@bongos/core 1.19.409 → 1.19.410

package/modules/lifecycle/db.js

@@ -90,6 +90,7 @@ const {
   setGoalMembershipKind,
   setGoalStatus,
   setGoalSuccessor,
+  setGoalAcceptingRequests,
   setGoalVisibility,
   transferGoalOwnership,
 } = require('./db-goals.js');
@@ -227,8 +228,10 @@ module.exports = {
   rescopeTaskTouches,
   addGoalScopeModules,
   setGoalSuccessor,
-  // Private goals: visibility + the invite/join-request queue (task 1951 / ADR 0112).
+  // Private goals: visibility + the invite/join-request queue (task 1951 / ADR 0112),
+  // plus the D6 open-/closed-to-requests flag (task 1002971).
   setGoalVisibility,
+  setGoalAcceptingRequests,
   createMembershipRequest,
   getMembershipRequest,
   resolveMembershipRequest,

package/modules/lifecycle/goal-edits.js

@@ -289,8 +289,48 @@ function goalVisibilityHandler({ db, authorizeGoalManagement, validateOrRespond,
   };
 }
 
+// goalAcceptingRequestsHandler — PATCH /goals/:id/accepting-requests (task
+// 1002971, spec docs/specs/bongos-v1-privacy-and-invites.md D6): a goal's own
+// authority opens or closes the goal to new join-requests. Lives beside
+// goalVisibilityHandler for the same reason that one does — a write to the goal's
+// own row behind the IDENTICAL gate (authorizeGoalManagement) — and here rather
+// than in routes/goals.js because that file is over the fitness oversize
+// threshold and the ratchet is shrink-only.
+//
+// A SEPARATE route from PATCH /goals/:id/visibility on purpose: they are two
+// different statements a lead makes ("who may see the door" vs "is the door
+// taking knocks"), a lead flips the second far more often than the first, and
+// folding them would make one careless request able to un-privatise a goal. The
+// server does NOT refuse the write on a public goal — the flag is simply
+// meaningless there (self-join needs no request) and the refusal gate is what
+// reads visibility; that also means a goal can be pre-closed before going
+// private without a two-step dance.
+function goalAcceptingRequestsHandler({ db, authorizeGoalManagement, validateOrRespond, parseId }) {
+  return async function patchGoalAcceptingRequests(req, res) {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    if (validateOrRespond(req, res, { accepting_requests: { required: true, type: 'boolean' } })) return;
+    try {
+      const goal = await db.getGoal(id);
+      const actorMembership = goal
+        ? await db.getGoalMember({ goalId: id, builderId: req.builder.id })
+        : null;
+      const decision = authorizeGoalManagement({
+        goal, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
+      });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+      const updated = await db.setGoalAcceptingRequests({ goalId: id, acceptingRequests: req.body.accepting_requests });
+      return res.json({ ok: true, goal: updated });
+    } catch (err) {
+      proseLog().error({ err: err && err.message }, 'PATCH /goals/:id/accepting-requests failed');
+      return res.fail('accepting_requests_update_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
 module.exports = {
   criterionProseRefusal,
+  goalAcceptingRequestsHandler,
   logProseEdit,
   recordProseEdit,
   goalProseHandler,

package/modules/lifecycle/routes/goal-route-authz.js

@@ -236,9 +236,20 @@ function protectedScopeAdmissionBlock({ scopeProtected, actorRank, targetRank })
 // POST /goals/:id/requests (task 1952): a builder asks to join. A request only
 // makes sense where self-join is gated — a PUBLIC, NON-protected goal is open-join,
 // so a request there is refused with a "just join" hint. Ordering:
-// goal_not_found → goal_not_open → already_a_member → goal_is_open (public+unprotected).
+// goal_not_found → goal_not_open → already_a_member → goal_is_open (public+unprotected)
+// → not_accepting_requests (private + closed to applications).
 // isMember is the caller's own membership; scopeProtected is scopeIncludesProtected(goal).
 // PURE + exported (the authorizeGoalTaskCreate precedent).
+//
+// THE CLOSED-TO-REQUESTS ARM (task 1002971, spec D6): a private goal whose lead
+// set accepting_requests=false is not taking applications, so the ask is refused
+// with honest copy rather than queued where nobody will answer it. Deliberately
+// narrowed to visibility='private' — D6 calls the flag meaningless on a public
+// goal (self-join needs no request), so a PUBLIC protected-scope goal keeps
+// today's Archon-mediated request door open whatever the column says. And it is
+// checked HERE, not on the invite paths: closing applications is about
+// unsolicited inbound, and a lead reaching out to a named builder is the
+// deliberate act the flag exists to protect.
 function authorizeCreateJoinRequest({ goal, isMember, scopeProtected }) {
   if (!goal) return { ok: false, status: 404, body: { error: 'goal_not_found' } };
   if (goal.status !== 'open') {
@@ -258,6 +269,12 @@ function authorizeCreateJoinRequest({ goal, isMember, scopeProtected }) {
       message: 'This goal is open — just join it (POST /goals/:id/join); no request needed.',
     } };
   }
+  if (goal.visibility === 'private' && goal.accepting_requests === false) {
+    return { ok: false, status: 409, body: {
+      error: 'not_accepting_requests',
+      message: "This goal isn't taking requests right now.",
+    } };
+  }
   return { ok: true };
 }
 
@@ -374,6 +391,38 @@ function authorizeWithdrawJoinRequest({ request, goalId, actorId }) {
   return { ok: true };
 }
 
+// authorizeRescindInvitation — the gate for POST /goals/:id/invitations/:reqId/rescind
+// (task 1002971): an owner|manager|Archon takes back an invitation the goal SENT
+// but nobody has answered yet. This is the MISSING HALF of core_188's 'cancelled'
+// state, which that migration defined as "withdrawn/rescinded by the opener" —
+// only the requester-withdraw half (authorizeWithdrawJoinRequest) was ever built,
+// so a mis-addressed or regretted invite could only be un-sent by asking the
+// invitee to decline it. The opener is a MANAGER here, not the row's builder_id,
+// which is why the authority prefix is authorizeGoalManagement VERBATIM (the
+// authorizeJoinRequestResponse shape) rather than the "is this your row" identity
+// check its withdraw mirror uses — and it runs BEFORE the request lookup so an
+// unauthorized actor never learns whether an invitation exists (the O1 no-leak
+// ordering). Then request containment + state: request_not_found → wrong_goal →
+// not_an_invitation → not_pending, so this route can never touch a join-request
+// row. Resolving an already-resolved invite is refused (409 not_pending) rather
+// than silently re-cancelled: db.resolveMembershipRequest moves only from
+// status='pending', so a repeat rescind changes no state either way. PURE + exported.
+function authorizeRescindInvitation({ goal, actorId, actorRank, actorMembership, request, goalId }) {
+  const mgmt = authorizeGoalManagement({ goal, actorId, actorRank, actorMembership });
+  if (!mgmt.ok) return mgmt;
+  if (!request) return { ok: false, status: 404, body: { error: 'request_not_found' } };
+  if (String(request.goal_id) !== String(goalId)) {
+    return { ok: false, status: 404, body: { error: 'request_not_found', message: 'No such invitation on this goal.' } };
+  }
+  if (request.kind !== 'invite') {
+    return { ok: false, status: 400, body: { error: 'not_an_invitation', message: 'That row is a join-request, not an invitation.' } };
+  }
+  if (request.status !== 'pending') {
+    return { ok: false, status: 409, body: { error: 'not_pending', status: request.status } };
+  }
+  return { ok: true };
+}
+
 // decorateGoalScope — additive, derived scope_protected flag on goal payloads
 // (task 1002689). A protected-scope goal is join-gated like a private one
 // (Archon-mediated membership, ADR 0086 §3), but the hall cannot re-derive the
@@ -393,6 +442,7 @@ module.exports = {
   authorizeJoinRequestResponse,
   authorizeMembershipKindChange,
   authorizeOwnershipTransfer,
+  authorizeRescindInvitation,
   authorizeWithdrawJoinRequest,
   decorateGoalScope,
   isMemberOrArchon,

package/modules/lifecycle/routes/goals.js

@@ -63,7 +63,7 @@ const JOIN_REQUEST_RESPONSE_ACTIONS = ['approve', 'deny']; // an owner/manager/A
 // proceed; a false result means "not a member" → the route should 403. This is the
 // membership half of the wall; the protected-module rank check is enforced per-route
 // (scope is never self-granted).
-const { authorizeCreateJoinRequest, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
+const { authorizeCreateJoinRequest, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 module.exports = function buildGoalsRouter() {
@@ -334,6 +334,15 @@ module.exports = function buildGoalsRouter() {
   // Pinned in route-rank-check.MODULE_EXPECTED_RANKS['lifecycle'].
   router.patch('/goals/:id/visibility', auth.requireBuilder, goalEdits.goalVisibilityHandler({ db, authorizeGoalManagement, validateOrRespond, parseId, VALID_VISIBILITIES }));
 
+  // PATCH /goals/:id/accepting-requests { accepting_requests } — a private goal's
+  // lead closes or re-opens it to join-requests (task 1002971, spec D6). Closed
+  // refuses new asks with honest copy; INVITATIONS ARE UNAFFECTED, so a lead can
+  // still reach out. Handler in goal-edits.js beside the visibility toggle (the
+  // same gate, the same kind of write); only the registration lives here so
+  // route-rank-check still classifies it.
+  // rank: any-builder (requireBuilder) + the in-handler owner|manager|Archon gate.
+  router.patch('/goals/:id/accepting-requests', auth.requireBuilder, goalEdits.goalAcceptingRequestsHandler({ db, authorizeGoalManagement, validateOrRespond, parseId }));
+
   // ---- the ADVISORY human category (task 1003275, criterion legibility-categories) ----
   // A category ORIENTS a person and steers Claude; it authorises nothing. Nothing
   // in this file, in claim eligibility, or in the claimable feed may branch on it —
@@ -605,6 +614,39 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // POST /goals/:id/invitations/:reqId/rescind — an owner|manager|Archon takes
+  // back a PENDING invitation the goal sent (task 1002971): the manager-side
+  // mirror of the requester's withdraw, and the missing half of core_188's
+  // 'cancelled' state ("withdrawn/rescinded by the opener" — only the requester
+  // half existed). Sets status='cancelled', kept as the audit trail like a deny's
+  // 'rejected'; never touches a join-request row.
+  // rank: any-builder (requireBuilder) + the in-handler authorizeRescindInvitation.
+  router.post('/goals/:id/invitations/:reqId/rescind', auth.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    const reqId = parseId(req, res, { param: 'reqId', code: 'bad_request_id', positiveInt: true });
+    if (reqId === null) return;
+    try {
+      const goal = await db.getGoal(id);
+      const [actorMembership, request] = goal
+        ? await Promise.all([
+            db.getGoalMember({ goalId: id, builderId: req.builder.id }),
+            db.getMembershipRequest(reqId),
+          ])
+        : [null, null];
+      const decision = authorizeRescindInvitation({
+        goal, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership, request, goalId: id,
+      });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+      const resolved = await db.resolveMembershipRequest({ id: reqId, status: 'cancelled', resolvedBy: req.builder.id });
+      if (!resolved) return res.fail('not_pending', { status: 409, message: 'The invitation changed underneath this rescind — re-read and retry.' });
+      return res.json({ ok: true, request: resolved });
+    } catch (err) {
+      log.error('[gds] POST /goals/:id/invitations/:reqId/rescind', err);
+      return res.fail('rescind_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // POST /goals/:id/members — the goal's own authority (owner | manager | Archon)
   // invites a builder to the goal (task 1762: widened from Archon-only so a
   // manager doesn't need an Archon in the loop for a normal goal). This stays the
@@ -1237,6 +1279,9 @@ module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
 // task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
 // same precedent as its siblings above.
 module.exports.authorizeWithdrawJoinRequest = authorizeWithdrawJoinRequest;
+// task 1002971: the manager-side rescind gate — the missing half of core_188's
+// 'cancelled' state; exported for tests/goal_membership_requests.mjs, same precedent.
+module.exports.authorizeRescindInvitation = authorizeRescindInvitation;
 // task 1002689: the derived scope_protected payload decorator — exported for
 // tests/goal_membership_requests.mjs (DB-free), same precedent.
 module.exports.decorateGoalScope = decorateGoalScope;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.409",
+  "version": "1.19.410",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.409",
+      "version": "1.19.410",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.409",
+  "version": "1.19.410",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -391,6 +391,12 @@ const MODULE_EXPECTED_RANKS = {
     // (authorizeWithdrawJoinRequest).
     'GET /goals/:id/requests': 'any-builder',
     'POST /goals/:id/requests/:reqId/withdraw': 'any-builder',
+    // task 1002971 (spec D6): the private-goal open/closed-to-requests toggle and
+    // the manager-side rescind of a pending invitation. Both walls are in-handler
+    // (authorizeGoalManagement / authorizeRescindInvitation), so both stay
+    // 'any-builder' — pinned so an accidental requireRank re-gate reds the build.
+    'PATCH /goals/:id/accepting-requests': 'any-builder',
+    'POST /goals/:id/invitations/:reqId/rescind': 'any-builder',
     // criterion confirmation + goal auto-achieve (ADR 0086 §6) — the planner's close loop.
     'POST /done-when/:criterionId/satisfy': 'metic+archon',
     // runtime criterion create (ADR 0105 gap fix, task 1874) — re-ranked Archon→Metic+

package/src/module-api.js

@@ -1249,8 +1249,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.407 with no explicit bump. run 33216756796. (task 1002620)
 //   1.19.409 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.408 with no explicit bump. run 33217065997. (task 1002620)
+//   1.19.410 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.409 with no explicit bump. run 33217599338. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.409'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.410'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_membership_requests.mjs

@@ -19,6 +19,10 @@
 //     goal is still OPEN (a stale invite can't admit to an achieved/archived goal);
 //     declining stays allowed, so the route declines before ever reading the goal.
 //   • the migration is additive + private-safe (default 'public', partial unique).
+//   • setGoalAcceptingRequests + the D6 closed-to-requests gate (task 1002971) —
+//     a private goal can stop taking join-requests WITHOUT stopping invitations.
+//   • authorizeRescindInvitation (task 1002971) — the manager-side rescind, the
+//     missing half of core_188's 'cancelled' state.
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -32,6 +36,7 @@ process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
 const {
   setGoalVisibility,
+  setGoalAcceptingRequests,
   createMembershipRequest,
   getMembershipRequest,
   resolveMembershipRequest,
@@ -48,6 +53,8 @@ const {
   authorizeInvitationAccept,
   authorizeJoinRequestResponse,
   authorizeWithdrawJoinRequest,
+  authorizeRescindInvitation,
+  authorizeGoalManagement,
   decorateGoalScope,
 } = require('../modules/lifecycle/routes/goals.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
@@ -76,6 +83,27 @@ await test('setGoalVisibility: writes visibility + returns the goal row', async
   assert.deepEqual(q.params, [7, 'private']);
 });
 
+// =========================================================================
+// setGoalAcceptingRequests (task 1002971, spec D6) — the same shape as its
+// visibility sibling: the route owns WHO may call it, the helper just writes.
+// =========================================================================
+
+await test('setGoalAcceptingRequests: writes the flag + returns the goal row', async () => {
+  const GOAL = { id: 7, visibility: 'private', accepting_requests: false };
+  const pool = fakePool((s) => (/UPDATE goals SET accepting_requests = \$2/.test(s) ? { rows: [GOAL] } : null));
+  const g = await setGoalAcceptingRequests({ goalId: 7, acceptingRequests: false }, { pool });
+  assert.deepEqual(g, GOAL);
+  const q = find(pool.queries, /UPDATE goals SET accepting_requests/);
+  assert.deepEqual(q.params, [7, false]);
+  assert.ok(/RETURNING .*accepting_requests/.test(norm(q.sql)),
+    'the returned row carries the flag, so the hall can render the toggle state');
+});
+
+await test('setGoalAcceptingRequests: unknown goal → null', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await setGoalAcceptingRequests({ goalId: 999, acceptingRequests: true }, { pool }), null);
+});
+
 await test('setGoalVisibility: unknown goal → null', async () => {
   const pool = fakePool(() => ({ rows: [] }));
   assert.equal(await setGoalVisibility({ goalId: 999, visibility: 'public' }, { pool }), null);
@@ -302,6 +330,15 @@ await test('migration core_188: additive, defaults public, partial-unique pendin
     'migration is purely additive');
 });
 
+await test('migration core_229: accepting_requests is additive and defaults TRUE', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const sql = readFileSync(join(here, '..', 'migrations', 'core_229_goals_accepting_requests.sql'), 'utf8');
+  assert.ok(/ADD COLUMN IF NOT EXISTS accepting_requests boolean NOT NULL DEFAULT true/.test(sql),
+    'defaults true so every existing private goal keeps taking requests');
+  assert.ok(!/\bDROP\s+(TABLE|COLUMN|INDEX)\b|\bDELETE\s+FROM\b|\bTRUNCATE\b/i.test(sql),
+    'migration is purely additive');
+});
+
 // =========================================================================
 // The pure route gates (task 1952) — DB-free, ordering included.
 // =========================================================================
@@ -348,6 +385,45 @@ await test('authorizeCreateJoinRequest: public but PROTECTED scope → ALLOW (no
   assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'public' }, isMember: false, scopeProtected: true }), { ok: true });
 });
 
+// The D6 closed-to-requests arm (task 1002971). A private goal whose lead closed
+// applications refuses the ask with honest copy instead of queueing it.
+const CLOSED_PRIVATE = { id: 5, status: 'open', created_by: '1', visibility: 'private', accepting_requests: false };
+await test('authorizeCreateJoinRequest: private + closed → 409 not_accepting_requests, honest copy', () => {
+  const d = authorizeCreateJoinRequest({ goal: CLOSED_PRIVATE, isMember: false, scopeProtected: false });
+  assert.equal(d.status, 409);
+  assert.equal(d.body.error, 'not_accepting_requests');
+  assert.equal(d.body.message, "This goal isn't taking requests right now.",
+    'the spec D6 copy verbatim — the refusal says why, it does not pretend the goal is gone');
+});
+await test('authorizeCreateJoinRequest: private + explicitly accepting → ALLOW', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { ...CLOSED_PRIVATE, accepting_requests: true }, isMember: false, scopeProtected: false }), { ok: true });
+});
+// A goal row read before the migration (or by an older release) has no such key.
+// Only an explicit false closes the door — undefined must never read as closed.
+await test('authorizeCreateJoinRequest: private, flag absent → ALLOW (fails OPEN, not closed)', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'private' }, isMember: false, scopeProtected: false }), { ok: true });
+});
+// D6 calls the flag meaningless on a public goal, so a PUBLIC protected-scope goal
+// keeps its Archon-mediated request door open whatever the column says.
+await test('authorizeCreateJoinRequest: PUBLIC protected goal + closed flag → ALLOW (flag is private-only)', () => {
+  assert.deepEqual(authorizeCreateJoinRequest({ goal: { status: 'open', visibility: 'public', accepting_requests: false }, isMember: false, scopeProtected: true }), { ok: true });
+});
+// The whole point of D6: closing applications is about unsolicited inbound. The
+// invite path is gated by authorizeGoalManagement, which never reads the flag —
+// so a lead can still invite into a goal that is closed to requests.
+await test('closed to requests: INVITATIONS are unaffected — the invite gate still allows the owner', () => {
+  assert.deepEqual(authorizeGoalManagement({ goal: CLOSED_PRIVATE, actorId: '1', actorRank: 'metic', actorMembership: null }), { ok: true });
+});
+await test('routes: the invitation paths never read accepting_requests (only the request gate does)', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const authz = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goal-route-authz.js'), 'utf8');
+  const gates = authz.match(/^function authorize\w+[\s\S]*?^}/gm) || [];
+  const reading = gates.filter((g) => /goal\.accepting_requests/.test(g));
+  assert.equal(reading.length, 1, 'exactly one gate reads the flag');
+  assert.ok(/^function authorizeCreateJoinRequest/.test(reading[0]),
+    'and it is the JOIN-REQUEST gate — invitations must stay unaffected (spec D6)');
+});
+
 // authorizeInvitationResponse — only the invitee resolves their own pending invite.
 const INVITE = { id: 9, goal_id: '5', builder_id: '2', kind: 'invite', status: 'pending' };
 await test('authorizeInvitationResponse: unknown request → 404', () => {
@@ -480,6 +556,80 @@ await test('authorizeWithdrawJoinRequest: the requester (string vs number id)
   assert.deepEqual(authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: '5', actorId: 2 }), { ok: true });
 });
 
+// =========================================================================
+// authorizeRescindInvitation (task 1002971) — the manager-side mirror of
+// withdraw, and the missing half of core_188's 'cancelled' state. Authority is
+// authorizeGoalManagement (owner|manager|Archon), checked BEFORE the request
+// lookup so an unauthorized actor never learns an invitation exists.
+// =========================================================================
+
+const RESCIND_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
+const PENDING_INVITE = { id: 12, goal_id: '5', builder_id: '2', kind: 'invite', status: 'pending' };
+const rescind = (over = {}) => authorizeRescindInvitation({
+  goal: RESCIND_GOAL, actorId: '1', actorRank: 'metic', actorMembership: null,
+  request: PENDING_INVITE, goalId: 5, ...over,
+});
+
+await test('authorizeRescindInvitation: the goal OWNER → ALLOW', () => {
+  assert.deepEqual(rescind(), { ok: true });
+});
+await test('authorizeRescindInvitation: a manager (lead) → ALLOW', () => {
+  assert.deepEqual(rescind({ actorId: '3', actorMembership: mgr(3) }), { ok: true });
+});
+await test('authorizeRescindInvitation: an Archon → ALLOW (acts as owner anywhere)', () => {
+  assert.deepEqual(rescind({ actorId: '99', actorRank: 'archon' }), { ok: true });
+});
+await test('authorizeRescindInvitation: a non-owner/manager → 403 (before any request lookup — no leak)', () => {
+  const d = rescind({ actorId: '7' });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');
+  const blind = authorizeRescindInvitation({
+    goal: RESCIND_GOAL, actorId: '7', actorRank: 'metic', actorMembership: null, request: null, goalId: 5,
+  });
+  assert.deepEqual(blind, d, 'the answer is identical whether or not the invitation exists');
+});
+await test('authorizeRescindInvitation: the INVITEE cannot rescind their own invitation → 403', () => {
+  const d = rescind({ actorId: '2' });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_owner_or_manager');
+});
+await test('authorizeRescindInvitation: unknown request → 404', () => {
+  const d = rescind({ request: null });
+  assert.equal(d.status, 404); assert.equal(d.body.error, 'request_not_found');
+});
+await test('authorizeRescindInvitation: invitation on a different goal → 404 (containment)', () => {
+  assert.equal(rescind({ request: { ...PENDING_INVITE, goal_id: '99' } }).status, 404);
+});
+await test('authorizeRescindInvitation: row is a join-request, not an invitation → 400', () => {
+  const d = rescind({ request: { ...PENDING_INVITE, kind: 'request' } });
+  assert.equal(d.status, 400); assert.equal(d.body.error, 'not_an_invitation');
+});
+// Rescinding an invite that is already resolved changes nothing: the gate refuses
+// 409 not_pending, and db.resolveMembershipRequest moves only from 'pending', so a
+// repeat rescind can never re-cancel an accepted membership.
+await test('authorizeRescindInvitation: already resolved → 409 not_pending (no state change on a repeat)', () => {
+  for (const status of ['accepted', 'rejected', 'cancelled']) {
+    const d = rescind({ request: { ...PENDING_INVITE, status } });
+    assert.equal(d.status, 409); assert.equal(d.body.error, 'not_pending'); assert.equal(d.body.status, status);
+  }
+});
+await test('authorizeRescindInvitation: a closed goal cannot be managed → 409 goal_not_open', () => {
+  const d = rescind({ goal: { ...RESCIND_GOAL, status: 'archived' } });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'goal_not_open');
+});
+// The route must land the state core_188 already defined for "rescinded by the
+// opener" — not a second word for the same thing (source-pinned, the addGoalMember
+// resolvedBy precedent; the live route is exercised in goal_routes.mjs).
+await test('routes: the rescind route resolves to cancelled, attributed to the actor', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const handler = src.slice(src.indexOf("router.post('/goals/:id/invitations/:reqId/rescind'"));
+  assert.ok(handler.startsWith("router.post('/goals/:id/invitations/:reqId/rescind'"), 'the rescind route exists');
+  const body = handler.slice(0, handler.indexOf('\n  });'));
+  assert.ok(/db\.resolveMembershipRequest\(\{ id: reqId, status: 'cancelled', resolvedBy: req\.builder\.id \}\)/.test(body),
+    "cancelled — core_188's 'withdrawn/rescinded by the opener' state, attributed to the rescinder");
+  assert.ok(body.indexOf('authorizeRescindInvitation({') < body.indexOf('db.resolveMembershipRequest('),
+    'the gate runs before the write');
+});
+
 // =========================================================================
 // decorateGoalScope (task 1002689) — goal payloads carry a derived
 // scope_protected flag so the hall can render the join-gate on a
@@ -509,7 +659,7 @@ await test('decorateGoalScope: returns a copy, never mutates the row', () => {
 // stay 'any-builder'; an accidental requireRank re-gate must be a red build.
 // =========================================================================
 
-await test('route-rank pins: the eight private-goal routes are pinned any-builder', () => {
+await test('route-rank pins: the ten private-goal routes are pinned any-builder', () => {
   const pins = MODULE_EXPECTED_RANKS.lifecycle;
   for (const r of [
     'GET /goals/inbox',
@@ -520,6 +670,9 @@ await test('route-rank pins: the eight private-goal routes are pinned any-builde
     'POST /goals/:id/invitations/:reqId/respond',
     'GET /goals/:id/requests',
     'POST /goals/:id/requests/:reqId/withdraw',
+    // task 1002971 — the D6 toggle + the manager-side rescind.
+    'PATCH /goals/:id/accepting-requests',
+    'POST /goals/:id/invitations/:reqId/rescind',
   ]) {
     assert.equal(pins[r], 'any-builder', `${r} must be pinned any-builder (wall is in-handler)`);
   }

package/tests/prose_edits.mjs

@@ -182,16 +182,20 @@ await test('ROUTE SHAPE: the author gate is fail-closed and uses the array form
   assert.match(src, /captured_by != null/, 'and the author check treats a NULL author as not-you');
 });
 
-await test('ROUTE SHAPE: the goal + visibility handlers share ONE authority gate', () => {
-  // Both were moved into goal-edits.js precisely because they are the same kind
-  // of operation behind the same gate; this pins that they still are.
+await test('ROUTE SHAPE: every goal-edit handler shares ONE authority gate', () => {
+  // Each was moved into goal-edits.js precisely because they are the same kind
+  // of operation behind the same gate; this pins that they still are. The count
+  // grows with the file — task 1002971 added the D6 accepting-requests toggle,
+  // the third write to a goal's own row behind authorizeGoalManagement.
   const src = readFileSync(new URL('../modules/lifecycle/goal-edits.js', import.meta.url), 'utf8');
-  assert.equal((src.match(/authorizeGoalManagement\(/g) || []).length, 2, 'prose + visibility, both gated');
+  assert.equal((src.match(/authorizeGoalManagement\(/g) || []).length, 3, 'prose + visibility + accepting-requests, all gated');
   assert.equal(typeof goalEdits.goalProseHandler, 'function');
   assert.equal(typeof goalEdits.goalVisibilityHandler, 'function');
+  assert.equal(typeof goalEdits.goalAcceptingRequestsHandler, 'function');
   const routes = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
   assert.match(routes, /router\.patch\('\/goals\/:id',/, 'the REGISTRATION stays in the route file so route-rank-check sees it');
   assert.match(routes, /router\.patch\('\/goals\/:id\/visibility',/);
+  assert.match(routes, /router\.patch\('\/goals\/:id\/accepting-requests',/);
 });
 
 // ---- 5. THE HANDLERS ARE ACTUALLY INVOKED ---------------------------------