@bongos/core 1.19.374 → 1.19.376

package/modules/onboarding/routes/access-requests.js

@@ -10,11 +10,21 @@
 //   POST /api/bongos/access-requests          PUBLIC (the one unauthenticated GDS
 //                                          write) — a stranger submits their
 //                                          GitHub username; a pending row lands
-//                                          in the queue.
+//                                          in the queue. Refused outright on an
+//                                          invite-only project, and on an open
+//                                          one (sign in — you're in already).
 //   GET  /api/bongos/access-requests          Archon-only — the pending queue (and
 //                                          ?status=invited|dismissed history).
 //   PATCH /api/bongos/access-requests/:id     Archon-only — resolve a request:
 //                                          { status: 'invited' | 'dismissed' }.
+//   POST /api/bongos/access-requests/invite   Archon-only — invite a GitHub
+//                                          username before any request exists:
+//                                          the way in on an invite-only project.
+//
+// Which door a project runs — open / apply / invite_only — is the owner's
+// joinability setting, read through the doorway's joinabilityMode() (task
+// 1003044, ADR 0194): the same reader the sign-in gate uses, so this route and
+// the gate never disagree about whether a stranger may ask.
 //
 // The global IP rate-limiter (mounted in routes.js before every router) guards
 // the public POST against spam. A partial unique index on lower(github_login)
@@ -30,6 +40,14 @@ const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requir
 const { pool } = api;
 const { validateOrRespond, parseId } = api;
 const approvalBroadcast = require('../approval-broadcast');
+const log = api.logger('onboarding');
+
+// The public refusal each door gives a would-be applicant — plain sentences,
+// shown as written by the hall, the CLI, and the hub's join relay.
+const DOOR_REFUSAL = {
+  invite_only: { code: 'invite_only', status: 403, message: 'This project is invite-only — it doesn’t take applications. If you’ve been invited, or already have an account, sign in with GitHub to enter.' },
+  open: { code: 'open_enrollment', status: 409, message: 'This project is open — no request needed. Sign in with GitHub and you’re in.' },
+};
 
 // GitHub usernames: 1–39 chars, alphanumeric or single hyphens, no leading/
 // trailing hyphen. We accept a leading '@' and strip it (people paste "@name").
@@ -46,6 +64,12 @@ module.exports = function buildAccessRequestsRouter() {
   // rank: public — the requester is by definition outside the system (no
   // builder row yet); this is the one public write on the GDS.
   router.post('/access-requests', async (req, res) => {
+    // The door answers first — before validation and before any lookup — so a
+    // refusal costs no query and reveals nothing about who already exists.
+    const refusal = DOOR_REFUSAL[api.joinabilityMode()];
+    if (refusal) {
+      return res.fail(refusal.code, { status: refusal.status, message: refusal.message });
+    }
     if (validateOrRespond(req, res, {
       github_login: { required: true, type: 'string', minLength: 1, maxLength: 60 },
       display_name: { type: 'string', maxLength: 100 },
@@ -204,5 +228,67 @@ module.exports = function buildAccessRequestsRouter() {
     }
   });
 
+  // POST /access-requests/invite — an Archon admits a GitHub username BEFORE any
+  // request exists (task 1003044): the only way in on an invite-only project,
+  // where the public POST refuses, and a shortcut on an apply one. It writes the
+  // same access_request row the sign-in gate reads (status 'invited' —
+  // hasInvitedAccessRequest), so nothing new is consulted at sign-in; a pending
+  // request for that login is resolved in place rather than duplicated. Two
+  // Archons inviting the same login at once can each insert a row (the unique
+  // index covers pending only): harmless — the gate reads "any invited row" —
+  // and it shows as two lines in the invited history, so no lock is taken.
+  // body: { github_login }. 201 with a new row; 200 with the row when a pending
+  // request was resolved; 200 already_invited when an invite already stands;
+  // 409 already_member when they have an account.
+  // rank: archon — the same gate as resolving a request.
+  router.post('/access-requests/invite', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      github_login: { required: true, type: 'string', minLength: 1, maxLength: 60 },
+    })) return;
+    const login = normalizeLogin(req.body.github_login);
+    if (!GITHUB_LOGIN_RE.test(login)) {
+      return res.fail('bad_github_login', { status: 400, message: 'That does not look like a GitHub username.' });
+    }
+    try {
+      const member = await pool.query(
+        `SELECT 1 FROM builders WHERE lower(github_login) = lower($1) LIMIT 1`,
+        [login]
+      );
+      if (member.rows.length > 0) {
+        return res.fail('already_member', { status: 409, message: 'They already have an account here — no invite needed.' });
+      }
+      const standing = await pool.query(
+        `SELECT 1 FROM access_requests
+          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`,
+        [login]
+      );
+      if (standing.rows.length > 0) {
+        return res.json({ ok: true, already_invited: true, github_login: login });
+      }
+      const resolved = await pool.query(
+        `UPDATE access_requests
+            SET status = 'invited',
+                resolved_by_builder_id = $1,
+                resolved_at = now()
+          WHERE lower(github_login) = lower($2) AND status = 'pending'
+          RETURNING id, github_login, status, resolved_at`,
+        [req.builder.id, login]
+      );
+      if (resolved.rows.length > 0) {
+        return res.json({ ok: true, request: resolved.rows[0] });
+      }
+      const { rows } = await pool.query(
+        `INSERT INTO access_requests (github_login, status, resolved_by_builder_id, resolved_at)
+         VALUES ($1, 'invited', $2, now())
+         RETURNING id, github_login, status, resolved_at`,
+        [login, req.builder.id]
+      );
+      return res.status(201).json({ ok: true, request: rows[0] });
+    } catch (err) {
+      log.error('[gds] POST /access-requests/invite', err);
+      return res.fail('invite_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/platform-identity/routes/my-projects.js

@@ -16,6 +16,34 @@ const pi = require('../platform-identity');
 
 const { pool, requireBuilder, validateOrRespond, userAgent } = api;
 
+// joinRelayOutcome — what the project's own admission surface answered, said in
+// the HUB's words (task 1003044). The project decides; the hub relays and must
+// never paint a refusal as "requested" — nor as "unreachable". A 2xx is a filed
+// request; 409 already_member a standing membership; the door refusals (403
+// invite_only, 409 open_enrollment) name the door; a 401 is the project's
+// member-only visibility door (ADR 0192) refusing the ask itself. The project's
+// own sentence is deliberately NOT relayed: a registered project is trusted to
+// build, not to write prose into the platform's UI. Anything else is "not
+// relayed" (null) → the caller's 502.
+const RELAY_SENTENCE = {
+  requested: 'Requested access. The project’s owner admits new builders; once approved, sign in to enter.',
+  already_member: 'You already build on this project — sign in to it to see it here.',
+  invite_only: 'This project is invite-only — it doesn’t take requests. Ask its owner for an invite; once invited, sign in to it.',
+  open_enrollment: 'This project is open — no request needed. Sign in to it and you’re in.',
+  members_only: 'This project is only visible to its members right now, so it can’t take a request from here — ask its owner.',
+};
+function joinRelayOutcome(status, body) {
+  const err = (body && body.error) || null;
+  const code = err && (err.code || err);
+  let outcome;
+  if (status >= 200 && status < 300) outcome = 'requested';
+  else if (code === 'invite_only' || code === 'open_enrollment') outcome = code;
+  else if (status === 409) outcome = 'already_member';
+  else if (status === 401) outcome = 'members_only';
+  else return null;
+  return { status: outcome, message: RELAY_SENTENCE[outcome] };
+}
+
 module.exports = function myProjectsRoutes() {
   const router = express.Router();
 
@@ -56,27 +84,24 @@ module.exports = function myProjectsRoutes() {
       // Relay an access request to the project's OWN (public) admission endpoint —
       // the project decides (open-join, or request/invite per ADR 0112). We post to
       // the registry-trusted origin, never the caller's raw input.
-      let relayed = false;
-      let alreadyMember = false;
+      let outcome = null;
       try {
         const r = await fetch(`${client.origin}/api/gds/access-requests`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
           body: JSON.stringify({ github_login: req.builder.github_login, note: 'via platform My Projects' }),
         });
-        alreadyMember = r.status === 409;
-        relayed = r.ok || r.status === 200 || r.status === 201 || alreadyMember;
+        const body = await r.json().catch(() => null);
+        outcome = joinRelayOutcome(r.status, body);
       } catch (e) {
         console.log('[platform-identity] join relay failed (non-fatal):', e.message);
       }
-      if (!relayed) return res.fail('join_relay_failed', { status: 502, message: 'the project could not be reached to request access' });
+      if (!outcome) return res.fail('join_relay_failed', { status: 502, message: 'the project could not be reached to request access' });
       res.json({
         ok: true,
-        status: alreadyMember ? 'already_member' : 'requested',
+        status: outcome.status,
         project: { name: client.name, origin: client.origin },
-        message: alreadyMember
-          ? 'You already build on this project — sign in to it to see it here.'
-          : 'Requested access. The project’s owner admits new builders; once approved, sign in to enter.',
+        message: outcome.message,
       });
     } catch (err) {
       console.error('[platform-identity] POST /my-projects/join', err);
@@ -138,3 +163,4 @@ module.exports = function myProjectsRoutes() {
 
   return router;
 };
+module.exports.joinRelayOutcome = joinRelayOutcome;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.374",
+  "version": "1.19.376",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.374",
+      "version": "1.19.376",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.374",
+  "version": "1.19.376",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -678,11 +678,19 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
-      <!-- the setting the sibling task (1003044) fills in — placed BELOW the
-           sections that work, so a founder meets controls before promises -->
+      <!-- live since task 1003044: how people join — the membership door. The
+           visibility section's two reads, key for key: the choice shown is
+           the platform's REQUEST (its settings row); what the project actually
+           RUNS is read back from its own public manifest (brand.project.
+           joinability) — never from the save's reply, which is a receipt. The
+           fold is a SIBLING of the volatile slot so no re-render can drop it. -->
       <div class="card" id="mJoinability">
         <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">How people join</h2>
-        <div class="empty"><p>Choosing how new people join — walk right in, apply first, or invite only — isn’t wired up here yet. For now, people apply to join and you invite them.</p></div>
+        <div id="mJoin"><p class="finePrint">Reading the project’s settings…</p></div>
+        <details class="finePrint" id="mJoinWhat">
+          <summary>What each choice changes</summary>
+          <p><b>Anyone can join</b> — whoever signs in with GitHub becomes a member at once, at the newcomer rank. <b>Apply to join</b> — people ask from the project’s hall, you approve each one from the hall’s Watch page, and then they sign in. <b>Invite only</b> — no one can apply: the project’s hall and its sign-in say so, and you invite people by GitHub username from the hall’s Watch page; only an invited person’s sign-in gets in — and people who asked before you switched stay in your queue, to approve or dismiss. Whichever you pick, people who are already members stay members. Changing it restarts the project to pick it up — the line under the choice says what the project is running right now.</p>
+        </details>
       </div>
 
       <!-- live since task 1003042: the teardown control, for a project in ANY
@@ -4379,6 +4387,7 @@ summary{min-height:24px;padding:3px 0;}
     /* same contract: the visibility section's in-flight line reads open_intent
        only, so a queued settings push shows up on the tick without a reload */
     renderVisState(inst);
+    renderJoinState(inst);
     /* the page names its project — in the heading and in the tab */
     $('mTitle').textContent = inst.slug || 'Manage';
     document.title = (inst.slug ? inst.slug + ' — ' : '') + BASE_TITLE;
@@ -4484,6 +4493,7 @@ summary{min-height:24px;padding:3px 0;}
         /* the settings row + the project's own manifest — the same cadence as
            the GitHub read: entry + tab return, never the in-flight tick */
         if (!keepRepo) loadVisibility(inst);
+        if (!keepRepo) loadJoinability(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -4805,6 +4815,162 @@ summary{min-height:24px;padding:3px 0;}
     if (t && t.hasAttribute('data-vis-save')) doVisSave();
   });
 
+  /* ── how people join (task 1003044): the joinability toggle — the visibility
+     section's shape, key for key: the CHOICE from the platform's settings row,
+     what the project RUNS from its own manifest (brand.project.joinability),
+     the save's push.message shown verbatim and never painted as the live
+     state. visPushOpen() is shared: one settings push carries every key. ── */
+
+  var JOIN_OPTIONS = {
+    open: { label: 'Anyone can join', blurb: 'Whoever signs in with GitHub becomes a member right away, at the newcomer rank.' },
+    apply: { label: 'Apply to join', blurb: 'People ask to join from the project’s hall; you approve each one, then they sign in.' },
+    invite_only: { label: 'Invite only', blurb: 'No one can apply. You invite people by GitHub username from the hall, and only an invited person can sign in.' }
+  };
+  var mJoinSettings = null;  /* the platform row's last answer: { value, options } */
+  var mJoinRunsHtml = '';    /* what the project's manifest last said it runs */
+  var mJoinPushSeen = false; /* a settings push was open — re-read the manifest once it settles */
+
+  function joinMsg(html) { $('mJoin').innerHTML = html; }
+
+  function renderJoin() {
+    var s = mJoinSettings;
+    if (!s) return;
+    var opts = (s.options || []).filter(function (v) { return !!JOIN_OPTIONS[v]; });
+    joinMsg('<div role="radiogroup" aria-label="How people join">' + opts.map(function (v) {
+      var o = JOIN_OPTIONS[v];
+      return '<label class="visOpt"><input type="radio" name="mJoinPick" value="' + esc(v) + '"' +
+        (v === s.value ? ' checked' : '') + '><span><b>' + esc(o.label) + '</b>' + esc(o.blurb) + '</span></label>';
+    }).join('') + '</div>' +
+      '<div class="actions"><button type="button" class="btn small" data-join-save>Save</button></div>' +
+      '<div class="projMsg" id="mJoinMsg" role="status" aria-live="polite"></div>' +
+      '<p class="finePrint" id="mJoinRuns">' + mJoinRunsHtml + '</p>');
+    renderJoinState(manageInst);
+  }
+
+  function joinRuns(html) {
+    mJoinRunsHtml = html;
+    var el = $('mJoinRuns');
+    if (el) el.innerHTML = html;
+  }
+
+  /* fetch-free, from open_intent only (renderManage calls it on every repaint) */
+  function renderJoinState(inst) {
+    if (!inst || !$('mJoinRuns')) return;
+    if (visPushOpen(inst)) {
+      mJoinPushSeen = true;
+      joinRuns(inst.open_intent.state === 'running'
+        ? 'Restarting the project to apply a settings change…'
+        : 'A settings change is queued — the project restarts to pick it up. Until then it keeps its current setting.');
+      return;
+    }
+    if (mJoinPushSeen) { mJoinPushSeen = false; loadJoinRuns(inst); }
+  }
+
+  /* what the project RUNS: its own public manifest, read cross-origin */
+  function loadJoinRuns(inst) {
+    if (!inst || inst.status !== 'active' || !inst.domain) { joinRuns(''); return; }
+    var asked = manageId;
+    joinRuns('Checking what the project is running…');
+    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
+    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
+    fetch('https://' + inst.domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
+      .then(function (res) {
+        if (!res.ok) throw new Error('http:' + res.status);
+        return res.json();
+      })
+      .then(function (m) {
+        if (asked !== manageId) return;
+        var p = m && m.brand && m.brand.project;
+        var v = p && p.joinability;
+        if (!p || typeof p !== 'object') {
+          joinRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
+          return;
+        }
+        var o = JOIN_OPTIONS[v];
+        if (!o) { joinRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
+        var want = mJoinSettings && mJoinSettings.value;
+        joinRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
+          (want && want !== v && JOIN_OPTIONS[want] ? ' — the saved choice (' + esc(JOIN_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
+      })
+      .catch(function (err) {
+        if (asked !== manageId) return;
+        var http = /^http:(\d+)$/.exec(String(err && err.message));
+        joinRuns(http
+          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(http[1]) + ').'
+          : 'Couldn’t reach the project to check what it’s running right now.');
+      })
+      .then(function () { if (timer) clearTimeout(timer); });
+  }
+
+  function loadJoinability(inst) {
+    mJoinSettings = null; mJoinRunsHtml = ''; mJoinPushSeen = false;
+    joinMsg('<p class="finePrint">Reading the project’s settings…</p>');
+    var asked = manageId; /* a stale answer must never describe a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        return jsonOrEmpty(res).then(function (data) {
+          if (res.ok) {
+            mJoinSettings = {
+              value: (data.settings || {}).joinability,
+              options: (data.options || {}).joinability || Object.keys(JOIN_OPTIONS)
+            };
+            renderJoin();
+            if (!visPushOpen(inst)) loadJoinRuns(inst);
+            return;
+          }
+          joinMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
+        });
+      })
+      .catch(function (err) {
+        if (String(err && err.message) === 'stale') return;
+        joinMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
+      });
+  }
+
+  /* the save sends the CHOICE and shows the platform's receipt verbatim */
+  function doJoinSave() {
+    if (!manageInst || !mJoinSettings) return;
+    var picked = document.querySelector('#mJoin input[name="mJoinPick"]:checked');
+    if (!picked) return;
+    var value = picked.value;
+    var box = $('mJoinMsg');
+    var btn = document.querySelector('#mJoin [data-join-save]');
+    if (btn) btn.disabled = true;
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ joinability: value })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the row now holds the choice — the radio follows it; the "runs"
+             line does NOT, until the project's own manifest says so */
+          mJoinSettings.value = (data.saved || {}).joinability || value;
+          if (data.push && data.push.queued) mJoinPushSeen = true;
+          box.className = 'projMsg ok';
+          box.textContent = (data.push && data.push.message) || 'Saved.';
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+        box.className = e.code === 'intent_conflict' ? 'projMsg' : 'projMsg err';
+        box.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () {
+      if (btn) btn.disabled = false;
+      loadManage(true, true);
+    });
+  }
+
+  $('mJoin').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-join-save')) doJoinSave();
+  });
+
   /* ── delete the project (task 1003042): the manage page's teardown control.
      It renders from status + open_intent only — no second request — so the
      minute tick can repaint it and a queued teardown appears without a reload.

package/scripts/gds/login.js

@@ -189,11 +189,20 @@ async function main() {
   }
   const instanceName = man.data.name || base;
   const admission = (man.data.admission && man.data.admission.policy) || 'invite-only';
+  // The project's door (task 1003044): brand.project.joinability names which of
+  // open / apply / invite_only it runs; an older core reports none, and then the
+  // binary admission.policy above is all there is to say.
+  // admission.policy 'open' wins over a pushed 'apply': a self-hosted instance on
+  // the legacy open-enrolment flag reports the pack's default while its door is open.
+  const joinability = admission === 'open' ? 'open'
+    : (man.data.brand && man.data.brand.project && man.data.brand.project.joinability) || null;
+  const DOOR_WORD = { open: '', apply: ' (apply to join)', invite_only: ' (invite-only)' };
+  const doorWord = joinability in DOOR_WORD ? DOOR_WORD[joinability] : (admission === 'invite-only' ? ' (invite-only)' : '');
   // Federation (ADR 0141 §1): a hosted instance advertises auth.idp = { origin,
   // client_id } — sign-in then runs through the Cloud Bongos hub, not a local
   // GitHub app. null → the direct-GitHub path, unchanged.
   const idp = (man.data.auth && man.data.auth.idp) || null;
-  log(`  Signing in to ${instanceName}${admission === 'invite-only' ? ' (invite-only)' : ''}${idp ? ' — via Cloud Bongos platform sign-in' : ''}`);
+  log(`  Signing in to ${instanceName}${doorWord}${idp ? ' — via Cloud Bongos platform sign-in' : ''}`);
 
   // 2. Device flow.
   let flow = await runDeviceFlow(base, { log, idp });
@@ -202,6 +211,12 @@ async function main() {
   //    then finish sign-in with a fresh device flow (the first code is spent).
   if (flow.state === 'not_approved') {
     log('');
+    // An invite-only project takes no applications — say so instead of
+    // collecting a username for a request the project would refuse.
+    if (joinability === 'invite_only') {
+      console.error(`✖ ${instanceName} is invite-only — it doesn’t take applications. Ask its owner for an invite, then re-run \`bongos login ${base}\`.`);
+      process.exit(1);
+    }
     log(`  You're not admitted to ${instanceName} yet.`);
     const ghLogin = (await prompt('  Your GitHub username: ')).replace(/^@/, '');
     if (!ghLogin) {
@@ -212,12 +227,18 @@ async function main() {
       method: 'POST',
       body: JSON.stringify({ github_login: ghLogin, note: 'via bongos login' }),
     });
-    if (reqRes.status === 409 && reqRes.data && reqRes.data.error === 'already_member') {
+    // The refusal envelope is { error: { code, message } } (ADR 0116); an older
+    // instance answered a flat { error: 'code' } — read both.
+    const reqErr = (reqRes.data && reqRes.data.error) || null;
+    const reqCode = reqErr && (reqErr.code || reqErr);
+    const reqMessage = reqErr && reqErr.message;
+    if (reqRes.status === 409 && reqCode === 'already_member') {
       log('  You already have an account — retrying sign-in…');
     } else if (reqRes.ok || reqRes.status === 200 || reqRes.status === 201) {
       log(`  ✓ Requested access to ${instanceName}. An Archon approves you with a 👍 in Discord (#member-approvals).`);
     } else {
-      console.error(`✖ could not file an access request (HTTP ${reqRes.status}).`);
+      // the project's own sentence when it gave one (an invite-only or open door)
+      console.error(reqMessage ? `✖ ${reqMessage}` : `✖ could not file an access request (HTTP ${reqRes.status}).`);
       process.exit(1);
     }
     log('  Waiting for approval (safe to leave running)…');

package/src/bongos/auth-admission.js

@@ -121,15 +121,59 @@ async function reportActivityRollup({ builderId, githubId }) {
 // already exists for their github_id) ALWAYS passes — the gate never locks out
 // someone already enrolled.
 //
-// OTB_OPEN_XENOS_ENROLLMENT is the escape-hatch: set it truthy ('1' or 'true')
-// to restore fully-open self-enrollment (anyone with a GitHub account becomes a
-// Xenos) WITHOUT a code change, for an owner who deliberately wants open
-// enrollment. Default (unset/anything-else) = invite required. See ADR 0050.
-function openEnrollmentEnabled() {
+// The project's JOINABILITY decides which of those a first-timer gets (task
+// 1003044, goal 1000058; the owner's 2026-08-16 decision). The owner picks it on
+// the hub's manage page; the platform pushes it into this instance's branding
+// pack as project.joinability (ADR 0190) and it is read through branding(),
+// like platformVisibility — memoized for the process, applied by a restart:
+//   open         a first-time GitHub sign-in self-enrols at xenos — no request,
+//                no invite (what OTB_OPEN_XENOS_ENROLLMENT used to switch on)
+//   apply        (the default — today's behaviour) a stranger files an access
+//                request and an Archon marks it 'invited'; then sign-in admits
+//   invite_only  the public POST /access-requests refuses; only an access
+//                request an Archon CREATED at 'invited' admits a first-timer
+// The legacy OPEN_XENOS_ENROLLMENT flag (ADR 0050) still opens an *apply*
+// project, so a self-hosted instance that set it keeps its open door across the
+// upgrade — but it does not override an explicit invite_only: the stricter,
+// newer choice wins. An unreadable pack fails CLOSED (invite_only): when the
+// door's policy is unknown the widest door is never the fallback.
+function legacyOpenEnrollmentFlag() {
   const v = ic.resolveEnv('OPEN_XENOS_ENROLLMENT');
   return v === '1' || v === 'true';
 }
 
+// joinabilityMode — the project's effective membership door policy: 'open' |
+// 'apply' | 'invite_only'. The one reader every admission surface uses (both
+// sign-in flows, the public access-request route via the doorway, the manifest,
+// the refusal pages), so none of them can disagree about which door this is.
+// `read` is injectable for the unit tests only (the pack is memoized).
+let warnedUnknownJoinability = false;
+function joinabilityMode(read = branding) {
+  let v;
+  try { v = read().project?.joinability; } catch (err) {
+    log.error('[auth] joinability: branding pack unreadable — treating the project as invite-only:', err.message);
+    return 'invite_only';
+  }
+  if (v === 'open' || v === 'invite_only') return v;
+  if (v === undefined || v === null || v === '' || v === 'apply') {
+    return legacyOpenEnrollmentFlag() ? 'open' : 'apply';
+  }
+  // A value this core cannot read ('invite-only' with a hyphen, a truncated
+  // write) is a policy it does not know — never the wider door.
+  if (!warnedUnknownJoinability) {
+    warnedUnknownJoinability = true;
+    log.error(`[auth] joinability: unrecognised value ${JSON.stringify(v)} — treating the project as invite-only`);
+  }
+  return 'invite_only';
+}
+
+// openEnrollmentEnabled — true when a first-time GitHub account self-enrols
+// (joinability 'open'). Kept as the name the four sign-in call sites and the
+// manifest read; the decision itself is joinabilityMode().
+function openEnrollmentEnabled() {
+  return joinabilityMode() === 'open';
+}
+
 // PURE admission decision shared by both flows so they CANNOT drift (SR-19).
 // Returns true when a first-time account must be blocked. `existing` is the
 // builder row (or null) from getBuilderByGithubId; `approved` is the result of
@@ -257,6 +301,7 @@ async function safeSyncRankRole(builder) {
 module.exports = {
   firstAdminLogin,
   firstTimeAdmissionBlocked,
+  joinabilityMode,
   maybeSeatFirstAdmin,
   membershipKind,
   openEnrollmentEnabled,

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -730,6 +730,7 @@ module.exports = {
   loadIdpConfig,
   idpConfigured,
   openEnrollmentEnabled,
+  joinabilityMode,
   firstTimeAdmissionBlocked,
   webAdmissionStatus,
   firstAdminLogin,

package/src/bongos/routes/auth.js

@@ -677,6 +677,21 @@ module.exports = function buildAuthRouter() {
         // approval brings them back to it — the return cookie says where.
         const founderReturn = safeReturnTo(parseCookie(req, RETURN_COOKIE)) || '';
         const onWayToProject = founderReturn.startsWith('/projects');
+        // An invite-only project (task 1003044) takes no applications: say so,
+        // and name the one way in — an invite from the admitter — instead of
+        // sending a stranger to a request form the project refuses.
+        if (auth.joinabilityMode() === 'invite_only') {
+          return res.status(403).type('text/html').send(renderAuthErrorPage(
+            'This project is invite-only',
+            `Signing in with GitHub is only for builders the ${admitterLabel()} has invited. This project doesn’t take applications, so there is nothing to request here. If you know the ${admitterLabel()}, ask them for an invite — once you’re invited, this sign-in lets you in.`,
+            {
+              subtitle: 'Sign-in is for invited builders. This project is invite-only.',
+              cta: { href: '/builders', label: 'Go to the hall' },
+              note: (onWayToProject ? 'You were on your way to creating a project — once invited, sign in again and you land back in it. ' : '') +
+                `Already invited and still blocked? Ask the ${admitterLabel()} to confirm your invite was recorded.`,
+            },
+          ));
+        }
         return res.status(403).type('text/html').send(renderAuthErrorPage(
           'This account is not approved yet',
           `Signing in with GitHub is only for builders the ${admitterLabel()} has already approved. If you are new, request access at the builders’ hall — once the ${admitterLabel()} approves you, this sign-in will let you in. If you were just approved, it may take a moment to be marked invited; try again shortly.`,

package/src/branding.js

@@ -209,8 +209,9 @@ function clientBranding(b = branding()) {
     // says so — and the READ-BACK a manage page needs: a settings PATCH on the
     // platform is only a request until this instance restarts with the value, so
     // the honest place to learn what it RESOLVED from its environment is its own
-    // GET /instance manifest. Resolved, not enforced: enforcement lands with
-    // tasks 1003043 (visibility) and 1003044 (joinability).
+    // GET /instance manifest. Enforced on the instance by the platform-visibility
+    // gate (task 1003043, ADR 0192) and the admission machinery (task 1003044,
+    // ADR 0194 — joinabilityMode() in auth-admission.js).
     project: {
       platformVisibility: b.project?.platformVisibility || 'public',
       joinability: b.project?.joinability || 'apply',