@bongos/core 1.19.374 → 1.19.375

package/public-landing/projects.html

@@ -678,11 +678,19 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
-      <!-- the setting the sibling task (1003044) fills in — placed BELOW the
-           sections that work, so a founder meets controls before promises -->
+      <!-- live since task 1003044: how people join — the membership door. The
+           visibility section's two reads, key for key: the choice shown is
+           the platform's REQUEST (its settings row); what the project actually
+           RUNS is read back from its own public manifest (brand.project.
+           joinability) — never from the save's reply, which is a receipt. The
+           fold is a SIBLING of the volatile slot so no re-render can drop it. -->
       <div class="card" id="mJoinability">
         <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">How people join</h2>
-        <div class="empty"><p>Choosing how new people join — walk right in, apply first, or invite only — isn’t wired up here yet. For now, people apply to join and you invite them.</p></div>
+        <div id="mJoin"><p class="finePrint">Reading the project’s settings…</p></div>
+        <details class="finePrint" id="mJoinWhat">
+          <summary>What each choice changes</summary>
+          <p><b>Anyone can join</b> — whoever signs in with GitHub becomes a member at once, at the newcomer rank. <b>Apply to join</b> — people ask from the project’s hall, you approve each one from the hall’s Watch page, and then they sign in. <b>Invite only</b> — no one can apply: the project’s hall and its sign-in say so, and you invite people by GitHub username from the hall’s Watch page; only an invited person’s sign-in gets in — and people who asked before you switched stay in your queue, to approve or dismiss. Whichever you pick, people who are already members stay members. Changing it restarts the project to pick it up — the line under the choice says what the project is running right now.</p>
+        </details>
       </div>
 
       <!-- live since task 1003042: the teardown control, for a project in ANY
@@ -4379,6 +4387,7 @@ summary{min-height:24px;padding:3px 0;}
     /* same contract: the visibility section's in-flight line reads open_intent
        only, so a queued settings push shows up on the tick without a reload */
     renderVisState(inst);
+    renderJoinState(inst);
     /* the page names its project — in the heading and in the tab */
     $('mTitle').textContent = inst.slug || 'Manage';
     document.title = (inst.slug ? inst.slug + ' — ' : '') + BASE_TITLE;
@@ -4484,6 +4493,7 @@ summary{min-height:24px;padding:3px 0;}
         /* the settings row + the project's own manifest — the same cadence as
            the GitHub read: entry + tab return, never the in-flight tick */
         if (!keepRepo) loadVisibility(inst);
+        if (!keepRepo) loadJoinability(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -4805,6 +4815,162 @@ summary{min-height:24px;padding:3px 0;}
     if (t && t.hasAttribute('data-vis-save')) doVisSave();
   });
 
+  /* ── how people join (task 1003044): the joinability toggle — the visibility
+     section's shape, key for key: the CHOICE from the platform's settings row,
+     what the project RUNS from its own manifest (brand.project.joinability),
+     the save's push.message shown verbatim and never painted as the live
+     state. visPushOpen() is shared: one settings push carries every key. ── */
+
+  var JOIN_OPTIONS = {
+    open: { label: 'Anyone can join', blurb: 'Whoever signs in with GitHub becomes a member right away, at the newcomer rank.' },
+    apply: { label: 'Apply to join', blurb: 'People ask to join from the project’s hall; you approve each one, then they sign in.' },
+    invite_only: { label: 'Invite only', blurb: 'No one can apply. You invite people by GitHub username from the hall, and only an invited person can sign in.' }
+  };
+  var mJoinSettings = null;  /* the platform row's last answer: { value, options } */
+  var mJoinRunsHtml = '';    /* what the project's manifest last said it runs */
+  var mJoinPushSeen = false; /* a settings push was open — re-read the manifest once it settles */
+
+  function joinMsg(html) { $('mJoin').innerHTML = html; }
+
+  function renderJoin() {
+    var s = mJoinSettings;
+    if (!s) return;
+    var opts = (s.options || []).filter(function (v) { return !!JOIN_OPTIONS[v]; });
+    joinMsg('<div role="radiogroup" aria-label="How people join">' + opts.map(function (v) {
+      var o = JOIN_OPTIONS[v];
+      return '<label class="visOpt"><input type="radio" name="mJoinPick" value="' + esc(v) + '"' +
+        (v === s.value ? ' checked' : '') + '><span><b>' + esc(o.label) + '</b>' + esc(o.blurb) + '</span></label>';
+    }).join('') + '</div>' +
+      '<div class="actions"><button type="button" class="btn small" data-join-save>Save</button></div>' +
+      '<div class="projMsg" id="mJoinMsg" role="status" aria-live="polite"></div>' +
+      '<p class="finePrint" id="mJoinRuns">' + mJoinRunsHtml + '</p>');
+    renderJoinState(manageInst);
+  }
+
+  function joinRuns(html) {
+    mJoinRunsHtml = html;
+    var el = $('mJoinRuns');
+    if (el) el.innerHTML = html;
+  }
+
+  /* fetch-free, from open_intent only (renderManage calls it on every repaint) */
+  function renderJoinState(inst) {
+    if (!inst || !$('mJoinRuns')) return;
+    if (visPushOpen(inst)) {
+      mJoinPushSeen = true;
+      joinRuns(inst.open_intent.state === 'running'
+        ? 'Restarting the project to apply a settings change…'
+        : 'A settings change is queued — the project restarts to pick it up. Until then it keeps its current setting.');
+      return;
+    }
+    if (mJoinPushSeen) { mJoinPushSeen = false; loadJoinRuns(inst); }
+  }
+
+  /* what the project RUNS: its own public manifest, read cross-origin */
+  function loadJoinRuns(inst) {
+    if (!inst || inst.status !== 'active' || !inst.domain) { joinRuns(''); return; }
+    var asked = manageId;
+    joinRuns('Checking what the project is running…');
+    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
+    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
+    fetch('https://' + inst.domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
+      .then(function (res) {
+        if (!res.ok) throw new Error('http:' + res.status);
+        return res.json();
+      })
+      .then(function (m) {
+        if (asked !== manageId) return;
+        var p = m && m.brand && m.brand.project;
+        var v = p && p.joinability;
+        if (!p || typeof p !== 'object') {
+          joinRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
+          return;
+        }
+        var o = JOIN_OPTIONS[v];
+        if (!o) { joinRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
+        var want = mJoinSettings && mJoinSettings.value;
+        joinRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
+          (want && want !== v && JOIN_OPTIONS[want] ? ' — the saved choice (' + esc(JOIN_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
+      })
+      .catch(function (err) {
+        if (asked !== manageId) return;
+        var http = /^http:(\d+)$/.exec(String(err && err.message));
+        joinRuns(http
+          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(http[1]) + ').'
+          : 'Couldn’t reach the project to check what it’s running right now.');
+      })
+      .then(function () { if (timer) clearTimeout(timer); });
+  }
+
+  function loadJoinability(inst) {
+    mJoinSettings = null; mJoinRunsHtml = ''; mJoinPushSeen = false;
+    joinMsg('<p class="finePrint">Reading the project’s settings…</p>');
+    var asked = manageId; /* a stale answer must never describe a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        return jsonOrEmpty(res).then(function (data) {
+          if (res.ok) {
+            mJoinSettings = {
+              value: (data.settings || {}).joinability,
+              options: (data.options || {}).joinability || Object.keys(JOIN_OPTIONS)
+            };
+            renderJoin();
+            if (!visPushOpen(inst)) loadJoinRuns(inst);
+            return;
+          }
+          joinMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
+        });
+      })
+      .catch(function (err) {
+        if (String(err && err.message) === 'stale') return;
+        joinMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
+      });
+  }
+
+  /* the save sends the CHOICE and shows the platform's receipt verbatim */
+  function doJoinSave() {
+    if (!manageInst || !mJoinSettings) return;
+    var picked = document.querySelector('#mJoin input[name="mJoinPick"]:checked');
+    if (!picked) return;
+    var value = picked.value;
+    var box = $('mJoinMsg');
+    var btn = document.querySelector('#mJoin [data-join-save]');
+    if (btn) btn.disabled = true;
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ joinability: value })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the row now holds the choice — the radio follows it; the "runs"
+             line does NOT, until the project's own manifest says so */
+          mJoinSettings.value = (data.saved || {}).joinability || value;
+          if (data.push && data.push.queued) mJoinPushSeen = true;
+          box.className = 'projMsg ok';
+          box.textContent = (data.push && data.push.message) || 'Saved.';
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+        box.className = e.code === 'intent_conflict' ? 'projMsg' : 'projMsg err';
+        box.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () {
+      if (btn) btn.disabled = false;
+      loadManage(true, true);
+    });
+  }
+
+  $('mJoin').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-join-save')) doJoinSave();
+  });
+
   /* ── delete the project (task 1003042): the manage page's teardown control.
      It renders from status + open_intent only — no second request — so the
      minute tick can repaint it and a queued teardown appears without a reload.

package/scripts/gds/login.js

@@ -189,11 +189,20 @@ async function main() {
   }
   const instanceName = man.data.name || base;
   const admission = (man.data.admission && man.data.admission.policy) || 'invite-only';
+  // The project's door (task 1003044): brand.project.joinability names which of
+  // open / apply / invite_only it runs; an older core reports none, and then the
+  // binary admission.policy above is all there is to say.
+  // admission.policy 'open' wins over a pushed 'apply': a self-hosted instance on
+  // the legacy open-enrolment flag reports the pack's default while its door is open.
+  const joinability = admission === 'open' ? 'open'
+    : (man.data.brand && man.data.brand.project && man.data.brand.project.joinability) || null;
+  const DOOR_WORD = { open: '', apply: ' (apply to join)', invite_only: ' (invite-only)' };
+  const doorWord = joinability in DOOR_WORD ? DOOR_WORD[joinability] : (admission === 'invite-only' ? ' (invite-only)' : '');
   // Federation (ADR 0141 §1): a hosted instance advertises auth.idp = { origin,
   // client_id } — sign-in then runs through the Cloud Bongos hub, not a local
   // GitHub app. null → the direct-GitHub path, unchanged.
   const idp = (man.data.auth && man.data.auth.idp) || null;
-  log(`  Signing in to ${instanceName}${admission === 'invite-only' ? ' (invite-only)' : ''}${idp ? ' — via Cloud Bongos platform sign-in' : ''}`);
+  log(`  Signing in to ${instanceName}${doorWord}${idp ? ' — via Cloud Bongos platform sign-in' : ''}`);
 
   // 2. Device flow.
   let flow = await runDeviceFlow(base, { log, idp });
@@ -202,6 +211,12 @@ async function main() {
   //    then finish sign-in with a fresh device flow (the first code is spent).
   if (flow.state === 'not_approved') {
     log('');
+    // An invite-only project takes no applications — say so instead of
+    // collecting a username for a request the project would refuse.
+    if (joinability === 'invite_only') {
+      console.error(`✖ ${instanceName} is invite-only — it doesn’t take applications. Ask its owner for an invite, then re-run \`bongos login ${base}\`.`);
+      process.exit(1);
+    }
     log(`  You're not admitted to ${instanceName} yet.`);
     const ghLogin = (await prompt('  Your GitHub username: ')).replace(/^@/, '');
     if (!ghLogin) {
@@ -212,12 +227,18 @@ async function main() {
       method: 'POST',
       body: JSON.stringify({ github_login: ghLogin, note: 'via bongos login' }),
     });
-    if (reqRes.status === 409 && reqRes.data && reqRes.data.error === 'already_member') {
+    // The refusal envelope is { error: { code, message } } (ADR 0116); an older
+    // instance answered a flat { error: 'code' } — read both.
+    const reqErr = (reqRes.data && reqRes.data.error) || null;
+    const reqCode = reqErr && (reqErr.code || reqErr);
+    const reqMessage = reqErr && reqErr.message;
+    if (reqRes.status === 409 && reqCode === 'already_member') {
       log('  You already have an account — retrying sign-in…');
     } else if (reqRes.ok || reqRes.status === 200 || reqRes.status === 201) {
       log(`  ✓ Requested access to ${instanceName}. An Archon approves you with a 👍 in Discord (#member-approvals).`);
     } else {
-      console.error(`✖ could not file an access request (HTTP ${reqRes.status}).`);
+      // the project's own sentence when it gave one (an invite-only or open door)
+      console.error(reqMessage ? `✖ ${reqMessage}` : `✖ could not file an access request (HTTP ${reqRes.status}).`);
       process.exit(1);
     }
     log('  Waiting for approval (safe to leave running)…');

package/src/bongos/auth-admission.js

@@ -121,15 +121,59 @@ async function reportActivityRollup({ builderId, githubId }) {
 // already exists for their github_id) ALWAYS passes — the gate never locks out
 // someone already enrolled.
 //
-// OTB_OPEN_XENOS_ENROLLMENT is the escape-hatch: set it truthy ('1' or 'true')
-// to restore fully-open self-enrollment (anyone with a GitHub account becomes a
-// Xenos) WITHOUT a code change, for an owner who deliberately wants open
-// enrollment. Default (unset/anything-else) = invite required. See ADR 0050.
-function openEnrollmentEnabled() {
+// The project's JOINABILITY decides which of those a first-timer gets (task
+// 1003044, goal 1000058; the owner's 2026-08-16 decision). The owner picks it on
+// the hub's manage page; the platform pushes it into this instance's branding
+// pack as project.joinability (ADR 0190) and it is read through branding(),
+// like platformVisibility — memoized for the process, applied by a restart:
+//   open         a first-time GitHub sign-in self-enrols at xenos — no request,
+//                no invite (what OTB_OPEN_XENOS_ENROLLMENT used to switch on)
+//   apply        (the default — today's behaviour) a stranger files an access
+//                request and an Archon marks it 'invited'; then sign-in admits
+//   invite_only  the public POST /access-requests refuses; only an access
+//                request an Archon CREATED at 'invited' admits a first-timer
+// The legacy OPEN_XENOS_ENROLLMENT flag (ADR 0050) still opens an *apply*
+// project, so a self-hosted instance that set it keeps its open door across the
+// upgrade — but it does not override an explicit invite_only: the stricter,
+// newer choice wins. An unreadable pack fails CLOSED (invite_only): when the
+// door's policy is unknown the widest door is never the fallback.
+function legacyOpenEnrollmentFlag() {
   const v = ic.resolveEnv('OPEN_XENOS_ENROLLMENT');
   return v === '1' || v === 'true';
 }
 
+// joinabilityMode — the project's effective membership door policy: 'open' |
+// 'apply' | 'invite_only'. The one reader every admission surface uses (both
+// sign-in flows, the public access-request route via the doorway, the manifest,
+// the refusal pages), so none of them can disagree about which door this is.
+// `read` is injectable for the unit tests only (the pack is memoized).
+let warnedUnknownJoinability = false;
+function joinabilityMode(read = branding) {
+  let v;
+  try { v = read().project?.joinability; } catch (err) {
+    log.error('[auth] joinability: branding pack unreadable — treating the project as invite-only:', err.message);
+    return 'invite_only';
+  }
+  if (v === 'open' || v === 'invite_only') return v;
+  if (v === undefined || v === null || v === '' || v === 'apply') {
+    return legacyOpenEnrollmentFlag() ? 'open' : 'apply';
+  }
+  // A value this core cannot read ('invite-only' with a hyphen, a truncated
+  // write) is a policy it does not know — never the wider door.
+  if (!warnedUnknownJoinability) {
+    warnedUnknownJoinability = true;
+    log.error(`[auth] joinability: unrecognised value ${JSON.stringify(v)} — treating the project as invite-only`);
+  }
+  return 'invite_only';
+}
+
+// openEnrollmentEnabled — true when a first-time GitHub account self-enrols
+// (joinability 'open'). Kept as the name the four sign-in call sites and the
+// manifest read; the decision itself is joinabilityMode().
+function openEnrollmentEnabled() {
+  return joinabilityMode() === 'open';
+}
+
 // PURE admission decision shared by both flows so they CANNOT drift (SR-19).
 // Returns true when a first-time account must be blocked. `existing` is the
 // builder row (or null) from getBuilderByGithubId; `approved` is the result of
@@ -257,6 +301,7 @@ async function safeSyncRankRole(builder) {
 module.exports = {
   firstAdminLogin,
   firstTimeAdmissionBlocked,
+  joinabilityMode,
   maybeSeatFirstAdmin,
   membershipKind,
   openEnrollmentEnabled,

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -730,6 +730,7 @@ module.exports = {
   loadIdpConfig,
   idpConfigured,
   openEnrollmentEnabled,
+  joinabilityMode,
   firstTimeAdmissionBlocked,
   webAdmissionStatus,
   firstAdminLogin,

package/src/bongos/routes/auth.js

@@ -677,6 +677,21 @@ module.exports = function buildAuthRouter() {
         // approval brings them back to it — the return cookie says where.
         const founderReturn = safeReturnTo(parseCookie(req, RETURN_COOKIE)) || '';
         const onWayToProject = founderReturn.startsWith('/projects');
+        // An invite-only project (task 1003044) takes no applications: say so,
+        // and name the one way in — an invite from the admitter — instead of
+        // sending a stranger to a request form the project refuses.
+        if (auth.joinabilityMode() === 'invite_only') {
+          return res.status(403).type('text/html').send(renderAuthErrorPage(
+            'This project is invite-only',
+            `Signing in with GitHub is only for builders the ${admitterLabel()} has invited. This project doesn’t take applications, so there is nothing to request here. If you know the ${admitterLabel()}, ask them for an invite — once you’re invited, this sign-in lets you in.`,
+            {
+              subtitle: 'Sign-in is for invited builders. This project is invite-only.',
+              cta: { href: '/builders', label: 'Go to the hall' },
+              note: (onWayToProject ? 'You were on your way to creating a project — once invited, sign in again and you land back in it. ' : '') +
+                `Already invited and still blocked? Ask the ${admitterLabel()} to confirm your invite was recorded.`,
+            },
+          ));
+        }
         return res.status(403).type('text/html').send(renderAuthErrorPage(
           'This account is not approved yet',
           `Signing in with GitHub is only for builders the ${admitterLabel()} has already approved. If you are new, request access at the builders’ hall — once the ${admitterLabel()} approves you, this sign-in will let you in. If you were just approved, it may take a moment to be marked invited; try again shortly.`,

package/src/branding.js

@@ -209,8 +209,9 @@ function clientBranding(b = branding()) {
     // says so — and the READ-BACK a manage page needs: a settings PATCH on the
     // platform is only a request until this instance restarts with the value, so
     // the honest place to learn what it RESOLVED from its environment is its own
-    // GET /instance manifest. Resolved, not enforced: enforcement lands with
-    // tasks 1003043 (visibility) and 1003044 (joinability).
+    // GET /instance manifest. Enforced on the instance by the platform-visibility
+    // gate (task 1003043, ADR 0192) and the admission machinery (task 1003044,
+    // ADR 0194 — joinabilityMode() in auth-admission.js).
     project: {
       platformVisibility: b.project?.platformVisibility || 'public',
       joinability: b.project?.joinability || 'apply',

package/src/module-api.js

@@ -1178,8 +1178,20 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.372 with no explicit bump. run 32906118616. (task 1002620)
 //   1.19.374 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.373 with no explicit bump. run 32906477349. (task 1002620)
+//   (next carrier) — joinabilityMode re-exported (task 1003044, goal 1000058; ADR 0194).
+//         The project's membership door — open / apply / invite_only — is enforced by
+//         the admission machinery: the two sign-in flows self-enrol only on 'open', and
+//         the onboarding module's public POST /access-requests must refuse an invite-only
+//         project with the SAME decision (SR-19: one gate, no drift), so the reader moves
+//         onto the doorway beside branding. Additive — a MINOR by the 1.19.0 precedent,
+//         but a hand-bumped version cannot pass the publish lane's LIVE test
+//         (tests/bump_version.mjs: HEAD's version must be one the lane's own carrier
+//         commits announced), so it rides the next CI patch; the contradiction with
+//         ADR 0161 §2 is filed as an idea from task 1003044.
+//   1.19.375 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.374 with no explicit bump. run 32909701598. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.374'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.375'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -1357,6 +1369,13 @@ module.exports = {
   //     hardcodes, instance strings).
   branding: branding.branding,
   clientBranding: branding.clientBranding,
+  // joinabilityMode() — the project's effective membership door: 'open' |
+  //     'apply' | 'invite_only' (task 1003044; ADR 0194). Read here, never
+  //     re-derived from branding().project by a module: the legacy
+  //     open-enrolment flag and the fail-closed default live in this one
+  //     reader, and the sign-in flows and the public access-request route
+  //     must answer with the same door (SR-19).
+  joinabilityMode: auth.joinabilityMode,
   // userAgent — the instance's HTTP User-Agent string (branding-derived). The
   // carved lifecycle module's github-push.js stamps every GitHub API request with
   // it instead of reaching into src/branding.js directly (BV1.R86).

package/tests/access_requests_invite.mjs

@@ -0,0 +1,165 @@
+// tests/access_requests_invite.mjs — the admission routes against a scripted
+// pool (task 1003044). The Archon's invite is the security-critical write on an
+// invite-only project — it is the only thing that admits anyone — so every
+// branch is pinned: already a member, an invite already standing, a pending
+// request resolved in place, a fresh row, a bad username, a DB failure. Plus
+// the public POST's three doors against the same router: apply reaches the
+// queries, invite_only and open refuse before any.
+//
+// The doorway is stubbed in require.cache BEFORE the route loads (the route
+// destructures pool/validators at require time — the web_admission_status
+// pattern): the session gates admit a fixed Archon, the pool replays a script
+// of results and records every query, and joinabilityMode is a switch.
+//
+// Run:  node --test tests/access_requests_invite.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+
+let calls = [];
+let script = [];
+let mode = 'apply';
+const pool = {
+  async query(sql, params) {
+    calls.push({ sql, params });
+    if (!script.length) throw new Error(`unscripted query: ${sql.trim().slice(0, 40)}`);
+    const next = script.shift();
+    if (next instanceof Error) throw next;
+    return next;
+  },
+};
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool,
+  joinabilityMode: () => mode,
+  requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'archon' }; next(); },
+  requirePermission: () => (_req, _res, next) => next(),
+};
+
+const buildAccessRequestsRouter = require('../modules/onboarding/routes/access-requests.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildAccessRequestsRouter());
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function post(pathname, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method: 'POST',
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, json: data ? JSON.parse(data) : null }));
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+const reset = (m, s) => { mode = m; script = s; calls = []; };
+const none = { rows: [] };
+const one = (row = {}) => ({ rows: [row] });
+
+// ── POST /access-requests/invite ─────────────────────────────────────────────
+
+test('invite: already a member → 409, nothing written', async () => {
+  reset('invite_only', [one()]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'already_member');
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].sql, /FROM builders/);
+});
+
+test('invite: an invite already standing → 200 already_invited, nothing written', async () => {
+  reset('invite_only', [none, one()]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.already_invited, true);
+  assert.equal(calls.length, 2);
+  assert.match(calls[1].sql, /status = 'invited'/);
+});
+
+test('invite: a pending request is resolved in place — the same row the sign-in gate reads', async () => {
+  reset('invite_only', [none, none, one({ id: 7, github_login: 'Octocat', status: 'invited' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: '@Octocat ' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.request.status, 'invited');
+  assert.equal(calls.length, 3, 'no insert after a successful resolve');
+  assert.match(calls[2].sql, /UPDATE access_requests/);
+  assert.match(calls[2].sql, /SET status = 'invited'/);
+  assert.match(calls[2].sql, /WHERE lower\(github_login\) = lower\(\$2\) AND status = 'pending'/);
+  assert.deepEqual(calls[2].params, [42, 'Octocat'], 'resolved by the Archon; the login is trimmed and un-@ed, case kept for lower()');
+});
+
+test('invite: no request at all → a fresh invited row, 201', async () => {
+  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.status, 'invited');
+  assert.match(calls[3].sql, /INSERT INTO access_requests/);
+  assert.match(calls[3].sql, /'invited'/);
+  assert.deepEqual(calls[3].params, ['octocat', 42]);
+});
+
+test('invite: a bad username → 400 before any query', async () => {
+  reset('invite_only', []);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'not a login!' });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'bad_github_login');
+  assert.equal(calls.length, 0);
+});
+
+test('invite: a DB failure → 500 invite_failed, no internals in the message', async () => {
+  reset('invite_only', [new Error('connection refused')]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 500);
+  assert.equal(r.json.error.code, 'invite_failed');
+  assert.doesNotMatch(r.json.error.message, /connection refused/);
+});
+
+// ── the public POST's three doors ────────────────────────────────────────────
+
+test('public POST on apply: the door is open — the request is filed', async () => {
+  reset('apply', [none, none, one({ id: 9, github_login: 'octocat', status: 'pending' })]);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.status, 'pending');
+  assert.equal(calls.length, 3);
+});
+
+test('public POST on invite_only: refused before any query — nothing about the applicant is consulted', async () => {
+  reset('invite_only', []);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 403);
+  assert.equal(r.json.error.code, 'invite_only');
+  assert.equal(calls.length, 0);
+});
+
+test('public POST on open: "no request needed", before any query', async () => {
+  reset('open', []);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'open_enrollment');
+  assert.equal(calls.length, 0);
+});

package/tests/auth_admission_gate.mjs

@@ -72,6 +72,48 @@ t("'0' / '' / 'yes' do NOT enable open enrollment", () => {
   }
 });
 
+// task 1003044: the decision is the project's joinability (branding().project,
+// 'apply' on this repo's pack). The legacy flag still opens an APPLY project —
+// a self-hosted instance that set it keeps its open door across the upgrade.
+// The open / invite_only packs are booted in tests/joinability_*.mjs.
+console.log('\njoinabilityMode — the door the flag now opens (task 1003044):');
+
+t('joinabilityMode is exported, and the default pack runs as apply', () => {
+  assert.equal(typeof auth.joinabilityMode, 'function');
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(), 'apply'));
+});
+
+t('the legacy flag turns an apply project into an open one — and nothing else does', () => {
+  withOpenEnrollmentEnv('true', () => assert.equal(auth.joinabilityMode(), 'open'));
+  withOpenEnrollmentEnv('yes', () => assert.equal(auth.joinabilityMode(), 'apply'));
+});
+
+// the reader is injectable (the pack is memoized): the edges the boots can't reach
+t('an absent value is apply, and the legacy flag opens exactly that', () => {
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(() => ({})), 'apply'));
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: {} })), 'open'));
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'apply' } })), 'open'));
+});
+
+t('a value this core cannot read fails CLOSED — invite-only, never the wider door, flag or no flag', () => {
+  withOpenEnrollmentEnv('1', () => {
+    for (const bad of ['invite-only', 'Open', 'OPEN', 'apply ', 'gated', 42]) {
+      assert.equal(auth.joinabilityMode(() => ({ project: { joinability: bad } })), 'invite_only', JSON.stringify(bad));
+    }
+  });
+});
+
+t('an unreadable pack fails CLOSED', () => {
+  withOpenEnrollmentEnv('1', () => {
+    assert.equal(auth.joinabilityMode(() => { throw new Error('pack unreadable'); }), 'invite_only');
+  });
+});
+
+t('an explicit invite_only is never reopened by the legacy flag; an explicit open needs no flag', () => {
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'invite_only' } })), 'invite_only'));
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'open' } })), 'open'));
+});
+
 console.log('\nfirstTimeAdmissionBlocked — the shared decision both flows make:');
 
 t('first-timer WITHOUT invite, open enrollment OFF → BLOCKED', () => {