@bongos/core 1.19.395 → 1.19.396

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.395",
-  "core_contract": "1.19.395",
-  "source_commit": "c6682951454183e1d8561983b2bb2295aced7775",
+  "core_version": "1.19.396",
+  "core_contract": "1.19.396",
+  "source_commit": "b4632d6e8d92e8096e958762a36e810fc24c9c35",
   "source_ref": "HEAD",
-  "built_at": "2026-08-28T16:02:31.625Z",
+  "built_at": "2026-08-28T16:08:46.136Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 345,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1634,
+    "functional_verbatim": 1635,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2002,
-  "tree_sha256": "354b4dc6de55dc65198160070a23c27d7aa950cd96962014f2f436a5ccfaefc8",
+  "file_count": 2003,
+  "tree_sha256": "950c8c43ac98c0e161e25a1c17cd699ad9582392105dcd0abadc8efc090a95c8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -372,7 +372,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "e2924c48715177477a8f828e2118f832acad6b3f63ae7b4fe5f124e80a4e7c17"
+      "sha256": "88bfa3b136c58ce104a56cb2b7c922f11b55ae9e8ca0ec0d30d67bdb78ed70cf"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1497,12 +1497,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "3e488311a87f4db6ffbb85b26c7a61fba0204ff6cc1cc8ab6c09b2ae21cea24b"
+      "sha256": "567afe22acead45477a501c61b9aea2f6a99eac1cfa3cf87e143f7b5077567ca"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "6e93e2f283103158bc46062459b79b5528424ffb57f4730eb29a1cdba1b4976b"
+      "sha256": "e53b70240119fe856005a7627177d26bf559ab60fb003db5a7a31274fa432616"
     },
     {
       "path": "docs/architecture.md",
@@ -1527,12 +1527,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "fabaf96fa63e3bf2e690619ef11038b3503154368aeaa9c10d8eb2641e306dee"
+      "sha256": "52655bf8c7a2c5860a1ce4486f1715769eba8b3e7162a4e43c78d582c935b7b0"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "cfdea83dda157439808ea4d0ef9ba7af11e77ad4693b6dd135cdddc529754583"
+      "sha256": "da37e58c70ef12e106d81be96072ee66ec52cb26ac4e624b18ca2455b90719d3"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -3912,17 +3912,17 @@
     {
       "path": "modules/hall-ui/public/my-projects.css",
       "mode": "0000644",
-      "sha256": "5c702a9c2054287a8523b6901cd46e7caa1cb9580b7e8f04a3898b2c8bd82fd0"
+      "sha256": "443e24fc3e403cfc97c36a8f81fe81a540be84cbe52b6af86a1476fb87bc44b6"
     },
     {
       "path": "modules/hall-ui/public/my-projects.html",
       "mode": "0000644",
-      "sha256": "49c63ef48e0fc6450ba15d76743c8220b5d5f27702843be71fa077551d92c35b"
+      "sha256": "764221e2425c7430e83469fc865198e1020bcc8c5950aae6c3c1cecb49132721"
     },
     {
       "path": "modules/hall-ui/public/my-projects.js",
       "mode": "0000644",
-      "sha256": "25195cabf71890f93f065e2aa15e899d51c251807e59ba14a147150c5b6228a3"
+      "sha256": "e664a08787727fcd7019fe3008e3b9d63d07b9ab8be5043a46d3fcac5218f261"
     },
     {
       "path": "modules/hall-ui/public/not-ready.html",
@@ -4737,7 +4737,7 @@
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
-      "sha256": "4fadf91c0d40f3e5dd5d53f9ebe3ec825fd16a13aab41a76e8af25c911e11edf"
+      "sha256": "fc948963cef6f7ef71b488cc5627310b6b217f3f62e13030b4da42a08e92796c"
     },
     {
       "path": "modules/platform-identity/routes/profile.js",
@@ -5212,12 +5212,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "58c9432c30c1c3c319aa7c526368a890cc9722773a0fb4f31bed0e59e1d5ebe9"
+      "sha256": "7dd6552859e62daf201d9fdd1c17f95ea4a97bac3e5dc95d175ed0c8bbac88c7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8a4b801babd875eed0c1ca44c26640f0745a8e7a1fc82c51fea271333e68e62c"
+      "sha256": "292bfaf5419d894c03339b6363173872ba73e896a9dceec60ff625568fe9ed60"
     },
     {
       "path": "public-docs/index.html",
@@ -7207,7 +7207,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5ead37acb3188ec29cea517b3b256b2882ca304152e30ecfea7d2ef82716bce2"
+      "sha256": "711a3add8803459721523364c9c993e30908475bebdf65eb83789f5520e91104"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8744,6 +8744,11 @@
       "mode": "0000644",
       "sha256": "d00e82184fbf7aab49c9b6efe5709b14f300ca0cea277a0eb140f073ded7ff50"
     },
+    {
+      "path": "tests/join_application_note.mjs",
+      "mode": "0000644",
+      "sha256": "6db72752d69ebdfcc82bdf4f0e2445d7c8a939f6b4b88c1915c9f1d2f8eb9d76"
+    },
     {
       "path": "tests/join_relay_outcome.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -292,7 +292,7 @@ export interface PostModulesKeySubmitResponse { ok: boolean; submission: unknown
 export interface PostMyProjectsClientIdLeaveResponse { ok: boolean; left: unknown }
 export interface PostMyProjectsInvitesClientIdAcceptResponse { ok: boolean; accepted: boolean }
 export interface PostMyProjectsInvitesClientIdDeclineResponse { ok: boolean; accepted: boolean }
-export interface PostMyProjectsJoinRequest { origin: string }
+export interface PostMyProjectsJoinRequest { origin: string; note?: string }
 export interface PostMyProjectsJoinResponse { ok: boolean; status: unknown; project: unknown; message: unknown }
 export interface PostOverrideRequestsIdDecideRequest { decision: string; note?: string }
 export interface PostProjectsInviteRequest { client_id: string; github_login: string }

package/docs/api/openapi.json

@@ -18967,6 +18967,10 @@
           "origin": {
             "type": "string",
             "maxLength": 512
+          },
+          "note": {
+            "type": "string",
+            "maxLength": 400
           }
         },
         "required": [

package/docs/api-reference.md

@@ -395,7 +395,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/my-projects/invites` | `any-builder` | — | the caller's OWN pending invitations (ADR 0141 §5). |
 | POST | `/api/bongos/my-projects/invites/:clientId/accept` | `any-builder` | — | accept an invite (pending → builder) for the caller's OWN account. |
 | POST | `/api/bongos/my-projects/invites/:clientId/decline` | `any-builder` | — | decline an invite (delete the pending row) for the caller's OWN account. |
-| POST | `/api/bongos/my-projects/join` | `any-builder` | `origin` | request to join a project. |
+| POST | `/api/bongos/my-projects/join` | `any-builder` | `origin`, `note` | request to join a project. |
 
 ## `override-requests` (2)
 

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1533 strings** across 3 surfaces · 1334 distinct pieces of copy · 1533 certain, 0 heuristic · 154 shown in more than one place.
+**1535 strings** across 3 surfaces · 1336 distinct pieces of copy · 1535 certain, 0 heuristic · 154 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 71 | 1128 |
+| `builders-hall` | `modules/hall-ui/public` | 71 | 1130 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 98 |
 | `landing` | `public-landing` | 5 | 307 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c10806b50c61` | 2x | Claim task {…} | modules/hall-ui/public/goals-render.js:280, modules/hall-ui/public/work.js:417 |
 | … | | _114 more in the JSON registry_ | |
 
-## `builders-hall` — 1128 strings
+## `builders-hall` — 1130 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -135,6 +135,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:65` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:162` |
 | `f6036360c90c` | certain | Activity, by craft | `modules/hall-ui/public/profile.html:84` |
+| `b8476c677e7c` | certain | Add a note (optional) | `modules/hall-ui/public/my-projects.html:52` |
 | `62eded408097` | certain | Add {…} | `modules/hall-ui/public/profile-nudge.js:68` |
 | `7cf0163d4cde` | certain | Aggregate totals across every recorded work session. | `modules/hall-ui/public/sessions.html:35` |
 | `8b736e365191` | certain | All builders | `modules/hall-ui/public/hall-render.js:1039` |
@@ -148,6 +149,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `69f0ca4a4d84` | certain | Analytics scope | `modules/hall-ui/public/hall-render.js:1037` |
 | `14bdceaac078` | certain | Answer the five questions and this spark becomes a Full Idea. | `modules/hall-ui/public/ideas.js:423` |
 | `52ed0e2e3470` | certain | Any rank | `modules/hall-ui/public/task-lib.js:62` |
+| `1ab0e6d5b079` | certain | Anything the project's owner should know — what you'd like to work on, who you are. | `modules/hall-ui/public/my-projects.html:54` |
 | `c89833aa985a` | certain | Approval failed — try again. | `modules/hall-ui/public/pair.js:92` |
 | `0832ba017c90` | certain | Approve & re-run | `modules/hall-ui/public/gate.js:100` |
 | `222121f67525` | certain | Approve only if you just clicked “Connect” in the Dev Box app on your own machine. Approving signs that app in | `modules/hall-ui/public/pair.html:30` |
@@ -306,8 +308,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8b470cebf53d` | certain | Could not remove your key. Try again. | `modules/hall-ui/public/settings.js:1093` |
 | `4cf6bc8b377b` | certain | Could not remove. Try again. | `modules/hall-ui/public/settings.js:1092` |
 | `7a778d188e87` | certain | Could not remove: {…} | `modules/hall-ui/public/government.js:336` |
-| `ebeda72a6c15` | certain | Could not request access right now. | `modules/hall-ui/public/my-projects.js:140` |
-| `ebeda72a6c15` | certain | Could not request access right now. | `modules/hall-ui/public/my-projects.js:142` |
+| `ebeda72a6c15` | certain | Could not request access right now. | `modules/hall-ui/public/my-projects.js:146` |
+| `ebeda72a6c15` | certain | Could not request access right now. | `modules/hall-ui/public/my-projects.js:148` |
 | `bb5a7753e62b` | certain | Could not reset: {…} | `modules/hall-ui/public/government.js:275` |
 | `b526ee0b8c48` | certain | Could not save just now. Try again. | `modules/hall-ui/public/builders.js:459` |
 | `41a351aea8d4` | certain | Could not save the volume. Try again. | `modules/hall-ui/public/settings.js:214` |
@@ -338,7 +340,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `278e8281c82f` | certain | Could not vote: {…} | `modules/hall-ui/public/government.js:913` |
 | `a48e9f098392` | certain | Could not {…} just now. | `modules/hall-ui/public/goals-render.js:951` |
 | `cb09ee26014f` | certain | Could not {…}: {…} | `modules/hall-ui/public/government.js:288` |
-| `7f600651bbf1` | certain | Couldn’t load your projects right now. | `modules/hall-ui/public/my-projects.js:115` |
+| `7f600651bbf1` | certain | Couldn’t load your projects right now. | `modules/hall-ui/public/my-projects.js:117` |
 | `28ec06f6060a` | certain | Counted, not judged: each question is worth the same, and earns its share in proportion to how much real text  | `modules/hall-ui/public/ideas.html:104` |
 | `38827a954f3b` | certain | Create a custom rank first. | `modules/hall-ui/public/government.js:419` |
 | `dd8ead7adc9a` | certain | Create rank | `modules/hall-ui/public/government.html:69` |
@@ -383,7 +385,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7f1b1c32d360` | certain | Each slash-command can run on a different model. The system has a default for every skill; choose another to o | `modules/hall-ui/public/settings.html:245` |
 | `854a21d2eb39` | certain | Eight achievements recognize sustained contribution. Earned ones are highlighted; the rest show what’s left to | `modules/hall-ui/public/hall-widgets.js:197` |
 | `58d381535285` | certain | Engagement reports | `modules/hall-ui/public/watch.html:120` |
-| `35d1ae09a6b3` | certain | Enter a project URL. | `modules/hall-ui/public/my-projects.js:122` |
+| `35d1ae09a6b3` | certain | Enter a project URL. | `modules/hall-ui/public/my-projects.js:124` |
 | `bd7a40639a1c` | certain | Estimate (min) | `modules/hall-ui/public/task-detail.js:362` |
 | `c15d1f0ddfb6` | certain | Estimation accuracy | `modules/hall-ui/public/watch.html:133` |
 | `44f928d13699` | certain | Event sounds | `modules/hall-ui/public/settings.html:282` |
@@ -826,7 +828,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
 | `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:321` |
-| `4a8d1beb6f98` | certain | That project isn’t on the platform. | `modules/hall-ui/public/my-projects.js:139` |
+| `4a8d1beb6f98` | certain | That project isn’t on the platform. | `modules/hall-ui/public/my-projects.js:145` |
 | `c0e28f30524d` | certain | That project's own standing, as reported by that project. | `modules/hall-ui/public/profile.js:230` |
 | `50198c465225` | certain | The 16-value rank enum in three bands, which ranks are live, and the permissions each rank holds. | `modules/hall-ui/public/diagrams.html:68` |
 | `1569b8838862` | certain | The Dev Box app now acts as | `modules/hall-ui/public/pair.js:40` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1533,
-    "unique_ids": 1334,
-    "certain": 1533,
+    "strings": 1535,
+    "unique_ids": 1336,
+    "certain": 1535,
     "heuristic": 0,
     "duplicate_ids": 154
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 71,
-      "strings": 1128
+      "strings": 1130
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -589,8 +589,8 @@
       "text": "Could not request access right now.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/my-projects.js:140",
-        "modules/hall-ui/public/my-projects.js:142"
+        "modules/hall-ui/public/my-projects.js:146",
+        "modules/hall-ui/public/my-projects.js:148"
       ]
     },
     {
@@ -2102,6 +2102,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "b8476c677e7c",
+      "surface": "builders-hall",
+      "text": "Add a note (optional)",
+      "file": "modules/hall-ui/public/my-projects.html",
+      "line": 52,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "62eded408097",
       "surface": "builders-hall",
@@ -2219,6 +2228,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "1ab0e6d5b079",
+      "surface": "builders-hall",
+      "text": "Anything the project's owner should know — what you'd like to work on, who you are.",
+      "file": "modules/hall-ui/public/my-projects.html",
+      "line": 54,
+      "origin": "html-attr:placeholder",
+      "confidence": "certain"
+    },
     {
       "id": "c89833aa985a",
       "surface": "builders-hall",
@@ -3646,7 +3664,7 @@
       "surface": "builders-hall",
       "text": "Could not request access right now.",
       "file": "modules/hall-ui/public/my-projects.js",
-      "line": 140,
+      "line": 146,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3655,7 +3673,7 @@
       "surface": "builders-hall",
       "text": "Could not request access right now.",
       "file": "modules/hall-ui/public/my-projects.js",
-      "line": 142,
+      "line": 148,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3934,7 +3952,7 @@
       "surface": "builders-hall",
       "text": "Couldn’t load your projects right now.",
       "file": "modules/hall-ui/public/my-projects.js",
-      "line": 115,
+      "line": 117,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4339,7 +4357,7 @@
       "surface": "builders-hall",
       "text": "Enter a project URL.",
       "file": "modules/hall-ui/public/my-projects.js",
-      "line": 122,
+      "line": 124,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8326,7 +8344,7 @@
       "surface": "builders-hall",
       "text": "That project isn’t on the platform.",
       "file": "modules/hall-ui/public/my-projects.js",
-      "line": 139,
+      "line": 145,
       "origin": "js-text-assign",
       "confidence": "certain"
     },

package/modules/hall-ui/public/my-projects.css

@@ -37,4 +37,26 @@
   background: var(--surface);
   color: var(--ink);
 }
+/* The application's optional note (task 1002330). Sits under the one-click join
+   row so the click stays the primary act and the note is plainly skippable. */
+.join-note-label {
+  display: block;
+  margin: 10px 0 4px;
+  color: var(--ink-soft);
+  font-size: 12px;
+}
+.join-note {
+  display: block;
+  width: 100%;
+  box-sizing: border-box;
+  font: inherit;
+  font-size: 13px;
+  line-height: 1.4;
+  padding: 6px 10px;
+  resize: vertical;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface);
+  color: var(--ink);
+}
 .note { margin: 10px 0 0; color: var(--ink-soft); font-size: 13px; min-height: 1.2em; }

package/modules/hall-ui/public/my-projects.html

@@ -46,7 +46,13 @@
             <input id="join-origin" type="url" placeholder="https://project.cloudbongos.com" autocomplete="off">
             <button id="join-btn" type="button" class="btn-ghost">Request to join</button>
           </div>
-          <p id="join-note" class="note"></p>
+          <!-- An application is one click; the note is the applicant's own words,
+               and it is optional on purpose (task 1002330 — lightweight, never an
+               owner-defined form). It reaches the project owner's queue. -->
+          <label class="join-note-label" for="join-note">Add a note (optional)</label>
+          <textarea id="join-note" class="join-note" rows="2" maxlength="400"
+                    placeholder="Anything the project's owner should know — what you'd like to work on, who you are."></textarea>
+          <p id="join-status" class="note"></p>
         </section>
       </main>
 

package/modules/hall-ui/public/my-projects.js

@@ -1,6 +1,7 @@
 // my-projects.js — the signed-in builder's cross-project view (ADR 0141 §3, task
 // #1002112). Fetches /api/gds/my-projects (session cookie, same-origin) and renders
-// owned + building-on lists with self-service leave, plus a join-by-origin form.
+// owned + building-on lists with self-service leave, plus a join-by-origin form
+// whose application is one click plus an optional note (task 1002330).
 // All network values are rendered via textContent — never innerHTML.
 (function () {
   'use strict';
@@ -8,7 +9,8 @@
   var buildingEl = document.getElementById('building');
   var joinBtn = document.getElementById('join-btn');
   var joinInput = document.getElementById('join-origin');
-  var joinNote = document.getElementById('join-note');
+  var joinNoteInput = document.getElementById('join-note');   // the applicant's own words (optional)
+  var joinStatus = document.getElementById('join-status');    // what the project answered
 
   function el(tag, cls) { var e = document.createElement(tag); if (cls) e.className = cls; return e; }
 
@@ -119,27 +121,31 @@
 
   joinBtn.addEventListener('click', function () {
     var origin = (joinInput.value || '').trim();
-    if (!origin) { joinNote.textContent = 'Enter a project URL.'; return; }
+    if (!origin) { joinStatus.textContent = 'Enter a project URL.'; return; }
+    var note = (joinNoteInput.value || '').trim();
     joinBtn.disabled = true;
-    joinNote.textContent = 'Requesting…';
+    joinStatus.textContent = 'Requesting…';
     fetch('/api/gds/my-projects/join', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ origin: origin }),
+      /* note is omitted entirely when blank — an application with nothing written
+         is still an application (task 1002330). */
+      body: JSON.stringify(note ? { origin: origin, note: note } : { origin: origin }),
     })
       .then(function (r) { return r.json().then(function (b) { return { ok: r.ok, body: b }; }); })
       .then(function (res) {
         joinBtn.disabled = false;
         if (res.ok && res.body && res.body.message) {
-          joinNote.textContent = res.body.message;
-          /* a door refusal rides a 200 (task 1003044): keep the address, and don't repaint as if a request went out */
+          joinStatus.textContent = res.body.message;
+          /* a door refusal rides a 200 (task 1003044): keep the address AND the
+             note the applicant wrote, and don't repaint as if a request went out */
           var refused = res.body.status === 'invite_only' || res.body.status === 'open_enrollment' || res.body.status === 'members_only';
-          if (!refused) { joinInput.value = ''; load(); }
+          if (!refused) { joinInput.value = ''; joinNoteInput.value = ''; load(); }
         }
-        else if (res.body && res.body.error && res.body.error.code === 'unknown_project') { joinNote.textContent = 'That project isn’t on the platform.'; }
-        else { joinNote.textContent = 'Could not request access right now.'; }
+        else if (res.body && res.body.error && res.body.error.code === 'unknown_project') { joinStatus.textContent = 'That project isn’t on the platform.'; }
+        else { joinStatus.textContent = 'Could not request access right now.'; }
       })
-      .catch(function () { joinBtn.disabled = false; joinNote.textContent = 'Could not request access right now.'; });
+      .catch(function () { joinBtn.disabled = false; joinStatus.textContent = 'Could not request access right now.'; });
   });
 
   load();

package/modules/platform-identity/routes/my-projects.js

@@ -2,7 +2,9 @@
 // project "My Projects" view + self-service join / leave (ADR 0141 §3, task #1002112).
 //
 //   GET  /my-projects              — projects this account builds on, owned grouped apart
-//   POST /my-projects/join         — request to join a project (executed by the project)
+//   POST /my-projects/join         — apply to a project: one click plus an optional
+//                                    note in the applicant's own words (task 1002330).
+//                                    Relayed; the project executes and decides.
 //   POST /my-projects/:clientId/leave — self-service offboard (reflected to the hub)
 //
 // All gated on a live HUB session (requireBuilder). Authority stays LOCAL: JOIN only
@@ -44,6 +46,40 @@ function joinRelayOutcome(status, body) {
   return { status: outcome, message: RELAY_SENTENCE[outcome] };
 }
 
+// The provenance line the project's owner reads when an application arrives
+// through the platform rather than off their own landing page. It is the HUB's
+// sentence, not the applicant's — see relayApplicationNote.
+const RELAY_PROVENANCE = 'via platform My Projects';
+
+// What an applicant may write, and what the project will store. The project's
+// public POST /access-requests caps `note` at 500 chars and `display_name` at
+// 100, and refuses anything longer with a 400 — which joinRelayOutcome cannot
+// read, so the hub would tell the applicant the project "could not be reached".
+// A lie about someone else's door because our own field was too long is the bug
+// these two caps exist to prevent: the hub asks for less than the project takes,
+// and clamps anyway.
+const APPLICANT_NOTE_MAX = 400;
+const APPLICANT_NAME_MAX = 100;
+
+// relayApplicationNote — the note that reaches the project's queue: the
+// applicant's own words plus where the request came from (task 1002330). An
+// application with nothing written is still an application, so an absent note
+// relays the provenance line alone — exactly what this route sent before the
+// applicant could write anything. Pure; clamped so the composed string always
+// fits the project's 500-char column.
+function relayApplicationNote(note) {
+  const written = String(note == null ? '' : note).trim().slice(0, APPLICANT_NOTE_MAX);
+  return written ? `${written} (${RELAY_PROVENANCE})` : RELAY_PROVENANCE;
+}
+
+// relayApplicantName — the applicant's display name as the project should show
+// it, or null when they have none (the queue then reads as the bare @login it
+// always did). Clamped to the project's column.
+function relayApplicantName(displayName) {
+  const name = String(displayName == null ? '' : displayName).trim().slice(0, APPLICANT_NAME_MAX);
+  return name || null;
+}
+
 module.exports = function myProjectsRoutes() {
   const router = express.Router();
 
@@ -75,7 +111,10 @@ module.exports = function myProjectsRoutes() {
   // stays local). SSRF guard: only relay to an origin that is a REGISTERED, active
   // client — never an arbitrary builder-supplied URL.
   router.post('/my-projects/join', requireBuilder, async (req, res) => {
-    if (validateOrRespond(req, res, { origin: { required: true, type: 'string', maxLength: 512 } })) return;
+    if (validateOrRespond(req, res, {
+      origin: { required: true, type: 'string', maxLength: 512 },
+      note: { type: 'string', maxLength: APPLICANT_NOTE_MAX },
+    })) return;
     try {
       const client = await pi.getClientByOrigin(req.body.origin, { pool });
       if (!client || client.status !== 'active' || !client.origin) {
@@ -89,7 +128,11 @@ module.exports = function myProjectsRoutes() {
         const r = await fetch(`${client.origin}/api/gds/access-requests`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
-          body: JSON.stringify({ github_login: req.builder.github_login, note: 'via platform My Projects' }),
+          body: JSON.stringify({
+            github_login: req.builder.github_login,
+            display_name: relayApplicantName(req.builder.display_name),
+            note: relayApplicationNote(req.body.note),
+          }),
         });
         const body = await r.json().catch(() => null);
         outcome = joinRelayOutcome(r.status, body);
@@ -164,3 +207,7 @@ module.exports = function myProjectsRoutes() {
   return router;
 };
 module.exports.joinRelayOutcome = joinRelayOutcome;
+module.exports.relayApplicationNote = relayApplicationNote;
+module.exports.relayApplicantName = relayApplicantName;
+module.exports.APPLICANT_NOTE_MAX = APPLICANT_NOTE_MAX;
+

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.395",
+  "version": "1.19.396",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.395",
+      "version": "1.19.396",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.395",
+  "version": "1.19.396",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1230,8 +1230,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.393 with no explicit bump. run 33182535783. (task 1002620)
 //   1.19.395 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.394 with no explicit bump. run 33188021384. (task 1002620)
+//   1.19.396 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.395 with no explicit bump. run 33188525568. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.395'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.396'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/join_application_note.mjs

@@ -0,0 +1,112 @@
+// tests/join_application_note.mjs — a project-level application is one click plus
+// an optional note (task 1002330, ADR 0182 D6 / the admin-console spec's D2).
+//
+// The hub does not admit anyone; it relays the application to the project's own
+// public POST /access-requests, which is what the owner's queue reads. So what
+// this file pins is the composition of that relayed row:
+//
+//   - the applicant's own words reach the owner, with the hub's provenance line
+//     saying where the request came from;
+//   - writing nothing is still an application — the pre-1002330 behaviour;
+//   - nothing the applicant types can push the relayed fields past the project's
+//     own column caps (500 note / 100 display_name), because a 400 from the
+//     project is a status joinRelayOutcome cannot read, and the applicant would
+//     then be told the project "could not be reached" — a lie about someone
+//     else's door caused by our own field.
+//
+// Pure, DB-free.
+//
+// Run:  node --test tests/join_application_note.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import {
+  relayApplicationNote,
+  relayApplicantName,
+  APPLICANT_NOTE_MAX,
+} from '../modules/platform-identity/routes/my-projects.js';
+
+// The caps the PROJECT's public POST /access-requests enforces on the row it
+// stores (modules/onboarding/routes/access-requests.js). Restated here so this
+// test fails if the hub ever starts asking for more than a project will take.
+const PROJECT_NOTE_MAX = 500;
+const PROJECT_NAME_MAX = 100;
+
+test('the applicant’s own words reach the owner, with where it came from', () => {
+  const note = relayApplicationNote("I'd like to help with the terrain work");
+  assert.match(note, /I'd like to help with the terrain work/);
+  assert.match(note, /via platform My Projects/);
+});
+
+test('an application with nothing written is still an application', () => {
+  for (const empty of [undefined, null, '', '   ', '\n\t']) {
+    assert.equal(relayApplicationNote(empty), 'via platform My Projects',
+      `${JSON.stringify(empty)} relays the provenance line alone`);
+  }
+});
+
+test('the composed note always fits the project’s column', () => {
+  const composed = relayApplicationNote('x'.repeat(5000));
+  assert.ok(composed.length <= PROJECT_NOTE_MAX,
+    `composed note is ${composed.length} chars, project stores ${PROJECT_NOTE_MAX}`);
+  assert.match(composed, /via platform My Projects/, 'provenance survives the clamp');
+});
+
+test('the hub asks for less note than the project will take', () => {
+  const suffix = relayApplicationNote('').length + ' ()'.length;
+  assert.ok(APPLICANT_NOTE_MAX + suffix <= PROJECT_NOTE_MAX,
+    'the validator cap plus the provenance suffix must fit the project’s 500');
+});
+
+test('a display name travels so the queue reads as a person, not a bare login', () => {
+  assert.equal(relayApplicantName('  Jane Doe  '), 'Jane Doe');
+  const clamped = relayApplicantName('n'.repeat(400));
+  assert.ok(clamped.length <= PROJECT_NAME_MAX);
+});
+
+test('no display name relays null — the queue keeps the bare @login it always had', () => {
+  for (const empty of [undefined, null, '', '   ']) {
+    assert.equal(relayApplicantName(empty), null, `${JSON.stringify(empty)}`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The wiring — that the composed note actually travels, and that the applicant's
+// words survive a door refusal. Source assertions (the house pattern in
+// tests/joinability_invite_only.mjs): the relay needs a live hub session and a
+// second running project to exercise, which no unit test can boot.
+// ---------------------------------------------------------------------------
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const src = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+test('the relay sends the composed note and the applicant’s name — not a constant', () => {
+  const route = src('modules/platform-identity/routes/my-projects.js');
+  const join = (route.match(/router\.post\('\/my-projects\/join'[\s\S]*?\n  \}\);\n/) || [''])[0];
+  assert.ok(join, 'the join route must exist');
+  assert.match(join, /note: relayApplicationNote\(req\.body\.note\)/, 'the applicant’s words are composed, then relayed');
+  assert.match(join, /display_name: relayApplicantName\(req\.builder\.display_name\)/);
+  assert.doesNotMatch(join, /note: 'via platform My Projects'/, 'the hardcoded note is gone');
+  assert.match(join, /note: \{ type: 'string', maxLength: APPLICANT_NOTE_MAX \}/, 'the note is declared in the route’s schema');
+});
+
+test('the join box offers the note as optional, and never demands it', () => {
+  const html = src('modules/hall-ui/public/my-projects.html');
+  assert.match(html, /<textarea id="join-note"/, 'the note field exists');
+  assert.match(html, /maxlength="400"/, 'the field cannot outrun the route’s cap');
+  assert.match(html, /Add a note \(optional\)/, 'and it is labelled optional');
+  assert.match(html, /id="join-status"/, 'the answer line is its own element, not the note field');
+});
+
+test('a door refusal keeps what the applicant typed; a filed request clears it', () => {
+  const js = src('modules/hall-ui/public/my-projects.js');
+  const click = (js.match(/joinBtn\.addEventListener\('click'[\s\S]*?\n  \}\);\n/) || [''])[0];
+  assert.ok(click, 'the join handler must exist');
+  assert.match(click, /note \? \{ origin: origin, note: note \} : \{ origin: origin \}/, 'a blank note is omitted, not sent as ""');
+  assert.match(click, /if \(!refused\) \{ joinInput\.value = ''; joinNoteInput\.value = ''; load\(\); \}/,
+    'cleared only when the request was actually filed — a refusal keeps the words for the next try');
+});