@bongos/core 1.23.9 → 1.23.10

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.9",
+  "version": "1.23.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.9",
+      "version": "1.23.10",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.9",
+  "version": "1.23.10",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10441,5 +10441,11 @@
       "id": "1004897",
       "text": "The record of this session's work on goal 1000110 is written down for the next person who picks it up."
     }
+  ],
+  "1.23.10": [
+    {
+      "id": "1003363",
+      "text": "cloudbongos.com now has a Community menu: a leaderboard of builders across every project (by week, month, year or all time, and by craft), a search for builders by name, and, for project owners, a list of builders who keep the"
+    }
   ]
 }

package/src/bongos/serve-internal.js

@@ -1005,8 +1005,10 @@ function mountInternalSurfaces(app) {
   // /people itself (owner call, 2026-09-25 — ADR 0337 D5): cross-project
   // discovery belongs to the hub, and /roster is the hall's directory. Both URLs
   // survive as redirects to /roster so a bookmark lands somewhere instead of a
-  // 404. 302, not 301: /roster is interim until the hub community page (task
-  // 1003363) ships, and a browser caches a 301 past any re-point. No page gate:
+  // 404. They stay on /roster now the hub's community pages exist (task 1003363):
+  // each hall is its own instance and only the hub serves /community, so a child
+  // hall has nowhere else to send them. 302, not 301, so a re-point is never
+  // stuck in a browser cache. No page gate:
   // the redirect discloses nothing, and /roster is deliberately public.
   // GET /scouting's own gate (platform-identity) is untouched by this.
   const RETIRED_DIRECTORY_RE = /^\/builders\/(?:people|scouting)(?:\.html)?\/?$/;

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.9'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.10'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -337,6 +337,17 @@ function buildPlatformApp() {
     if (!html) return next();
     res.type('html').send(html);
   });
+  // THE COMMUNITY PAGES (task 1003363, ADR 0217 D1, ADR 0337 D1/D3): who is building
+  // across every project — the leaderboard, the builder search (the same for every
+  // viewer) and the recruiter list GET /scouting's own door admits. One file serves all
+  // three; its script shows the one the path names. Hub-only for the /account reason:
+  // every read it makes is a platform-identity route.
+  app.get(['/community', '/community/find', '/community/recruiters'], (req, res, next) => {
+    if (!isApexHost(req) || !isModuleEnabled('platform-identity')) return next();
+    const html = landingPage('community.html');
+    if (!html) return next();
+    res.type('html').send(html);
+  });
   // THE GUILD PAGE (task 1002301, R25; ADR 0336 D4/D6): /g/<slug>, the namespace
   // D6 reserved. Hub-only for the /account reason — every read it makes is a
   // platform-identity route. ONE shell for every slug: the page reads the public

package/tests/hub_account_page.mjs

@@ -135,6 +135,8 @@ test('the bands say what the hub’s say and lead into /projects; Account is the
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProjects')), [
     ['Sky', '/projects?view=map'], ['Table', '/projects?view=map&sub=table'],
     ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
+    // the Community menu's three sub-pages, folded into the band under 480px (task 1003363)
+    ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
   ], 'this page has no views of its own, so every item names /projects in full');
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProfile')), [
     ['My projects', '/projects?view=mine'], ['Invitations', '/invitations'], ['Connections', '/connections'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],

package/tests/hub_community_page.mjs

@@ -0,0 +1,475 @@
+// tests/hub_community_page.mjs — the hub's community pages (task 1003363; ADR 0217 D1,
+// ADR 0337 D1/D3/D4.1, docs/specs/bongos-v1-community-tab.md D1/D3/D4/D8).
+//
+// One file served as three sub-pages of the bar's Community menu (owner, 2026-10-27):
+// /community the leaderboard, /community/find the builder search, /community/recruiters
+// the name-only list of hidden builders open to recruiters. They render three existing
+// platform-identity reads and add no rule of their own. What this file pins:
+//   • the markup: the hub's bar with the Community menu as the current section, no top
+//     block, noindex, dark only, the routes' own windows and query limits
+//   • viewing is ungated: the leaderboard and the search read the same routes for every
+//     viewer, and nothing on them asks who is signed in
+//   • the page RUN in a vm, once per sub-page: the path picks the section and the menu
+//     item marked current; the board in the server's order with its `place`, the window
+//     dropdown and the crafts, the empty, failed and rate-limited board; the search and
+//     its refusals; the recruiter list as a door signed out, a refusal on a 403, and rows
+//     only from a 200 — name, face and login, never the ranked half's numbers
+//   • the Community menu on every page that wears the hub's bar (apex-only where the page
+//     also serves a child), folded into the Projects band on phones
+//   • the routes: the three paths served on the hub's apex only
+//   • the kit: the states files, and the stub answering as the three reads do
+//
+// DB-free. Run:  node --test tests/hub_community_page.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const PI = path.join(ROOT, 'modules', 'platform-identity');
+const read = (f) => fs.readFileSync(path.join(LANDING, f), 'utf8').replace(/\r\n/g, '\n');
+const PAGE = read('community.html');
+const SCRIPT = PAGE.split('<script>').pop().split('</script>')[0];
+// the code alone: the comments name what they rule out
+const CODE = SCRIPT.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+const STYLE = PAGE.split('<style>')[1].split('</style>')[0].replace(/\/\*[\s\S]*?\*\//g, '');
+const MAIN = PAGE.split('<main class="acct" id="comm">')[1].split('</main>')[0];
+const BOARD_JS = fs.readFileSync(path.join(PI, 'community-leaderboard.js'), 'utf8');
+const SEARCH_JS = fs.readFileSync(path.join(PI, 'builder-search.js'), 'utf8');
+const SUBPAGES = [['/community', 'Leaderboard'], ['/community/find', 'Find a builder'], ['/community/recruiters', 'Open to recruiters']];
+
+// ── 1. the markup ────────────────────────────────────────────────────────────
+
+test('the pages wear the hub’s bar with the Community menu as the current section; dark only, no page :root, not indexed', () => {
+  assert.match(PAGE, /<html lang="en" data-mode="dark">/);
+  assert.match(PAGE, /<meta name="robots" content="noindex">/, 'public, but kept out of search until the SEO goal decides (owner, 2026-10-27)');
+  assert.match(PAGE, /<title>\{\{productName\}\} — Community<\/title>/);
+  assert.match(PAGE, /<link rel="stylesheet" href="\/assets\/cosmos\.css">/);
+  assert.match(PAGE, /<script src="\/assets\/hub-bar\.js"><\/script>/);
+  assert.match(PAGE, /<script src="\/assets\/invite-badge\.js"><\/script>/);
+  assert.doesNotMatch(STYLE, /:root/, 'the pack’s injected theme owns the tokens');
+  assert.doesNotMatch(STYLE, /#[0-9a-fA-F]{3,8}\b/, 'every colour is a token or a mix of one');
+  assert.match(PAGE, /<button class="trig commTrig" type="button" id="commTrig" data-menu="community" aria-expanded="false" aria-controls="menuCommunity" aria-current="true">Community<svg class="cv"/);
+  assert.deepEqual(PAGE.match(/aria-current="page"/g), null, 'which sub-page is current is the script’s, from the path');
+  assert.match(PAGE, /<a class="skip vh" href="#comm">Skip to content<\/a>/);
+  assert.equal((PAGE.match(/<!--apex-only:start-->/g) || []).length, 1, 'hub-only: the footer’s platform sentence is the one apex-only region');
+  assert.ok(PAGE.indexOf('<!--apex-only:start-->') > PAGE.indexOf('<footer class="foot">'));
+});
+
+test('the bar and bands are /connections’ but for the sign-in return and the current section', () => {
+  const bar = (html) => html.slice(html.indexOf('<header class="shell bar">'), html.indexOf('<main '))
+    .replace(/return=\/\w+&amp;/g, 'return=X&amp;').replace(/ aria-current="(page|true)"/g, '');
+  assert.equal(bar(PAGE), bar(read('connections.html')));
+});
+
+test('no top block: one visually hidden h1, then one section per sub-page, only the leaderboard shown in the markup', () => {
+  assert.match(MAIN, /^\s*<h1 class="vh">Community<\/h1>\s*(<!--[\s\S]*?-->\s*)?<div class="mineExtra">/, 'nothing is drawn above the first section (the /design floor)');
+  const order = ['<section id="board" data-view="leaderboard" aria-labelledby="boardH">', '<section id="find" data-view="find" aria-labelledby="findH" hidden>', '<section id="recruit" data-view="recruiters" aria-labelledby="recruitH" hidden>'].map((s) => MAIN.indexOf(s));
+  assert.ok(order.every((i) => i > 0), 'every sub-page is real markup the script only shows');
+  assert.deepEqual([...order].sort((a, b) => a - b), order);
+  assert.match(MAIN, /<ol class="commRows" id="boardList" data-unit="\{\{currency\}\}" aria-labelledby="boardH"><\/ol>/, 'the unit is the instance’s own word, stamped by the server');
+  assert.match(MAIN, /<p class="projMsg err" id="boardFailed" role="alert" hidden><\/p>/);
+  assert.match(MAIN, /<form class="mineJoinRow commFind" id="findForm" role="search"/);
+  assert.match(MAIN, /<h2 id="recruitH">Open to recruiters<\/h2>/, 'the hide flag is "hidden", never "private" (ADR 0337)');
+  assert.match(MAIN, /<a class="btn" id="recruitSignin" href="\/api\/bongos\/auth\/web\/start\?return=\/community\/recruiters&amp;repos=1">/);
+  for (const id of ['recruitDoor', 'recruitClosed', 'recruitFailed', 'recruitEmpty']) assert.match(MAIN, new RegExp(` id="${id}"[^>]*hidden`), `${id} waits for the route’s answer`);
+});
+
+test('the window dropdown and the query limits are the routes’ own (boundary-forced copies)', () => {
+  const days = BOARD_JS.match(/const WINDOW_DAYS = Object\.freeze\(\{([^}]*)\}\);/);
+  const windows = [...days[1].matchAll(/'?(\w+)'?:/g)].map((m) => m[1]);
+  assert.deepEqual(windows, ['7d', '30d', '365d', 'all']);
+  assert.match(SCRIPT, new RegExp(`var WINDOWS = \\[${windows.map((w) => `'${w}'`).join(', ')}\\];`));
+  const select = MAIN.split('<select id="boardWindow">')[1].split('</select>')[0];
+  assert.deepEqual([...select.matchAll(/<option value="([^"]+)"/g)].map((m) => m[1]), windows, 'one option per window, in the route’s order');
+  assert.match(BOARD_JS, /const DEFAULT_WINDOW = 'all';/);
+  assert.match(select, /<option value="all" selected>All time<\/option>/, 'the page opens on the route’s default window');
+  assert.match(MAIN, /<label class="vh" for="boardWindow">/, 'the dropdown is labelled');
+  const min = SEARCH_JS.match(/const MIN_QUERY_CHARS = (\d+);/)[1];
+  const max = SEARCH_JS.match(/const MAX_QUERY_CHARS = (\d+);/)[1];
+  assert.match(SCRIPT, new RegExp(`var QUERY_MIN = ${min};`));
+  assert.match(SCRIPT, new RegExp(`var QUERY_MAX = ${max};`));
+  assert.match(MAIN, new RegExp(`<input id="findQ" type="search"[^>]* maxlength="${max}"`));
+});
+
+test('the script builds no markup from strings, reads only the three routes, and never re-ranks or reads the ranked tier', () => {
+  assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
+  // every path literal in the code: the API base, the three reads, the three sub-pages and the sign-in door
+  const paths = [...new Set([...CODE.matchAll(/'(\/[^'?]*)/g)].map((m) => m[1]))];
+  assert.deepEqual(paths.sort(), ['/api/bongos', '/api/bongos/auth/web/start', '/community', '/community/find', '/community/leaderboard', '/community/recruiters', '/community/search', '/scouting']);
+  assert.doesNotMatch(CODE, /method:/, 'it only reads');
+  assert.doesNotMatch(CODE, /'\/me\b/, 'who is signed in is the bar’s question');
+  assert.doesNotMatch(CODE, /\.sort\(|\.count\b|_count\b/, 'the server ranks; every count is a list’s length');
+  assert.doesNotMatch(CODE, /\.builders\b|total_credits|total_tasks_shipped|project_count/, 'the directory’s ranked half is never drawn here');
+  assert.doesNotMatch(CODE, /\brank\b/, '`place` is a position on the board, never a builder rank');
+});
+
+// ── 2. the pages, run ────────────────────────────────────────────────────────
+
+function attrsOf(tag) {
+  const out = {};
+  for (const m of tag.matchAll(/ ([\w-]+)(?:="([^"]*)")?/g)) out[m[1]] = m[2] === undefined ? '' : m[2];
+  return out;
+}
+function el(tag, attrs = {}) {
+  const n = { tag, children: [], _text: '', className: attrs.class || '', hidden: 'hidden' in attrs, disabled: false, value: attrs.value || '', attrs: { ...attrs }, _on: {}, parent: null };
+  Object.defineProperty(n, 'textContent', {
+    get() { return n._text + n.children.map((c) => c.textContent).join(''); },
+    set(v) { n._text = String(v); n.children = []; },
+  });
+  n.appendChild = (c) => { c.parent = n; n.children.push(c); return c; };
+  n.setAttribute = (k, v) => { n.attrs[k] = String(v); };
+  n.getAttribute = (k) => (k in n.attrs ? n.attrs[k] : null);
+  n.addEventListener = (t, f) => { (n._on[t] ||= []).push(f); };
+  n.querySelectorAll = (sel) => (sel === '.commTab' ? n.children.filter((c) => /\bcommTab\b/.test(c.className)) : []);
+  n.closest = (sel) => { const a = (sel.match(/^\[([\w-]+)\]$/) || [])[1]; return a && a in n.attrs ? n : null; };
+  return n;
+}
+const settle = async () => { for (let i = 0; i < 60; i++) await Promise.resolve(); };
+const kids = (n) => n.children;
+const find = (n, cls) => {
+  for (const c of n.children) {
+    if (String(c.className).split(' ').includes(cls)) return c;
+    const d = find(c, cls);
+    if (d) return d;
+  }
+  return null;
+};
+
+const ROW = (place, handle, credits, extra = {}) => ({ place, handle, github_login: handle, display_name: handle.toUpperCase(), avatar_url: `https://avatars.example/${handle}`, credits, tasks_shipped: 2, karma: 1, disciplines: ['engineer'], ...extra });
+const READS = () => ({
+  '/community/leaderboard?window=all': { status: 200, body: { window: 'all', count: 99, results: [ROW(26, 'ana', 1200), ROW(27, 'bo', 1500, { tasks_shipped: 1, karma: 0, avatar_url: 'javascript:alert(1)', display_name: null })] } },
+  '/community/leaderboard?window=30d': { status: 200, body: { window: '30d', results: [ROW(1, 'cy', 40)] } },
+  '/community/leaderboard?window=all&discipline=artist': { status: 200, body: { window: 'all', results: [] } },
+  '/community/search?q=pri': { status: 200, body: { results: [{ handle: 'priya', github_login: 'priyan', display_name: 'Priya', avatar_url: null, disciplines: ['engineer', 'ui'] }, { handle: 'pri-hidden', github_login: 'ph', display_name: 'Pri <b>H</b>', avatar_url: null, disciplines: null }] } },
+  '/community/search?q=pri&discipline=artist': { status: 200, body: { results: [] } },
+  '/scouting': { status: 403, body: { error: { code: 'forbidden' } } },
+});
+
+async function boot({ pathname = '/community', me = null, reads = READS() } = {}) {
+  const ids = new Map();
+  for (const m of PAGE.matchAll(/<(\w+)([^>]* id="([^"]+)"[^>]*)>/g)) {
+    const attrs = attrsOf(m[2]);
+    if (attrs['data-unit']) attrs['data-unit'] = 'credits';
+    const n = el(m[1], attrs);
+    n.id = m[3];
+    if (m[1] === 'select') n.value = (PAGE.split(m[0])[1].split('</select>')[0].match(/<option value="([^"]*)" selected>/) || [, ''])[1];
+    ids.set(m[3], n);
+  }
+  const body = PAGE.split('id="craftTabs"')[1].split('</div>')[0];
+  for (const b of body.matchAll(/<button([^>]*)>([^<]+)<\/button>/g)) { const n = el('button', attrsOf(b[1])); n.textContent = b[2]; ids.get('craftTabs').appendChild(n); }
+  // every menu link, so the script can mark the sub-page's items current
+  const anchors = [...PAGE.matchAll(/<a class="bandT" href="([^"]+)"[^>]*>([^<]+)<\/a>/g)].map((m) => { const n = el('a', { href: m[1] }); n.textContent = m[2]; return n; });
+  const requests = [];
+  const fetch = (url, init = {}) => {
+    requests.push({ url, credentials: init.credentials });
+    const a = reads[url.replace(/^\/api\/bongos/, '')];
+    if (!a || a.reject) return Promise.reject(new Error('offline'));
+    return Promise.resolve({ ok: a.status >= 200 && a.status < 300, status: a.status, json: () => Promise.resolve(a.body) });
+  };
+  const document = {
+    title: 'Cloud Bongos — Community',
+    getElementById: (id) => ids.get(id) || null,
+    createElement: (t) => el(t),
+    querySelectorAll: (sel) => { const h = (sel.match(/^a\[href="([^"]+)"\]$/) || [])[1]; return anchors.filter((a) => a.attrs.href === h); },
+  };
+  const window = { HubBar: { paint: () => {}, ready: Promise.resolve(me) }, location: { pathname } };
+  const sandbox = { window, document, fetch, console, Promise, JSON, String, Object, Array, URL, Number, isFinite, encodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(SCRIPT, sandbox, { filename: 'community.html' });
+  await settle();
+  const tab = (value) => kids(ids.get('craftTabs')).find((b) => b.attrs['data-craft'] === value);
+  const craft = async (value) => { for (const f of ids.get('craftTabs')._on.click || []) f({ target: tab(value) }); await settle(); };
+  const pick = async (value) => { ids.get('boardWindow').value = value; for (const f of ids.get('boardWindow')._on.change || []) f({}); await settle(); };
+  const submit = async () => { const e = { preventDefault() { e.prevented = true; } }; for (const f of ids.get('findForm')._on.submit || []) f(e); await settle(); return e; };
+  const current = () => anchors.filter((a) => a.attrs['aria-current'] === 'page').map((a) => a.attrs.href);
+  return { ids, requests, document, gets: () => requests.map((r) => r.url), tab, craft, pick, submit, current, $: (id) => ids.get(id) };
+}
+
+test('each path shows its one section, marks its menu items current and names itself; any other shape is the leaderboard', async () => {
+  for (const [pathname, title, section] of [['/community', 'Leaderboard', 'board'], ['/community/', 'Leaderboard', 'board'], ['/community/find', 'Find a builder', 'find'], ['/community/recruiters/', 'Open to recruiters', 'recruit']]) {
+    const ui = await boot({ pathname });
+    assert.deepEqual(['board', 'find', 'recruit'].filter((s) => !ui.$(s).hidden), [section], `${pathname}: one section`);
+    const href = SUBPAGES.find(([, t]) => t === title)[0];
+    assert.deepEqual(ui.current(), [href, href], `${pathname}: its Community item and its folded twin in the Projects band`);
+    assert.equal(ui.document.title, `Cloud Bongos — Community · ${title}`);
+    assert.equal(ui.$('signinTop').attrs.href, `/api/bongos/auth/web/start?return=${href}&repos=1`, 'signing in comes back to this sub-page');
+  }
+});
+
+test('the leaderboard, signed out: the all-time board in the server’s order with the server’s places, and nothing asked about the viewer', async () => {
+  const ui = await boot();
+  assert.deepEqual(ui.gets(), ['/api/bongos/community/leaderboard?window=all']);
+  assert.ok(ui.requests.every((r) => r.credentials === 'same-origin'));
+  assert.equal(ui.$('boardLoading').hidden, true);
+  assert.equal(ui.$('boardFailed').hidden, true);
+  assert.equal(ui.$('boardEmpty').hidden, true);
+  const [ana, bo] = kids(ui.$('boardList'));
+  assert.deepEqual([find(ana, 'commPlace').textContent, find(bo, 'commPlace').textContent], ['26', '27'], 'the place is the server’s, never renumbered');
+  assert.equal(find(ana, 'mineRow__name').textContent, 'ANA');
+  assert.equal(find(ana, 'mineRow__host').textContent, '@ana');
+  assert.equal(find(ana, 'commNum').textContent, (1200).toLocaleString());
+  assert.equal(find(ana, 'commUnit').textContent, 'credits');
+  assert.equal(find(ana, 'mineRow__hint').textContent, '2 works shipped · 1 karma');
+  assert.equal(find(bo, 'commNum').textContent, (1500).toLocaleString(), 'a higher number below stays below: the server ranked it');
+  assert.equal(find(bo, 'mineRow__name').textContent, 'bo', 'no display name: the handle stands in');
+  assert.equal(find(bo, 'connAv').tag, 'span', 'an avatar that is not http(s) is never loaded');
+  assert.equal(find(bo, 'mineRow__hint').textContent, '1 work shipped · 0 karma');
+  assert.equal(ui.$('boardNote').textContent, 'Credits earned across every project, since each builder started.');
+  const signedIn = await boot({ me: { github_login: 'someone' } });
+  assert.deepEqual(signedIn.gets(), ['/api/bongos/community/leaderboard?window=all'], 'signed in, the same one read: viewing is ungated');
+});
+
+test('the window dropdown and a craft are each one read; the pressed craft follows the pick', async () => {
+  const ui = await boot();
+  await ui.pick('30d');
+  assert.equal(ui.gets().pop(), '/api/bongos/community/leaderboard?window=30d');
+  assert.equal(ui.$('boardWindow').value, '30d');
+  assert.equal(ui.$('boardNote').textContent, 'Credits earned in the last 30 days, across every project.');
+  assert.deepEqual(kids(ui.$('boardList')).map((r) => find(r, 'mineRow__host').textContent), ['@cy']);
+  const before = ui.requests.length;
+  await ui.pick('30d');
+  assert.equal(ui.requests.length, before, 'picking the window already shown reads nothing');
+  await ui.pick('1d');
+  assert.equal(ui.requests.length, before, 'a window the route does not know is never asked for');
+  await ui.pick('all');
+  await ui.craft('artist');
+  assert.equal(ui.gets().pop(), '/api/bongos/community/leaderboard?window=all&discipline=artist');
+  assert.equal(ui.tab('artist').attrs['aria-pressed'], 'true');
+  assert.equal(ui.tab('').attrs['aria-pressed'], 'false');
+  assert.equal(ui.$('boardEmpty').hidden, false);
+  assert.equal(ui.$('boardEmpty').textContent, 'No artists on the leaderboard yet.');
+  assert.equal(kids(ui.$('boardList')).length, 0);
+});
+
+test('a failed board is an alert, never an empty board; a rate limit says to wait', async () => {
+  const reads = READS();
+  reads['/community/leaderboard?window=all'] = { status: 500, body: {} };
+  const failed = await boot({ reads });
+  assert.equal(failed.$('boardFailed').hidden, false);
+  assert.equal(failed.$('boardFailed').textContent, 'The leaderboard could not be read. Reload the page to try again.');
+  assert.equal(failed.$('boardEmpty').hidden, true, 'a failure never reads as nobody on the board');
+  reads['/community/leaderboard?window=all'] = { status: 429, body: { error: { code: 'rate_limited' } } };
+  assert.match((await boot({ reads })).$('boardFailed').textContent, /^Too many requests from your network just now\./);
+  reads['/community/leaderboard?window=all'] = { reject: true };
+  assert.equal((await boot({ reads })).$('boardFailed').hidden, false, 'offline is a failure too');
+});
+
+test('find: nothing read on arrival; too short is refused before any read; a hidden builder is found by name with no craft line', async () => {
+  const ui = await boot({ pathname: '/community/find' });
+  assert.deepEqual(ui.requests, [], 'the search page reads nothing until asked');
+  ui.$('findQ').value = ' p ';
+  const e = await ui.submit();
+  assert.ok(e.prevented, 'the form never navigates');
+  assert.deepEqual(ui.requests, []);
+  assert.equal(ui.$('findStatus').textContent, 'Type at least 2 letters of a name.');
+  ui.$('findQ').value = 'pri';
+  await ui.submit();
+  assert.equal(ui.gets().pop(), '/api/bongos/community/search?q=pri');
+  assert.equal(ui.$('findStatus').textContent, '2 builders found.');
+  const [priya, hidden] = kids(ui.$('findList'));
+  assert.equal(find(priya, 'mineRow__hint').textContent, 'engineer · designer');
+  assert.equal(find(hidden, 'mineRow__name').textContent, 'Pri <b>H</b>', 'textContent: a name is never markup');
+  assert.equal(find(hidden, 'mineRow__hint'), null, 'disciplines null (hidden numbers): nothing said about their craft');
+  assert.equal(ui.$('findBtn').disabled, false);
+  ui.$('findCraft').value = 'artist';
+  await ui.submit();
+  assert.equal(ui.gets().pop(), '/api/bongos/community/search?q=pri&discipline=artist');
+  assert.equal(ui.$('findStatus').textContent, 'No builder by that name in that role.');
+  assert.equal(kids(ui.$('findList')).length, 0);
+});
+
+test('recruiters: a door signed out, a refusal on a 403, rows only from a 200 as name, face and login', async () => {
+  const at = '/community/recruiters';
+  const shown = (ui) => ['recruitLoading', 'recruitDoor', 'recruitClosed', 'recruitFailed', 'recruitEmpty'].filter((s) => !ui.$(s).hidden);
+  const out = await boot({ pathname: at });
+  assert.deepEqual(out.requests, [], 'signed out, the door is not even asked');
+  assert.deepEqual(shown(out), ['recruitDoor']);
+  const refused = await boot({ pathname: at, me: { github_login: 'someone' } });
+  assert.deepEqual(refused.gets(), ['/api/bongos/scouting'], 'signed in: the route’s door decides, and the board is not read here');
+  assert.deepEqual(shown(refused), ['recruitClosed'], 'a viewer the door does not admit is told it is for project owners');
+  assert.equal(kids(refused.$('recruitList')).length, 0);
+  const reads = READS();
+  reads['/scouting'] = { status: 200, body: {
+    builders: [{ github_id: '9', github_login: 'ranked', display_name: 'Ranked One', total_credits: 777777, total_tasks_shipped: 4242 }],
+    name_only: [{ github_login: 'kemi-a', display_name: 'Kemi', avatar_url: 'https://avatars.example/k' }, { github_login: 'yuki-t', display_name: null, avatar_url: null }],
+  } };
+  const admitted = await boot({ pathname: at, me: { github_login: 'owner' }, reads });
+  assert.deepEqual(shown(admitted), []);
+  const [kemi, yuki] = kids(admitted.$('recruitList'));
+  assert.equal(find(kemi, 'mineRow__name').textContent, 'Kemi');
+  assert.equal(find(kemi, 'mineRow__host').textContent, 'GitHub: kemi-a');
+  assert.equal(find(yuki, 'mineRow__name').textContent, 'yuki-t');
+  assert.equal(find(kemi, 'mineRow__hint'), null, 'no numbers, no crafts: the name-only tier is a name');
+  assert.doesNotMatch(admitted.$('recruitList').textContent, /Ranked One|777|4242/, 'the ranked half is never drawn');
+  reads['/scouting'] = { status: 200, body: { builders: [], name_only: [] } };
+  assert.deepEqual(shown(await boot({ pathname: at, me: { github_login: 'owner' }, reads })), ['recruitEmpty']);
+  reads['/scouting'] = { status: 401, body: {} };
+  assert.deepEqual(shown(await boot({ pathname: at, me: { github_login: 'stale' }, reads })), ['recruitDoor'], 'an expired session is a door');
+  reads['/scouting'] = { status: 500, body: {} };
+  const failed = await boot({ pathname: at, me: { github_login: 'owner' }, reads });
+  assert.deepEqual(shown(failed), ['recruitFailed']);
+  assert.equal(failed.$('recruitFailed').textContent, 'This list could not be read. Reload the page to try again.');
+});
+
+// ── 3. every bar carries the Community menu ──────────────────────────────────
+
+const SERVES_A_CHILD = ['privacy.html', 'terms.html', 'contact.html', 'index.html', 'projects.html'];
+const HUB_ONLY = ['account.html', 'connections.html', 'invitations.html', 'guild.html', 'community.html'];
+const wrap = (apex, s) => (apex ? `<!--apex-only:start-->${s}<!--apex-only:end-->` : s);
+const ITEMS = [
+  ['/community', 'Leaderboard', 'who earned the most, across every project'],
+  ['/community/find', 'Find a builder', 'anyone building here, by name or role'],
+  ['/community/recruiters', 'Open to recruiters', 'who is open to recruiting, for project owners'],
+];
+
+test('every page that wears the hub’s bar carries the Community menu before Projects; apex-only where the page serves a child', () => {
+  const { stripApexOnly } = require('../src/platform-server.js');
+  const trig = '<button class="trig commTrig" type="button" id="commTrig" data-menu="community" aria-expanded="false" aria-controls="menuCommunity"';
+  const band = ['<div class="menuBand" id="menuCommunity" data-menu="community" hidden>', '  <div class="bandIn">', '    <ul class="bandRow">',
+    ...ITEMS.map(([h, t, c]) => `      <li class="bandCell"><a class="bandT" href="${h}">${t}</a><span class="bandC">${c}</span></li>`), '    </ul>', '  </div>', '</div>'].join('\n');
+  const fold = ITEMS.map(([h, t, c]) => `<li class="bandCell bandFold"><a class="bandT" href="${h}">${t}</a><span class="bandC">${c}</span></li>`).join('');
+  for (const f of [...SERVES_A_CHILD, ...HUB_ONLY]) {
+    const html = read(f);
+    const apex = SERVES_A_CHILD.includes(f);
+    const at = html.indexOf(apex ? `<!--apex-only:start-->${trig}` : trig);
+    assert.ok(at > 0, `${f}: the Community trigger`);
+    assert.ok(html.indexOf('id="projTrig"') > at, `${f}: Community comes before Projects`);
+    assert.ok(html.includes(wrap(apex, band)), `${f}: the Community band, its three sub-pages`);
+    assert.ok(html.indexOf('id="menuCommunity"') < html.indexOf('id="menuProjects"'), `${f}: the bands in the bar’s order`);
+    assert.ok(html.includes(wrap(apex, fold)), `${f}: the three folded into the Projects band for phones`);
+    if (apex) assert.doesNotMatch(stripApexOnly(html, false).split('<body>')[1], /\/community|commTrig|menuCommunity/, `${f}: a child has no community pages, so no trace of the menu`);
+  }
+});
+
+test('the menu folds into the Projects band under 480px on the hub and 900px on the landing; the arrows skip what CSS does not draw', () => {
+  const css = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
+  assert.match(css, /\.trig\[aria-expanded="true"\],\.trig\[aria-current="true"\]\{color:var\(--ink\);text-decoration:underline;/, 'on its own pages the menu reads as the current section');
+  assert.match(css, /\n\.bandFold\{display:none;\}\n/, 'above 480 the Projects band does not repeat the menu');
+  assert.match(css.split('@media (max-width:480px){')[1].split('\n}')[0], /\.commTrig\{display:none;\}\s*\.bandFold\{display:block;\}/);
+  const index = read('index.html');
+  assert.match(index, /\n\.bandFold\{display:none\}\n/);
+  assert.match(index.split('@media (max-width:900px){')[1], /^[\s\S]*?\.commTrig\{display:none\}\s*\.bandFold\{display:block\}/);
+  for (const f of ['assets/hub-bar.js', 'projects.html', 'index.html']) {
+    assert.match(read(f), /return !a\.closest\('\[hidden\]'\) && a\.offsetParent !== null; \}\);/, `${f}: the arrows skip a cell CSS does not draw`);
+  }
+  assert.doesNotMatch(css + index, /\.barLink/, 'the plain link this menu replaced is gone');
+});
+
+// ── 4. the routes ────────────────────────────────────────────────────────────
+
+const { buildPlatformApp } = require('../src/platform-server.js');
+const modules = require('../src/modules.js');
+let server;
+let port;
+before(async () => {
+  server = http.createServer(buildPlatformApp());
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => {
+  modules.setModuleOverrides({});
+  await new Promise((resolve) => server.close(resolve));
+});
+function get(pathname, host) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    }).on('error', reject);
+  });
+}
+
+test('GET /community, /community/find and /community/recruiters: one stamped page on the hub’s apex; never on a child or another host', async () => {
+  modules.setModuleOverrides({ 'platform-identity': false });
+  for (const [p] of SUBPAGES) assert.equal((await get(p, 'game.test.local')).status, 404, `${p}: a child instance has none of the routes these pages read`);
+  modules.setModuleOverrides({ 'platform-identity': true });
+  const bodies = [];
+  for (const [p] of SUBPAGES) {
+    const hub = await get(p, 'game.test.local');
+    assert.equal(hub.status, 200, p);
+    assert.match(hub.body, /— Community<\/title>/);
+    assert.doesNotMatch(hub.body, /\{\{[a-zA-Z]+\}\}/, 'every token stamped, the unit word included');
+    bodies.push(hub.body);
+  }
+  assert.ok(bodies.every((b) => b === bodies[0]), 'byte-identical for every sub-page: the script picks the view');
+  assert.doesNotMatch((await get('/community/everyone', 'game.test.local')).body, /— Community<\/title>/, 'only the three sub-pages');
+  for (const host of ['builders.test.local', 'status.test.local']) {
+    assert.doesNotMatch((await get('/community', host)).body, /— Community<\/title>/, `${host} must not serve /community`);
+  }
+});
+
+// ── 5. the kit ───────────────────────────────────────────────────────────────
+
+test('the kit renders each sub-page for everyone, the empty board, and a project owner’s recruiter list', () => {
+  const json = (f) => JSON.parse(read(f));
+  const states = json('community.states.json');
+  assert.equal(states.page, '/community');
+  assert.deepEqual(states.modes, ['dark']);
+  for (const s of ['out', 'out-30d', 'out-artists', 'out-find', 'out-find-search', 'out-recruiters', 'in-recruiters', 'in']) assert.ok(states.states[s], `kit state ${s}`);
+  assert.equal(states.states['out-find'].url, '/community/find');
+  assert.equal(states.states['in-recruiters'].url, '/community/recruiters');
+  assert.ok(states.states['in-recruiters'].expect.visible.includes('#recruitClosed'), 'signed in but not admitted: told, shown no one');
+  for (const [file, name, fixture] of [['community-empty.states.json', 'community-leaderboard', 'community-leaderboard-empty'], ['community-recruiter.states.json', 'scouting', 'scouting-recruiter']]) {
+    assert.equal(json(file).stub.fixtures[name], fixture);
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', fixture + '.json')), `fixture ${fixture}`);
+  }
+  assert.equal(json('community-recruiter.states.json').states['in-recruiter'].url, '/community/recruiters');
+});
+
+function stub(env = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js')], {
+      env: { ...process.env, STUB_PORT: '0', ...env }, stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    let out = '';
+    child.stdout.on('data', (c) => {
+      out += c;
+      const m = out.match(/stub on (http:\/\/127\.0\.0\.1:\d+)\//);
+      if (m) resolve({ origin: m[1], stop: () => child.kill() });
+    });
+    child.on('exit', (code) => reject(new Error(`stub exited ${code}: ${out}`)));
+  });
+}
+async function call(origin, p) {
+  const res = await globalThis.fetch(origin + '/api/bongos' + p);
+  return { status: res.status, body: await res.json() };
+}
+
+test('the kit stub answers the board, the search and the recruiting door the way the routes do', async () => {
+  const s = await stub();
+  try {
+    const all = await call(s.origin, '/community/leaderboard');
+    assert.equal(all.body.window, 'all');
+    assert.deepEqual(all.body.results.map((r) => r.place), all.body.results.map((_, i) => i + 1));
+    assert.equal(all.body.count, all.body.results.length);
+    const artists = await call(s.origin, '/community/leaderboard?window=all&discipline=artist');
+    assert.ok(artists.body.results.length && artists.body.results.every((r) => r.disciplines.includes('artist')));
+    assert.equal(artists.body.results[0].place, 1, 'a filtered board is numbered on its own');
+    assert.equal((await call(s.origin, '/community/leaderboard?window=1d')).body.error.code, 'bad_window');
+    assert.equal((await call(s.origin, '/community/search?q=p')).body.error.code, 'query_too_short');
+    const byName = await call(s.origin, '/community/search?q=sam');
+    assert.deepEqual(byName.body.results.map((r) => [r.handle, r.disciplines]), [['sam-rivera', null]], 'a hidden builder is found by name');
+    assert.equal((await call(s.origin, '/community/search?q=sam&discipline=engineer')).body.results.length, 0, 'and drops out of a craft search');
+    assert.equal((await call(s.origin, '/scouting')).status, 401, 'signed out, the door answers 401');
+  } finally { s.stop(); }
+  const member = await stub({ AUTH: '1' });
+  try {
+    assert.equal((await call(member.origin, '/scouting')).status, 403, 'signed in, most builders are refused');
+  } finally { member.stop(); }
+  const owner = await stub({ AUTH: '1', FIXTURE_ALIAS: JSON.stringify({ scouting: 'scouting-recruiter' }) });
+  try {
+    const r = await call(owner.origin, '/scouting');
+    assert.equal(r.status, 200);
+    assert.ok(r.body.name_only.every((n) => Object.keys(n).sort().join() === 'avatar_url,display_name,github_login'), 'the name-only tier is three columns');
+  } finally { owner.stop(); }
+});

package/tests/landing_legal_pages.mjs

@@ -193,7 +193,10 @@ for (const p of PAGES) {
     assert.deepEqual(bandLinks(bandOf(html, 'menuProjects')), [
       ['Sky', '/projects?view=map'], ['Table', '/projects?view=map&sub=table'],
       ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
+      // the Community menu's three sub-pages, folded into the band under 480px (task 1003363); apex-only
+      ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
     ], 'this page has no views of its own, so every item names /projects in full');
+    assert.deepEqual(bandLinks(bandOf(stripApexOnly(html, false), 'menuProjects')).map((l) => l[0]), ['Sky', 'Table', 'Your projects', 'New project'], 'a child has no /community');
     assert.deepEqual(bandLinks(bandOf(html, 'menuProfile')), [
       ['My projects', '/projects?view=mine'], ['Invitations', '/invitations'], ['Connections', '/connections'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
     ]);

package/tests/landing_page.mjs

@@ -594,7 +594,7 @@ test('the bands are one disclosure: Escape returns focus, arrows cycle, Tab out
   assert.match(CODE, /else openMenu\(t, ev\.detail === 0\);/, 'a keyboard-fired click is told apart from a pointer');
   assert.match(CODE, /if \(ev\.key === 'Escape'\) \{ closeMenus\(\); return; \}/);
   assert.match(CODE, /if \(ev\.key !== 'ArrowDown' && ev\.key !== 'ArrowUp'\) return;/);
-  assert.match(CODE, /return !a\.closest\('\[hidden\]'\);/, 'the arrows skip the hidden Your-projects cell');
+  assert.match(CODE, /return !a\.closest\('\[hidden\]'\) && a\.offsetParent !== null;/, 'the arrows skip the hidden Your-projects cell, and the Community cell above 900px, which CSS does not draw (task 1003363)');
   assert.match(CODE, /b\.addEventListener\('focusout', function \(ev\) \{[\s\S]*?if \(!to \|\| b\.contains\(to\) \|\| \(to\.closest && to\.closest\('\.trig'\)\)\) return;[\s\S]*?closeMenus\(\);/, 'Tab out closes; a null relatedTarget is left alone');
   assert.match(CODE, /if \(ev\.target\.closest && \(ev\.target\.closest\('\.menuBand'\) \|\| ev\.target\.closest\('\.trig'\)\)\) return;[\s\S]*?closeMenus\(\);/, 'a click outside closes');
   assert.doesNotMatch(HTML, /role="menu"|aria-haspopup/, 'plain links in a disclosure — what is announced is what ships');

package/tests/render_check.mjs

@@ -25,8 +25,8 @@ test('a shared asset reaches every page in its dir whose HTML names it', () => {
   assert.deepEqual(names(['modules/hall-ui/public/sky-data.js']), ['goal-map.states.json', 'thinking.states.json']);
   assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goals.states.json']);
   // the account page links the hub's sheet too since task 1004259, the guild page since task 1002301,
-  // the invitations page since task 1004276, and the connections page since task 1004278
-  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'connections.states.json', 'guild.states.json', 'invitations.states.json', 'projects.states.json']);
+  // the invitations page since task 1004276, the connections page since task 1004278, and the community page since task 1003363
+  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'community.states.json', 'connections.states.json', 'guild.states.json', 'invitations.states.json', 'projects.states.json']);
 });
 
 test('the page a builder changed comes before the pages a shared file reaches, so the render cap never drops it', () => {