@bongos/core 1.19.409 → 1.19.411

package/docs/modules-contract.md

@@ -54,6 +54,8 @@ A module's `module.json` declares `"coreVersion": "^1.4.0"` (a semver range). Th
 
 **Current `CORE_VERSION`:** `1.8.0`
 
+> The table below is a hand-maintained summary of the MINOR bumps only, and it lags. The authoritative, complete release ledger — every version, including the CI carrier patches — is [`docs/module-api-changelog.md`](module-api-changelog.md) ([ADR 0203](adr/<redacted>.md) moved it out of `src/module-api.js`); the live value is the `const CORE_VERSION` literal in `src/module-api.js`.
+
 | Bump | What it added |
 |---|---|
 | 1.0.0 | Initial doorway: auth gates, pool accessor, config/branding, seams. |

package/docs/recipes/core-release-pipeline.md

@@ -72,7 +72,7 @@ Three steps. The first two are ordinary claimed work; only the publish (2c) is o
 
 ### 2a. Bump `CORE_VERSION` — the step with no automation behind it
 
-`CORE_VERSION` lives in [`src/module-api.js`](../../src/module-api.js) and is bumped **by hand, inside a claimed task**, with a changelog line in the same file. It is never auto-bumped: the version's provenance stays in git history + changelog ([ADR 0137](../adr/<redacted>.md) §2).
+`CORE_VERSION` lives in [`src/module-api.js`](../../src/module-api.js) and is bumped **by hand, inside a claimed task**, with an entry appended to the release ledger [`docs/module-api-changelog.md`](../module-api-changelog.md) in the same commit. (The ledger used to be a comment block inside `module-api.js`; appending to it there on every CI release grew the file past the oversized-file fitness ratchet and broke `unit` on `main` — [ADR 0203](../adr/<redacted>.md).) The version's provenance stays in git history + ledger ([ADR 0137](../adr/<redacted>.md) §2).
 
 Semver here is not decoration — it decides **who receives the change automatically** ([ADR 0136](../adr/<redacted>.md)):
 
@@ -82,7 +82,7 @@ Semver here is not decoration — it decides **who receives the change automatic
 | **minor** — an added export / additive surface | ❌ **invisible to them** | ✅ |
 | **major** — never automatic for anyone | ❌ | ❌ |
 
-The practical trap: a **MINOR is silently withheld from every patch-only instance**, which is the default channel. If a fix must reach the fleet, it belongs behind a *patch* bump — so an additive export shipped alongside a needed fix will strand that fix. The changelog convention is to justify the level explicitly ("the doorway surface is byte-identical to X, so despite the volume this is → PATCH").
+The practical trap: a **MINOR is silently withheld from every patch-only instance**, which is the default channel. If a fix must reach the fleet, it belongs behind a *patch* bump — so an additive export shipped alongside a needed fix will strand that fix. The ledger convention is to justify the level explicitly ("the doorway surface is byte-identical to X, so despite the volume this is → PATCH").
 
 **A bump is mandatory even for a one-file fix.** `bongos upgrade` refuses an equal version, and npm rejects a duplicate — a natural guard, and the reason "carrier bumps" exist to sweep up commits that landed with no bump behind them.
 
@@ -99,7 +99,7 @@ node scripts/gds/package-core.js --ref main --self-verify
 
 ### 2c. Publish — automatic on merge
 
-**Every merge to `main` publishes** ([ADR 0161](../adr/<redacted>.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push, the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, changelog line included), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
+**Every merge to `main` publishes** ([ADR 0161](../adr/<redacted>.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push, the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, which writes the literal AND appends the ledger entry to [`docs/module-api-changelog.md`](../module-api-changelog.md) — ADR 0203; the carrier commit stages both), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
 
 The lane is armed by the owner via the `PUBLISH_ON_MERGE=1` repo variable + two secrets (`NPM_TOKEN`, `RELEASE_PUSH_TOKEN`); while disarmed it no-ops loudly. Manual fallback, same command CI runs:
 

package/docs/recipes/private-npm-distribution.md

@@ -55,7 +55,7 @@ npm publish ./clients/bongos-client               # real (publishConfig makes it
 
 The steps below remain as the **manual fallback** (lane disarmed, npm outage, or a deliberate out-of-band release):
 
-1. **Bump `CORE_VERSION`** in [`src/module-api.js`](../../src/module-api.js) (semver; a **patch** for a fix, **minor** for additive surface — a **major** is a deliberate, human-only event) and add a one-line changelog entry in the same file. This bump is a normal claimed task, not a release-tool side effect — the version's provenance stays in the git history + changelog.
+1. **Bump `CORE_VERSION`** in [`src/module-api.js`](../../src/module-api.js) (semver; a **patch** for a fix, **minor** for additive surface — a **major** is a deliberate, human-only event) and append an entry to the release ledger [`docs/module-api-changelog.md`](../module-api-changelog.md) in the same commit ([ADR 0203](../adr/<redacted>.md) moved that ledger out of `module-api.js`). This bump is a normal claimed task, not a release-tool side effect — the version's provenance stays in the git history + ledger.
 2. **Publish** (owner, from a clean checkout of the released commit):
    ```sh
    node scripts/gds/package-core.js --publish        # DRY-RUN: runs the fail-closed no-leak gate, previews @bongos/core@<version>

package/migrations/core_229_goals_accepting_requests.sql

@@ -0,0 +1,37 @@
+-- core_229_goals_accepting_requests.sql — a private goal can be CLOSED to
+-- join-requests without being closed as a goal (task 1002971, spec
+-- docs/specs/bongos-v1-privacy-and-invites.md D6).
+--
+-- core_188 gave a goal `visibility`, and a private goal has always accepted
+-- join-requests: the only "we're not taking applications" a lead could express
+-- was to archive the goal, which is a different (and destructive) statement.
+-- `accepting_requests` separates the two: a private goal with it FALSE still
+-- runs, still invites, still shows in the list — it just refuses new
+-- join-requests with honest copy instead of queueing asks nobody will answer.
+--
+-- INVITATIONS ARE UNAFFECTED BY DESIGN. Closing applications is about unsolicited
+-- inbound; a lead reaching out to a specific builder is the deliberate act the
+-- flag exists to protect. The flag is likewise MEANINGLESS on a public goal
+-- (self-join needs no request), which is why the toggle renders only on private
+-- goals — the column still exists on every row so the write path needs no
+-- branch, and the refusal gate reads visibility first.
+--
+-- goals is a CORE-owned table (created in 160_goal_tier; ADR 0083 §Decision 5 —
+-- a module migration may touch only its own <key>_ objects), so this lives in
+-- core migrations/, core_-namespaced (ADR 0108 §5: a core migration numbered
+-- above LEGACY_BARE_CORE_MAX=187 must carry the core_ prefix, else the fitness
+-- namespacing check reds the build).
+--
+-- PURELY ADDITIVE + idempotent: DEFAULT true means every existing goal keeps
+-- today's behaviour (a private goal takes requests), NOT NULL is safe because
+-- the default backfills, and IF NOT EXISTS makes a replay a no-op.
+-- Fresh-DB-replay safe; no hard-coded builder ids (learning 1238). migrate.sh
+-- records this file's stem in schema_migrations (the modern 187 pattern — the
+-- file does not self-insert).
+
+BEGIN;
+
+ALTER TABLE goals
+  ADD COLUMN IF NOT EXISTS accepting_requests boolean NOT NULL DEFAULT true;
+
+COMMIT;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -324,6 +324,8 @@ function createClient(opts = {}) {
       getGoalsId: (args) => request("GET", "/goals/{id}", { hasBody: false }, args),
       // PATCH /goals/{id} — rank: any-builder — PATCH /goals/:id
       patchGoalsId: (args) => request("PATCH", "/goals/{id}", { hasBody: true }, args),
+      // PATCH /goals/{id}/accepting-requests — rank: any-builder — PATCH /goals/:id/accepting-requests
+      patchGoalsIdAcceptingRequests: (args) => request("PATCH", "/goals/{id}/accepting-requests", { hasBody: true }, args),
       // POST /goals/{id}/archive — rank: metic+archon — POST /goals/:id/archive
       postGoalsIdArchive: (args) => request("POST", "/goals/{id}/archive", { hasBody: true }, args),
       // PATCH /goals/{id}/category — rank: any-builder — PATCH /goals/:id/category
@@ -334,6 +336,8 @@ function createClient(opts = {}) {
       postGoalsIdConflictsResolve: (args) => request("POST", "/goals/{id}/conflicts/resolve", { hasBody: true }, args),
       // POST /goals/{id}/invitations — rank: any-builder — POST /goals/:id/invitations
       postGoalsIdInvitations: (args) => request("POST", "/goals/{id}/invitations", { hasBody: true }, args),
+      // POST /goals/{id}/invitations/{reqId}/rescind — rank: any-builder — POST /goals/:id/invitations/:reqId/rescind
+      postGoalsIdInvitationsReqIdRescind: (args) => request("POST", "/goals/{id}/invitations/{reqId}/rescind", { hasBody: true }, args),
       // POST /goals/{id}/invitations/{reqId}/respond — rank: any-builder — POST /goals/:id/invitations/:reqId/respond
       postGoalsIdInvitationsReqIdRespond: (args) => request("POST", "/goals/{id}/invitations/{reqId}/respond", { hasBody: true }, args),
       // POST /goals/{id}/join — rank: any-builder — POST /goals/:id/join

package/modules/hall-ui/public/goals-page.js

@@ -678,9 +678,31 @@
     }
   }
 
+  // rescindInvitation (task 1002971) — the goal's own authority takes back an
+  // invitation nobody has answered yet, the manager-side mirror of the
+  // requester's Withdraw. Shares respondToJoinRequest's in-flight guard so a
+  // double-click can't fire two rescinds at one row.
+  async function rescindInvitation(goalId, reqId, btn) {
+    const key = `rescind:${reqId}`;
+    if (pendingActionsPending.has(key)) return;
+    pendingActionsPending.add(key);
+    if (btn) btn.disabled = true;
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/invitations/${encodeURIComponent(reqId)}/rescind`, {});
+      toast('Invitation rescinded.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+    } catch (err) {
+      toast((err && err.data && err.data.message) || 'Could not rescind that invitation just now.');
+      if (btn) btn.disabled = false;
+    } finally {
+      pendingActionsPending.delete(key);
+    }
+  }
+
   // task 1953 — every pending row on THIS goal, rendered for a manager: join
-  // requests get Approve/Deny; outstanding invites are informational (only the
-  // invitee can accept/decline theirs — the server has no manager-cancel route).
+  // requests get Approve/Deny; an outstanding invite the goal sent can be
+  // rescinded (task 1002971), and only the invitee can accept/decline theirs.
 
   // task 1953 — async membership-queue load, kicked off (fire-and-forget) from
   // renderDetail like loadGoalTasks: my own pending request on this goal (any
@@ -1060,6 +1082,8 @@
     if (approveBtn) { respondToJoinRequest(state.current, approveBtn.dataset.approveReq, 'approve', approveBtn); return; }
     const denyBtn = e.target.closest('[data-deny-req]');
     if (denyBtn) { respondToJoinRequest(state.current, denyBtn.dataset.denyReq, 'deny', denyBtn); return; }
+    const rescindBtn = e.target.closest('[data-rescind-inv]');
+    if (rescindBtn) { rescindInvitation(state.current, rescindBtn.dataset.rescindInv, rescindBtn); return; }
   });
   window.addEventListener('hashchange', route);
 

package/modules/hall-ui/public/goals-render.js

@@ -772,6 +772,13 @@
       const nextVisibility = g.visibility === 'private' ? 'public' : 'private';
       const label = g.visibility === 'private' ? '🔒 Private — make public' : 'Make private';
       parts.push(`<button class="btn-ghost" id="goal-visibility-btn" type="button" data-next-visibility="${escapeHtml(nextVisibility)}">${label}</button>`);
+      // task 1002971 (spec D6) — "closed to applications" is a PRIVATE-goal idea
+      // only: a public goal is self-join, so the toggle would say nothing there.
+      // Closing never touches invitations — a lead can always still invite.
+      if (g.visibility === 'private') {
+        const closing = g.accepting_requests !== false;
+        parts.push(`<button class="btn-ghost" id="goal-accepting-btn" type="button" data-next-accepting="${closing ? 'false' : 'true'}" title="${closing ? 'Stop taking join-requests; you can still invite people' : 'Take join-requests again'}">${closing ? 'Close to requests' : 'Open to requests'}</button>`);
+      }
     }
     if (g.status === 'open') {
       if (joined) {
@@ -780,6 +787,10 @@
         if (state.myPendingRequest) {
           parts.push('<span class="member-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
           parts.push('<button class="btn-ghost" id="goal-withdraw-btn" type="button">Withdraw</button>');
+        } else if (g.visibility === 'private' && g.accepting_requests === false) {
+          // task 1002971 — say so instead of offering a button the server will
+          // refuse; the same honest copy the API answers with.
+          parts.push('<span class="member-pill" title="The goal\'s leads have paused applications; they can still invite you">Not taking requests</span>');
         } else {
           parts.push('<button class="btn-ghost" id="goal-request-btn" type="button">🔒 Request to join</button>');
         }
@@ -791,6 +802,7 @@
     $('#goal-join-btn')?.addEventListener('click', () => joinLeave(g.id, 'join'));
     $('#goal-leave-btn')?.addEventListener('click', () => joinLeave(g.id, 'leave'));
     $('#goal-visibility-btn')?.addEventListener('click', (e) => toggleVisibility(g.id, e.currentTarget.dataset.nextVisibility));
+    $('#goal-accepting-btn')?.addEventListener('click', (e) => toggleAcceptingRequests(g.id, e.currentTarget.dataset.nextAccepting === 'true'));
     $('#goal-request-btn')?.addEventListener('click', () => requestToJoin(g.id));
     $('#goal-withdraw-btn')?.addEventListener('click', () => withdrawRequest(g.id, state.myPendingRequest && state.myPendingRequest.id));
   }
@@ -965,6 +977,22 @@
       else toast('Could not update visibility just now.');
     }
   }
+  // task 1002971 (spec D6) — open/close a PRIVATE goal to join-requests. Closing
+  // refuses new asks with honest copy; it never affects invitations, which is why
+  // the toast says so out loud rather than reading as "the goal is shut".
+  async function toggleAcceptingRequests(goalId, accepting) {
+    try {
+      await patchJSON(`${API}/goals/${encodeURIComponent(goalId)}/accepting-requests`, { accepting_requests: accepting });
+      toast(accepting ? 'This goal is taking join-requests again.' : 'Closed to join-requests — you can still invite people.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+    } catch (err) {
+      const code = err?.data?.error;
+      if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may do this.');
+      else if (code === 'goal_not_open') toast('Only an open goal can be managed.');
+      else toast('Could not change that just now.');
+    }
+  }
   async function requestToJoin(goalId) {
     try {
       await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests`, {});
@@ -976,6 +1004,7 @@
       if (code === 'request_pending') toast('You already have a pending request or invitation for this goal.');
       else if (code === 'already_a_member') toast('You are already a member of this goal.');
       else if (code === 'goal_is_open') toast('This goal is open — joining directly instead.');
+      else if (code === 'not_accepting_requests') toast('This goal isn\'t taking requests right now.');
       else toast('Could not send the request just now.');
     }
   }
@@ -1004,9 +1033,15 @@
           <button class="btn-ghost" type="button" data-deny-req="${escapeHtml(String(r.id))}">Deny</button>
         </span>
       </li>`;
+    // task 1002971 — an invitation the goal SENT can now be taken back by the
+    // people who sent it (core_188's 'cancelled' = "withdrawn/rescinded by the
+    // opener"); before this the only un-send was asking the invitee to decline.
     const inviteLi = (r) => `<li class="pending-row">
         <span class="pending-row__who">${escapeHtml(pendingRequestWho(r))}</span>
         <span class="pending-row__note">invited — awaiting their response</span>
+        <span class="pending-row__actions">
+          <button class="btn-ghost" type="button" data-rescind-inv="${escapeHtml(String(r.id))}">Rescind</button>
+        </span>
       </li>`;
     const parts = [];
     if (requests.length) parts.push(`<div class="pending-group"><h3 class="pending-group__h">Join requests<span class="count-pill">${requests.length}</span></h3><ul class="pending-list">${requests.map(requestLi).join('')}</ul></div>`);

package/modules/lifecycle/db-goals.js

@@ -32,7 +32,7 @@ const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 // Shared column list so every goal read/return shapes a row identically.
 
 const GOAL_COLS =
-  'id, version_id, title, subtitle, description, scope_modules, status, visibility, created_by, succeeded_by_goal_id, sort_order, category_id, created_at, updated_at';
+  'id, version_id, title, subtitle, description, scope_modules, status, visibility, accepting_requests, created_by, succeeded_by_goal_id, sort_order, category_id, created_at, updated_at';
 
 // Shared column list for a goal_membership_requests row (task 1951 / ADR 0112) —
 // the invite / join-request queue behind private goals. Every helper below shapes
@@ -567,6 +567,26 @@ async function setGoalVisibility({ goalId, visibility }, deps = {}) {
   return rows[0] ?? null;
 }
 
+// setGoalAcceptingRequests — open or close a PRIVATE goal to new join-requests
+// (task 1002971, spec D6). false = closed: the request path refuses with honest
+// copy instead of queueing asks nobody will answer; invitations keep working, so
+// a lead can still reach out to a specific builder. Meaningless on a public goal
+// (self-join needs no request) — the column exists on every row, and the refusal
+// gate is what reads visibility. Bumps updated_at. Returns the updated goal row,
+// or null for an unknown id. The route gates WHO may call this
+// (authorizeGoalManagement: owner|manager|Archon); this helper just writes.
+async function setGoalAcceptingRequests({ goalId, acceptingRequests }, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const { rows } = await activePool.query(
+    `UPDATE goals
+        SET accepting_requests = $2, updated_at = now()
+      WHERE id = $1
+      RETURNING ${GOAL_COLS}`,
+    [goalId, acceptingRequests]
+  );
+  return rows[0] ?? null;
+}
+
 // createMembershipRequest — open a pending invite (kind='invite', a manager asks
 // builder_id in) or join-request (kind='request', the builder asks to join). The
 // partial-unique index (one pending row per goal+builder) means a duplicate ask
@@ -758,6 +778,7 @@ module.exports = {
   setGoalMembershipKind,
   setGoalStatus,
   setGoalSuccessor,
+  setGoalAcceptingRequests,
   setGoalVisibility,
   transferGoalOwnership,
 };

package/modules/lifecycle/db.js

@@ -90,6 +90,7 @@ const {
   setGoalMembershipKind,
   setGoalStatus,
   setGoalSuccessor,
+  setGoalAcceptingRequests,
   setGoalVisibility,
   transferGoalOwnership,
 } = require('./db-goals.js');
@@ -227,8 +228,10 @@ module.exports = {
   rescopeTaskTouches,
   addGoalScopeModules,
   setGoalSuccessor,
-  // Private goals: visibility + the invite/join-request queue (task 1951 / ADR 0112).
+  // Private goals: visibility + the invite/join-request queue (task 1951 / ADR 0112),
+  // plus the D6 open-/closed-to-requests flag (task 1002971).
   setGoalVisibility,
+  setGoalAcceptingRequests,
   createMembershipRequest,
   getMembershipRequest,
   resolveMembershipRequest,

package/modules/lifecycle/goal-edits.js

@@ -289,8 +289,48 @@ function goalVisibilityHandler({ db, authorizeGoalManagement, validateOrRespond,
   };
 }
 
+// goalAcceptingRequestsHandler — PATCH /goals/:id/accepting-requests (task
+// 1002971, spec docs/specs/bongos-v1-privacy-and-invites.md D6): a goal's own
+// authority opens or closes the goal to new join-requests. Lives beside
+// goalVisibilityHandler for the same reason that one does — a write to the goal's
+// own row behind the IDENTICAL gate (authorizeGoalManagement) — and here rather
+// than in routes/goals.js because that file is over the fitness oversize
+// threshold and the ratchet is shrink-only.
+//
+// A SEPARATE route from PATCH /goals/:id/visibility on purpose: they are two
+// different statements a lead makes ("who may see the door" vs "is the door
+// taking knocks"), a lead flips the second far more often than the first, and
+// folding them would make one careless request able to un-privatise a goal. The
+// server does NOT refuse the write on a public goal — the flag is simply
+// meaningless there (self-join needs no request) and the refusal gate is what
+// reads visibility; that also means a goal can be pre-closed before going
+// private without a two-step dance.
+function goalAcceptingRequestsHandler({ db, authorizeGoalManagement, validateOrRespond, parseId }) {
+  return async function patchGoalAcceptingRequests(req, res) {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    if (validateOrRespond(req, res, { accepting_requests: { required: true, type: 'boolean' } })) return;
+    try {
+      const goal = await db.getGoal(id);
+      const actorMembership = goal
+        ? await db.getGoalMember({ goalId: id, builderId: req.builder.id })
+        : null;
+      const decision = authorizeGoalManagement({
+        goal, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
+      });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+      const updated = await db.setGoalAcceptingRequests({ goalId: id, acceptingRequests: req.body.accepting_requests });
+      return res.json({ ok: true, goal: updated });
+    } catch (err) {
+      proseLog().error({ err: err && err.message }, 'PATCH /goals/:id/accepting-requests failed');
+      return res.fail('accepting_requests_update_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
 module.exports = {
   criterionProseRefusal,
+  goalAcceptingRequestsHandler,
   logProseEdit,
   recordProseEdit,
   goalProseHandler,

package/modules/lifecycle/routes/goal-route-authz.js

@@ -236,9 +236,20 @@ function protectedScopeAdmissionBlock({ scopeProtected, actorRank, targetRank })
 // POST /goals/:id/requests (task 1952): a builder asks to join. A request only
 // makes sense where self-join is gated — a PUBLIC, NON-protected goal is open-join,
 // so a request there is refused with a "just join" hint. Ordering:
-// goal_not_found → goal_not_open → already_a_member → goal_is_open (public+unprotected).
+// goal_not_found → goal_not_open → already_a_member → goal_is_open (public+unprotected)
+// → not_accepting_requests (private + closed to applications).
 // isMember is the caller's own membership; scopeProtected is scopeIncludesProtected(goal).
 // PURE + exported (the authorizeGoalTaskCreate precedent).
+//
+// THE CLOSED-TO-REQUESTS ARM (task 1002971, spec D6): a private goal whose lead
+// set accepting_requests=false is not taking applications, so the ask is refused
+// with honest copy rather than queued where nobody will answer it. Deliberately
+// narrowed to visibility='private' — D6 calls the flag meaningless on a public
+// goal (self-join needs no request), so a PUBLIC protected-scope goal keeps
+// today's Archon-mediated request door open whatever the column says. And it is
+// checked HERE, not on the invite paths: closing applications is about
+// unsolicited inbound, and a lead reaching out to a named builder is the
+// deliberate act the flag exists to protect.
 function authorizeCreateJoinRequest({ goal, isMember, scopeProtected }) {
   if (!goal) return { ok: false, status: 404, body: { error: 'goal_not_found' } };
   if (goal.status !== 'open') {
@@ -258,6 +269,12 @@ function authorizeCreateJoinRequest({ goal, isMember, scopeProtected }) {
       message: 'This goal is open — just join it (POST /goals/:id/join); no request needed.',
     } };
   }
+  if (goal.visibility === 'private' && goal.accepting_requests === false) {
+    return { ok: false, status: 409, body: {
+      error: 'not_accepting_requests',
+      message: "This goal isn't taking requests right now.",
+    } };
+  }
   return { ok: true };
 }
 
@@ -374,6 +391,38 @@ function authorizeWithdrawJoinRequest({ request, goalId, actorId }) {
   return { ok: true };
 }
 
+// authorizeRescindInvitation — the gate for POST /goals/:id/invitations/:reqId/rescind
+// (task 1002971): an owner|manager|Archon takes back an invitation the goal SENT
+// but nobody has answered yet. This is the MISSING HALF of core_188's 'cancelled'
+// state, which that migration defined as "withdrawn/rescinded by the opener" —
+// only the requester-withdraw half (authorizeWithdrawJoinRequest) was ever built,
+// so a mis-addressed or regretted invite could only be un-sent by asking the
+// invitee to decline it. The opener is a MANAGER here, not the row's builder_id,
+// which is why the authority prefix is authorizeGoalManagement VERBATIM (the
+// authorizeJoinRequestResponse shape) rather than the "is this your row" identity
+// check its withdraw mirror uses — and it runs BEFORE the request lookup so an
+// unauthorized actor never learns whether an invitation exists (the O1 no-leak
+// ordering). Then request containment + state: request_not_found → wrong_goal →
+// not_an_invitation → not_pending, so this route can never touch a join-request
+// row. Resolving an already-resolved invite is refused (409 not_pending) rather
+// than silently re-cancelled: db.resolveMembershipRequest moves only from
+// status='pending', so a repeat rescind changes no state either way. PURE + exported.
+function authorizeRescindInvitation({ goal, actorId, actorRank, actorMembership, request, goalId }) {
+  const mgmt = authorizeGoalManagement({ goal, actorId, actorRank, actorMembership });
+  if (!mgmt.ok) return mgmt;
+  if (!request) return { ok: false, status: 404, body: { error: 'request_not_found' } };
+  if (String(request.goal_id) !== String(goalId)) {
+    return { ok: false, status: 404, body: { error: 'request_not_found', message: 'No such invitation on this goal.' } };
+  }
+  if (request.kind !== 'invite') {
+    return { ok: false, status: 400, body: { error: 'not_an_invitation', message: 'That row is a join-request, not an invitation.' } };
+  }
+  if (request.status !== 'pending') {
+    return { ok: false, status: 409, body: { error: 'not_pending', status: request.status } };
+  }
+  return { ok: true };
+}
+
 // decorateGoalScope — additive, derived scope_protected flag on goal payloads
 // (task 1002689). A protected-scope goal is join-gated like a private one
 // (Archon-mediated membership, ADR 0086 §3), but the hall cannot re-derive the
@@ -393,6 +442,7 @@ module.exports = {
   authorizeJoinRequestResponse,
   authorizeMembershipKindChange,
   authorizeOwnershipTransfer,
+  authorizeRescindInvitation,
   authorizeWithdrawJoinRequest,
   decorateGoalScope,
   isMemberOrArchon,

package/modules/lifecycle/routes/goals.js

@@ -63,7 +63,7 @@ const JOIN_REQUEST_RESPONSE_ACTIONS = ['approve', 'deny']; // an owner/manager/A
 // proceed; a false result means "not a member" → the route should 403. This is the
 // membership half of the wall; the protected-module rank check is enforced per-route
 // (scope is never self-granted).
-const { authorizeCreateJoinRequest, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
+const { authorizeCreateJoinRequest, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 module.exports = function buildGoalsRouter() {
@@ -334,6 +334,15 @@ module.exports = function buildGoalsRouter() {
   // Pinned in route-rank-check.MODULE_EXPECTED_RANKS['lifecycle'].
   router.patch('/goals/:id/visibility', auth.requireBuilder, goalEdits.goalVisibilityHandler({ db, authorizeGoalManagement, validateOrRespond, parseId, VALID_VISIBILITIES }));
 
+  // PATCH /goals/:id/accepting-requests { accepting_requests } — a private goal's
+  // lead closes or re-opens it to join-requests (task 1002971, spec D6). Closed
+  // refuses new asks with honest copy; INVITATIONS ARE UNAFFECTED, so a lead can
+  // still reach out. Handler in goal-edits.js beside the visibility toggle (the
+  // same gate, the same kind of write); only the registration lives here so
+  // route-rank-check still classifies it.
+  // rank: any-builder (requireBuilder) + the in-handler owner|manager|Archon gate.
+  router.patch('/goals/:id/accepting-requests', auth.requireBuilder, goalEdits.goalAcceptingRequestsHandler({ db, authorizeGoalManagement, validateOrRespond, parseId }));
+
   // ---- the ADVISORY human category (task 1003275, criterion legibility-categories) ----
   // A category ORIENTS a person and steers Claude; it authorises nothing. Nothing
   // in this file, in claim eligibility, or in the claimable feed may branch on it —
@@ -605,6 +614,39 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // POST /goals/:id/invitations/:reqId/rescind — an owner|manager|Archon takes
+  // back a PENDING invitation the goal sent (task 1002971): the manager-side
+  // mirror of the requester's withdraw, and the missing half of core_188's
+  // 'cancelled' state ("withdrawn/rescinded by the opener" — only the requester
+  // half existed). Sets status='cancelled', kept as the audit trail like a deny's
+  // 'rejected'; never touches a join-request row.
+  // rank: any-builder (requireBuilder) + the in-handler authorizeRescindInvitation.
+  router.post('/goals/:id/invitations/:reqId/rescind', auth.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    const reqId = parseId(req, res, { param: 'reqId', code: 'bad_request_id', positiveInt: true });
+    if (reqId === null) return;
+    try {
+      const goal = await db.getGoal(id);
+      const [actorMembership, request] = goal
+        ? await Promise.all([
+            db.getGoalMember({ goalId: id, builderId: req.builder.id }),
+            db.getMembershipRequest(reqId),
+          ])
+        : [null, null];
+      const decision = authorizeRescindInvitation({
+        goal, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership, request, goalId: id,
+      });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+      const resolved = await db.resolveMembershipRequest({ id: reqId, status: 'cancelled', resolvedBy: req.builder.id });
+      if (!resolved) return res.fail('not_pending', { status: 409, message: 'The invitation changed underneath this rescind — re-read and retry.' });
+      return res.json({ ok: true, request: resolved });
+    } catch (err) {
+      log.error('[gds] POST /goals/:id/invitations/:reqId/rescind', err);
+      return res.fail('rescind_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // POST /goals/:id/members — the goal's own authority (owner | manager | Archon)
   // invites a builder to the goal (task 1762: widened from Archon-only so a
   // manager doesn't need an Archon in the loop for a normal goal). This stays the
@@ -1237,6 +1279,9 @@ module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
 // task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
 // same precedent as its siblings above.
 module.exports.authorizeWithdrawJoinRequest = authorizeWithdrawJoinRequest;
+// task 1002971: the manager-side rescind gate — the missing half of core_188's
+// 'cancelled' state; exported for tests/goal_membership_requests.mjs, same precedent.
+module.exports.authorizeRescindInvitation = authorizeRescindInvitation;
 // task 1002689: the derived scope_protected payload decorator — exported for
 // tests/goal_membership_requests.mjs (DB-free), same precedent.
 module.exports.decorateGoalScope = decorateGoalScope;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.409",
+  "version": "1.19.411",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.409",
+      "version": "1.19.411",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.409",
+  "version": "1.19.411",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",