@bongos/core 1.19.1023 → 1.19.1025

package/modules/platform-identity/migrations/platform_identity_024_terms_grandfathered.sql

@@ -0,0 +1,68 @@
+-- platform_identity_024_terms_grandfathered.sql — grandfather existing accounts
+-- onto the platform T&C, and record that they were grandfathered rather than
+-- signed in (task 1003360; owner decision on blocker 1000123; ADR 0217 D3,
+-- amending ADR 0213 D4).
+--
+-- WHY. Migration 019 made consent two columns and deliberately backfilled
+-- nothing, so every account the hub had already witnessed ('active') stopped
+-- being published until its owner next signed in. The owner chose instead to
+-- grandfather them — nothing goes dark — having been shown that this records a
+-- consent which did not happen. So the record must not hide it: a grandfathered
+-- acceptance is marked as such, and /terms says so.
+--
+-- WHAT IT DOES, once:
+--   1. adds terms_accepted_source ('signin' | 'grandfathered'). A named marker,
+--      not a magic timestamp, so any later audit can count the two apart.
+--   2. marks every acceptance already on record as 'signin' — until now the one
+--      statement that could write an acceptance was the hub sign-in
+--      (upsertAccount's activate branch, ADR 0213 D1). This runs FIRST, or step 3's
+--      rows would be relabelled too.
+--   3. grandfathers every 'active' account with no acceptance: stamped now(),
+--      with the version in force today, marked 'grandfathered'. profile_state is
+--      not touched — a 'provisional' account was never public and stays
+--      unpublished; this keeps published profiles published, it publishes nobody.
+--
+-- ONE-SHOT, ON PURPOSE. The writes run only in the transaction that creates the
+-- column. Grandfathering is an event at this deploy ("accounts that existed
+-- before these terms"), not a rule: replaying this file (the integration tests
+-- do) must never grandfather an account created since.
+--
+-- The version literal is pinned, not a placeholder: it names the text these
+-- accounts were accepted under, and a later revision must not rewrite that.
+--
+-- AFTER THIS, the grandfather mark gives way to a real acceptance: the owner's
+-- next hub sign-in restamps all three columns as a 'signin'
+-- (terms-acceptance.js acceptanceConflictSet). No runtime code writes
+-- 'grandfathered'; tests/terms_acceptance.mjs fails any that does.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Safe to re-run.
+
+BEGIN;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+     WHERE table_schema = current_schema()
+       AND table_name = 'platform_identity_accounts'
+       AND column_name = 'terms_accepted_source'
+  ) THEN
+    ALTER TABLE platform_identity_accounts
+      ADD COLUMN terms_accepted_source text
+        CHECK (terms_accepted_source IN ('signin', 'grandfathered'));
+
+    UPDATE platform_identity_accounts
+       SET terms_accepted_source = 'signin'
+     WHERE terms_accepted_at IS NOT NULL;
+
+    UPDATE platform_identity_accounts
+       SET terms_accepted_at = now(),
+           terms_version = '2026-08-29',
+           terms_accepted_source = 'grandfathered'
+     WHERE profile_state = 'active'
+       AND terms_accepted_at IS NULL;
+  END IF;
+END
+$$;
+
+COMMIT;

package/modules/platform-identity/terms-acceptance.js

@@ -30,12 +30,22 @@
 // reaches these statements, which is the whole point: an acceptance record a
 // caller could assert would be evidence of nothing.
 //
-// IDEMPOTENT BY CONSTRUCTION: the conflict branch is COALESCE(existing, new), so
-// the FIRST acceptance stands and a second sign-in never rewrites or duplicates
-// it. The two columns are only ever written together, so they cannot diverge.
+// THE FIRST ACCEPTANCE A HUMAN GAVE STANDS. The conflict branch keeps an existing
+// acceptance (COALESCE), so a second sign-in never rewrites or duplicates one.
+// The three columns are only ever written together, so they cannot diverge.
+//
+// HOW IT WAS GIVEN IS RECORDED TOO (task 1003360, ADR 0217 D3). Every acceptance
+// written here is marked terms_accepted_source = 'signin'. The only other value,
+// the grandfather marker, is written by migration platform_identity_024 alone —
+// accounts that already existed were accepted on their owner's behalf, and the
+// record says so rather than passing that off as a sign-in. A grandfather is not
+// an acceptance its owner gave, so it is the one acceptance that does not
+// "stand": the owner's next sign-in replaces it with their own. This file only
+// ever READS the marker. tests/terms_acceptance.mjs holds both rules, and fails
+// any other server file that writes these columns or names the marker.
 //
 // A LATER REVISION IS A KNOWN GAP, NOT A SILENT ONE. Because the version is
-// recorded and never overwritten, publishing a new TERMS_VERSION leaves every
+// recorded and a sign-in never overwrites it, publishing a new TERMS_VERSION leaves every
 // existing row naming the text it actually agreed to — so the platform can see
 // who has not accepted the new one. Re-acceptance on revision is deliberately
 // NOT built here (ADR 0213 D4): it is a product flow, not a storage shape.
@@ -60,7 +70,7 @@ function assertPlaceholder(fn, value) {
 // The acceptance columns, for an INSERT column list. Leading comma: it appends
 // to an existing list rather than standing alone.
 function acceptanceInsertColumns() {
-  return ', terms_accepted_at, terms_version';
+  return ', terms_accepted_at, terms_version, terms_accepted_source';
 }
 
 // The matching VALUES fragment. A row created by a NON-activating caller
@@ -70,23 +80,33 @@ function acceptanceInsertValues(activateParam, versionParam) {
   assertPlaceholder('acceptanceInsertValues', activateParam);
   assertPlaceholder('acceptanceInsertValues', versionParam);
   return `, CASE WHEN ${activateParam}::boolean THEN now() ELSE NULL END`
-    + `, CASE WHEN ${activateParam}::boolean THEN ${versionParam}::text ELSE NULL END`;
+    + `, CASE WHEN ${activateParam}::boolean THEN ${versionParam}::text ELSE NULL END`
+    + `, CASE WHEN ${activateParam}::boolean THEN 'signin' ELSE NULL END`;
 }
 
-// The ON CONFLICT DO UPDATE SET fragment — the idempotent half. COALESCE keeps
-// the FIRST acceptance, so signing in again re-reads the terms but does not
-// restamp them; a non-activating upsert leaves both columns exactly as they are,
-// mirroring the one-way rule profile_state already follows.
+// The ON CONFLICT DO UPDATE SET fragment — the write-once half. On the
+// activating sign-in: a grandfathered acceptance is replaced outright; any other
+// acceptance on record is kept (COALESCE), so a second sign-in re-reads the terms
+// without restamping them; and the source becomes 'signin' either way, since a
+// human just accepted. Keying the replacement on the grandfather marker, not on
+// "no signin recorded", matters: an acceptance with no source (written by the
+// pre-024 code in the deploy window) is a real sign-in and keeps its date. A
+// non-activating upsert leaves every column exactly as it is, mirroring the
+// one-way rule profile_state already follows. Postgres evaluates each right-hand
+// side against the row BEFORE the update, so all three read the same old source.
 //
 // Trailing comma: it sits between two other assignments in the SET list.
 function acceptanceConflictSet(activateParam, versionParam) {
   assertPlaceholder('acceptanceConflictSet', activateParam);
   assertPlaceholder('acceptanceConflictSet', versionParam);
   const self = 'platform_identity_accounts';
-  return `terms_accepted_at = CASE WHEN ${activateParam}::boolean`
-    + ` THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
-    + ` terms_version = CASE WHEN ${activateParam}::boolean`
-    + ` THEN COALESCE(${self}.terms_version, ${versionParam}::text) ELSE ${self}.terms_version END,`;
+  const signin = `${activateParam}::boolean`;
+  const replaces = `WHEN ${signin} AND ${self}.terms_accepted_source = 'grandfathered'`;
+  return `terms_accepted_at = CASE ${replaces} THEN now()`
+    + ` WHEN ${signin} THEN COALESCE(${self}.terms_accepted_at, now()) ELSE ${self}.terms_accepted_at END,`
+    + ` terms_version = CASE ${replaces} THEN ${versionParam}::text`
+    + ` WHEN ${signin} THEN COALESCE(${self}.terms_version, ${versionParam}::text) ELSE ${self}.terms_version END,`
+    + ` terms_accepted_source = CASE WHEN ${signin} THEN 'signin' ELSE ${self}.terms_accepted_source END,`;
 }
 
 module.exports = {

package/modules/public-landing/public/terms.html

@@ -67,7 +67,8 @@
     <p><b>These numbers describe; they do not govern.</b> Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project&rsquo;s own standing for you, as that project reported it &mdash; the platform holds no rank of its own.</p>
     <p><b>What is public.</b> Once you have signed in here and accepted these terms, your profile and that record are public by default: at your handle&rsquo;s page, in the people directory, to project owners looking for people to work with, and to search engines. An account that has never signed in here stays provisional and is published nowhere.</p>
     <p><b>What you control.</b> From your settings you can hide your statistics, drop out of the recruiting directory, or make your account private. Each takes effect immediately, everywhere, including on a page someone already has open. Hiding removes the platform&rsquo;s combined view; it does not retract the per-project numbers each project publishes itself, so a determined reader could still add them up the hard way.</p>
-    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written only by signing in here, and only once &mdash; signing in again does not change the original date. This is version <b>2026-08-29</b>.</p>
+    <p><b>Your acceptance is recorded.</b> The platform stores the date you accepted these terms, and which version, on your account. It is written by signing in here, and only once &mdash; signing in again does not change the original date. This is version <b>2026-08-29</b>.</p>
+    <p><b>Accounts from before these terms.</b> If your account already existed when this version took effect, the platform accepted it on your behalf, rather than waiting for you to sign in, and dated it the day that was done. The record marks that acceptance as grandfathered, so it is never mistaken for one you gave, and your own acceptance replaces it the next time you sign in.</p>
     <!--apex-only:end-->
     <h2>Fair use</h2>
     <p>Don't use {{productName}} to break the law, to attack this site or other people's projects, to mine, spam or otherwise abuse hosted resources, or to harass other builders. The owner may deactivate a builder or take a project offline for breaking these, and may set further house rules inside the hall.</p>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1023",
+  "version": "1.19.1025",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1023",
+      "version": "1.19.1025",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1023",
+  "version": "1.19.1025",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -198,6 +198,11 @@ const INTEGRATION = new Set([
   // DB-free siblings (session_records, session_cost) cover the transcript
   // de-duplication half.
   'session_cost_row_raise',
+  // task 1003360: the T&C grandfather migration against real SQL. The DB-free
+  // sibling (the T&C acceptance suite) pins the statement text and runs the conflict
+  // branch over a fake table; only a real engine runs the one-shot DO block and
+  // shows a legacy account published again and marked apart from a sign-in.
+  'terms_grandfather_db',
   'setup_smoke',
   'status-probe',
 ]);

package/src/bongos/auth-github.js

@@ -312,8 +312,10 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   // callback can persist it (encrypted, short-TTL) for the repo picker/creator.
   // auth.js stays kernel-clean — it never writes the token to the DB itself; the
   // token is surfaced ONLY on this opt-in path, so an ordinary hall sign-in never
-  // even returns it.
-  const captured = captureRepoToken ? { githubToken: accessToken, githubScope: grantedScope } : {};
+  // even returns it. Never for an offboarded builder: the gate admits every existing
+  // row, and this would re-seed the token deactivateBuilder deleted (ADR 0332, task 1004245).
+  const captured = captureRepoToken && builder.status !== 'inactive'
+    ? { githubToken: accessToken, githubScope: grantedScope } : {};
   return { token, builder, expiresAt, ...captured };
 }
 

package/src/bongos/db-kernel.js

@@ -192,7 +192,7 @@ async function upsertBuilder({ githubId, githubLogin, displayName, avatarUrl })
                                       THEN 'user'
                                       ELSE 'github' END,
            avatar_url   = EXCLUDED.avatar_url
-     RETURNING id, github_id, github_login, display_name, avatar_url, total_credits, created_at, rank, preferred_disciplines`,
+     RETURNING id, github_id, github_login, display_name, avatar_url, total_credits, created_at, rank, preferred_disciplines, status`,
     [String(githubId), githubLogin, displayName, avatarUrl ?? null]
   );
   return rows[0];

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1023'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1025'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/access_requests_invite.mjs

@@ -4,7 +4,9 @@
 // branch is pinned: already a member, an invite already standing, a pending
 // request resolved in place, a fresh row, a bad username, a DB failure. Plus
 // the public POST's three doors against the same router: apply reaches the
-// queries, invite_only and open refuse before any.
+// queries, invite_only and open refuse before any. Task 1002814 (ADR 0335 D2)
+// adds the invite row's own marks — kind, created_by, the inviter's note — and
+// the outstanding-invite list; tests/application_lifecycle.mjs executes them.
 //
 // The doorway is stubbed in require.cache BEFORE the route loads (the route
 // destructures pool/validators at require time — the web_admission_status
@@ -76,6 +78,15 @@ function post(pathname, body) {
     req.end();
   });
 }
+function get(pathname) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, json: data ? JSON.parse(data) : null }));
+    }).on('error', reject);
+  });
+}
 const reset = (m, s) => { mode = m; script = s; calls = []; };
 const none = { rows: [] };
 const one = (row = {}) => ({ rows: [row] });
@@ -112,14 +123,80 @@ test('invite: a pending request is resolved in place — the same row the sign-i
   assert.deepEqual(calls[2].params, [42, 'Octocat'], 'resolved by the Archon; the login is trimmed and un-@ed, case kept for lower()');
 });
 
-test('invite: no request at all → a fresh invited row, 201', async () => {
-  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited' })]);
+test('invite: no request at all → a fresh invited row, 201, marked as an invite from its sender', async () => {
+  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited', kind: 'invite' })]);
   const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
   assert.equal(r.status, 201);
   assert.equal(r.json.request.status, 'invited');
+  assert.equal(r.json.request.kind, 'invite');
   assert.match(calls[3].sql, /INSERT INTO access_requests/);
   assert.match(calls[3].sql, /'invited'/);
-  assert.deepEqual(calls[3].params, ['octocat', 42]);
+  assert.match(calls[3].sql, /'invite'/, 'kind = invite, so the row can be told apart from an approved application (ADR 0335 D2.1)');
+  assert.match(calls[3].sql, /\bcreated_by\b/, 'created_by names the sender, and no rescind overwrites it (D2.2)');
+  assert.deepEqual(calls[3].params, ['octocat', null, 42]);
+});
+
+test('invite: an optional note rides on the invite row — the inviter’s words', async () => {
+  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited', kind: 'invite' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat', note: '  Come build the parser with us  ' });
+  assert.equal(r.status, 201);
+  assert.match(calls[3].sql, /\bnote\b/);
+  assert.deepEqual(calls[3].params, ['octocat', 'Come build the parser with us', 42]);
+});
+
+test('invite: a note over 500 characters → 400 before any query', async () => {
+  reset('invite_only', []);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat', note: 'x'.repeat(501) });
+  assert.equal(r.status, 400);
+  assert.equal(calls.length, 0);
+});
+
+test('invite: resolving a pending application in place leaves it an application — its kind, sender column and note untouched', async () => {
+  reset('invite_only', [none, none, one({ id: 7, github_login: 'octocat', status: 'invited', kind: 'application' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat', note: 'not their words' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.request.kind, 'application', 'it was an application, and its history says so (D2.1)');
+  const update = calls[2].sql;
+  assert.match(update, /UPDATE access_requests/);
+  assert.doesNotMatch(update, /\bkind\s*=/, 'the resolve never re-labels an application as an invite');
+  assert.doesNotMatch(update, /\bcreated_by\b/, 'created_by is set on invite rows only (D2.2)');
+  assert.doesNotMatch(update, /\bnote\b/, 'the applicant’s note is theirs — an inviter’s note never overwrites it');
+});
+
+// ── GET /access-requests/invites — the sender's outstanding list ─────────────
+
+test('invites list: outstanding invites only, each naming who sent it', async () => {
+  const sent = { id: 8, github_login: 'octocat', note: 'hi', created_at: '2026-09-25T00:00:00Z', invited_by_login: 'archon' };
+  reset('invite_only', [one(sent)]);
+  const r = await get('/api/gds/access-requests/invites');
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.invites, [sent]);
+  assert.equal(calls.length, 1);
+  const { sql } = calls[0];
+  assert.match(sql, /ar\.kind = 'invite'/, 'an approved application is not an invite this project sent');
+  assert.match(sql, /ar\.status = 'invited'/, 'a rescinded invite is no longer outstanding');
+  assert.match(sql, /NOT EXISTS \(SELECT 1 FROM builders b\s+WHERE lower\(b\.github_login\) = lower\(ar\.github_login\)\)/,
+    'an invitee who already signed in is a member, not an outstanding invite');
+  assert.match(sql, /LEFT JOIN builders ib ON ib\.id = ar\.created_by/, 'the sender is read from created_by, which survives a rescind');
+  assert.doesNotMatch(sql, /ar\.created_by = \$/, 'without ?mine=1 the list is the whole project’s');
+  assert.deepEqual(calls[0].params, []);
+});
+
+test('invites list ?mine=1: only the caller’s own invites', async () => {
+  reset('invite_only', [none]);
+  const r = await get('/api/gds/access-requests/invites?mine=1');
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.invites, []);
+  assert.match(calls[0].sql, /AND ar\.created_by = \$1/);
+  assert.deepEqual(calls[0].params, [42], 'narrowed to the acting builder, never to a caller-supplied id');
+});
+
+test('invites list: a DB failure → 500 list_invites_failed, no internals in the message', async () => {
+  reset('invite_only', [new Error('connection refused')]);
+  const r = await get('/api/gds/access-requests/invites');
+  assert.equal(r.status, 500);
+  assert.equal(r.json.error.code, 'list_invites_failed');
+  assert.doesNotMatch(r.json.error.message, /connection refused/);
 });
 
 test('invite: a bad username → 400 before any query', async () => {

package/tests/application_lifecycle.mjs

@@ -65,11 +65,14 @@ let nextId = 100;
 // comparing them rather than by reading the code and believing it.
 function seed() {
   const now = Date.now();
+  // `kind`/`created_by` carry core_255's column default on every seeded row:
+  // each of these is an application, and cy's is an APPROVED one.
+  const app = { kind: 'application', created_by: null };
   rows = [
-    { id: 1, github_login: 'ada', display_name: 'Ada', note: 'I build tools', status: 'pending', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR },
-    { id: 2, github_login: 'bo', display_name: 'Bo', note: 'I build tools', status: 'pending', applicant_github_id: '9002', vouched_at: now - 3 * HOUR, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR },
-    { id: 3, github_login: 'cy', display_name: 'Cy', note: null, status: 'invited', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - 2 * HOUR, created_at: now - 4 * HOUR },
-    { id: 4, github_login: 'dee', display_name: 'Dee', note: null, status: 'dismissed', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - HOUR, created_at: now - 5 * HOUR },
+    { id: 1, github_login: 'ada', display_name: 'Ada', note: 'I build tools', status: 'pending', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR, ...app },
+    { id: 2, github_login: 'bo', display_name: 'Bo', note: 'I build tools', status: 'pending', applicant_github_id: '9002', vouched_at: now - 3 * HOUR, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR, ...app },
+    { id: 3, github_login: 'cy', display_name: 'Cy', note: null, status: 'invited', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - 2 * HOUR, created_at: now - 4 * HOUR, ...app },
+    { id: 4, github_login: 'dee', display_name: 'Dee', note: null, status: 'dismissed', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - HOUR, created_at: now - 5 * HOUR, ...app },
   ];
   builders = [{ github_login: 'existing' }];
   statements = [];
@@ -102,6 +105,15 @@ function predicateFor(rawWhere, params) {
     where = where.replace(transition[0], ' TRUE ');
   }
 
+  // The outstanding-invite list's member exclusion (task 1002814): an invitee who
+  // has signed in is a member, not an outstanding invite. Stripped as one unit,
+  // like the transition guard, so its inner `lower(...)` is not re-read.
+  const notMember = /NOT EXISTS \(SELECT 1 FROM builders b WHERE lower\(b\.github_login\) = lower\(ar\.github_login\)\)/.exec(where);
+  if (notMember) {
+    tests.push((r) => !isBuilder(r.github_login));
+    where = where.replace(notMember[0], ' TRUE ');
+  }
+
   let m;
   const eat = () => { where = where.replace(m[0], ' TRUE '); };
   if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
@@ -112,6 +124,8 @@ function predicateFor(rawWhere, params) {
   }
   if ((m = /\b(?:ar\.)?status = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => r.status === v); eat(); }
   if ((m = /\b(?:ar\.)?status = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); eat(); }
+  if ((m = /\b(?:ar\.)?kind = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.kind === v); eat(); }
+  if ((m = /\b(?:ar\.)?created_by = \$(\d+)/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.created_by) === String(v)); eat(); }
   if ((m = /\bapplicant_github_id IS NULL\b/.exec(where))) { tests.push((r) => r.applicant_github_id == null); eat(); }
 
   for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
@@ -181,11 +195,47 @@ const pool = {
         applicant_github_id: applicantGithubId, applicant_handle: applicantHandle, vouched_at: vouchedAt,
         resolved_by_builder_id: null, resolved_at: null,
         created_at: Date.now(),
+        kind: 'application', created_by: null, // the column defaults — the public write names neither
       };
       rows.push(fresh);
       return { rows: [{ id: fresh.id, github_login: fresh.github_login, status: fresh.status, created_at: fresh.created_at }] };
     }
 
+    // The invite route's fresh row (task 1002814, ADR 0335 D2). Matched EXACTLY,
+    // like the public write above, so `kind` or `created_by` cannot be dropped
+    // from the real statement with every test still green.
+    if (/^INSERT INTO access_requests \(github_login, note, kind, created_by, status, resolved_by_builder_id, resolved_at\) VALUES \(\$1, \$2, 'invite', \$3, 'invited', \$3, now\(\)\) RETURNING id, github_login, status, kind, resolved_at$/.test(sql)) {
+      const [login, note, sender] = params;
+      const at = Date.now();
+      const fresh = {
+        id: nextId++, github_login: login, display_name: null, note, status: 'invited',
+        applicant_github_id: null, applicant_handle: null, vouched_at: null,
+        resolved_by_builder_id: sender, resolved_at: at, created_at: at,
+        kind: 'invite', created_by: sender,
+      };
+      rows.push(fresh);
+      return { rows: [{ id: fresh.id, github_login: login, status: 'invited', kind: 'invite', resolved_at: at }] };
+    }
+
+    // The invite route resolving a PENDING application in place. The SET list is
+    // matched exactly: it must never touch kind, created_by or the applicant's note.
+    if ((m = /^UPDATE access_requests SET status = 'invited', resolved_by_builder_id = \$1, resolved_at = now\(\) WHERE (.+?) RETURNING id, github_login, status, kind, resolved_at$/.exec(sql))) {
+      const hit = rows.filter(predicateFor(m[1], params));
+      for (const r of hit) { r.status = 'invited'; r.resolved_by_builder_id = params[0]; r.resolved_at = Date.now(); }
+      return { rows: hit.map((r) => ({ id: r.id, github_login: r.github_login, status: r.status, kind: r.kind, resolved_at: r.resolved_at })) };
+    }
+
+    // The outstanding-invite list. Its sender is joined through created_by.
+    if ((m = /^SELECT ar\.id, ar\.github_login, ar\.note, ar\.created_at, ib\.github_login AS invited_by_login FROM access_requests ar LEFT JOIN builders ib ON ib\.id = ar\.created_by WHERE (.+?) ORDER BY ar\.created_at DESC LIMIT 200$/.exec(sql))) {
+      const hit = rows.filter(predicateFor(m[1], params)).sort((a, b) => b.created_at - a.created_at);
+      return {
+        rows: hit.map((r) => ({
+          id: r.id, github_login: r.github_login, note: r.note, created_at: r.created_at,
+          invited_by_login: (builders.find((b) => b.id === r.created_by) || {}).github_login || null,
+        })),
+      };
+    }
+
     // The owner's queue.
     if ((m = /^SELECT ar\.id, .* FROM access_requests ar .* WHERE (.+?) ORDER BY/.exec(sql))) {
       const hit = rows.filter(predicateFor(m[1], params)).sort((a, b) => b.created_at - a.created_at);
@@ -197,6 +247,9 @@ const pool = {
           // Returned only when the real SELECT names it, so the queue test below
           // proves the route reads the column rather than that this fake invents it.
           ...(/\bar\.applicant_handle\b/.test(sql) ? { applicant_handle: r.applicant_handle ?? null } : {}),
+          ...(/\bar\.kind\b/.test(sql) ? { kind: r.kind } : {}),
+          ...(/\bib\.github_login AS invited_by_login\b/.test(sql) && /\bON ib\.id = ar\.created_by\b/.test(sql)
+            ? { invited_by_login: (builders.find((b) => b.id === r.created_by) || {}).github_login || null } : {}),
           vouched: r.applicant_github_id !== null,
           resolved_by_login: null,
         })),
@@ -280,6 +333,9 @@ const dbKernel = require('../src/bongos/db-kernel.js');
 // Who is calling, and at what LIVE rank. The rank is resolved through the real
 // government port on every request — never cached — exactly as production does.
 let actingRank = 'archon';
+// Which builder is acting — switched only to prove an invite keeps its SENDER
+// when a different archon rescinds it.
+let actingId = 42;
 
 require.cache[apiPath].exports = {
   ...realApi,
@@ -287,7 +343,7 @@ require.cache[apiPath].exports = {
   joinabilityMode: () => 'apply',
   projectJoinDoor: () => 'apply',
   logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
-  requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'owner' }; next(); },
+  requireBuilder: (req, _res, next) => { req.builder = { id: actingId, github_login: 'owner' }; next(); },
   // requirePermission is NOT stubbed: realApi's own gate is used, so the denial
   // below is the production denial.
   readApplicationVouch: (token, { githubLogin } = {}) =>
@@ -336,7 +392,7 @@ function call(method, pathname, body, extraHeaders = {}) {
     req.end(payload);
   });
 }
-const reset = (rank = 'archon') => { seed(); actingRank = rank; };
+const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; };
 
 // ===========================================================================
 // The interpreter is the instrument, so it is calibrated first
@@ -692,6 +748,118 @@ test('only invited|dismissed are accepted, and a rejected status writes nothing'
   assert.equal(JSON.stringify(rows), snapshot);
 });
 
+// ===========================================================================
+// Invite — a pre-approved row the gate already reads (task 1002814, ADR 0335 D2)
+// ===========================================================================
+
+// The two archons the invite tests act as. Only their ids matter: the sender is
+// joined through created_by → builders.id.
+const ARCHONS = [{ id: 42, github_login: 'owner' }, { id: 43, github_login: 'second' }];
+
+test('invite: a login that never applied signs straight in, and the row says it is an invite and who sent it', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), false, 'precondition: eve never applied');
+  const r = await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve', note: 'Come build the parser' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.kind, 'invite');
+  const eve = rows.find((x) => x.github_login === 'eve');
+  assert.equal(eve.kind, 'invite');
+  assert.equal(eve.created_by, 42, 'the sender');
+  assert.equal(eve.note, 'Come build the parser', 'the inviter’s words, and kind says whose');
+  statements = [];
+  assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), true, 'the REAL admission read admits her — signing in is the acceptance act');
+  assert.ok(statements.length > 0 && statements.every(({ sql }) => !/\bkind\b|\bcreated_by\b/.test(sql)),
+    'and it admitted her without reading either new column (D2.5)');
+});
+
+test('rescind: an invite keeps its sender through a rescind by a different archon, and the door re-locks', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  const sent = await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve' });
+  actingId = 43;
+  const r = await call('PATCH', `/api/gds/access-requests/${sent.json.request.id}`, { status: 'dismissed' });
+  assert.equal(r.status, 200);
+  const eve = rows.find((x) => x.github_login === 'eve');
+  assert.equal(eve.status, 'dismissed');
+  assert.equal(eve.resolved_by_builder_id, 43, 'resolved_by records whoever acted last (ADR 0201 D4.2)…');
+  assert.equal(eve.created_by, 42, '…so the sender needs its own column, and the rescind does not touch it (D2.2)');
+  assert.equal(eve.kind, 'invite', 'a rescinded invite is still an invite in the history');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), false, 'the door is shut again');
+});
+
+test('invites list: outstanding only — not an approved application, a rescinded invite, or an invitee who signed in', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve', note: 'hi' });
+  actingId = 43;
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
+  const gus = await call('POST', '/api/gds/access-requests/invite', { github_login: 'gus' });
+  await call('PATCH', `/api/gds/access-requests/${gus.json.request.id}`, { status: 'dismissed' });
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'hal' });
+  builders.push({ id: 90, github_login: 'HAL' }); // hal accepted: he signed in
+  const r = await call('GET', '/api/gds/access-requests/invites');
+  assert.equal(r.status, 200);
+  const byLogin = Object.fromEntries(r.json.invites.map((x) => [x.github_login, x]));
+  assert.deepEqual(Object.keys(byLogin).sort(), ['eve', 'fay'],
+    'cy (an approved application), gus (rescinded) and hal (signed in, case-insensitively) are not outstanding');
+  assert.equal(byLogin.eve.invited_by_login, 'owner');
+  assert.equal(byLogin.fay.invited_by_login, 'second', 'each names its own sender');
+  assert.equal(byLogin.eve.note, 'hi');
+
+  const mine43 = await call('GET', '/api/gds/access-requests/invites?mine=1');
+  assert.deepEqual(mine43.json.invites.map((x) => x.github_login), ['fay'], '?mine=1: the sender lists their own outstanding invites');
+  actingId = 42;
+  const mine42 = await call('GET', '/api/gds/access-requests/invites?mine=1');
+  assert.deepEqual(mine42.json.invites.map((x) => x.github_login), ['eve']);
+});
+
+test('the queue history tells an invite from an approved application, and names the sender', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve', note: 'Come build the parser' });
+  await call('PATCH', '/api/gds/access-requests/1', { status: 'invited' }); // approve ada's application
+  const r = await call('GET', '/api/gds/access-requests?status=invited');
+  const byLogin = Object.fromEntries(r.json.requests.map((x) => [x.github_login, x]));
+  assert.equal(byLogin.cy.kind, 'application', 'cy applied and was approved');
+  assert.equal(byLogin.cy.invited_by_login, null);
+  assert.equal(byLogin.eve.kind, 'invite', 'eve never applied — an archon invited her');
+  assert.equal(byLogin.eve.invited_by_login, 'owner');
+  // `note` on this read has always meant the APPLICANT's words (the hall quotes it
+  // as theirs), so an inviter's note must never arrive in it.
+  assert.equal(byLogin.eve.note, null, 'an inviter’s note is not the invitee’s words');
+  assert.equal(byLogin.eve.invite_note, 'Come build the parser');
+  assert.equal(byLogin.ada.note, 'I build tools', 'an applicant’s note stays where it always was');
+  assert.equal(byLogin.ada.invite_note, null);
+});
+
+test('invite: resolving a pending application in place keeps it an application, with the applicant’s own note', async () => {
+  reset();
+  builders.push(...ARCHONS);
+  const r = await call('POST', '/api/gds/access-requests/invite', { github_login: 'ada', note: 'not their words' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.request.kind, 'application');
+  assert.equal(row(1).status, 'invited');
+  assert.equal(row(1).kind, 'application', 'it was an application, and its history says so (D2.1)');
+  assert.equal(row(1).created_by, null, 'created_by is set on invite rows only (D2.2)');
+  assert.equal(row(1).note, 'I build tools', 'an inviter never overwrites the applicant’s note');
+  assert.equal(rows.filter((x) => x.github_login === 'ada').length, 1, 'resolved, not duplicated');
+});
+
+for (const rank of ['thetes', 'metic']) {
+  test(`a ${rank} can neither invite nor list outstanding invites — access_request.review until R3 mints project.recruit`, async () => {
+    reset(rank);
+    const snapshot = JSON.stringify(rows);
+    const invited = await call('POST', '/api/gds/access-requests/invite', { github_login: 'eve' });
+    assert.equal(invited.status, 403);
+    assert.deepEqual(invited.json.error.details.required, ['access_request.review']);
+    const listed = await call('GET', '/api/gds/access-requests/invites');
+    assert.equal(listed.status, 403, 'the list names logins that are not members yet');
+    assert.equal(JSON.stringify(rows), snapshot, 'nothing was written');
+    assert.equal(await dbKernel.hasInvitedAccessRequest('eve'), false);
+  });
+}
+
 // ===========================================================================
 // Authority — "a builder cannot approve or decline for a project they don't own"
 // ===========================================================================