@bongos/core 1.19.374 → 1.19.376

package/migrations/core_227_task_created_by.sql

@@ -0,0 +1,83 @@
+-- core_227_task_created_by.sql — a task remembers who created it (task 1003278,
+-- goal 1000072, criterion legibility-sort-and-staleness).
+--
+-- THE GAP. "You can find your own work" was impossible on the task tier: tasks
+-- carried source/source_ref (which PIPELINE filed it) and shipped_by (who landed
+-- it), but nothing said which PERSON created it. A goal has had created_by since
+-- migration 160; a task had nothing, so the owner could not ask the board "what
+-- did I create" — one of the exact questions goal 1000072 exists to answer.
+--
+-- NULLABLE, NO BACKFILL, ON PURPOSE. History is honestly unattributable: the
+-- ~1,357 existing BONGOS-V1 tasks were created before this column, and guessing
+-- (from shipped_by, from a claim, from the source string) would write confident
+-- lies into an attribution column. NULL = created before attribution existed, or
+-- by a system path with no builder in the request — the same convention as
+-- goals.created_by (migration 160: "NULL = system-attributed"). The UI's filter
+-- gets a 'system / unattributed' bucket, exactly like the goals owner filter.
+--
+-- Additive + forward-safe: every existing reader either SELECTs an explicit
+-- column list or `t.*` (which tolerates a new column); nothing NOT NULL, nothing
+-- renamed (tests/migrations_forward_safe.mjs).
+--
+-- THE VIEWS MUST BE REBUILT WITH IT. A Postgres view created with `SELECT t.*`
+-- pins its column list at CREATE VIEW time — core_190's own header documents six
+-- columns that silently never reached the claim feed this way, and the Work
+-- Board's Creator filter reads created_by off exactly that feed. So this
+-- migration re-runs core_190's DROP+CREATE verbatim (no WHERE/CASE change), the
+-- same way core_190 itself repaired the 044-era views.
+
+BEGIN;
+
+ALTER TABLE tasks
+  ADD COLUMN IF NOT EXISTS created_by bigint REFERENCES builders(id);
+
+COMMENT ON COLUMN tasks.created_by IS
+  'The builder who created this task (task 1003278). NULL = created before attribution existed, or by a system path with no builder in the request — never backfilled, because a guessed attribution is a confident lie. The goals.created_by convention (migration 160).';
+
+CREATE INDEX IF NOT EXISTS idx_tasks_created_by ON tasks (created_by);
+
+-- Rebuild the two t.* views so created_by is projected (bodies identical to
+-- core_190 — the wildcard re-expands to every current column).
+
+DROP VIEW IF EXISTS claimable_tasks;
+CREATE VIEW claimable_tasks AS
+SELECT t.*,
+       pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
+  FROM tasks t
+ WHERE t.status = 'ready'
+   AND t.title NOT LIKE '\_\_smoke\_\_%' ESCAPE '\'
+   AND NOT EXISTS (
+     SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id
+   )
+   AND NOT EXISTS (
+     SELECT 1 FROM claims c
+       JOIN tasks t2 ON t2.id = c.task_id
+      WHERE c.released_at IS NULL
+        AND t2.touches && t.touches
+   );
+
+DROP VIEW IF EXISTS tasks_session_fit;
+CREATE VIEW tasks_session_fit AS
+SELECT t.*,
+  CASE
+    WHEN t.automation_tag = 'overnight-safe' AND COALESCE(t.manual_degree, 5) <= 2
+         AND NOT EXISTS (SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id)
+      THEN ARRAY['autonomous','check-in','active']
+    WHEN t.automation_tag = 'live-only' OR COALESCE(t.manual_degree, 5) >= 4
+      THEN ARRAY['active']
+    ELSE ARRAY['check-in','active']
+  END AS fits_session_modes,
+  pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated,
+  CASE
+    WHEN t.credits_reward > 0
+     AND pms_calibrated_minutes(t.est_minutes, t.kind) IS NOT NULL
+     AND pms_calibrated_minutes(t.est_minutes, t.kind) > 0
+    THEN ROUND(t.credits_reward::numeric / pms_calibrated_minutes(t.est_minutes, t.kind), 3)
+    ELSE NULL
+  END AS credits_per_minute
+FROM tasks t;
+
+COMMIT;
+
+INSERT INTO schema_migrations (version) VALUES ('core_227_task_created_by')
+ON CONFLICT (version) DO NOTHING;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -90,6 +90,8 @@ function createClient(opts = {}) {
       postAccessRequests: (args) => request("POST", "/access-requests", { hasBody: true }, args),
       // PATCH /access-requests/{id} — rank: archon — PATCH /access-requests/:id
       patchAccessRequestsId: (args) => request("PATCH", "/access-requests/{id}", { hasBody: true }, args),
+      // POST /access-requests/invite — rank: archon — POST /access-requests/invite
+      postAccessRequestsInvite: (args) => request("POST", "/access-requests/invite", { hasBody: true }, args),
       // GET /access-requests/status — rank: public — GET /access-requests/status
       getAccessRequestsStatus: (args) => request("GET", "/access-requests/status", { hasBody: false }, args),
     },
@@ -364,6 +366,8 @@ function createClient(opts = {}) {
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
+      // GET /goals/rollups — rank: any-builder — GET /goals/rollups
+      getGoalsRollups: (args) => request("GET", "/goals/rollups", { hasBody: false }, args),
       // GET /goals/suggestions — rank: any-builder — GET /goals/suggestions
       getGoalsSuggestions: (args) => request("GET", "/goals/suggestions", { hasBody: false }, args),
     },

package/modules/government/catalog.js

@@ -127,7 +127,7 @@ const PERMISSIONS = [
   // one of them would make this delegation self-reversible.
   { key: 'builder.status.set', system: false, floor: 'archon', guards: 'PATCH /builders/:id/status — offboard / (de)activate' },
   { key: 'auth.session.revoke', system: false, floor: 'archon', guards: 'POST /auth/revoke, /auth/revoke-all' },
-  { key: 'access_request.review', system: false, floor: 'archon', guards: 'GET/PATCH /access-requests/:id — admit a builder' },
+  { key: 'access_request.review', system: false, floor: 'archon', guards: 'GET/PATCH /access-requests/:id, POST /access-requests/invite — admit a builder' },
 
   // ── operational — floor metic (the working rank's review/triage/authoring) ────
   { key: 'idea.triage', system: false, floor: 'metic', guards: 'PATCH /inbox/:id' },

package/modules/hall-ui/public/builders.js

@@ -79,9 +79,11 @@
       let code = null;
       try {
         const j = res.data;
-        // Prefer the human-facing message; fall back to the machine code.
-        detail = j.message || j.detail || j.error || detail;
-        code = j.error || null;
+        // Prefer the human-facing message; fall back to the machine code. The
+        // envelope (ADR 0116) nests both under `error`; older handlers answer flat.
+        const env = j.error && typeof j.error === 'object' ? j.error : null;
+        detail = (env && env.message) || j.message || j.detail || (typeof j.error === 'string' ? j.error : detail);
+        code = (env && env.code) || (typeof j.error === 'string' ? j.error : null);
       } catch (_) { /* keep default */ }
       const err = new Error(detail);
       err.status = res.status;

package/modules/hall-ui/public/goals-lib.js

@@ -84,11 +84,11 @@
     return false;
   }
 
-  // ms helpers for the goal ordering (task 1002965): updated_at moves on every
-  // task write, shipped_at folded in because a ship path can stamp it without
-  // touching updated_at.
-  const msOf = (iso) => { const t = iso ? Date.parse(iso) : NaN; return Number.isNaN(t) ? 0 : t; };
-  const taskActivityMs = (t) => Math.max(msOf(t.updated_at), msOf(t.shipped_at));
+  // ms helpers for the goal ordering (task 1002965). The DEFINITIONS moved to
+  // task-lib.js in task 1003278 so the Tasks board and the Goals page read ONE
+  // meaning of "touched"; re-exported here so this lib's API is unchanged.
+  // goals.html loads task-lib.js before this file (the render-family order).
+  const { msOf, taskActivityMs } = window.OTBTaskLib;
 
   // task 1003224 — on a LIST, a goal's subtitle is a TOOLTIP, never a second
   // visible line. The board's job there is to let someone find a goal by name;

package/modules/hall-ui/public/goals-page.js

@@ -144,37 +144,60 @@
   // Array#sort is stable in every browser this hall supports — so goals sharing
   // a timestamp (or both missing one) keep their priority order as the tiebreak.
 
-  // Fetch every task for the versions the goals span (one request each, with dep
-  // summaries) and fold into per-goal rollups. Failure-tolerant: an older server
-  // that doesn't honor include=deps just yields empty rollups and the list falls
-  // back to plain cards. Tasks come back priority-ordered, so the first `ready`
-  // one is the goal's best next pick.
+  // Per-goal rollups: readiness counters, the last-activity timestamp, and the
+  // craft set. Since task 1003278 the SERVER computes these (GET /goals/rollups),
+  // one small row per goal.
+  //
+  // WHY IT MOVED, in one number. This used to fetch every task in every version
+  // the board spans — `GET /tasks?version=…&include=deps` — and reduce them here.
+  // On the real corpus that single request measured **5,229,455 bytes for ~1,400
+  // tasks** (2026-08-25) to produce about forty counter objects. The criterion
+  // this page serves says it plainly: "~1,357 tasks on BONGOS-V1 alone. A view
+  // that does not survive that number is not a solution." It did not survive it;
+  // it just did not visibly fall over.
+  //
+  // The buckets, the activity clock and the next-ready pick are unchanged — the
+  // SQL mirrors goals-lib.js `readinessOf` exactly, and a test holds the two
+  // against each other, because a divergence would show a person different
+  // numbers depending on which surface they opened.
+  //
+  // Failure-tolerant, and deliberately NOT falling back to the old whole-version
+  // fetch: a "fallback" that quietly re-downloads 5 MB is the bug wearing a
+  // safety belt. An older server yields empty rollups and the cards render plain.
   async function loadRollups() {
     const versions = [...new Set(state.goals.map((g) => g.version_id).filter(Boolean))];
     const lists = await Promise.all(versions.map((v) =>
-      getJSON(`${API}/tasks?version=${encodeURIComponent(v)}&include=deps`)
-        .then((r) => r.tasks || []).catch(() => [])));
+      getJSON(`${API}/goals/rollups?version=${encodeURIComponent(v)}`)
+        .then((r) => r.rollups || []).catch(() => [])));
     const roll = new Map();
     const activity = new Map();
-    for (const t of lists.flat()) {
-      if (t.goal_id == null) continue;
-      const key = String(t.goal_id);
-      let r = roll.get(key);
-      if (!r) { r = { done: 0, active: 0, ready: 0, blocked: 0, backlog: 0, cut: 0, total: 0, nextReady: null }; roll.set(key, r); }
-      const bucket = readinessOf(t);
-      r[bucket] += 1;
-      if (bucket !== 'cut') r.total += 1;
-      if (bucket === 'ready' && !r.nextReady) r.nextReady = t;
-      // task 1002965 — ANY task activity counts (owner call), not just ships: a
-      // goal being worked right now should read as active before anything lands.
-      // updated_at moves on every task write (claim, status flip, edit), so it
-      // dominates in practice; shipped_at is folded in because a task can be
-      // shipped by a path that stamps it without touching updated_at.
-      const ts = taskActivityMs(t);
-      if (ts && ts > (activity.get(key) || 0)) activity.set(key, ts);
+    const disciplines = new Map(); // task 1003278 — goalId -> Set(craft)
+    for (const row of lists.flat()) {
+      const key = String(row.goal_id);
+      roll.set(key, {
+        done: row.done || 0,
+        active: row.active || 0,
+        ready: row.ready || 0,
+        blocked: row.blocked || 0,
+        backlog: row.backlog || 0,
+        cut: row.cut || 0,
+        total: row.total || 0,
+        // The row shape the renderers already expect: `nextReady` is a task-like
+        // object with an id and a title, and nothing else was ever read off it.
+        nextReady: row.next_ready_id ? { id: row.next_ready_id, title: row.next_ready_title } : null,
+      });
+      const ts = msOf(row.last_activity_at);
+      if (ts) activity.set(key, ts);
+      // The goal's CRAFT set. "Role" here is the craft axis ADR 0174 reserves the
+      // word for (engineer | artist | ideator | ui), never a goal membership —
+      // that is `membership_kind` (ADR 0177). A goal has no discipline column and
+      // must not get one: its craft set is what its tasks carry, which is why the
+      // server aggregates it rather than the goal row storing it.
+      disciplines.set(key, new Set(row.disciplines || []));
     }
     state.rollups = roll;
     state.activity = activity;
+    state.disciplines = disciplines;
   }
 
   /* ---------------- list view ---------------- */
@@ -893,6 +916,14 @@
       // task 1003276 — filled from GET /work-categories after boot
       // (populateCategoryFilter), the populateOwnerFilter pattern.
       { id: 'f-goal-category', label: 'Category', options: [{ value: '', label: '— any —' }] },
+      // task 1003278 — the craft axis (ADR 0174 reserves "role" for the crafts;
+      // a goal membership is a membership_kind, ADR 0177). Values are the
+      // disciplines a goal's tasks carry, derived in loadRollups. Staleness
+      // buckets are the shared STALE_CHOICES from task-lib.js so this page and
+      // the Tasks board offer the same lenses.
+      { id: 'f-goal-role', label: 'Craft', options: [ // ADR 0174: "role" means a craft
+        { value: '', label: '— any —' }, 'engineer', 'artist', 'ideator', 'ui'] },
+      { id: 'f-goal-stale', label: 'Age', options: window.OTBTaskLib.STALE_CHOICES },
       { id: 'f-goal-order',
         label: 'Sort',
         value: GOAL_SORTS[savedGoalSort] ? savedGoalSort : undefined,

package/modules/hall-ui/public/goals-render.js

@@ -60,6 +60,9 @@
     newest: { label: 'newest first', cmp: (a, b) => goalCreatedMs(b) - goalCreatedMs(a), stamp: (g) => ({ label: 'created', ms: goalCreatedMs(g) }) },
     oldest: { label: 'oldest first', cmp: (a, b) => goalCreatedMs(a) - goalCreatedMs(b), stamp: (g) => ({ label: 'created', ms: goalCreatedMs(g) }) },
     active: { label: 'recently active', cmp: (a, b) => goalActivityMs(b) - goalActivityMs(a), stamp: (g) => ({ label: 'last work', ms: goalActivityMs(g) }) },
+    // task 1003278 — the rot view: least-recently-touched first, on the SAME
+    // clock as 'recently active' so the two can never disagree.
+    stale: { label: 'stalest first', cmp: (a, b) => goalActivityMs(a) - goalActivityMs(b), stamp: (g) => ({ label: 'last work', ms: goalActivityMs(g) }) },
   };
   const currentGoalSort = () => GOAL_SORTS[$('#f-goal-order')?.value] || GOAL_SORTS.priority;
   function sortGoals(rows) {
@@ -93,6 +96,16 @@
       || (owner === 'none' ? g.created_by == null : String(g.created_by) === owner);
     const matchesCategory = (g) => !cat
       || (cat === 'none' ? !g.category : (g.category?.slug === cat));
+    // task 1003278 — role + staleness. A goal's role is the discipline set its
+    // tasks carry (loadRollups derives it from the per-version task fetch); its
+    // clock is the same activity timestamp the 'recently active' sort reads, so
+    // sorting and filtering can never disagree about what "touched" means.
+    const role = $('#f-goal-role')?.value || '';
+    const staleDays = $('#f-goal-stale')?.value || '';
+    const { isStale } = window.OTBTaskLib;
+    const matchesRole = (g) => !role
+      || !!(state.disciplines && state.disciplines.get(String(g.id))?.has(role));
+    const matchesStale = (g) => !staleDays || isStale(goalActivityMs(g), staleDays);
     const myId = selfId();
     const iAmMember = (g) => {
       const d = state.details.get(String(g.id));
@@ -104,6 +117,8 @@
       matchesSearch(g) &&
       matchesOwner(g) &&
       matchesCategory(g) &&
+      matchesRole(g) &&
+      matchesStale(g) &&
       (!mineOnly || iAmMember(g)));
   }
   function goalStampHtml(g) {

package/modules/hall-ui/public/hall-render.js

@@ -238,23 +238,43 @@
       else standingRail = window.OTBKit.makeSectionRail({ mount: rail, items, mode: 'scrollspy' });
     }
   }
-  function renderLanding() {
-    // task 1723: collapse the shell nav to the signed-out minimum (Home + a
-    // Sign-in button). Cosmetic — the server gates every page regardless.
-    window.OTBShell?.applyAccess({ authed: false });
-
-    const welcome = $('#welcome-line');
-    if (welcome) welcome.textContent = '';
+  // The project's door, as the platform pushed it into this instance's pack
+  // (window.__BRANDING__.project.joinability, task 1003044): what a stranger is
+  // told to do next depends on it. An older pack reports none → 'apply', today's
+  // behaviour. Cosmetic — the server refuses on its own terms either way.
+  function joinabilityMode() {
+    const p = window.__BRANDING__ && window.__BRANDING__.project;
+    const v = p && p.joinability;
+    return v === 'open' || v === 'invite_only' ? v : 'apply';
+  }
 
-    const landing = $('#landing-root');
-    if (landing) {
-      landing.hidden = false;
-      landing.innerHTML = `
-        <div class="scroll landing">
-          <h2 class="scroll__h">Welcome</h2>
+  // One landing per door: open → sign in and you're in; invite_only → nothing to
+  // apply for, sign in once invited; apply → the request form.
+  function landingDoorHtml(mode) {
+    const hub = `This is the builders' hub for ${brandWorld()} — where builders claim work, earn ${curLabel()}, and track their standing.`;
+    const admitter = escapeHtml(rankLabel('archon'));
+    const signIn = `<p class="landing__cta"><a class="landing__btn" href="${API}/auth/web/start">Sign in with GitHub</a></p>`;
+    if (mode === 'open') {
+      return `
+          <p class="landing__lede">${hub} Anyone with a GitHub account can join: sign in and you're in, starting at the newcomer rank.</p>
+          <div class="landing__request" id="landing-request">
+            <h3 class="landing__request-h">New here — sign in to join</h3>
+            <p class="landing__request-lede">No request and no invite needed. Sign in with GitHub, and a step-by-step guide takes you the rest of the way.</p>
+            ${signIn}
+          </div>`;
+    }
+    if (mode === 'invite_only') {
+      return `
+          <p class="landing__lede">${hub} This project is invite-only: the ${admitter} invites each builder, and there is nothing to apply for here.</p>
+          <div class="landing__request" id="landing-request">
+            <h3 class="landing__request-h">Invited? Sign in</h3>
+            <p class="landing__request-lede">If the ${admitter} has invited you, sign in with GitHub and you're in. If not, ask them for an invite — this project doesn't take requests.</p>
+            ${signIn}
+          </div>`;
+    }
+    return `
           <p class="landing__lede">
-            This is the builders' hub for ${brandWorld()} — where builders claim
-            work, earn ${curLabel()}, and track their standing. Access is
+            ${hub} Access is
             invite-based: an Archon approves each new builder. To begin, request
             access below.
           </p>
@@ -290,7 +310,24 @@
               <button type="submit" class="landing__btn landing__btn--request" id="ar-submit">Request access</button>
               <p class="landing__request-status" id="ar-status" aria-live="polite"></p>
             </form>
-          </div>
+          </div>`;
+  }
+
+  function renderLanding() {
+    // task 1723: collapse the shell nav to the signed-out minimum (Home + a
+    // Sign-in button). Cosmetic — the server gates every page regardless.
+    window.OTBShell?.applyAccess({ authed: false });
+
+    const welcome = $('#welcome-line');
+    if (welcome) welcome.textContent = '';
+
+    const landing = $('#landing-root');
+    if (landing) {
+      landing.hidden = false;
+      landing.innerHTML = `
+        <div class="scroll landing">
+          <h2 class="scroll__h">Welcome</h2>
+          ${landingDoorHtml(joinabilityMode())}
 
           <p class="landing__signin-note">
             Already a member? <a href="${API}/auth/web/start">Sign in with GitHub</a>.
@@ -346,15 +383,19 @@
             </p>`;
         }
       } catch (err) {
-        // Already known to the city — they don't need a request, they need to
-        // sign in. Both the "already a builder" and "already approved" cases
-        // collapse the form into a sign-in prompt rather than a red error.
-        if (err && (err.code === 'already_member' || err.code === 'already_approved')) {
+        // The door's own answers — already a builder, already approved, or a
+        // project that takes no requests (invite-only) / needs none (open) —
+        // collapse the form into what to do instead: sign in. Never a red error.
+        const code = err && err.code;
+        if (code === 'already_member' || code === 'already_approved' || code === 'invite_only' || code === 'open_enrollment') {
           const req = $('#landing-request');
           if (req) {
+            const heading = code === 'invite_only' ? 'This project is invite-only'
+              : code === 'open_enrollment' ? 'No request needed'
+                : 'You already have access ✓';
             req.innerHTML = `
-              <h3 class="landing__request-h">You already have access ✓</h3>
-              <p class="landing__request-lede">${escapeHtml(err.message || 'You already have access.')}</p>
+              <h3 class="landing__request-h">${heading}</h3>
+              <p class="landing__request-lede">${escapeHtml(err.message || 'Sign in with GitHub to continue.')}</p>
               <p class="landing__cta">
                 <a class="landing__btn" href="${API}/auth/web/start">Sign in with GitHub</a>
               </p>`;

package/modules/hall-ui/public/my-projects.js

@@ -130,7 +130,12 @@
       .then(function (r) { return r.json().then(function (b) { return { ok: r.ok, body: b }; }); })
       .then(function (res) {
         joinBtn.disabled = false;
-        if (res.ok && res.body && res.body.message) { joinNote.textContent = res.body.message; joinInput.value = ''; load(); }
+        if (res.ok && res.body && res.body.message) {
+          joinNote.textContent = res.body.message;
+          /* a door refusal rides a 200 (task 1003044): keep the address, and don't repaint as if a request went out */
+          var refused = res.body.status === 'invite_only' || res.body.status === 'open_enrollment' || res.body.status === 'members_only';
+          if (!refused) { joinInput.value = ''; load(); }
+        }
         else if (res.body && res.body.error && res.body.error.code === 'unknown_project') { joinNote.textContent = 'That project isn’t on the platform.'; }
         else { joinNote.textContent = 'Could not request access right now.'; }
       })

package/modules/hall-ui/public/task-lib.js

@@ -108,6 +108,34 @@
   // case leaked a machine code into the Goals page UI. Adding a server-side reason
   // without adding it here degrades quietly rather than loudly, so keep this in
   // step with the claim route's refusal codes.
+  // ---- staleness (task 1003278, criterion legibility-sort-and-staleness) ----
+  // ONE definition of "touched", shared by both tiers: updated_at moves on every
+  // task write (claim, status flip, edit); shipped_at is folded in because a ship
+  // path can stamp it without touching updated_at (the task-1002965 owner call,
+  // previously private to goals-lib.js — moved HERE so the Tasks board and the
+  // Goals page cannot disagree about what "untouched" means).
+  const msOf = (iso) => { const t = iso ? Date.parse(iso) : NaN; return Number.isNaN(t) ? 0 : t; };
+  const taskActivityMs = (t) => Math.max(msOf(t.updated_at), msOf(t.shipped_at));
+
+  // The staleness buckets both boards offer. A CLIENT-side vocabulary, not the
+  // project's configured stale timer (task 1003279 wires that into the sweep);
+  // these are lenses for a person browsing, and the sweep is the enforcement.
+  const STALE_CHOICES = [
+    { value: '', label: '— any age —' },
+    { value: '14', label: 'untouched 14+ days' },
+    { value: '30', label: 'untouched 30+ days' },
+    { value: '60', label: 'untouched 60+ days' },
+  ];
+  // Does this activity timestamp fall past the chosen bucket? '' = no filter.
+  // 0 (no readable timestamp at all) is treated as STALE, not fresh — a row
+  // nobody can date is exactly what a rot-hunt must not hide.
+  function isStale(activityMs, days, nowMs) {
+    const d = Number(days);
+    if (!d) return true;
+    const now = Number.isFinite(nowMs) ? nowMs : Date.now();
+    return now - activityMs >= d * 24 * 60 * 60 * 1000;
+  }
+
   function friendlyBatchReason(item) {
     switch (item && item.reason) {
       case 'TASK_NOT_FOUND': return 'no longer exists';
@@ -128,6 +156,7 @@
   }
 
   const api = {
+    msOf, taskActivityMs, STALE_CHOICES, isStale,
     priorityRank, touchesConflict, rankTagHtml, deHashRefs,
     creditsPerMinute, buildPromptForTask, friendlyBatchReason,
   };

package/modules/hall-ui/public/watch.css

@@ -182,3 +182,11 @@ table.watch tr:hover td { background: var(--surface-2); }
   font-size: 13px; font-weight: 500;
   color: var(--accent-text);
 }
+
+/* Invite by GitHub username (task 1003044) — the Access requests section's own
+   form: the way in on an invite-only project, a shortcut on an apply one. */
+.watch-invite { margin: 0 0 14px; padding: 12px 14px; border: 1px solid var(--line, #e5e0d6); border-radius: 10px; }
+.watch-invite__label { display: block; font-weight: 600; margin-bottom: 6px; }
+.watch-invite__row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
+.watch-invite__row input[type="text"] { flex: 1 1 200px; min-width: 0; }
+.watch-invite__why { margin: 8px 0 0; font-size: 13px; opacity: .8; }

package/modules/hall-ui/public/watch.js

@@ -88,7 +88,11 @@
     const res = await api.request('POST', `${API}${path}`, { body: body || {} });
     if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); throw { kind: '401' }; }
     const data = res.data || {};
-    if (!res.ok) throw new Error(data.message || data.error || `${path} → ${res.status}`);
+    if (!res.ok) {
+      // the envelope (ADR 0116) nests the sentence under `error`; older handlers answer flat
+      const env = data.error && typeof data.error === 'object' ? data.error : null;
+      throw new Error((env && env.message) || data.message || (typeof data.error === 'string' ? data.error : '') || `${path} → ${res.status}`);
+    }
     return data;
   }
 
@@ -183,14 +187,62 @@
   // 1. GATE — access requests (pending)
   // =========================================================================
 
+  // Invite by GitHub username (task 1003044): admits someone BEFORE any request
+  // exists — the only way in on an invite-only project, where nobody can apply,
+  // and a shortcut on an apply one. POST /access-requests/invite writes the same
+  // 'invited' row the sign-in gate reads. The door the project runs comes from
+  // the pack the server injected (window.__BRANDING__.project.joinability).
+  function inviteFormHtml() {
+    const p = window.__BRANDING__ && window.__BRANDING__.project;
+    const mode = (p && p.joinability) || 'apply';
+    const why = mode === 'invite_only'
+      ? 'This project is invite-only — nobody can apply, so this is how people get in.'
+      : mode === 'open'
+        ? 'This project is open — anyone who signs in is admitted, so an invite is rarely needed.'
+        : 'Admit someone before they ask — once invited, their sign-in gets in.';
+    return (
+      '<form class="watch-invite" id="gate-invite" novalidate>' +
+      '<label class="watch-invite__label" for="gate-invite-login">Invite by GitHub username</label>' +
+      '<div class="watch-invite__row">' +
+      '<input type="text" id="gate-invite-login" name="github_login" autocomplete="off" placeholder="e.g. octocat" maxlength="40">' +
+      '<button type="submit" class="watch-btn">Invite</button>' +
+      '</div>' +
+      `<p class="watch-invite__why">${escapeHtml(why)}</p>` +
+      '</form>'
+    );
+  }
+
+  function wireInviteForm(target) {
+    const form = target.querySelector('#gate-invite');
+    if (!form) return;
+    form.addEventListener('submit', async (e) => {
+      e.preventDefault();
+      const input = form.querySelector('#gate-invite-login');
+      const login = ((input && input.value) || '').trim().replace(/^@/, '');
+      if (!login) { toast('A GitHub username is needed.'); return; }
+      const btn = form.querySelector('button[type="submit"]');
+      if (btn) btn.disabled = true;
+      try {
+        const r = await postJson('/access-requests/invite', { github_login: login });
+        toast(r.already_invited ? `@${login} is already invited.` : `@${login} invited — their sign-in gets in.`);
+        await loadGate();
+      } catch (err) {
+        if (err && err.kind === '401') return;
+        if (btn) btn.disabled = false;
+        toast(`Could not invite: ${err.message || err}`);
+      }
+    });
+  }
+
   function renderGate(data, target) {
     const requests = Array.isArray(data.requests) ? data.requests : [];
     setAttention('att-access', requests.length); // tile count = table content
     if (!requests.length) {
-      target.innerHTML = emptyStateHtml('No pending access requests.');
+      target.innerHTML = inviteFormHtml() + emptyStateHtml('No pending access requests.');
+      wireInviteForm(target);
       return;
     }
-    target.innerHTML = requests
+    target.innerHTML = inviteFormHtml() + requests
       .map((r) => {
         const who = r.display_name
           ? `${escapeHtml(r.display_name)} <span class="watch-mono">@${escapeHtml(r.github_login)}</span>`
@@ -221,6 +273,7 @@
       toast(status === 'invited' ? 'Builder invited.' : 'Request dismissed.');
       await loadGate();
     }, 'Could not resolve');
+    wireInviteForm(target);
   }
 
   function loadGate() {