@bongos/core 1.19.536 → 1.19.538

package/modules/provisioning/provisioning.js

@@ -492,6 +492,26 @@ function normalizeProjectDetail(input) {
   return out;
 }
 
+// A detail PATCH split into what it SETS and what it CLEARS (task 1003577). An
+// explicit `null` for a known question means UN-ANSWER it — the JSON-merge-patch
+// convention (RFC 7396) this repo already uses for `description` on the same route
+// and for every builder-settings knob. It exists because a merging write can add an
+// answer but never take one back, which made "never answered" — the third value
+// ADR 0240 and `effectiveModules` both read — a state a project could leave once and
+// never return to. Everything else is unchanged: an off-vocabulary value is still
+// dropped rather than treated as a clear, and an empty patch still changes nothing.
+// PURE.
+function projectDetailPatch(input) {
+  const given = input && typeof input === 'object' && !Array.isArray(input) ? input : {};
+  const set = {};
+  const clear = [];
+  for (const [key, vocab] of Object.entries(PROJECT_DETAIL_VOCAB)) {
+    if (given[key] === null) clear.push(key);
+    else if (vocab.includes(given[key])) set[key] = given[key];
+  }
+  return { set, clear };
+}
+
 // What a row's detail answers READ as — the stored object filtered through the
 // same vocabulary, so a value that was valid when written and has since left the
 // vocabulary never leaks out of the read surface. Mirrors effectiveSettings, minus
@@ -661,6 +681,13 @@ async function updateInstanceSettings(db, id, patch) {
 // is the honest consequence of deleting half the identity gate, not a bug.
 // Undefined leaves the column alone.
 //
+// A merge alone could only ever ADD an answer, so `detail` also takes a PER-KEY null
+// as "un-answer this question" (task 1003577, RFC 7396's rule and `description`'s own
+// beside it): the key is DROPPED from the jsonb rather than stored as null, so the row
+// reads back exactly as one that was never asked — which is the state ADR 0240 and
+// `effectiveModules` treat as a distinct third value. `detail: {}` still changes
+// nothing, since a form that sends no answers is not asking for any to be erased.
+//
 // `modules` is the SAME way back for the wizard's other optional step (BV1.R23,
 // task 1002342, ADR 0245). It REPLACES like `description` and unlike `detail`: a
 // module selection is one whole list, so merging would make removing a module
@@ -675,8 +702,11 @@ async function updateInstanceDetail(db, id, { description, detail, modules } = {
     sets.push(`description = $${params.length}`);
   }
   if (detail !== undefined) {
-    params.push(JSON.stringify(normalizeProjectDetail(detail)));
-    sets.push(`detail = detail || $${params.length}::jsonb`);
+    const { set, clear } = projectDetailPatch(detail);
+    params.push(JSON.stringify(set));
+    const merged = params.length;
+    params.push(clear);
+    sets.push(`detail = (detail || $${merged}::jsonb) - $${params.length}::text[]`);
   }
   if (modules !== undefined) {
     const picked = normalizeModuleSelection(modules);
@@ -1150,6 +1180,43 @@ async function instanceStateForSlug(db, slug) {
   };
 }
 
+// The `provisioning.projectOwnedBy` port (task 1003580): is THIS builder the owner of the
+// control-plane project a hub catalog row names? Lets a hub surface own-scope a project it
+// did not create — without importing this module (ADR 0083) and without promoting the hub's
+// own `owner_github_id` columns, which are attribution and never authority (ADR 0238). The
+// fact returned is the one `instanceAccessDenied` already enforces on every owner-facing
+// route here: `provisioning_instances.owner_builder_id`.
+//
+// BOTH HALVES OF THE PROJECTION MUST AGREE, which is why this takes a slug AND a host rather
+// than a slug alone. ADR 0246 projects an instance onto the map as `client_id = slug` at
+// `origin = https://<domain>`, so a caller speaks for a catalog row only when they own the
+// instance carrying BOTH. Matching the slug by itself would let someone who registers an
+// instance NAMED after a client the control plane never created — a hand-seeded row, whose
+// origin the catalog's own claim rule already refuses to overwrite — speak for that project.
+//
+// A BOOLEAN, not the owner's id: the comparison is authority and belongs on the plane that
+// holds the row, so no consumer ever handles an ownership fact it could mis-compare. Read-only
+// and fail-closed on an unidentifiable key or builder id.
+//
+// AN ABSENT HOST IS STILL ASKED, and matches nothing — `domain` is never the empty string (it
+// is a hostname or NULL, and `lower(NULL) = ''` is NULL, i.e. not true). Short-circuiting it
+// would make the caller's work depend on whether the catalog row exists, and a refusal that is
+// byte-identical but measurably FASTER is still an existence oracle. The query is the cheap
+// half of keeping every caller's path the same shape.
+async function projectOwnedBy(db, { slug, host, builderId } = {}) {
+  const wantSlug = typeof slug === 'string' ? slug : '';
+  const wantHost = typeof host === 'string' ? host.toLowerCase() : '';
+  const owner = Number(builderId);
+  if (!wantSlug || !Number.isInteger(owner) || owner <= 0) return false;
+  const { rows } = await db.query(
+    `SELECT 1 FROM provisioning_instances
+      WHERE slug = $1 AND lower(domain) = $2 AND owner_builder_id = $3
+      LIMIT 1`,
+    [wantSlug, wantHost, owner],
+  );
+  return rows.length > 0;
+}
+
 // The `provisioning.projectPlanets` port (task 1003347): the owners' planet
 // choices for a set of HOSTS (the catalog's origins, host-matched — the join the
 // hub's sky makes), so platform-identity's public featured feed can carry them
@@ -1211,7 +1278,7 @@ module.exports = {
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   defaultDomainForSlug, isReservedHostname, effectiveSettings, planetChoice,
-  normalizeDescription, normalizeProjectDetail, projectDetail,
+  normalizeDescription, normalizeProjectDetail, projectDetailPatch, projectDetail,
   // pure — GitHub App Manifest flow (task 2080)
   githubAppName, buildGithubAppManifest, manifestPostUrl, publicGithubApp,
   // data access
@@ -1222,7 +1289,7 @@ module.exports = {
   createInstance, setInstanceStatus, updateInstanceDomain, updateInstanceSettings, updateInstanceDetail,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
-  recordEvent, instanceStateForSlug, planetChoicesForHosts, costLedger,
+  recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)
   createOAuthManifest, getOAuthManifestByState, attachManifestCode,
   getLatestOAuthManifestForInstance, claimNextOAuthManifest, resolveOAuthManifest,

package/modules/provisioning/routes/provisioning.js

@@ -113,8 +113,13 @@ function badProjectDetail(detail) {
     if (!Object.prototype.hasOwnProperty.call(vocab, key)) {
       return { code: 'bad_detail', message: `Unknown detail answer "${key}" — the interview asks: ${Object.keys(vocab).join(', ')}.` };
     }
+    // An explicit null is the UN-ANSWER, not an off-vocabulary value (task 1003577):
+    // the merge-patch way back to "never answered". Only null — an empty string or any
+    // other sentinel stays a typo, so a caller trying to SET one is never silently
+    // read as having erased their answer.
+    if (value === null) continue;
     if (!vocab[key].includes(value)) {
-      return { code: 'bad_detail', message: `"${key}" must be one of: ${vocab[key].join(', ')}.` };
+      return { code: 'bad_detail', message: `"${key}" must be one of: ${vocab[key].join(', ')} — or null to un-answer it.` };
     }
   }
   return null;
@@ -154,10 +159,16 @@ function badModuleSelection(modules) {
 //   • PROVIDES port `provisioning.projectPlanets` (hosts[]) → { host: { planet_template,
 //     planet_accent } } — the owners' planet choices (task 1003347), so the hub's
 //     public featured feed can carry them without importing this module.
+//   • PROVIDES port `provisioning.projectOwnedBy` ({ slug, host, builderId }) → boolean —
+//     the OWNERSHIP fact behind a hub catalog row (task 1003580), so a hub surface can
+//     own-scope a project without importing this module and without treating the hub's
+//     `owner_github_id` columns as authority (ADR 0238). See projectOwnedBy for why the
+//     question names both halves of the ADR 0246 projection.
 function registerProvisioningSeams() {
   if (api.hasProvider('provisioning.instanceState')) return;
   api.registerProvider('provisioning.instanceState', (slug) => provisioning.instanceStateForSlug(pool, slug));
   api.registerProvider('provisioning.projectPlanets', (hosts) => provisioning.planetChoicesForHosts(pool, hosts));
+  api.registerProvider('provisioning.projectOwnedBy', (target) => provisioning.projectOwnedBy(pool, target));
 }
 
 // Is this project on the public map, and if not, what is it still missing?
@@ -682,6 +693,15 @@ module.exports = function provisioningRoutes() {
   // column alone, so the "never asked" NULL (ADR 0240 §2) can never be written by
   // a later edit. The always-on core stays unremovable by construction:
   // badModuleSelection refuses its keys and `effectiveModules` re-adds it on read.
+  //
+  // AN ANSWER CAN BE TAKEN BACK (task 1003577). `detail` merges, so before this the
+  // first `team_shape` an owner sent was permanent — and "never answered" is a state
+  // `effectiveModules` reads (ADR 0240), not merely the absence of one. Sending
+  // `detail: { <key>: null }` UN-ANSWERS that question: the key is dropped from the
+  // jsonb, so the row reads back exactly as one that was never asked and the bundle
+  // the answer moved moves back. Only null does it — an empty string or any other
+  // value is still refused as off-vocabulary, and `detail: {}` still changes nothing,
+  // because a form that collected no answers is not asking for any to be erased.
   router.patch('/provisioning/instances/:id/detail', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;

package/modules/provisioning/tests/provisioning.mjs

@@ -323,12 +323,32 @@ t('normalizeProjectDetail: on-vocabulary keys only — an unknown key or value i
   assert.deepEqual(P.normalizeProjectDetail({ team_shape: 'community' }), { team_shape: 'community' });
   assert.deepEqual(P.normalizeProjectDetail({ team_shape: 'enormous' }), {}, 'an off-vocabulary answer is not stored');
   assert.deepEqual(P.normalizeProjectDetail({ favourite_colour: 'blue' }), {}, 'an unknown question is not stored');
+  assert.deepEqual(P.normalizeProjectDetail({ team_shape: null }), {},
+    'the un-answer (task 1003577) is a PATCH verb — at creation there is nothing to clear, so it just stores nothing');
   // skipping is the supported default, so every not-an-object shape reads as {}
   for (const skipped of [undefined, null, 'solo', ['solo'], 7]) {
     assert.deepEqual(P.normalizeProjectDetail(skipped), {}, 'a skipped interview stores {}');
   }
 });
 
+t('projectDetailPatch: an explicit null CLEARS the answer; an off-vocabulary value is still dropped (task 1003577)', () => {
+  // The way back to "never answered" — the third value effectiveModules reads
+  // (ADR 0240) and that a merging write could never reach again once written.
+  assert.deepEqual(P.projectDetailPatch({ team_shape: 'community' }), { set: { team_shape: 'community' }, clear: [] });
+  assert.deepEqual(P.projectDetailPatch({ team_shape: null }), { set: {}, clear: ['team_shape'] },
+    'null is the un-answer, not an off-vocabulary value');
+  assert.deepEqual(P.projectDetailPatch({ team_shape: 'enormous' }), { set: {}, clear: [] },
+    'an off-vocabulary answer neither stores nor clears — normalizeProjectDetail\'s rule is unchanged');
+  assert.deepEqual(P.projectDetailPatch({ team_shape: '' }), { set: {}, clear: [] },
+    'only null clears; an empty string is just another value the vocabulary refuses');
+  assert.deepEqual(P.projectDetailPatch({ favourite_colour: null }), { set: {}, clear: [] },
+    'an unknown question has no answer to clear');
+  // `{}` stays a no-op, which is RFC 7396's own rule and what a skipped step sends
+  for (const nothing of [{}, undefined, null, 'solo', ['solo'], 7]) {
+    assert.deepEqual(P.projectDetailPatch(nothing), { set: {}, clear: [] }, 'an empty patch changes nothing');
+  }
+});
+
 t('projectDetail: a stored value that has since LEFT the vocabulary never leaks out of the read surface', () => {
   assert.deepEqual(P.projectDetail({ detail: { team_shape: 'solo' } }), { team_shape: 'solo' });
   assert.deepEqual(P.projectDetail({ detail: { team_shape: 'guild' } }), {});
@@ -408,9 +428,16 @@ await ta('updateInstanceDetail: detail MERGES, description REPLACES, and neither
   const db = { query: async (q, p) => { sql = q; params = p; return { rows: [{ id: 18 }] }; } };
 
   await P.updateInstanceDetail(db, 18, { detail: { team_shape: 'small-team' } });
-  assert.ok(sql.includes('detail = detail || $2::jsonb'), 'one answer does not erase the others');
+  assert.ok(sql.includes('detail = (detail || $2::jsonb) - $3::text[]'), 'one answer does not erase the others');
   assert.ok(!sql.includes('description ='), 'an unsent description is left alone, never nulled');
-  assert.deepEqual(params, [18, JSON.stringify({ team_shape: 'small-team' })]);
+  assert.deepEqual(params, [18, JSON.stringify({ team_shape: 'small-team' }), []],
+    'nothing to clear, so the key-drop list is empty');
+
+  // The way back (task 1003577): an explicit null UN-ANSWERS the question, which a
+  // merging write alone could never do — `{}` merges to nothing and an off-vocabulary
+  // sentinel is dropped, so before this the first answer was permanent.
+  await P.updateInstanceDetail(db, 18, { detail: { team_shape: null } });
+  assert.deepEqual(params, [18, '{}', ['team_shape']], 'the key is DROPPED from the jsonb, not stored as null');
 
   await P.updateInstanceDetail(db, 18, { description: 'Filled in later.' });
   assert.ok(sql.includes('description = $2'), 'the way back for a skipped step');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.536",
+  "version": "1.19.538",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.536",
+      "version": "1.19.538",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.536",
+  "version": "1.19.538",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.536'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.538'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/project_catalog_routes.mjs

@@ -211,3 +211,25 @@ test('a catalog hiccup can never turn a saved change into a failure', async () =
     catalogBridge.publishInstanceToCatalog = saved;
   }
 });
+
+test('mounting the routes registers the `provisioning.projectOwnedBy` port (task 1003580)', async () => {
+  // The OTHER direction of the same seam: the catalog write travels provisioning → hub, and
+  // this ownership read travels hub → provisioning, so the hub's invite door can own-scope a
+  // project without importing this module (ADR 0083) and without treating the hub's own
+  // `owner_github_id` columns as authority (ADR 0238). Registered here at mount, so a hub
+  // running with provisioning enabled always has it.
+  assert.equal(api.hasProvider('provisioning.projectOwnedBy'), true);
+  const ownedBy = api.resolve('provisioning.projectOwnedBy');
+  assert.equal(typeof ownedBy, 'function');
+  // It reaches the module's own read, bound to the module's pool — the caller never supplies
+  // a database handle, so no consumer can point this question at another connection.
+  const seen = [];
+  const saved = provisioning.projectOwnedBy;
+  provisioning.projectOwnedBy = async (_db, target) => { seen.push(target); return true; };
+  try {
+    assert.equal(await ownedBy({ slug: 'spike-harbor', host: 'spike-harbor.cloudbongos.test', builderId: 7 }), true);
+    assert.deepEqual(seen, [{ slug: 'spike-harbor', host: 'spike-harbor.cloudbongos.test', builderId: 7 }]);
+  } finally {
+    provisioning.projectOwnedBy = saved;
+  }
+});

package/tests/project_invite_ownership.mjs

@@ -0,0 +1,366 @@
+// tests/project_invite_ownership.mjs — A PROJECT'S OWNER MAY INVITE INTO THEIR OWN PROJECT
+// (task 1003580, GAP 2; the ADR 0210 owner-or-rank shape applied to POST /projects/invite).
+//
+// Task 1003576 / ADR 0246 gave every control-plane project a catalog row, so the invite route
+// stopped 404ing for a wizard-made project. What was left is WHO may call it: the route is
+// gated `project.curate`, floor metic, and the wizard's audience is any signed-in GitHub user
+// — typically a `xenos` who gets 403 on their OWN project. This file is the proof of the arm
+// that fixes it, and of the four things the arm must NOT do.
+//
+// THE OWNERSHIP PROOF IS THE PROVISIONING ROW. `provisioning_instances.owner_builder_id` is
+// the authority the manage view already trusts; the hub's `owner_github_id` columns are
+// attribution, never authority (ADR 0238). platform-identity may not import provisioning
+// (ADR 0083), so the fact travels on the `provisioning.projectOwnedBy` port — resolved
+// OPTIONALLY, because the hub must boot with no provisioning module at all.
+//
+// DB-free: the real router driven over loopback, data access stubbed on the cached module
+// objects and the port stubbed on the doorway (the catalog_only_client.mjs pattern).
+//
+// Run:  node --test --test-reporter=tap tests/project_invite_ownership.mjs
+
+import assert from 'node:assert/strict';
+import { test, after, beforeEach } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const pi = require('../modules/platform-identity/platform-identity.js');
+const api = require('../src/module-api.js');
+
+// ── the world ────────────────────────────────────────────────────────────────
+
+// A wizard-made standalone project: catalog-only client (no secret), owned by builder 7 whose
+// provisioning row is slug `spike-harbor` at spike-harbor.cloudbongos.test.
+const OWNED = Object.freeze({
+  client_id: 'spike-harbor', secret_hash: '', name: 'spike-harbor',
+  redirect_uris: [], origin: 'https://spike-harbor.cloudbongos.test',
+  owner_github_id: 9001, status: 'active',
+});
+// Someone ELSE's project, and a STEALTH one: the refusal a stranger gets must not tell them
+// this row exists (ADR 0182 D2a — a stealth project is on the map anonymously or not at all).
+const STEALTH = Object.freeze({
+  ...OWNED, client_id: 'quiet-cove', name: 'quiet-cove', origin: 'https://quiet-cove.cloudbongos.test',
+  owner_github_id: 9002,
+});
+// A client the control plane never created — the hand-seeded catalog row shape (ADR 0246's
+// "unclaimable" case). Its slug is squattable in provisioning, which is why the port is asked
+// about the ORIGIN as well as the slug.
+const HAND_SEEDED = Object.freeze({
+  ...OWNED, client_id: 'legacy-port', name: 'legacy-port', origin: 'https://legacy-port.example',
+  secret_hash: 'a'.repeat(64), owner_github_id: 9003,
+});
+const CLIENTS = new Map([OWNED, STEALTH, HAND_SEEDED].map((c) => [c.client_id, c]));
+
+// The provisioning rows the port answers from: (slug, host) → owner builder id.
+const INSTANCES = [
+  { slug: 'spike-harbor', host: 'spike-harbor.cloudbongos.test', owner: 7 },
+  { slug: 'quiet-cove', host: 'quiet-cove.cloudbongos.test', owner: 9 },
+  // The SQUAT: builder 42 registered an instance named after the hand-seeded client, at their
+  // own address. Same slug, different origin — so it is not that project.
+  { slug: 'legacy-port', host: 'legacy-port.squatter.test', owner: 42 },
+];
+
+const OWNER = Object.freeze({ id: 7, github_id: 9001, github_login: 'owner', rank: 'xenos', curate: false });
+const STRANGER = Object.freeze({ id: 42, github_id: 4242, github_login: 'stranger', rank: 'xenos', curate: false });
+const CURATOR = Object.freeze({ id: 3, github_id: 3003, github_login: 'curator', rank: 'metic', curate: true });
+
+let caller = OWNER;
+// 'ok' | 'throws' | 'absent' — the port's health, so the fail-closed paths are executed.
+let portMode = 'ok';
+let invites = [];
+let portCalls = [];
+let clientReads = [];
+
+// ── the doorway, stubbed before the router is required ───────────────────────
+
+// Destructured at route-module load, so these must be in place first.
+api.requireBuilder = (req, _res, next) => { req.builder = caller; next(); };
+// A faithful stand-in for auth.requirePermission: it admits a holder and otherwise sends the
+// SAME 403 body every caller of this route has always received. The arm under test delegates
+// to this untouched middleware, so "the refusal is unchanged" is true by construction — what
+// these tests pin is that the delegation happens, and that it happens identically whether or
+// not the project exists.
+api.requirePermission = (...required) => (req, res, next) => {
+  if (req.builder && req.builder.curate) return next();
+  return res.fail('permission_forbidden', {
+    status: 403,
+    message: `missing permission${required.length === 1 ? '' : 's'}: ${required.join(', ')} (floor: metic)`,
+    details: { required, held: [], floors: { [required[0]]: 'metic' } },
+  });
+};
+// Silenced: the fallback path logs, and a pino line on stdout would land inside the TAP stream.
+api.logger = () => ({ error: () => {}, warn: () => {}, info: () => {} });
+
+const realResolveOptional = api.resolveOptional;
+api.resolveOptional = (name) => {
+  if (name !== 'provisioning.projectOwnedBy') return realResolveOptional(name);
+  if (portMode === 'absent') return null;
+  return async ({ slug, host, builderId }) => {
+    portCalls.push({ slug, host, builderId });
+    if (portMode === 'throws') throw new Error('provisioning is down');
+    return INSTANCES.some((i) => i.slug === slug && i.host === host && String(i.owner) === String(builderId));
+  };
+};
+
+pi.getClient = async (id) => { clientReads.push(id); return CLIENTS.get(id) || null; };
+pi.getAccountByLogin = async (login) => (login === 'ghost' ? null : { github_id: 5150, github_login: login });
+pi.inviteToProject = async ({ clientId, githubId }) => {
+  invites.push({ clientId, githubId });
+  return { invited: true, clientId, githubId };
+};
+
+const express = require('express');
+const projectsRoutes = require('../modules/platform-identity/routes/projects.js');
+
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', projectsRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+after(() => server.close());
+
+function invite(body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body === undefined ? {} : body);
+    const req = http.request(`${base}/projects/invite`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j }); });
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+beforeEach(() => { caller = OWNER; portMode = 'ok'; invites = []; portCalls = []; clientReads = []; });
+
+// ── the arm ──────────────────────────────────────────────────────────────────
+
+test('the OWNER of a wizard-made project invites into it, holding no permission at all', async () => {
+  // The whole point of the task: the wizard's audience is any signed-in GitHub user, and a
+  // `xenos` owner used to get 403 on their own project before the target was even resolved.
+  caller = OWNER;
+  const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
+  assert.equal(res.status, 201);
+  assert.equal(res.body.invited, true);
+  assert.deepEqual(invites, [{ clientId: 'spike-harbor', githubId: 5150 }]);
+  // The ownership question was asked of the provisioning row, keyed on BOTH halves of the
+  // catalog projection (ADR 0246: client_id = slug, origin = https://domain).
+  assert.deepEqual(portCalls, [{ slug: 'spike-harbor', host: 'spike-harbor.cloudbongos.test', builderId: 7 }]);
+  // …and the row the gate resolved to ask it rides forward to the handler: equalising the
+  // lookup across callers must not turn into reading the same row twice.
+  assert.deepEqual(clientReads, ['spike-harbor'], 'the client row is read exactly once per request');
+});
+
+test('a METIC curator still invites into a project they do not own — the old door is untouched', async () => {
+  caller = CURATOR;
+  const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
+  assert.equal(res.status, 201);
+  assert.equal(res.body.invited, true);
+  assert.equal(invites.length, 1);
+});
+
+test('a DIFFERENT builder is refused with the unchanged shape, and writes nothing', async () => {
+  caller = STRANGER;
+  const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
+  assert.equal(res.status, 403);
+  assert.equal(res.body.error.code, 'permission_forbidden');
+  assert.deepEqual(res.body.error.details.required, ['project.curate']);
+  assert.deepEqual(invites, [], 'a refused invite writes no membership row');
+});
+
+// ── the refusal is not an existence oracle ───────────────────────────────────
+
+test('a stranger cannot tell a STEALTH project from one that does not exist', async () => {
+  // ADR 0182 D2a: a stealth project is anonymous on the map. Turning this route's 403 into a
+  // 404-or-403 split would hand any signed-in stranger a membership oracle over every private
+  // project on the platform — the refusal must be byte-identical.
+  caller = STRANGER;
+  const stealth = await invite({ client_id: 'quiet-cove', github_login: 'someone' });
+  const nothing = await invite({ client_id: 'never-provisioned', github_login: 'someone' });
+  assert.equal(stealth.status, 403);
+  assert.deepEqual(stealth, nothing);
+  assert.deepEqual(invites, []);
+  // The LATENCY half of the same rule: both requests do the same work. A body-identical
+  // refusal that is measurably faster for a client_id nobody has taken is still an oracle, so
+  // the unknown client is asked about anyway — with the empty host, which matches nothing.
+  assert.deepEqual(clientReads, ['quiet-cove', 'never-provisioned']);
+  assert.deepEqual(portCalls, [
+    { slug: 'quiet-cove', host: 'quiet-cove.cloudbongos.test', builderId: 42 },
+    { slug: 'never-provisioned', host: '', builderId: 42 },
+  ], 'the same two lookups on both paths — the refusal is identical in latency, not only in body');
+});
+
+test('a stranger cannot tell a real project from a malformed request either', async () => {
+  // The gate runs BEFORE the body validator, exactly as requirePermission always did, so a
+  // caller who may not invite never learns whether their body was well-formed.
+  caller = STRANGER;
+  const good = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
+  const empty = await invite({});
+  assert.equal(good.status, 403);
+  assert.deepEqual(good, empty);
+});
+
+// ── the arm cannot be widened by squatting a name ────────────────────────────
+
+test('owning an instance that merely SHARES a client_id grants nothing', async () => {
+  // Builder 42 registered `legacy-port` at their own address; the catalog row of that name is
+  // a hand-seeded client at a different origin, which ADR 0246's claim rule already refuses to
+  // overwrite. The ownership arm answers to the same binding: both halves of the projection
+  // (slug AND origin) must be the caller's, or this is simply not their project.
+  caller = STRANGER;
+  const res = await invite({ client_id: 'legacy-port', github_login: 'someone' });
+  assert.equal(res.status, 403);
+  assert.equal(res.body.error.code, 'permission_forbidden');
+  assert.deepEqual(invites, []);
+  assert.deepEqual(portCalls, [{ slug: 'legacy-port', host: 'legacy-port.example', builderId: 42 }],
+    'the port is asked about the CATALOG row\'s origin, never the caller\'s own instance');
+});
+
+// ── fail-closed on the ownership question itself ─────────────────────────────
+
+test('a missing provisioning module leaves the old door, unchanged', async () => {
+  // platform-identity is the hub; provisioning is a separate default-off module. The hub must
+  // boot without it, and an unresolvable port must deny rather than admit (ADR 0016).
+  portMode = 'absent';
+  caller = OWNER;
+  const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
+  assert.equal(res.status, 403);
+  assert.deepEqual(invites, []);
+});
+
+test('a THROWING ownership check denies — it never 500s and never admits', async () => {
+  portMode = 'throws';
+  caller = OWNER;
+  const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
+  assert.equal(res.status, 403);
+  assert.equal(res.body.error.code, 'permission_forbidden');
+  assert.deepEqual(invites, []);
+  // …while the CURATOR still gets through the same broken path: the failure mode of the new
+  // door is the old door, not an outage.
+  caller = CURATOR;
+  const asCurator = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
+  assert.equal(asCurator.status, 201);
+});
+
+test('a non-string client_id is not an ownership claim', async () => {
+  // The gate runs before the body validator, so it validates its own input rather than
+  // trusting it: only a string names a project, and String(['spike-harbor']) must not.
+  caller = OWNER;
+  for (const client_id of [['spike-harbor'], { toString: () => 'spike-harbor' }, 7, null]) {
+    const res = await invite({ client_id, github_login: 'someone' });
+    assert.equal(res.status, 403, `client_id ${JSON.stringify(client_id)} must not pass the ownership arm`);
+  }
+  assert.deepEqual(portCalls, [], 'a non-string never even reaches the port');
+  assert.deepEqual(clientReads, [], 'nor the client registry — there is no project named here');
+});
+
+// ── the resolved target is still the catalog row's job ───────────────────────
+
+test('an owner asking for a project that has no catalog row still gets the plain 404', async () => {
+  // Ownership admits; it does not conjure a target. `never-provisioned` has no client row, so
+  // the handler's own `unknown_project` is what answers — unchanged from today.
+  caller = CURATOR;
+  const res = await invite({ client_id: 'never-provisioned', github_login: 'someone' });
+  assert.equal(res.status, 404);
+  assert.equal(res.body.error.code, 'unknown_project');
+});
+
+test('SUSPENDING the client still shuts the door on its own owner', async () => {
+  // The operator's revocation lever (`setClientStatus`) is what stops a rogue or compromised
+  // project signing anyone in; a widened door that outlived it would be a widening with no way
+  // back. Ownership admits at the gate, and the handler's own status check answers — the same
+  // `unknown_project` a stranger would get, so suspension is not disclosed either.
+  const suspended = { ...OWNED, status: 'suspended' };
+  CLIENTS.set(suspended.client_id, suspended);
+  try {
+    caller = OWNER;
+    const res = await invite({ client_id: 'spike-harbor', github_login: 'someone' });
+    assert.equal(res.status, 404);
+    assert.equal(res.body.error.code, 'unknown_project');
+    assert.deepEqual(invites, []);
+  } finally {
+    CLIENTS.set(OWNED.client_id, OWNED);
+  }
+});
+
+// ── the authority query itself ───────────────────────────────────────────────
+
+test('projectOwnedBy asks the provisioning row for all three facts at once', async () => {
+  // The authority half of the seam, on the plane that holds the row: slug AND host AND owner
+  // in ONE statement, so there is no read-then-compare window and no consumer ever handles an
+  // ownership id it could mis-compare (ADR 0238 — the hub's own columns are attribution).
+  const provisioning = require('../modules/provisioning/provisioning.js');
+  const seen = [];
+  const db = { query: async (sql, params) => { seen.push({ sql, params }); return { rows: [{ '?column?': 1 }] }; } };
+  assert.equal(await provisioning.projectOwnedBy(db, {
+    slug: 'spike-harbor', host: 'Spike-Harbor.CloudBongos.test', builderId: '7',
+  }), true, 'a bigint id arriving as a string still matches, and the host is compared case-folded');
+  assert.equal(seen.length, 1);
+  assert.match(seen[0].sql, /FROM provisioning_instances/);
+  assert.match(seen[0].sql, /slug = \$1/);
+  assert.match(seen[0].sql, /lower\(domain\) = \$2/);
+  assert.match(seen[0].sql, /owner_builder_id = \$3/);
+  assert.deepEqual(seen[0].params, ['spike-harbor', 'spike-harbor.cloudbongos.test', 7]);
+});
+
+test('projectOwnedBy fails closed before touching the database on anything unidentifiable', async () => {
+  const provisioning = require('../modules/provisioning/provisioning.js');
+  const db = { query: async () => { throw new Error('the query must not run'); } };
+  const bad = [
+    undefined,
+    { slug: '', host: 'h.test', builderId: 7 },
+    { slug: ['s'], host: 'h.test', builderId: 7 },
+    { slug: 's', host: 'h.test', builderId: 'not-a-number' },
+    { slug: 's', host: 'h.test', builderId: 0 },
+    { slug: 's', host: 'h.test', builderId: -1 },
+    { slug: 's', host: 'h.test', builderId: null },
+  ];
+  for (const target of bad) {
+    assert.equal(await provisioning.projectOwnedBy(db, target), false, JSON.stringify(target));
+  }
+});
+
+test('projectOwnedBy QUERIES an empty host rather than short-circuiting it', async () => {
+  // The timing-equalising half, on the plane that runs the statement. An empty host names no
+  // address and matches nothing — `domain` is a hostname or NULL, and `lower(NULL) = ''` is
+  // NULL — so this is a real round-trip with a guaranteed-empty result, not a dummy delay.
+  const provisioning = require('../modules/provisioning/provisioning.js');
+  const seen = [];
+  const db = { query: async (sql, params) => { seen.push(params); return { rows: [] }; } };
+  assert.equal(await provisioning.projectOwnedBy(db, { slug: 's', host: '', builderId: 7 }), false);
+  assert.deepEqual(seen, [['s', '', 7]], 'the query still ran — the caller pays the same cost either way');
+});
+
+test('projectOwnedBy answers false, not a row, when nothing matches', async () => {
+  const provisioning = require('../modules/provisioning/provisioning.js');
+  const db = { query: async () => ({ rows: [] }) };
+  assert.equal(await provisioning.projectOwnedBy(db, { slug: 's', host: 'h.test', builderId: 7 }), false);
+});
+
+// ── the seam ─────────────────────────────────────────────────────────────────
+
+test('provisioning DECLARES the ownership port, and platform-identity does not require it', async () => {
+  // verifyPortsSatisfied reads the manifests at boot, not the registry: an undeclared provider
+  // is invisible to it, and a port named in `consumes` the hub would refuse to boot without.
+  const read = async (rel) => JSON.parse(await (await import('node:fs/promises'))
+    .readFile(new URL(rel, import.meta.url), 'utf8'));
+  const provisioning = await read('../modules/provisioning/module.json');
+  const identity = await read('../modules/platform-identity/module.json');
+  assert.ok(provisioning.provides.includes('provisioning.projectOwnedBy'), 'the port is declared');
+  assert.ok(!(identity.consumes || []).includes('provisioning.projectOwnedBy'),
+    'optional, not required — the hub must boot with no provisioning module at all');
+});