@bongos/core 1.23.7 → 1.23.8

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.23.7",
-  "core_contract": "1.23.7",
-  "source_commit": "b3d8fd1d43987850a49b0262cddfb454592c3baa",
+  "core_version": "1.23.8",
+  "core_contract": "1.23.8",
+  "source_commit": "71abc904d0973c3f46522ec7fd473ad9dcbe3740",
   "source_ref": "HEAD",
-  "built_at": "2026-10-26T23:49:17.830Z",
+  "built_at": "2026-10-27T00:17:49.705Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 616,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 4206,
-  "tree_sha256": "a3771c367fe15a46a3890c73c3a51d5233d9722c445cef33b41f0c5c2689906a",
+  "tree_sha256": "bc6631716475089c36b86b3553193208ab3f55a824cc34fcc9739e5b46f1dc0f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2422,12 +2422,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "698489ed0ecdf125ef705bbcb953830453c22ae8632edb437d8f3ddd685d3561"
+      "sha256": "db72d41e471428058a50aa84790a1a82260e4a05695f8b3ace417962a68edbb2"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "aea042d0a416623e897295c7b959d0eeed8c4d2759d859e35e4715d5c18eb936"
+      "sha256": "aad1e5ab6a606bec9e29f2e80eebfb072e36b3ad3cfd71ba2e8b58488676bd67"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2937,7 +2937,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "91bc98777d143a46a4acdb3afc7662f9b6069fd5d2954f6b9aefd03d1d327f87"
+      "sha256": "6b3ccce147bbb46647a2bd411fb35559bf0c7c0a3d268bcb5f5bb2996641d8dd"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3027,7 +3027,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "3fa8c79139ee97fb0bc2b7ab3ce5d194984797f294ba9cedb78e322e95d6fa8d"
+      "sha256": "a659b466d5f83465efc73e9bb28ce33ef4bd67b543b1ec998be10b39e697d992"
     },
     {
       "path": "docs/project-context.template.md",
@@ -8672,7 +8672,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "e6896461ed1359d8c71c4af01cdceba2df3d644d31ebd807bff3bcdfa88697fb"
+      "sha256": "84beda2da932dec7f94056d78ca766ec4da4ffbe5a422e4290e0fbd318a5c8a6"
     },
     {
       "path": "modules/platform-identity/scouting-authz.js",
@@ -8687,7 +8687,7 @@
     {
       "path": "modules/platform-identity/terms-acceptance.js",
       "mode": "0000644",
-      "sha256": "00d3d1460d1fa0d224e487a1701309b4725f2872a36a0cfe283cbd21b96d1e53"
+      "sha256": "bc9be6664fef1f8854bf6cdbfddd872c4dee04d7a7df076adc63ff2b7d4125ce"
     },
     {
       "path": "modules/platform-identity/tests/activity-snapshots.mjs",
@@ -9947,7 +9947,7 @@
     {
       "path": "modules/public-landing/public/terms.html",
       "mode": "0000644",
-      "sha256": "54a9a74ee0398d5e309e3ccf1b657a612b2785bd9295304670a1e2cb7a2bc93a"
+      "sha256": "ea71459f4cd48240d7607d2ed9538cdedcdfc71ec80ae25c8960596aab2ffc37"
     },
     {
       "path": "modules/raise/CLAUDE.md",
@@ -10837,12 +10837,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b2707b768f0b92534351f237e4c1f2ad46894471f0f639f770bfa0b361fa584f"
+      "sha256": "c2355516436464dd695de67ba3e9fc57f4cc82782f63716f694b4296f83a7200"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2e911efb9044f425ef86de18b03ccadf10913f7db81eac836fc07ab901bd2011"
+      "sha256": "fcb3c2902fb41d0a2cb4effa8cb28d614664f390c0e7a9bdded7b472069f3fd5"
     },
     {
       "path": "public-docs/index.html",
@@ -10862,7 +10862,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "56aff299cc54f61132be2b6d1877e50cc35282ed1e759726246d0ae0f131f343"
+      "sha256": "2283bdaf35c46a9079b03e2a9dff5fd44153ec42ad3ece5045b123ce193523e4"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -14337,7 +14337,7 @@
     {
       "path": "src/bongos/auth-github.js",
       "mode": "0000644",
-      "sha256": "00ad42eac32546ed08948c89ade5b8a4ebaada1841a651bb84c124d659fbbbc8"
+      "sha256": "8d02a4f4fd3281fb65c926d4e837499db5050d47979c1ff4ec5e9b441994610e"
     },
     {
       "path": "src/bongos/auth-idp.js",
@@ -14737,7 +14737,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6b5b56cd550854c711eef1cd99f72c7c7f52a781bb0b6391845ff8a3fb1f78c9"
+      "sha256": "50b0b05cd25ea29cc845c537b33150b22115f65e680d4727a04673526f0da98e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -20632,7 +20632,7 @@
     {
       "path": "tests/terms_acceptance.mjs",
       "mode": "0000644",
-      "sha256": "7d30b0a0545c630157ff1b2a642ab588397e316575375a105d94f3ad82fbba70"
+      "sha256": "56b6c06ada67f3cff5ae2bc05182cdf11ffa9028b8725d0eeb35267bd9876e76"
     },
     {
       "path": "tests/terms_grandfather_db.mjs",

package/docs/copy-inventory.md

@@ -2300,7 +2300,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a86a02b0ded9` | certain | How your project’s own hall looks: its colours in light and dark mode, whether its dark mode takes a tint of y | `modules/public-landing/public/projects.html:1447` |
 | `23febbbd53e2` | certain | I can sign for this project, and I accept the | `modules/public-landing/public/projects.html:2056` |
 | `915b187df57e` | certain | If you grant repository access while creating a project, that permission is used to create or adopt your repos | `modules/public-landing/public/privacy.html:103` |
-| `d37e2fbde8c6` | certain | If your account already existed when this version took effect, the platform accepted it on your behalf, rather | `modules/public-landing/public/terms.html:119` |
+| `f11a5798d212` | certain | If your account already existed when this version took effect, the platform accepted it on your behalf, rather | `modules/public-landing/public/terms.html:119` |
 | `fa123fc3eda3` | certain | In a sentence | `modules/public-landing/public/projects.html:1627` |
 | `4b4238c12e62` | certain | In this guild’s totals | `modules/public-landing/public/guild.html:212` |
 | `ba0c71b83a99` | certain | Install it on your repo ↗ | `modules/public-landing/public/projects.html:2110` |
@@ -2386,7 +2386,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1bc11853e893` | certain | On the map | `modules/public-landing/public/projects.html:1303` |
 | `b4ac8f44710c` | certain | On the public map | `modules/public-landing/public/projects.html:1225` |
 | `d7d88100f4a8` | certain | On this guild’s public page | `modules/public-landing/public/guild.html:204` |
-| `1fdda2903cf9` | certain | Once you have signed in to a project in your browser with your platform account and accepted these terms, your | `modules/public-landing/public/terms.html:116` |
+| `b43bc7940904` | certain | Once you have signed in with your platform account in your browser, here or to a project, and accepted these t | `modules/public-landing/public/terms.html:116` |
 | `be2e114ee93f` | certain | One fewer | `modules/public-landing/public/projects.html:1848` |
 | `84eccbf0c014` | certain | One fewer person | `modules/public-landing/public/projects.html:1579` |
 | `a8fa42b47d99` | certain | One hour less | `modules/public-landing/public/projects.html:1586` |
@@ -2560,7 +2560,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a954f0dce9a3` | certain | The platform | `modules/public-landing/public/contact.html:113` |
 | `82d751a27370` | certain | The platform first gives this project its own read-only deploy key and switches its deploys over to it, and on | `modules/public-landing/public/projects.html:1257` |
 | `4fd8f5746cc5` | certain | The platform is run as a non-profit, capture-resistant commons. | `modules/public-landing/public/terms.html:98` |
-| `768a6990ebfc` | certain | The platform stores the date you accepted these terms, and which version, on your account. It is written when  | `modules/public-landing/public/terms.html:118` |
+| `f4e546b36564` | certain | The platform stores the date you accepted these terms, and which version, on your account. It is written when  | `modules/public-landing/public/terms.html:118` |
 | `20fcebaa85c4` | certain | The project hub needs JavaScript — the map, your projects, and starting a new one all live here. You can read  | `modules/public-landing/public/projects.html:888` |
 | `4a740b5afe73` | certain | The project map | `modules/public-landing/public/projects.html:898` |
 | `d4e91fc9e8ce` | certain | The projects you build on, and leaving one, are on your account page. | `modules/public-landing/public/projects.html:1090` |

package/docs/copy-registry.json

@@ -21657,9 +21657,9 @@
       "confidence": "certain"
     },
     {
-      "id": "d37e2fbde8c6",
+      "id": "f11a5798d212",
       "surface": "landing",
-      "text": "If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.",
+      "text": "If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in that way.",
       "file": "modules/public-landing/public/terms.html",
       "line": 119,
       "origin": "html-text",
@@ -22431,9 +22431,9 @@
       "confidence": "certain"
     },
     {
-      "id": "1fdda2903cf9",
+      "id": "b43bc7940904",
       "surface": "landing",
-      "text": "Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.",
+      "text": "Once you have signed in with your platform account in your browser, here or to a project, and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in that way stays provisional and is published nowhere.",
       "file": "modules/public-landing/public/terms.html",
       "line": 116,
       "origin": "html-text",
@@ -23997,9 +23997,9 @@
       "confidence": "certain"
     },
     {
-      "id": "768a6990ebfc",
+      "id": "f4e546b36564",
       "surface": "landing",
-      "text": "The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once — signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub’s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version",
+      "text": "The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in with your platform account in your browser, here or to a project, and only once — signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub’s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in once in your browser. This is version",
       "file": "modules/public-landing/public/terms.html",
       "line": 118,
       "origin": "html-text",

package/docs/module-api-changelog.md

@@ -3231,5 +3231,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.23.5 with no explicit bump. run 40420658396. (task 1002620)
   1.23.7 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.23.6 with no explicit bump. run 40422218359. (task 1002620)
+  1.23.8 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.23.7 with no explicit bump. run 40425356400. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -5579,8 +5579,8 @@
       "surface": "landing",
       "title": "{{productName}} — Terms",
       "states_read": ["default"],
-      "files_hash": "43d9344847eeced2",
-      "reading_hash": "4c8c1d349a6a79c2",
+      "files_hash": "1a299c86554b3ec1",
+      "reading_hash": "fc023f0ba4f509c1",
       "counts": {"lines":46,"placed":31,"shared":10,"unplaced":5},
       "omitted": {"data":1},
       "notes": [],
@@ -5605,13 +5605,13 @@
         {"key":"L0018","section":"Your work across projects","text":"These numbers describe; they do not govern.","placement":"placed","file":"modules/public-landing/public/terms.html","line":115,"string_id":"02e596cc4569"},
         {"key":"L0019","section":"Your work across projects","text":"Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project’s own standing for you, as that project reported it — the platform holds no rank of its own.","placement":"placed","file":"modules/public-landing/public/terms.html","line":115,"string_id":"1e6d91f484e4"},
         {"key":"L0020","section":"Your work across projects","text":"What is public.","placement":"placed","file":"modules/public-landing/public/terms.html","line":116,"string_id":"9b3312899fb1"},
-        {"key":"L0021","section":"Your work across projects","text":"Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.","placement":"placed","file":"modules/public-landing/public/terms.html","line":116,"string_id":"1fdda2903cf9"},
+        {"key":"L0021","section":"Your work across projects","text":"Once you have signed in with your platform account in your browser, here or to a project, and accepted these terms, your profile and that record are public by default: at your handle’s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in that way stays provisional and is published nowhere.","placement":"placed","file":"modules/public-landing/public/terms.html","line":116,"string_id":"b43bc7940904"},
         {"key":"L0022","section":"Your work across projects","text":"What you control.","placement":"placed","file":"modules/public-landing/public/terms.html","line":117,"string_id":"6130dcb60532"},
         {"key":"L0023","section":"Your work across projects","text":"From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform’s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.","placement":"placed","file":"modules/public-landing/public/terms.html","line":117,"string_id":"0808df6e434c"},
         {"key":"L0024","section":"Your work across projects","text":"Your acceptance is recorded.","placement":"placed","file":"modules/public-landing/public/terms.html","line":118,"string_id":"0f06f7e72ea7"},
-        {"key":"L0025","section":"Your work across projects","text":"The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once — signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub’s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version","placement":"placed","file":"modules/public-landing/public/terms.html","line":118,"string_id":"768a6990ebfc"},
+        {"key":"L0025","section":"Your work across projects","text":"The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in with your platform account in your browser, here or to a project, and only once — signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub’s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in once in your browser. This is version","placement":"placed","file":"modules/public-landing/public/terms.html","line":118,"string_id":"f4e546b36564"},
         {"key":"L0026","section":"Your work across projects","text":"Accounts from before these terms.","placement":"placed","file":"modules/public-landing/public/terms.html","line":119,"string_id":"9b02ec8a2e21"},
-        {"key":"L0027","section":"Your work across projects","text":"If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.","placement":"placed","file":"modules/public-landing/public/terms.html","line":119,"string_id":"d37e2fbde8c6"},
+        {"key":"L0027","section":"Your work across projects","text":"If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in that way.","placement":"placed","file":"modules/public-landing/public/terms.html","line":119,"string_id":"f11a5798d212"},
         {"key":"L0028","section":"Fair use","text":"Fair use","placement":"placed","file":"modules/public-landing/public/terms.html","line":121,"string_id":"2585087f4873"},
         {"key":"L0029","section":"Fair use","text":"Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.","placement":"placed","file":"modules/public-landing/public/terms.html","line":122,"string_id":"8d812912c392"},
         {"key":"L0030","section":"Liability","text":"Liability","placement":"unplaced"},

package/modules/platform-identity/routes/sso.js

@@ -225,6 +225,13 @@ function registerSeams() {
       // when a founder ticks the create wizard's terms box. A READ of the constant only —
       // it stamps nothing on any account (that stays terms-acceptance.js's alone).
       termsVersion: () => terms.TERMS_VERSION,
+      // task 1003361 (ADR 0217 D3): the hub's OWN browser sign-in is the second place
+      // a human accepts the platform terms, beside /sso/authorize. Core passes the
+      // identity GitHub returned for the code it exchanged, never a request field,
+      // and `activate: true` is a source literal here exactly as it is there.
+      recordHubSignin: ({ githubId, githubLogin, displayName, avatarUrl }) => pi.upsertAccount({
+        githubId, githubLogin, displayName, avatarUrl, activate: true,
+      }, { pool }),
     });
   }
 }
@@ -307,8 +314,9 @@ module.exports = function ssoRoutes() {
 
     // A live hub session — record/refresh the platform account and mint a
     // single-use code bound to (client_id, github_id, redirect_uri).
-    // `activate: true` — this is THE consent upgrade path (ADR 0171 D3): a
-    // hub-session authorize is the one place a human is demonstrably at the hub,
+    // `activate: true` — a consent upgrade path (ADR 0171 D3): a hub-session
+    // authorize is a place a human is demonstrably at the hub (the hub's own web
+    // sign-in is the other, through recordHubSignin above — task 1003361),
     // so the account's profile_state lazily flips provisional → active here.
     try {
       await pi.upsertAccount({

package/modules/platform-identity/terms-acceptance.js

@@ -23,15 +23,16 @@
 // predicate, and deliberately does not match a write.
 //
 // WHY THE CALLER CANNOT FORGE ONE. These fragments have exactly one call site:
-// upsertAccount's `activate` branch, whose only caller is /sso/authorize
-// (routes/sso.js) — the leg a builder passes through when they use their platform
-// account to sign in to a PROJECT. Signing in to the hub itself does not reach it
-// and records nothing (blocker 1000124; task 1003361 adds that capture point),
-// which is why /terms names a project sign-in. There `activate: true` is a SOURCE LITERAL and every other
-// field comes from the hub's own resolved session — the ADR 0205 D3 property
-// established for recordFederatedSignin by task 1003340. No request-body field
-// reaches these statements, which is the whole point: an acceptance record a
-// caller could assert would be evidence of nothing.
+// upsertAccount's `activate` branch, which has two callers, both browser sign-ins
+// and both in routes/sso.js — /sso/authorize, the leg a builder passes through when
+// they use their platform account to sign in to a PROJECT, and the hub port's
+// recordHubSignin, which core calls from the hub's own web sign-in (task 1003361;
+// before it a hub-only builder was never stamped, blocker 1000124). In both
+// `activate: true` is a SOURCE LITERAL; the identity is the hub's own resolved
+// session on the first (the ADR 0205 D3 property established for
+// recordFederatedSignin by task 1003340) and GitHub's answer for the exchanged code
+// on the second. No request field reaches these statements, which is the whole
+// point: an acceptance record a caller could assert would be evidence of nothing.
 //
 // THE FIRST ACCEPTANCE A HUMAN GAVE STANDS. The conflict branch keeps an existing
 // acceptance (COALESCE), so a second sign-in never rewrites or duplicates one.
@@ -43,7 +44,7 @@
 // accounts that already existed were accepted on their owner's behalf, and the
 // record says so rather than passing that off as a sign-in. A grandfather is not
 // an acceptance its owner gave, so it is the one acceptance that does not
-// "stand": the owner's next project sign-in replaces it with their own. This file only
+// "stand": the owner's next browser sign-in replaces it with their own. This file only
 // ever READS the marker. tests/terms_acceptance.mjs holds both rules, and fails
 // any other server file that writes these columns or names the marker.
 //

package/modules/public-landing/public/terms.html

@@ -113,10 +113,10 @@
     <h2>Your work across projects</h2>
     <p>Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency}} you earned, the works you shipped, your karma, the rank that project gave you, the roles you worked in, and when you were last active. The platform adds these up across every project into one cross-project record. Projects report this themselves — the platform does not read their databases.</p>
     <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
-    <p><b>What is public.</b> Once you have signed in to a project in your browser with your platform account and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in to a project that way stays provisional and is published nowhere.</p>
+    <p><b>What is public.</b> Once you have signed in with your platform account in your browser, here or to a project, and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in that way stays provisional and is published nowhere.</p>
     <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
-    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once &mdash; signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub&rsquo;s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version <b>2026-08-29</b>.</p>
-    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in to a project in your browser.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in with your platform account in your browser, here or to a project, and only once &mdash; signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub&rsquo;s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in once in your browser. This is version <b>2026-08-29</b>.</p>
+    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in that way.</p>
     <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.7",
+  "version": "1.23.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.7",
+      "version": "1.23.8",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.7",
+  "version": "1.23.8",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10429,5 +10429,11 @@
       "id": "1004896",
       "text": "Builders can now take a module they installed from the store back off their project with one command; its folder is kept aside so nothing is lost."
     }
+  ],
+  "1.23.8": [
+    {
+      "id": "1003361",
+      "text": "Someone who signs in at cloudbongos.com and never joins a project now gets their profile published and can make connections, instead of staying invisible forever."
+    }
   ]
 }

package/src/bongos/auth-github.js

@@ -26,6 +26,7 @@ const seams = require('../module-seams');
 const { branding, userAgent } = require('../branding');
 const { firstTimeAdmissionBlocked, maybeSeatFirstAdmin, openEnrollmentEnabled, safeSyncRankRole } = require('./auth-admission.js');
 const { SCOPE, deviceFlows, loadGithubCreds, scopeForWebFlow } = require('./auth-config.js');
+const log = require('./logger').logger.child({ src: 'auth-github' });
 
 function newSessionToken() {
   return crypto.randomBytes(32).toString('hex');
@@ -240,6 +241,26 @@ async function pollDeviceFlow(deviceCode, userAgent) {
 // Web Flow (browser)
 // -------------------------------------------------------------------------
 
+// The hub's own browser sign-in records the platform terms acceptance (task 1003361,
+// ADR 0217 D3), so a builder who never joins a project is still published. Only the
+// hub provides the function, so every other instance skips it. The identity is
+// GitHub's answer for the exchanged code, never a request field. Best-effort: a
+// failed stamp must not cost the sign-in, and the next sign-in writes it.
+async function recordHubSignin(ghUser) {
+  try {
+    const hub = seams.resolveOptional('platform-identity.hub');
+    if (!hub || typeof hub.recordHubSignin !== 'function') return;
+    await hub.recordHubSignin({
+      githubId: String(ghUser.id),
+      githubLogin: ghUser.login,
+      displayName: ghUser.name || ghUser.login,
+      avatarUrl: ghUser.avatar_url,
+    });
+  } catch (err) {
+    log.error({ err: err && err.message }, 'hub sign-in terms acceptance not recorded');
+  }
+}
+
 function buildAuthorizeUrl(state, redirectUri, { repos = false, switchAccount = false } = {}) {
   const creds = loadGithubCreds();
   if (!creds) throw new Error('GitHub OAuth credentials not configured');
@@ -327,6 +348,7 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   });
   // V3.R75 (#294): tick the onboarding state machine. Best-effort.
   await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
+  await recordHubSignin(ghUser);
   // Wizard opt-in only (task 1002099 / ADR 0143): when the caller asked to capture
   // repo access, hand the GitHub access token + granted scope back so the web
   // callback can persist it (encrypted, short-TTL) for the repo picker/creator.

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.7'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.8'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/terms_acceptance.mjs

@@ -4,9 +4,10 @@
 // only thing that can say a human accepted the platform terms, it says so once,
 // and nothing publishes without it" (ADR 0213, task 1002913; the artifact ADR
 // 0141 §4 deferred cross-project-aggregation consent to and ADR 0171 D3 reserved
-// a place for). That sign-in is GET /sso/authorize — a builder using their
-// platform account to sign in to a PROJECT. Signing in to the hub itself stamps
-// nothing yet (blocker 1000124); task 1003361 adds it as a second capture point.
+// a place for). There are two such sign-ins, both in a browser: GET /sso/authorize
+// (a builder using their platform account to sign in to a PROJECT) and the hub's
+// own web sign-in (task 1003361 — before it, a builder who signed in only at the
+// hub was never stamped, so never published; blocker 1000124).
 //
 // WHY THIS EXISTS. An acceptance record is only worth the evidence behind it. If
 // a caller can assert one — a body field, a query param, a header — then the
@@ -22,13 +23,15 @@
 //      a claim about the platform must not ship inside a child project's page
 //      (task 1002748). Run through the real stripApexOnly, not asserted by eye.
 //
-//   2. THE CAPTURE POINT. The acceptance columns are written by exactly one
-//      statement, reached from exactly one route — /sso/authorize, where
-//      `activate: true` is a SOURCE LITERAL and every other field comes from the
-//      hub's own resolved session (the ADR 0205 D3 property task 1003340
-//      established for recordFederatedSignin). The test drives the REAL router
-//      over real HTTP with an attacker-controlled query string and body, and
-//      proves neither reaches the statement.
+//   2. THE CAPTURE POINTS. The acceptance columns are written by exactly one
+//      statement, reached from exactly two routes. /sso/authorize passes
+//      `activate: true` as a SOURCE LITERAL with every other field from the hub's
+//      own resolved session (the ADR 0205 D3 property task 1003340 established
+//      for recordFederatedSignin); the hub's /auth/web/callback reaches the same
+//      literal through the `platform-identity.hub` port with the identity GitHub
+//      returned for the exchanged code. The test drives BOTH real routes with an
+//      attacker-controlled query string, and proves nothing it carries reaches
+//      the statement.
 //
 //   3. IDEMPOTENCE, EXECUTED. The fake pool below is a real little
 //      platform_identity_accounts table plus an interpreter that reads the
@@ -117,23 +120,22 @@ t('the acceptance the page promises is the one the code actually keeps', () => {
     'and that it is written once — the property the COALESCE below actually provides');
 });
 
-// The capture point is GET /sso/authorize — reached when a builder uses their
-// platform account to sign in to a PROJECT, IN A BROWSER. Signing in to the hub
-// itself stamps nothing (blocker 1000124, task 1003353), so the page must not say
-// "here"; and the CLI's project sign-in (the device poll) stamps nothing either
-// (task 1004265, executed in §3), so the page must say "in your browser" and tell a
-// command-line builder why. Task 1003361 adds the hub's own sign-in as a second
-// capture point; when it lands, this wording and §3 below change together.
-t('the page names the sign-in the code actually watches — a project sign-in in the browser, not "here" (blocker 1000124)', () => {
+// The capture points are both BROWSER sign-ins with the platform account: the hub's
+// own (task 1003361) and a project's, through GET /sso/authorize — both executed in
+// §3. The page once named only the project sign-in, because the hub's recorded
+// nothing (blocker 1000124, task 1003353); now it names both. The CLI's sign-in (the
+// device poll) stamps nothing (task 1004265), so the page must still say "in your
+// browser" and tell a command-line builder why.
+t('the page names both sign-ins the code watches — a browser sign-in here or to a project (task 1003361)', () => {
   const section = termsHtml.slice(termsHtml.indexOf('Your work across projects'), termsHtml.indexOf('Fair use'));
-  assert.doesNotMatch(section, /sign(?:ed|ing)? in here/i,
-    'the page promises that signing in to this site records acceptance — the code never stamps that sign-in');
-  assert.match(section, /Once you have signed in to a project in your browser with your platform account and accepted these terms/,
-    'what makes a profile public must name the moment the code captures');
-  assert.match(section, /never signed in to a project that way stays provisional/,
-    'and the provisional case must be the same moment, negated');
-  assert.match(section, /written when you sign in to a project in your browser with your platform account, and only once/,
-    'the acceptance paragraph must name the same capture point');
+  assert.match(section, /Once you have signed in with your platform account in your browser, here or to a project, and accepted these terms/,
+    'what makes a profile public must name the moments the code captures');
+  assert.match(section, /never signed in that way stays provisional/,
+    'and the provisional case must be the same moments, negated');
+  assert.match(section, /written when you sign in with your platform account in your browser, here or to a project, and only once/,
+    'the acceptance paragraph must name the same capture points');
+  assert.doesNotMatch(section, /sign(?:ed)? in to a project in your browser/,
+    'the page still names only the project sign-in — since task 1003361 the hub’s own browser sign-in records it too');
   assert.doesNotMatch(section, /sign(?:ed)? in to a project with your platform account/,
     'an unqualified "project sign-in" also covers the command line, which records nothing (task 1004265)');
 });
@@ -151,7 +153,7 @@ t('the page says which acceptances were given on a builder’s behalf, and that
     'the owner chose to grandfather AND to say so on the page — the page must tell a pre-existing builder what was recorded for them');
   assert.match(termsHtml, /marks that acceptance as grandfathered/i,
     'and that the record keeps it distinguishable from one they gave');
-  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in to a project in your browser/i,
+  assert.match(termsHtml, /your own acceptance replaces it the next time you sign in that way/i,
     'and what happens when they do sign in — the conflict branch below really does replace it');
   assert.doesNotMatch(termsHtml, /written only by signing in/i,
     'the page still says acceptance is written ONLY by signing in, which is false for every grandfathered account');
@@ -382,6 +384,7 @@ function makePool() {
 const noopLog = { info() {}, warn() {}, error() {}, debug() {} };
 const moduleApiPath = require.resolve('../src/module-api.js');
 const helpers = require('../src/bongos/routes/_helpers.js');
+const seams = require('../src/module-seams.js');
 const pool = makePool();
 let SESSION = null;
 
@@ -394,8 +397,10 @@ require.cache[moduleApiPath] = {
     // session; nothing a caller sends can change what it returns here.
     resolveSession: async () => SESSION,
     logger: () => noopLog,
-    hasProvider: () => true,
-    registerProvider: () => {},
+    // The REAL switchboard, so the `platform-identity.hub` port sso.js registers is
+    // the one core's completeWebFlow resolves (the hub sign-in capture point, §3).
+    hasProvider: seams.hasProvider,
+    registerProvider: seams.registerProvider,
     on: () => () => {},
     resolveEnv: () => null,
     userAgent: () => 'cloud-bongos-tests',
@@ -445,7 +450,8 @@ const authorize = (qs = '') => request(
 );
 
 // ===========================================================================
-// 3. The capture point — the project sign-in leg (/sso/authorize), and nothing else
+// 3. The capture points — a browser sign-in to a project (/sso/authorize) or to
+//    the hub itself (/auth/web/callback), and nothing else
 // ===========================================================================
 
 console.log('\nthe capture point (only the hub can say a human accepted):');
@@ -610,6 +616,144 @@ await ta('a CLI-only builder who later signs in to a project in the browser IS s
   assert.equal(row.profile_state, 'active');
 });
 
+// ---- the second capture point: the hub's OWN browser sign-in (task 1003361) ----
+// Before it, a builder who signed in at the hub and never joined a project was never
+// stamped — so isAccountActive was false, their profile invisible everywhere and
+// their connections denied, for good (blocker 1000124). This drives the REAL
+// /auth/web/callback over the REAL completeWebFlow, which reaches the port sso.js
+// registered above. Only GitHub is stubbed, and the builders table is a small fake
+// on core's pool; the account write runs through the same interpreter as §3's.
+const corePool = require('../src/bongos/pool.js').pool;
+const { envPrefix } = require('../src/instance-config.js');
+process.env[`${envPrefix()}_GITHUB_CLIENT_ID`] = 'test-client';
+process.env[`${envPrefix()}_GITHUB_CLIENT_SECRET`] = 'test-secret';
+
+const HUB_ONLY = { id: 4343, login: 'hub-only', name: 'Hub Only', avatar_url: null };
+let hubBuilder = null; // the hub's own builders row for HUB_ONLY, or null for a stranger
+const pickBuilder = (list) => Object.fromEntries(list.split(',').map((c) => c.trim()).map((c) => [c, hubBuilder[c]]));
+corePool.query = async (sql) => {
+  if (/INSERT INTO builders\b/.test(sql)) return { rows: [pickBuilder(sql.split('RETURNING')[1])] };
+  if (/FROM builders WHERE github_id/.test(sql)) return { rows: hubBuilder ? [pickBuilder(sql.match(/SELECT([\s\S]*?)FROM/)[1])] : [] };
+  return { rows: [], rowCount: 0 }; // no invite, no session row to read back
+};
+globalThis.fetch = async (url) => {
+  if (String(url) === 'https://github.com/login/oauth/access_token') return { ok: true, json: async () => ({ access_token: 'gho_t', scope: 'read:user' }) };
+  if (String(url) === 'https://api.github.com/user') return { ok: true, json: async () => ({ ...HUB_ONLY }) };
+  throw new Error(`unexpected fetch in test: ${url}`);
+};
+
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+const webCallback = buildAuthRouter().stack
+  .find((l) => l.route?.path === '/auth/web/callback' && l.route.methods.get).route.stack[0].handle;
+async function hubSignIn(extraQuery = {}) {
+  const req = {
+    query: { ...extraQuery, state: 'st8', code: 'c0de' }, secure: false,
+    headers: { cookie: 'gds_oauth_state=st8', host: 'localhost', 'user-agent': 'test' },
+  };
+  const res = {
+    redirectedTo: null, statusCode: 200, cookies: {},
+    cookie(name, value) { this.cookies[name] = value; return this; },
+    clearCookie() { return this; },
+    redirect(to) { this.redirectedTo = to; },
+    status(code) { this.statusCode = code; return this; },
+    type() { return this; },
+    send() { return this; },
+  };
+  await webCallback(req, res);
+  return res;
+}
+const HUB_BUILDER = {
+  id: 91, github_id: '4343', github_login: 'hub-only', display_name: 'Hub Only', avatar_url: null,
+  total_credits: 0, created_at: new Date(0), rank: 'xenos', preferred_disciplines: null, status: 'active',
+};
+
+await ta('CONTROL: a hub-only builder’s browser sign-in records the acceptance, publishes them, and their connections resolve', async () => {
+  hubBuilder = HUB_BUILDER;
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  const res = await hubSignIn();
+  assert.ok(res.redirectedTo, `CONTROL: the sign-in must succeed (status ${res.statusCode}), or the stamp below proves nothing`);
+  const row = pool.accounts.get('4343');
+  assert.ok(row, 'the hub’s own sign-in wrote no platform account — the hub-only builder stays unpublished (blocker 1000124)');
+  assert.equal(row.terms_accepted_at, NOW, 'the hub’s own browser sign-in did not stamp the acceptance');
+  assert.equal(row.terms_version, TERMS_VERSION);
+  assert.equal(row.terms_accepted_source, 'signin', 'a hub sign-in is a sign-in, not a grandfather');
+  assert.equal(row.profile_state, 'active');
+  assert.ok(isAccountActive(row), 'connections floor on consent — a hub-only builder must now pass it');
+  assert.ok(isAccountVisible(row), 'and their public profile must exist');
+});
+
+await ta('the hub sign-in’s acceptance cannot be forged — only GitHub’s identity for the code reaches the statement', async () => {
+  hubBuilder = HUB_BUILDER;
+  pool.accounts.clear();
+  pool.calls.length = 0;
+  pool.setClock(NOW);
+  const res = await hubSignIn({
+    terms_accepted_at: '1999-01-01T00:00:00.000Z', terms_version: 'FORGED', activate: 'true',
+    terms_accepted_source: 'grandfathered', profile_state: 'active', github_id: '9999', login: 'evil-login',
+  });
+  assert.ok(res.redirectedTo, 'CONTROL: the sign-in must succeed');
+  assert.deepEqual([...pool.accounts.keys()], ['4343'], 'an account other than the one GitHub vouched for was written');
+  const upserts = pool.calls.filter((c) => /INSERT INTO platform_identity_accounts/i.test(c.sql) && /DO UPDATE/i.test(c.sql));
+  assert.equal(upserts.length, 1, `expected exactly one account upsert, got ${upserts.length}`);
+  const [p] = upserts.map((c) => c.params);
+  assert.equal(p.length, 6, 'the statement grew a parameter — every one must come from GitHub or a constant');
+  assert.equal(String(p[0]), '4343', 'the account id must be GitHub’s answer for the exchanged code');
+  assert.equal(p[1], 'hub-only', 'and so must the login');
+  assert.equal(p[4], true, 'activate must be the source literal the port passes');
+  assert.equal(p[5], TERMS_VERSION, 'the version must be the server constant');
+  assert.doesNotMatch(JSON.stringify(p), /FORGED|1999|9999|evil-login|grandfathered/, 'a caller-controlled value was bound into the acceptance statement');
+});
+
+await ta('signing in at the hub again keeps the first acceptance date', async () => {
+  hubBuilder = HUB_BUILDER;
+  pool.accounts.clear();
+  pool.setClock(NOW);
+  await hubSignIn();
+  pool.setClock(LATER);
+  await hubSignIn();
+  assert.equal(pool.accounts.get('4343').terms_accepted_at, NOW, 'a second hub sign-in restamped the acceptance');
+});
+
+await ta('a sign-in the admission gate refuses records no acceptance', async () => {
+  hubBuilder = null; // a stranger with no invite
+  pool.accounts.clear();
+  const res = await hubSignIn();
+  assert.equal(res.redirectedTo, null, 'CONTROL: the gate must refuse this sign-in');
+  assert.equal(pool.accounts.size, 0, 'a refused sign-in recorded a platform T&C acceptance');
+});
+
+await ta('a failed acceptance write never fails the hub sign-in — the next sign-in records it', async () => {
+  hubBuilder = HUB_BUILDER;
+  pool.accounts.clear();
+  const realQuery = pool.query;
+  pool.query = async (text, params) => {
+    if (/INSERT INTO platform_identity_accounts/i.test(String(text))) throw new Error('db down');
+    return realQuery(text, params);
+  };
+  try {
+    const res = await hubSignIn();
+    assert.ok(res.redirectedTo, 'a failed acceptance write turned a good sign-in into an error');
+    assert.equal(pool.accounts.size, 0);
+  } finally { pool.query = realQuery; }
+  await hubSignIn();
+  assert.ok(pool.accounts.get('4343')?.terms_accepted_at, 'the next sign-in did not record it');
+});
+
+await ta('an instance without the hub function (every child project) signs in exactly as before and writes no account', async () => {
+  hubBuilder = HUB_BUILDER;
+  pool.accounts.clear();
+  const hub = seams.resolveOptional('platform-identity.hub');
+  assert.equal(typeof hub?.recordHubSignin, 'function', 'CONTROL: the hub port must carry recordHubSignin');
+  const saved = hub.recordHubSignin;
+  delete hub.recordHubSignin;
+  try {
+    const res = await hubSignIn();
+    assert.ok(res.redirectedTo, 'a sign-in without the hub function must still succeed');
+    assert.equal(pool.accounts.size, 0, 'an instance without the hub function wrote a platform account');
+  } finally { hub.recordHubSignin = saved; }
+});
+
 // ===========================================================================
 // 4. Idempotence — executed, not asserted against a string
 // ===========================================================================