ADR 0393): GitHub, Google, or both, with the address each provider vouched
+  // for. Keyed on the authenticated github_id (the person key); the provider's
+  // user id never crosses. A system:* principal has no platform account: [].
+  router.get('/me/sign-in-methods', requireBuilder, async (req, res) => {
+    try {
+      const methods = await logins.listLoginsForPerson(req.builder.github_id, { pool });
+      res.set('Cache-Control', 'no-store');
+      res.json({ methods, providers: logins.LOGIN_PROVIDERS });
+    } catch (err) {
+      console.error('[platform-identity] GET /me/sign-in-methods', err);
+      res.fail('sign_in_methods_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/platform-identity/routes/public-profile.js

@@ -28,6 +28,9 @@ const { pool, corsPublicGet } = api;
 const READ_RATE_WINDOW_MS = 60 * 1000;
 const READ_RATE_LIMIT = 120;
 const buckets = new Map(); // ip -> timestamp[]
+// Hard size cap (task 1004964): the sweep below bounds the map by time only, every
+// five minutes. At the cap the oldest-inserted IP goes first; the newest survive.
+const MAX_TRACKED_IPS = 50000;
 
 const sweepTimer = setInterval(() => {
   const cutoff = Date.now() - READ_RATE_WINDOW_MS;
@@ -42,7 +45,10 @@ function profileReadRateLimit(req, res, next) {
   const now = Date.now();
   const key = req.ip || req.socket?.remoteAddress || 'unknown';
   let bucket = buckets.get(key);
-  if (!bucket) { bucket = []; buckets.set(key, bucket); }
+  if (!bucket) {
+    while (buckets.size >= MAX_TRACKED_IPS) buckets.delete(buckets.keys().next().value);
+    bucket = []; buckets.set(key, bucket);
+  }
   const cutoff = now - READ_RATE_WINDOW_MS;
   while (bucket.length && bucket[0] < cutoff) bucket.shift();
   if (bucket.length >= READ_RATE_LIMIT) {
@@ -90,3 +96,6 @@ module.exports = function publicProfileRoutes() {
 
   return router;
 };
+
+// Test seam (task 1004964): the limiter and its map, so a test can show the cap holds.
+module.exports._internals = { profileReadRateLimit, buckets, MAX_TRACKED_IPS };

package/modules/platform-identity/routes/sso.js

@@ -31,6 +31,8 @@ const applicationEcho = require('../application-echo');
 const guildEngagements = require('../guild-engagements');
 const instanceFeedback = require('../instance-feedback');
 const projectStats = require('../project-stats');
+// Ways in other than GitHub (task 1004993, ADR 0393/0396).
+const { signInWithLogin, isMintedPersonKey } = require('../account-logins');
 
 // One limiter per hub process for POST /sso/feedback (task 1004462).
 const feedbackLimiter = instanceFeedback.makeFeedbackLimiter();
@@ -74,6 +76,9 @@ function hubHost() {
 const APPLICANT_READ_WINDOW_MS = 60 * 1000;
 const APPLICANT_READ_LIMIT = 300;
 const applicantReadBuckets = new Map(); // ip -> timestamp[]
+// Hard size cap (task 1004964): the sweep below bounds the map by time only, every
+// five minutes. At the cap the oldest-inserted IP goes first; the newest survive.
+const APPLICANT_MAX_TRACKED_IPS = 50000;
 
 const applicantSweep = setInterval(() => {
   const cutoff = Date.now() - APPLICANT_READ_WINDOW_MS;
@@ -88,7 +93,12 @@ function applicantReadRateLimit(req, res, next) {
   const now = Date.now();
   const key = req.ip || req.socket?.remoteAddress || 'unknown';
   let bucket = applicantReadBuckets.get(key);
-  if (!bucket) { bucket = []; applicantReadBuckets.set(key, bucket); }
+  if (!bucket) {
+    while (applicantReadBuckets.size >= APPLICANT_MAX_TRACKED_IPS) {
+      applicantReadBuckets.delete(applicantReadBuckets.keys().next().value);
+    }
+    bucket = []; applicantReadBuckets.set(key, bucket);
+  }
   const cutoff = now - APPLICANT_READ_WINDOW_MS;
   while (bucket.length && bucket[0] < cutoff) bucket.shift();
   if (bucket.length >= APPLICANT_READ_LIMIT) {
@@ -232,6 +242,12 @@ function registerSeams() {
       recordHubSignin: ({ githubId, githubLogin, displayName, avatarUrl }) => pi.upsertAccount({
         githubId, githubLogin, displayName, avatarUrl, activate: true,
       }, { pool }),
+      // task 1004993 (ADR 0396): the hub's own Google sign-in. Finds the person by
+      // Google's own id or creates them; never by an email. Core passes only what it
+      // read from Google's token endpoint for the code it exchanged.
+      signInWithGoogle: ({ subject, email, displayName, avatarUrl }) => signInWithLogin({
+        provider: 'google', subject, email, displayName, avatarUrl,
+      }, { pool }),
     });
   }
 }
@@ -311,6 +327,12 @@ module.exports = function ssoRoutes() {
           : 'This session type cannot be used for cross-project sign-in.';
       return res.status(403).type('text/html').send(errorPage(msg));
     }
+    // A person who signed up with Google has a minted key, which a project's hall
+    // cannot take yet (ADR 0393: an older core must not be sent one). Task 1004994
+    // opens this door; until then say so plainly instead of sending the key.
+    if (isMintedPersonKey(session.github_id)) {
+      return res.status(403).type('text/html').send(errorPage('Projects can’t be joined with a Google sign-in yet. That is coming soon; for now, sign in to the project with GitHub.'));
+    }
 
     // A live hub session — record/refresh the platform account and mint a
     // single-use code bound to (client_id, github_id, redirect_uri).
@@ -860,3 +882,6 @@ module.exports = function ssoRoutes() {
 
   return router;
 };
+
+// Test seam (task 1004964): the applicant limiter and its map, so a test can show the cap holds.
+module.exports._internals = { applicantReadRateLimit, applicantReadBuckets, APPLICANT_MAX_TRACKED_IPS };

package/modules/platform-identity/tests/platform-identity.mjs

@@ -1127,7 +1127,8 @@ await ta('upsertAccount SQL carries the ADR 0156 guard: a user-set name is never
   const sql = pool.calls[0].text;
   assert.match(sql, /display_name\s*=\s*CASE WHEN platform_identity_accounts\.display_name_source = 'user'/,
     'the conflict branch guards display_name on display_name_source');
-  assert.match(sql, /github_login\s*=\s*EXCLUDED\.github_login/, 'github_login still re-syncs unconditionally');
+  assert.match(sql, /github_login = CASE WHEN platform_identity_accounts\.github_id < 0 THEN platform_identity_accounts\.github_login ELSE EXCLUDED\.github_login END/,
+    'github_login re-syncs for a GitHub-born key; a minted key keeps the login only linking sets (ADR 0396)');
   assert.match(sql, /avatar_url\s*=\s*EXCLUDED\.avatar_url/, 'avatar_url still re-syncs unconditionally');
 });
 

package/modules/provisioning/credential-preflight.js

@@ -99,8 +99,8 @@ async function fetchRepoVisibility(token, { owner, name, fetchImpl, userAgent })
 // send: { code, status, message }. Returning a value rather than writing to `res`
 // keeps this directly testable and leaves the HTTP shape with the route that owns it.
 //
-// deps: { pool, secretBox, grantedScopeCoversRepos, userAgent, fetchImpl?,
-//         readToken?, fetchRepo? } — the last two are test seams.
+// deps: { pool, secretBox, grantedScopeCoversRepos, userAgent, prelaunchActive?,
+//         fetchImpl?, readToken?, fetchRepo? } — the last two are test seams.
 async function adoptCredentialFault({ builderId, onboardMode, targetRef }, deps) {
   if (onboardMode !== 'adopt') return null;            // greenfield: nothing to check
   const { grantedScopeCoversRepos, secretBox, fetchImpl, userAgent } = deps;
@@ -159,9 +159,19 @@ async function adoptCredentialFault({ builderId, onboardMode, targetRef }, deps)
   // (ADR 0176). Read-only collaborator access passes the read above and then fails at
   // key registration — the exact "looked like it worked" shape this exists to end.
   // The sentence matches the runner's own so the two can never disagree.
+  // PRE-LAUNCH (stealth) keeps every project's code private (task 1004998): while the
+  // instance's password gate is on, a PUBLIC repo is refused — and the admin refusal
+  // below stops offering "make it public" as a way out. Asked only on a positive read
+  // that the repo is public, so a GitHub hiccup still admits above.
+  const prelaunch = !!(deps.prelaunchActive && deps.prelaunchActive());
   if (info.private && !info.admin) {
     return { code: 'repo_admin_required', status: 403,
-      message: `Your GitHub account can read ${repo.owner}/${repo.name}, but adopting a private repository needs repository ADMIN so its deploy key can be registered. Ask a repository admin to raise your access, or make the repository public.` };
+      message: `Your GitHub account can read ${repo.owner}/${repo.name}, but adopting a private repository needs repository ADMIN so its deploy key can be registered. Ask a repository admin to raise your access${prelaunch ? '.' : ', or make the repository public.'}` };
+  }
+
+  if (!info.private && prelaunch) {
+    return { code: 'public_repo_prelaunch', status: 409,
+      message: `${repo.owner}/${repo.name} is public on GitHub, and while we are in pre-launch every project's code stays private. Make the repository private on GitHub first, then try again — or start a fresh project instead.` };
   }
 
   return null;

package/modules/provisioning/pollers/app-liveness.js

@@ -30,7 +30,13 @@ const { RENDER_URL_RE } = require('../app-status');
 
 const logger = api.logger('provisioning');
 
-const INTERVAL_MS = Number(process.env.PROVISIONING_APP_LIVENESS_MS) || 60_000;
+// CADENCE (task 1004960): every 5 minutes, not every minute. The only thing that
+// reads what this writes is the project page's app card (app-status.js), which
+// moves from "building" to "live" — and a Render first build itself takes
+// several minutes, so a card that turns live up to 5 minutes after the app does
+// costs the owner nothing, while a per-minute DB read on every hosted project
+// costs every instance ~1,440 queries a day. Nothing user-facing needs faster.
+const INTERVAL_MS = Number(process.env.PROVISIONING_APP_LIVENESS_MS) || 5 * 60_000;
 const FIRST_DELAY_MS = 20_000;
 const PROBE_TIMEOUT_MS = 10_000;
 const SWEEP_LIMIT = 50;
@@ -95,16 +101,30 @@ function start(deps = {}) {
 
 function arm(deps, delay) {
   timer = setTimeout(() => {
-    sweepOnce(deps)
-      .catch((e) => logger.error(`[app-liveness] sweep failed: ${e && e.message ? e.message : e}`))
-      .then(() => { if (started) arm(deps, INTERVAL_MS); });
+    tick(deps).then(() => { if (started) arm(deps, INTERVAL_MS); });
   }, delay);
   if (timer.unref) timer.unref();
 }
 
+// One run. A run that starts while the previous sweep is still in flight (ten
+// slow knocks can outlast a short interval) is skipped, never stacked.
+let running = false;
+async function tick(deps = {}) {
+  if (running) return { skipped: true };
+  running = true;
+  try {
+    return await sweepOnce(deps);
+  } catch (e) {
+    logger.error(`[app-liveness] sweep failed: ${e && e.message ? e.message : e}`);
+    return { failed: true };
+  } finally {
+    running = false;
+  }
+}
+
 function stop() {
   started = false;
   if (timer) { clearTimeout(timer); timer = null; }
 }
 
-module.exports = { start, stop, sweepOnce, appAnswers, INTERVAL_MS };
+module.exports = { start, stop, sweepOnce, tick, appAnswers, INTERVAL_MS };

package/modules/provisioning/routes/provisioning.js

@@ -404,7 +404,7 @@ module.exports = function provisioningRoutes() {
       // definition of a usable credential; ../credential-preflight.js says why.
       const credFault = await adoptCredentialFault(
         { builderId: req.builder.id, onboardMode, targetRef: body.target_ref },
-        { pool, secretBox: api.secretBox, grantedScopeCoversRepos: api.grantedScopeCoversRepos, userAgent: api.userAgent() },
+        { pool, secretBox: api.secretBox, grantedScopeCoversRepos: api.grantedScopeCoversRepos, prelaunchActive: api.prelaunchActive, userAgent: api.userAgent() },
       );
       if (credFault) return res.fail(credFault.code, { status: credFault.status, message: credFault.message });
       // A re-request must not re-litigate the address: createInstance never updates

package/modules/provisioning/starter-bundles.js

@@ -80,8 +80,12 @@ const ALWAYS_ON_CORE = Object.freeze([
 // investor page: its copy is Cloud Bongos's raise, so offering it to a new project would hand
 // that project someone else's fundraise (task 1004852). `ai-studio` (task 1004916, ADR 0392)
 // bills AI generation through Cloud Bongos's own payment processor account, so it stays on
-// the hub until a project can bring its own billing.
-const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise', 'ai-studio']);
+// the hub until a project can bring its own billing. `market-watch` (task 1004935) is not
+// hub-only in purpose: it is here because it is still EMPTY (no routes), and a picker entry
+// for a switch that does nothing is worse than none. This list is the one that keeps a
+// default:false module out of the opt-in catalog; the goal 1000137 task that ships the
+// owner's on/off switch moves it to OPTIONAL_MODULES with owner-facing copy.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise', 'ai-studio', 'market-watch']);
 
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,

package/modules/public-landing/public/account.html

@@ -156,11 +156,11 @@
   <!-- signed-out door: revealed on a 401, the /projects gate's shape -->
   <section class="aDoor" id="door" hidden aria-labelledby="door-h">
     <h2 class="vh" id="door-h">Sign in</h2>
-    <p>Sign in with GitHub to change your handle, your bio and links, and who can find you.</p>
+    <p>Sign in to change your handle, your bio and links, and who can find you.</p>
     <a class="btn" id="signin" href="/api/bongos/auth/web/start?return=/account&amp;repos=1">
       <!-- keep the spaces inside this path's numbers: same shape, and they are load-bearing (task 1004401) -->
       <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23 .82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2 .82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12 .51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29 .25.54.73 .54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15 .46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
-      Sign in with GitHub
+      Sign in
     </a>
   </section>
 
@@ -204,6 +204,7 @@
     <section class="aSec" id="aHandle" aria-labelledby="aHandle-h">
       <h2 id="aHandle-h">your handle</h2>
       <p class="aSide">The short name people find you by, the same in every project.</p>
+      <p class="projMsg ok" id="welcomeMsg" role="status" hidden>Welcome! Choose the handle people will know you by. We started you with one from your Google name, and you can change it now.</p>
       <form class="aBody" id="handleForm" novalidate>
         <label class="aField"><span class="aLabel">Handle</span>
           <input type="text" id="fHandle" maxlength="39" autocomplete="off" autocapitalize="none" spellcheck="false" placeholder="your-handle"></label>
@@ -368,6 +369,13 @@
       var hash = window.location && window.location.hash;
       var target = hash && document.getElementById(hash.slice(1));
       if (target && typeof target.scrollIntoView === 'function') target.scrollIntoView();
+      // A first Google sign-in lands here to choose a handle (task 1004993).
+      if (/[?&]welcome=google(&|$)/.test(window.location.search || '')) {
+        $('welcomeMsg').hidden = false;
+        var sec = $('aHandle');
+        if (sec && typeof sec.scrollIntoView === 'function') sec.scrollIntoView();
+        $('fHandle').focus();
+      }
       loadBuilding();
       loadGuilds();
     }, function () { showAlert('Couldn’t reach the server — check your connection and refresh.'); });

package/modules/public-landing/public/assets/world/r2-bongos-chrome-b.jpg.json

@@ -7,6 +7,6 @@
   "round": 2,
   "prompt": "Product render on a pure black background: a pair of bongo drums, one larger and one smaller joined by a short bridge, their shells liquid chrome with iridescent bronze, blue and violet reflections, crisp clean silhouette, seen straight on from slightly below so the drumheads are thin ellipses, faintly translucent drumheads, no hands, no text, no ground plane, no cast shadow or glow on the background. Pure black everywhere the drums are not.",
   "source": ".impeccable/mocks/world-assets/r2-bongos-chrome-b.jpg",
-  "encoded": "verbatim copy of the plate (task 1003298)",
+  "encoded": "verbatim copy of the plate (task 1003298); re-encoded 2026-10-28 for page weight with sharp 0.33.5 (mozjpeg) quality 86, same 2048x2048 and format, 46.2dB PSNR against the previous file, 264391 -> 195294 bytes (task 1004930)",
   "use": "the verbatim plate the .webp is encoded from, kept so a catalog art_url naming it still resolves; the page requests the .webp (task 1003649)"
 }