@bongos/core 1.19.423 → 1.19.425

package/tests/application_lifecycle.mjs

@@ -0,0 +1,634 @@
+// tests/application_lifecycle.mjs — the application lifecycle EXECUTED: apply,
+// list, approve, decline, rescind, and the two things that must never happen —
+// a builder without the owner's authority moving the queue, and a VOUCH buying
+// admission (task 1002284, R08 of goal 1000045; ADR 0201 D1/D3.2/D4, ADR 0016).
+//
+// THE MECHANISM, copied from tests/connections_ownership.mjs and
+// tests/own_session_revoke.mjs: the pool below is a real in-memory
+// `access_requests` table plus a mini-interpreter that builds each statement's
+// row filter FROM THAT STATEMENT'S OWN WHERE CLAUSE. Drop the transition guard
+// from the PATCH and the filter genuinely widens, so a declined applicant
+// genuinely becomes admitted, and these tests genuinely fail. The interpreter
+// REFUSES any statement whose placeholders it did not all consume, so a
+// predicate it cannot read is a loud error rather than a silently weaker filter
+// — the failure mode that makes a fake pool worthless.
+//
+// Everything above the storage is REAL: the real router, the REAL
+// `requirePermission('access_request.review')` gate resolving against the REAL
+// government catalog's rank seed, the real error envelope, real HTTP. The
+// admission read is the REAL `hasInvitedAccessRequest` out of src/bongos/db-kernel.js,
+// pointed at the same in-memory table through a stubbed ./pool — so "does this
+// row admit anyone?" is answered by the function that actually admits people,
+// not by a paraphrase of it.
+//
+// WHY THE PERMISSION GATE *IS* THE OWNERSHIP TEST. ADR 0201 D3 decided there is
+// no cross-project owner authority: the instance IS the project (ADR 0108), so
+// "the project's owner" is that instance's own Archon and the check is the atom
+// that already guards this act — `access_request.review`, floor archon. A
+// builder who is not the owner is therefore a builder whose live rank does not
+// carry that atom, and the proof is that the real gate refuses them and the row
+// does not move. No new permission is minted by this task.
+//
+// WHY THE VOUCH PROOF LOOKS LIKE THIS. R08 ships no vouch WRITER (the assertion
+// and the header are R09, task 1002285), so a vouched row is seeded directly and
+// then asked to behave: the approve path and the admission read must be
+// BYTE-IDENTICAL to the unvouched case, and neither statement may so much as
+// mention the vouch columns. A vouch is storage the gate never consults. The day
+// somebody wires `applicant_github_id` into admission, this file goes red.
+//
+// DB-free. Runs in the unit gate that executes on a PR.
+//
+// Run:  node --test tests/application_lifecycle.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+// ===========================================================================
+// The in-memory access_requests table + its statement interpreter
+// ===========================================================================
+
+const HOUR = 60 * 60 * 1000;
+
+let rows = [];
+let builders = [];
+let statements = [];
+let nextId = 100;
+
+// Two PENDING rows that differ in exactly one thing — whether the hub vouched
+// for who is asking — so "the vouch changes nothing" can be asserted by
+// comparing them rather than by reading the code and believing it.
+function seed() {
+  const now = Date.now();
+  rows = [
+    { id: 1, github_login: 'ada', display_name: 'Ada', note: 'I build tools', status: 'pending', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR },
+    { id: 2, github_login: 'bo', display_name: 'Bo', note: 'I build tools', status: 'pending', applicant_github_id: '9002', vouched_at: now - 3 * HOUR, resolved_by_builder_id: null, resolved_at: null, created_at: now - 3 * HOUR },
+    { id: 3, github_login: 'cy', display_name: 'Cy', note: null, status: 'invited', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - 2 * HOUR, created_at: now - 4 * HOUR },
+    { id: 4, github_login: 'dee', display_name: 'Dee', note: null, status: 'dismissed', applicant_github_id: null, vouched_at: null, resolved_by_builder_id: 7, resolved_at: now - HOUR, created_at: now - 5 * HOUR },
+  ];
+  builders = [{ github_login: 'existing' }];
+  statements = [];
+  nextId = 100;
+}
+const row = (id) => rows.find((r) => r.id === id);
+const isBuilder = (login) =>
+  builders.some((b) => String(b.github_login).toLowerCase() === String(login).toLowerCase());
+
+/**
+ * Build a row filter from a statement's own WHERE text. Every placeholder the
+ * clause mentions must be consumed by a fragment below; one that is not throws,
+ * so a predicate this cannot read can never degrade into "no constraint".
+ */
+function predicateFor(rawWhere, params) {
+  let where = rawWhere;
+  const tests = [];
+  const consumed = new Set();
+  const p = (n) => { consumed.add(String(n)); return params[Number(n) - 1]; };
+
+  // The PATCH's transition guard, matched and STRIPPED first so the bare
+  // `status = '...'` matcher below cannot re-read half of it as a one-sided
+  // filter. This disjunction IS the rescind rule (ADR 0201 D4.2): resolve from
+  // pending, or step invited → dismissed and nothing else.
+  const transition = /\(status = 'pending' OR \(status = 'invited' AND \$(\d+)::text = 'dismissed' AND NOT EXISTS \(SELECT 1 FROM builders b WHERE lower\(b\.github_login\) = lower\(access_requests\.github_login\)\)\)\)/.exec(where);
+  if (transition) {
+    const next = p(transition[1]);
+    tests.push((r) => r.status === 'pending'
+      || (r.status === 'invited' && next === 'dismissed' && !isBuilder(r.github_login)));
+    where = where.replace(transition[0], ' TRUE ');
+  }
+
+  let m;
+  const eat = () => { where = where.replace(m[0], ' TRUE '); };
+  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); eat(); }
+  if ((m = /\blower\(github_login\) = lower\(\$(\d+)\)/.exec(where))) {
+    const v = String(p(m[1])).toLowerCase();
+    tests.push((r) => String(r.github_login).toLowerCase() === v);
+    eat();
+  }
+  if ((m = /\b(?:ar\.)?status = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => r.status === v); eat(); }
+  if ((m = /\b(?:ar\.)?status = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); eat(); }
+
+  for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(ph[1])) {
+      throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
+    }
+  }
+
+  // Every fragment matched above blanks itself to TRUE, so whatever is LEFT is a
+  // predicate this interpreter did not model. The $-sweep above cannot catch a
+  // LITERAL-ONLY one (`AND resolved_at IS NULL`, `AND status <> 'dismissed'`) —
+  // it binds nothing — and such a predicate silently narrows or widens the real
+  // query while every test stays green. That hole was found by review after it
+  // had already hidden one real filter, so the residual is swept too: this is
+  // what makes "refuses a predicate it cannot read" true of ALL predicates
+  // rather than only parameterised ones.
+  const residual = where
+    .replace(/\bTRUE\b/gi, ' ')
+    .replace(/\b(?:AND|OR)\b/gi, ' ')
+    .replace(/[()\s]/g, '');
+  if (residual) {
+    throw new Error(`fake pool: unmodelled predicate "${residual}" in "${rawWhere}" — a filter the interpreter cannot read must be a loud error, not a silent no-op`);
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    statements.push({ sql, params });
+    let m;
+
+    // Is this login already a builder here?
+    if ((m = /^SELECT 1 FROM builders WHERE (.+?) LIMIT 1$/.exec(sql))) {
+      return { rows: builders.filter(predicateFor(m[1], params)).slice(0, 1).map(() => ({ ok: 1 })) };
+    }
+
+    // The one-row existence probes over access_requests — the public POST's
+    // "already approved?" check AND db-kernel's hasInvitedAccessRequest, which
+    // issue the identical statement. That identity is the point: the admission
+    // read has no special case for a vouched row because it has no case at all.
+    if ((m = /^SELECT 1 FROM access_requests WHERE (.+?) LIMIT 1$/.exec(sql))) {
+      return { rows: rows.filter(predicateFor(m[1], params)).slice(0, 1).map(() => ({ ok: 1 })) };
+    }
+
+    // The public write. The partial unique index on lower(github_login) WHERE
+    // status='pending' is modelled for real, so a duplicate application raises a
+    // genuine 23505 and the route's "re-applying is not an error" branch is
+    // reached the way Postgres would reach it.
+    if (/^INSERT INTO access_requests \(github_login, display_name, note\)/.test(sql)) {
+      const [login, displayName, note] = params;
+      if (rows.some((r) => r.status === 'pending' && String(r.github_login).toLowerCase() === String(login).toLowerCase())) {
+        const err = new Error('duplicate key value violates unique constraint "uniq_access_requests_open_per_login"');
+        err.code = '23505';
+        throw err;
+      }
+      const fresh = {
+        id: nextId++, github_login: login, display_name: displayName, note, status: 'pending',
+        applicant_github_id: null, vouched_at: null, resolved_by_builder_id: null, resolved_at: null,
+        created_at: Date.now(),
+      };
+      rows.push(fresh);
+      return { rows: [{ id: fresh.id, github_login: fresh.github_login, status: fresh.status, created_at: fresh.created_at }] };
+    }
+
+    // The owner's queue.
+    if ((m = /^SELECT ar\.id, .* FROM access_requests ar .* WHERE (.+?) ORDER BY/.exec(sql))) {
+      const hit = rows.filter(predicateFor(m[1], params)).sort((a, b) => b.created_at - a.created_at);
+      return {
+        rows: hit.map((r) => ({
+          id: r.id, github_login: r.github_login, display_name: r.display_name, note: r.note,
+          status: r.status, created_at: r.created_at, resolved_at: r.resolved_at,
+          applicant_github_id: r.applicant_github_id, vouched_at: r.vouched_at,
+          vouched: r.applicant_github_id !== null,
+          resolved_by_login: null,
+        })),
+      };
+    }
+
+    // The resolve — one UPDATE, one WHERE, and that WHERE is the whole rule.
+    // The SET list is matched EXACTLY, not as `.*?`: the fake applies its effect
+    // from JS, so a `.*?` would let `resolved_by_builder_id = $2` be deleted from
+    // the real statement — an audit-trail regression — with every test still green.
+    if ((m = /^UPDATE access_requests SET status = \$1, resolved_by_builder_id = \$2, resolved_at = now\(\) WHERE (.+?) RETURNING/.exec(sql))) {
+      const hit = rows.filter(predicateFor(m[1], params));
+      for (const r of hit) { r.status = params[0]; r.resolved_by_builder_id = params[1]; r.resolved_at = Date.now(); }
+      return { rows: hit.map((r) => ({ id: r.id, github_login: r.github_login, status: r.status, resolved_at: r.resolved_at })) };
+    }
+
+    // The explain-only read behind a refusal. It decides nothing — but it does
+    // carry the membership fact the refusal needs, so the EXISTS is modelled.
+    if ((m = /^SELECT ar\.id, ar\.github_login, ar\.status, ar\.resolved_at, EXISTS \(SELECT 1 FROM builders b WHERE lower\(b\.github_login\) = lower\(ar\.github_login\)\) AS is_member FROM access_requests ar WHERE (.+?)$/.exec(sql))) {
+      const hit = rows.filter(predicateFor(m[1].replace(/\bar\./g, ''), params));
+      return {
+        rows: hit.map((r) => ({
+          id: r.id, github_login: r.github_login, status: r.status, resolved_at: r.resolved_at,
+          is_member: isBuilder(r.github_login),
+        })),
+      };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql}`);
+  },
+};
+
+// ===========================================================================
+// The real router, the real permission gate, the real admission read
+// ===========================================================================
+
+// db-kernel reaches Postgres through ./pool; pointing that at the same in-memory
+// table is what lets the REAL hasInvitedAccessRequest answer these tests.
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool } };
+
+// Discord broadcast is fire-and-forget on the public write; stubbed so the suite
+// is hermetic (it is best-effort in production and never affects the queue).
+const broadcastPath = require.resolve('../modules/onboarding/approval-broadcast.js');
+require.cache[broadcastPath] = {
+  id: broadcastPath, filename: broadcastPath, loaded: true,
+  exports: { postMemberApprovalRequest: async () => ({ posted: false, skipped: 'test' }) },
+};
+
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+const seams = require('../src/module-seams.js');
+const catalog = require('../modules/government/catalog.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const dbKernel = require('../src/bongos/db-kernel.js');
+
+// Who is calling, and at what LIVE rank. The rank is resolved through the real
+// government port on every request — never cached — exactly as production does.
+let actingRank = 'archon';
+
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool,
+  joinabilityMode: () => 'apply',
+  logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
+  requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'owner' }; next(); },
+  // requirePermission is NOT stubbed: realApi's own gate is used, so the denial
+  // below is the production denial.
+};
+
+seams._reset();
+seams.registerProvider('government', {
+  // The compat seed DERIVED from the catalog's own floors — so this test moves
+  // with a floor change instead of pinning a stale rank.
+  resolveBuilderPermissions: async () => catalog.seedForRank(actingRank),
+  permissionFloor: (key) => (catalog.byKey(key) || {}).floor || null,
+});
+
+const buildAccessRequestsRouter = require('../modules/onboarding/routes/access-requests.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildAccessRequestsRouter());
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function call(method, pathname, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path: pathname,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* empty body */ }
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+const reset = (rank = 'archon') => { seed(); actingRank = rank; };
+
+// ===========================================================================
+// The interpreter is the instrument, so it is calibrated first
+// ===========================================================================
+
+test('the interpreter refuses a predicate it cannot read, rather than ignoring it', () => {
+  assert.throws(
+    () => predicateFor('id = $1 AND some_new_column = $2', [1, 2]),
+    /unread predicate on \$2/,
+    'a filter the fake cannot model must be a loud error — otherwise a rewritten WHERE silently widens',
+  );
+});
+
+test('the interpreter refuses a LITERAL-ONLY predicate too — the hole review found', () => {
+  assert.throws(
+    () => predicateFor("id = $1 AND resolved_at IS NULL", [1]),
+    /unmodelled predicate/,
+    'a filter that binds nothing is invisible to the placeholder sweep, so the residual is swept as well'
+  );
+  // and the modelled shapes still parse clean
+  assert.doesNotThrow(() => predicateFor("lower(github_login) = lower($1) AND status = 'invited'", ['ada']));
+});
+
+test('the interpreter really does narrow on the transition guard', () => {
+  seed();
+  const guarded = "id = $3 AND (status = 'pending' OR (status = 'invited' AND $1::text = 'dismissed' AND NOT EXISTS (SELECT 1 FROM builders b WHERE lower(b.github_login) = lower(access_requests.github_login))))";
+  // Approving a DISMISSED row: the guard must match nothing...
+  assert.equal(rows.filter(predicateFor(guarded, ['invited', 42, 4])).length, 0);
+  // ...where the same statement without the guard matches it happily.
+  assert.equal(rows.filter(predicateFor('id = $1', [4])).length, 1,
+    'without the status guard the same shape reaches a declined request');
+  // ...and the member half narrows too: cy is invited, so rescinding matches —
+  // until cy is a builder, at which point the same statement matches nothing.
+  assert.equal(rows.filter(predicateFor(guarded, ['dismissed', 42, 3])).length, 1);
+  builders.push({ github_login: 'CY' });
+  assert.equal(rows.filter(predicateFor(guarded, ['dismissed', 42, 3])).length, 0,
+    'case-insensitively, and by the applicant login rather than the row id');
+});
+
+// ===========================================================================
+// Apply — the one public, unauthenticated write
+// ===========================================================================
+
+test('apply: a stranger files a request and it lands pending', async () => {
+  reset();
+  const r = await call('POST', '/api/gds/access-requests', { github_login: '@Newcomer', display_name: 'New', note: 'hello' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.status, 'pending');
+  const landed = rows.find((x) => x.github_login === 'Newcomer');
+  assert.ok(landed, 'the row is really in the table');
+  assert.equal(landed.applicant_github_id, null, 'an application off the public write is UNVOUCHED — the row the project has always had');
+});
+
+test('apply: re-applying is a success, not an error (ADR 0201 D1.4)', async () => {
+  reset();
+  const before = rows.length;
+  const r = await call('POST', '/api/gds/access-requests', { github_login: 'ada', note: 'again' });
+  assert.equal(r.status, 200, 'a double-clicked Apply must never tell the applicant they failed');
+  assert.equal(r.json.already_pending, true);
+  assert.equal(rows.length, before, 'and the unique index means no second open row');
+  // The hub relay reads any 2xx as "requested", which is what makes the
+  // idempotent answer reach the applicant as a filed application.
+  const { joinRelayOutcome } = await import('../modules/platform-identity/routes/my-projects.js');
+  assert.equal(joinRelayOutcome(r.status, r.json).status, 'requested');
+});
+
+test('apply: an already-approved login is told to sign in, and nothing is written', async () => {
+  reset();
+  const before = JSON.stringify(rows);
+  const r = await call('POST', '/api/gds/access-requests', { github_login: 'cy' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'already_approved');
+  assert.equal(JSON.stringify(rows), before);
+});
+
+// ===========================================================================
+// The queue — and the vouched/unvouched distinction it must carry
+// ===========================================================================
+
+test('list-pending: the owner sees the open queue, newest first', async () => {
+  reset();
+  const r = await call('GET', '/api/gds/access-requests');
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.requests.map((x) => x.github_login), ['ada', 'bo']);
+});
+
+test('list-pending: every row says whether it is VOUCHED — the impersonation guard', async () => {
+  reset();
+  const r = await call('GET', '/api/gds/access-requests');
+  const byLogin = Object.fromEntries(r.json.requests.map((x) => [x.github_login, x]));
+  assert.equal(byLogin.ada.vouched, false, 'a name anyone could have typed must not read as vouched');
+  assert.equal(byLogin.ada.applicant_github_id, null);
+  assert.equal(byLogin.bo.vouched, true);
+  assert.equal(byLogin.bo.applicant_github_id, '9002');
+  assert.ok(byLogin.bo.vouched_at, 'when the vouch was verified rides along as audit data');
+});
+
+// The interpreter builds its filter from the placeholders a WHERE mentions, so a
+// predicate carrying NONE of them — `AND ar.applicant_github_id IS NOT NULL`, say —
+// would be invisible to it and the queue tests would stay green while production
+// silently hid every unvouched row. The queue is the one read where that matters
+// (it is also the one legitimately allowed to NAME the vouch columns, in its SELECT
+// list), so its filter is pinned exactly rather than inferred.
+test('list-pending: the queue filters on status and NOTHING else', async () => {
+  reset();
+  await call('GET', '/api/gds/access-requests');
+  const queue = statements.find((s) => /FROM access_requests ar/.test(s.sql));
+  const where = /WHERE (.+?) ORDER BY/.exec(queue.sql)[1];
+  assert.equal(where, 'ar.status = $1',
+    'an extra predicate here would hide rows from the owner, and a placeholder-free one is invisible to the fake pool');
+});
+
+test('list-pending: ?status=invited|dismissed reads the audit trail, and a bad status is refused', async () => {
+  reset();
+  const invited = await call('GET', '/api/gds/access-requests?status=invited');
+  assert.deepEqual(invited.json.requests.map((x) => x.github_login), ['cy']);
+  const dismissed = await call('GET', '/api/gds/access-requests?status=dismissed');
+  assert.deepEqual(dismissed.json.requests.map((x) => x.github_login), ['dee']);
+  const bad = await call('GET', '/api/gds/access-requests?status=deleted');
+  assert.equal(bad.status, 400);
+});
+
+// ===========================================================================
+// Approve / decline / rescind
+// ===========================================================================
+
+test('approve: pending → invited, and THAT is what opens the door', async () => {
+  reset();
+  assert.equal(await dbKernel.hasInvitedAccessRequest('ada'), false, 'a pending row admits nobody');
+  const r = await call('PATCH', '/api/gds/access-requests/1', { status: 'invited' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.request.status, 'invited');
+  assert.equal(row(1).resolved_by_builder_id, 42, 'the audit trail records who acted');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('ada'), true, 'the REAL admission read now admits them');
+});
+
+test('decline: pending → dismissed, and the door stays shut', async () => {
+  reset();
+  const r = await call('PATCH', '/api/gds/access-requests/1', { status: 'dismissed' });
+  assert.equal(r.status, 200);
+  assert.equal(row(1).status, 'dismissed');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('ada'), false);
+});
+
+test('rescind: invited → dismissed re-locks a door opened by mistake (D4.2)', async () => {
+  reset();
+  assert.equal(await dbKernel.hasInvitedAccessRequest('cy'), true, 'precondition: cy was approved');
+  const r = await call('PATCH', '/api/gds/access-requests/3', { status: 'dismissed' });
+  assert.equal(r.status, 200, 'this was the gap: the PATCH resolved only from pending');
+  assert.equal(row(3).status, 'dismissed');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('cy'), false, 'hasInvitedAccessRequest stops matching — the door is shut again');
+});
+
+// THE FINDING THIS PAIR EXISTS FOR (adversarial review, 2026-08-29). Nothing
+// flips an `invited` row when its applicant signs in, and firstTimeAdmissionBlocked
+// short-circuits on an existing `builders` row — so `invited` + a live member is a
+// permanently reachable state, and dismissing that row changes NOTHING about their
+// access. Before this guard the route answered 200 and the queue reported a removal
+// that had not happened: a false negative on an admission control, which is worse
+// than a refusal because the owner stops looking.
+test('rescind: a request whose applicant ALREADY SIGNED IN is refused, not silently flipped', async () => {
+  reset();
+  builders.push({ github_login: 'cy' });
+  const before = { ...row(3) };
+  const r = await call('PATCH', '/api/gds/access-requests/3', { status: 'dismissed' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'already_member');
+  assert.match(r.json.error.message, /builder-exit/, 'the refusal names the act that DOES remove a member');
+  assert.deepEqual(row(3), before, 'the row does not move — a dismissed row here would be a lie about a member');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('cy'), true,
+    'and nothing pretended their access changed, because it did not');
+});
+
+test('rescind: the member check is on the APPLICANT, case-insensitively — not on the acting builder', async () => {
+  reset();
+  // The acting archon is a builder by definition; only the APPLICANT's own
+  // membership may block a rescind, or no rescind would ever be possible.
+  builders.push({ github_login: 'owner' });
+  const r = await call('PATCH', '/api/gds/access-requests/3', { status: 'dismissed' });
+  assert.equal(r.status, 200, 'the archon being a builder must not block rescinding somebody else');
+  assert.equal(row(3).status, 'dismissed');
+
+  reset();
+  builders.push({ github_login: 'CY' });
+  const cased = await call('PATCH', '/api/gds/access-requests/3', { status: 'dismissed' });
+  assert.equal(cased.status, 409, 'GitHub logins are case-insensitive here as everywhere else in this file');
+});
+
+test('decline: a PENDING request from someone who is already a member is still dismissable', async () => {
+  reset();
+  builders.push({ github_login: 'ada' });
+  const r = await call('PATCH', '/api/gds/access-requests/1', { status: 'dismissed' });
+  assert.equal(r.status, 200, 'a stale pending row is housekeeping, not a removal — only the RESCIND is guarded');
+  assert.equal(row(1).status, 'dismissed');
+});
+
+test('a declined request is NOT revived by a PATCH — that path is the invite route (D4.2)', async () => {
+  reset();
+  const before = { ...row(4) };
+  const r = await call('PATCH', '/api/gds/access-requests/4', { status: 'invited' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'already_dismissed');
+  assert.match(r.json.error.message, /access-requests\/invite/, 'a refusal must name the action available there (ADR 0116)');
+  assert.deepEqual(row(4), before, 'and the declined row does not move');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('dee'), false);
+});
+
+test('idempotent: approving an already-invited request returns the row, not a 409 (D4.4)', async () => {
+  reset();
+  const before = { ...row(3) };
+  const r = await call('PATCH', '/api/gds/access-requests/3', { status: 'invited' });
+  assert.equal(r.status, 200, 'a double-clicked queue button is safe');
+  assert.equal(r.json.unchanged, true);
+  assert.equal(r.json.request.status, 'invited');
+  assert.deepEqual(row(3), before, 'and it does NOT re-stamp resolved_by/resolved_at — the audit trail records who actually resolved it');
+});
+
+test('idempotent: declining an already-dismissed request returns the row (D4.4)', async () => {
+  reset();
+  const before = { ...row(4) };
+  const r = await call('PATCH', '/api/gds/access-requests/4', { status: 'dismissed' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.unchanged, true);
+  assert.deepEqual(row(4), before);
+});
+
+test('a request that does not exist is 404, and nothing in the table moves', async () => {
+  reset();
+  const snapshot = JSON.stringify(rows);
+  const r = await call('PATCH', '/api/gds/access-requests/999', { status: 'invited' });
+  assert.equal(r.status, 404);
+  assert.equal(r.json.error.code, 'request_not_found');
+  assert.equal(JSON.stringify(rows), snapshot);
+});
+
+test('only invited|dismissed are accepted, and a rejected status writes nothing', async () => {
+  reset();
+  const snapshot = JSON.stringify(rows);
+  for (const status of ['pending', 'approved', '']) {
+    const r = await call('PATCH', '/api/gds/access-requests/1', { status });
+    assert.equal(r.status, 400, `status=${JSON.stringify(status)}`);
+  }
+  assert.equal(JSON.stringify(rows), snapshot);
+});
+
+// ===========================================================================
+// Authority — "a builder cannot approve or decline for a project they don't own"
+// ===========================================================================
+
+for (const rank of ['xenos', 'thetes', 'metic']) {
+  test(`a ${rank} cannot approve — the real access_request.review gate refuses and the row does not move`, async () => {
+    reset(rank);
+    const before = { ...row(1) };
+    const r = await call('PATCH', '/api/gds/access-requests/1', { status: 'invited' });
+    assert.equal(r.status, 403);
+    assert.equal(r.json.error.code, 'permission_forbidden');
+    assert.deepEqual(r.json.error.details.required, ['access_request.review']);
+    assert.deepEqual(row(1), before, 'the queue did not move for someone without the owner authority');
+    assert.equal(await dbKernel.hasInvitedAccessRequest('ada'), false, 'and nobody was admitted');
+  });
+
+  test(`a ${rank} cannot decline, and cannot even READ the queue`, async () => {
+    reset(rank);
+    const before = { ...row(1) };
+    const declined = await call('PATCH', '/api/gds/access-requests/1', { status: 'dismissed' });
+    assert.equal(declined.status, 403);
+    assert.deepEqual(row(1), before);
+    const listed = await call('GET', '/api/gds/access-requests');
+    assert.equal(listed.status, 403, 'the queue exposes would-be builders’ usernames — the read is gated too');
+  });
+}
+
+test('the gate is pinned to the atom ADR 0201 D3.2 names, at the floor the catalog holds', () => {
+  const atom = catalog.byKey('access_request.review');
+  assert.ok(atom, 'access_request.review must still exist — this task mints no new permission');
+  assert.equal(atom.floor, 'archon');
+  assert.ok(catalog.seedForRank('archon').includes('access_request.review'));
+  assert.ok(!catalog.seedForRank('metic').includes('access_request.review'),
+    'if this ever becomes metic-held, it is the console wave widening the READ half — revisit these tests deliberately');
+});
+
+// ===========================================================================
+// The vouch carries NO authority (ADR 0016) — the whole point of the goal
+// ===========================================================================
+
+test('a vouched application is approved by the byte-identical statement as an unvouched one', async () => {
+  reset();
+  // Everything that is allowed to differ: identity, the vouch fields, and the
+  // two clocks. What is left — status and who resolved it — is the whole of what
+  // approving does, and it must be the same on both rows.
+  const strip = (r) => ({
+    ...r, id: undefined, github_login: undefined, display_name: undefined,
+    applicant_github_id: undefined, vouched_at: undefined, resolved_at: undefined, created_at: undefined,
+  });
+
+  seed(); statements = [];
+  const unvouched = await call('PATCH', '/api/gds/access-requests/1', { status: 'invited' });
+  const unvouchedRow = { ...row(1) };
+  const unvouchedSql = statements.map((s) => s.sql);
+
+  seed(); statements = [];
+  const vouched = await call('PATCH', '/api/gds/access-requests/2', { status: 'invited' });
+  const vouchedRow = { ...row(2) };
+  const vouchedSql = statements.map((s) => s.sql);
+
+  assert.equal(unvouched.status, vouched.status);
+  assert.deepEqual(Object.keys(unvouched.json.request).sort(), Object.keys(vouched.json.request).sort());
+  assert.deepEqual(strip(unvouchedRow), strip(vouchedRow), 'the resulting rows differ ONLY in identity + the vouch fields the write never touched');
+  assert.deepEqual(unvouchedSql, vouchedSql, 'the SAME SQL ran — there is no vouched branch to take');
+  assert.equal(vouchedRow.applicant_github_id, '9002', 'and the vouch itself is left exactly as it was found');
+  assert.equal(vouchedRow.vouched_at, rows.find((r) => r.id === 2).vouched_at);
+});
+
+test('no statement on the approve path or the admission read so much as mentions the vouch columns', async () => {
+  seed(); statements = [];
+  await call('PATCH', '/api/gds/access-requests/2', { status: 'invited' });
+  await dbKernel.hasInvitedAccessRequest('bo');
+  assert.ok(statements.length >= 2, 'the approve and the admission read both ran');
+  for (const { sql } of statements) {
+    assert.ok(!/applicant_github_id|vouched_at/.test(sql),
+      `a write or read on the admission path referenced a vouch column: ${sql}`);
+  }
+});
+
+test('a vouch admits nobody on its own — only status=invited ever does', async () => {
+  seed();
+  // Row 2 is vouched and PENDING. The strongest form of the claim: the hub has
+  // confirmed exactly who this is, and the door is still shut.
+  assert.equal(row(2).applicant_github_id, '9002');
+  assert.equal(await dbKernel.hasInvitedAccessRequest('bo'), false,
+    'a confirmed identity is not an admission — descriptive analytics never become authority (ADR 0016)');
+  // And an UNVOUCHED invited row admits, which is the same statement proving the
+  // vouch is not a second, quieter gate hiding beside the first.
+  assert.equal(row(3).applicant_github_id, null);
+  assert.equal(await dbKernel.hasInvitedAccessRequest('cy'), true);
+});

package/tests/own_scope_guard.mjs

@@ -99,6 +99,11 @@ const OWN_SCOPED_SURFACES = [
     why: 'the connection graph (ADR 0202, task 1002295). The ACTING account is always the session; a counterparty is named by public handle or by the connection row id, never by an account identifier — and the degree label is a viewer-relative own-scope read (D4 §4).',
     crossOwner: [],
   },
+  {
+    file: 'modules/platform-identity/routes/my-projects.js',
+    why: "the caller's OWN cross-project memberships, invitations, applications and leave (ADR 0141 §3; the application echo, ADR 0201 D1.3, task 1002284) — every route keyed on req.builder.github_id / github_login. The only path param is :clientId, which names a PROJECT and never a builder: a project is the resource being acted on, and the actor is always the session, which is why join can relay an application for nobody but the caller.",
+    crossOwner: [],
+  },
   {
     file: 'modules/memory/routes/memory.js',
     why: 'per-builder memory (ADR 0024 §4). The self endpoints are own-scoped; the five cross-builder endpoints name their target in the path and are gate-verified below.',