@bongos/core 1.19.537 → 1.19.539

package/docs/module-api-changelog.md

@@ -1523,5 +1523,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.535 with no explicit bump. run 33888048777. (task 1002620)
   1.19.537 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.536 with no explicit bump. run 33888812605. (task 1002620)
+  1.19.538 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.537 with no explicit bump. run 33890191596. (task 1002620)
+  1.19.539 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.538 with no explicit bump. run 33892948885. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/invite-authz.js

@@ -0,0 +1,117 @@
+// modules/platform-identity/invite-authz.js — WHO may invite a builder into a project
+// (POST /projects/invite). Task 1003580 GAP 2, goal 1000046 criterion C6, unblocking the
+// wizard's invite step (BV1.R27, task 1002346).
+//
+// TWO DOORS, DELIBERATELY DIFFERENT KINDS — the scouting-authz.js shape (ADR 0210), which is
+// this codebase's design of record for owner-or-rank:
+//
+//   RANK      — `project.curate`, floor metic (ADR 0157). The hub CURATOR's door, unchanged:
+//               the atom, the 403 body, the floors map. Nothing about it moves here.
+//   OWNERSHIP — the project's own owner, for their own project. The whole of what this adds.
+//
+// WHY THE RANK DOOR ALONE WAS A DEAD END. The creation wizard's audience is any signed-in
+// GitHub user — typically a `xenos` on the hub — and `requirePermission` is purely
+// grant/rank-based with no own-scope branch. So the person who created a project got 403 on
+// inviting anyone to it, and no floor low enough to admit them excludes anybody at all.
+//
+// WHERE THE OWNERSHIP PROOF COMES FROM, AND WHERE IT MUST NOT. `platform_identity_sso_clients
+// .owner_github_id` and `platform_identity_projects.owner_github_id` are ATTRIBUTION, not
+// authority — their own migration says so and ADR 0238 restates it. The authority is
+// `provisioning_instances.owner_builder_id`, the fact the manage view already trusts and
+// `instanceAccessDenied` already enforces. This module may not import provisioning (ADR 0083's
+// one-way rule), so the fact travels on the kernel port `provisioning.projectOwnedBy` —
+// resolveOptional and NOT declared in `consumes` (the `provisioning.projectPlanets`
+// precedent): provisioning is default-off, and a hub running without it simply has no
+// control-plane project to own.
+//
+// THE REFUSAL IS NOT AN ORACLE, IN BODY OR IN LATENCY. Ownership is asked before the target is
+// resolved and before the body validator, and every path does the same two reads, so a
+// stranger's 403 is identical — and identically slow — for a real project, a stealth one
+// (ADR 0182 D2a), one that does not exist, and a malformed body.
+//
+// THE PORT IS ASKED ABOUT BOTH HALVES OF THE PROJECTION. ADR 0246 puts a control-plane project
+// on the map as `client_id = slug` at `origin = https://<domain>`, so the question is "do you
+// own the instance carrying BOTH", never "do you own the slug". A hand-seeded catalog row's
+// name is squattable in `provisioning_instances` — the catalog's own claim rule already
+// refuses to overwrite such a row, and this arm answers to the same binding rather than
+// handing its owner's name to whoever registers an instance called that.
+//
+// IT GRANTS NOTHING ELSE (ADR 0016). Owning a project buys exactly one act on the hub:
+// pre-seeding a `pending` membership on your own project. It confers no rank, no curation, no
+// read of anyone else's project, and nothing else consults it.
+// Proof: ../../tests/project_invite_ownership.mjs
+'use strict';
+
+const api = require('../../src/module-api');
+const pi = require('./platform-identity');
+
+// The kernel port the ownership fact travels on. Resolved BY NAME at call time through the
+// doorway, never imported — provisioning is a sibling module (ADR 0083).
+const OWNERSHIP_PORT = 'provisioning.projectOwnedBy';
+
+// The host a catalog origin names, which is the `provisioning_instances.domain` the projection
+// was keyed on. An unparseable origin has no host and therefore no owner. PURE.
+function hostOfOrigin(origin) {
+  try { return new URL(String(origin)).hostname.toLowerCase(); } catch { return ''; }
+}
+
+// callerOwnsProject(req, { pool }) — is this caller the owner of the control-plane project the
+// requested catalog row was projected from? Fail-closed on every unhappy path: a non-string
+// key (only a string names a project — `String(['x'])` must not become a claim), an
+// unauthenticated caller, no provisioning module.
+//
+// SAME WORK ON EVERY PATH, which is the timing half of "the refusal is not an oracle". An
+// unknown client is asked about anyway — `hostOfOrigin(null)` is the empty host, which
+// `projectOwnedBy` still queries and which matches nothing — so a stranger cannot separate
+// "this project exists" from "it does not" by measuring how long the identical 403 took to
+// arrive. A body-identical refusal that is measurably faster is still an oracle.
+//
+// The resolved row rides forward on `req.inviteTargetClient` (the `req.builder` /
+// `req.rawPermissionKeys` precedent) so equalising the lookup does not duplicate it: the
+// handler needs this same row, and re-reading it would be pure waste on every admitted call.
+async function callerOwnsProject(req, { pool }) {
+  const clientId = req.body && req.body.client_id;
+  if (typeof clientId !== 'string' || clientId === '') return false;
+  const builderId = req.builder && req.builder.id;
+  if (!builderId) return false;
+  const ownedBy = api.resolveOptional(OWNERSHIP_PORT);
+  if (typeof ownedBy !== 'function') return false;
+  const client = await pi.getClient(clientId, { pool });
+  if (client) req.inviteTargetClient = client;
+  return (await ownedBy({ slug: clientId, host: hostOfOrigin(client && client.origin), builderId })) === true;
+}
+
+// requireProjectInviter({ curateGate, pool, log }) — the OR gate as one middleware, mounted
+// after requireBuilder. `curateGate` is the ALREADY-BUILT `requirePermission('project.curate')`
+// middleware: the atom stays spelled in the route's own middleware list, where
+// route-rank-check.js and gen-api-docs.js can see it, so widening the door cannot make the
+// route's recorded rank read looser than it is.
+//
+// ORDER IS THE DESIGN, and it is what keeps the refusal from becoming an existence oracle.
+// Ownership is asked FIRST; when it answers yes the request proceeds and the permission gate
+// never runs. When it answers no — for ANY reason, including "no such project" — the request
+// falls through to the UNMODIFIED permission gate, so a caller who is neither owner nor
+// curator gets exactly the 403 this route has always produced: same code, same required/held,
+// same floors map. A stranger therefore cannot tell a stealth project (ADR 0182 D2a) from one
+// that does not exist, and cannot tell either from a malformed body — the gate still runs
+// before the body validator, exactly as `requirePermission` always did. The widening can only
+// ever ADMIT; it cannot change, soften, or swallow a refusal.
+//
+// FAIL-CLOSED ON THE OWNERSHIP QUESTION ITSELF. A database blip while asking "is this your
+// project" must not admit, and must not 500 either: it falls to the permission gate, which
+// denies unless the caller holds the atom. The failure mode of the new door is the old door.
+function requireProjectInviter({ curateGate, pool, log }) {
+  return async function projectInviterGate(req, res, next) {
+    try {
+      if (await callerOwnsProject(req, { pool })) return next();
+    } catch (err) {
+      // Message only — a query error can carry row data (the requirePermission precedent).
+      log.error({ err: err && err.message }, 'project invite owner check failed — falling back to the permission gate');
+    }
+    return curateGate(req, res, next);
+  };
+}
+
+module.exports = {
+  requireProjectInviter,
+};

package/modules/platform-identity/routes/projects.js

@@ -12,6 +12,8 @@
 //   GET   /projects            — Archon: full curation list (+ featured flags, the stored
 //                                join door, and the DERIVED publish verdict — ADR 0182)
 //   POST  /projects            — Archon: create / update a catalog entry
+//   POST  /projects/invite     — a `project.curate` holder OR the project's OWN owner:
+//                                pre-seed a 'pending' membership (invite-authz.js)
 //   PATCH /projects/:id/featured — Archon: the feature / unfeature control
 //
 // Reaches core only through the doorway (ADR 0083). Archon routes declared first so
@@ -23,6 +25,7 @@ const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const projectCatalog = require('../project-catalog');
 const projectStats = require('../project-stats');
+const inviteAuthz = require('../invite-authz');
 
 const { pool, requireBuilder, requirePermission, validateOrRespond, parseId, corsPublicGet } = api;
 const log = api.logger('platform-identity');
@@ -105,28 +108,52 @@ module.exports = function projectsRoutes() {
     }
   });
 
-  // rank: archon — invite a builder into a project (ADR 0141 §5, task #1002115).
-  // Pre-seeds a 'pending' membership the invitee accepts from My Projects. V1 invites
-  // by github_login and requires the invitee to already have a platform account (they
-  // build on some project); inviting someone entirely new to the platform (GitHub-id
-  // resolution) is a follow-up.
-  router.post('/projects/invite', requireBuilder, requirePermission('project.curate'), async (req, res) => {
-    if (validateOrRespond(req, res, {
-      client_id: { required: true, type: 'string', maxLength: 200 },
-      github_login: { required: true, type: 'string', maxLength: 200 },
-    })) return;
-    try {
-      const client = await pi.getClient(req.body.client_id, { pool });
-      if (!client || client.status !== 'active') return res.fail('unknown_project', 404);
-      const account = await pi.getAccountByLogin(req.body.github_login, { pool });
-      if (!account) return res.fail('account_not_found', { status: 404, message: 'That builder has no platform account yet — they must sign in somewhere once before they can be invited.' });
-      const out = await pi.inviteToProject({ clientId: req.body.client_id, githubId: account.github_id }, { pool });
-      res.status(out.invited ? 201 : 200).json(out);
-    } catch (err) {
-      console.error('[platform-identity] POST /projects/invite', err);
-      res.fail('invite_failed', { status: 500, message: 'internal error' });
-    }
-  });
+  // The atom is spelled in the middleware list below, not hidden inside
+  // requireProjectInviter, so route-rank-check.js and gen-api-docs.js classify this
+  // route from its real gate. A helper-hidden gate would record a privileged route
+  // as any-builder — wrong in the dangerous direction (the ADR 0210 rule).
+
+  // rank: metic+archon — own-or-metic in effect: invite a builder into a project
+  // (ADR 0141 §5, task #1002115), called by a `project.curate` holder OR the project's OWN
+  // OWNER (task 1003580; the ownership proof is `provisioning_instances.owner_builder_id`,
+  // reached through a port — see invite-authz.js). The wizard's audience is any signed-in
+  // GitHub user, typically a xenos who used to get 403 on their own project. A caller who is
+  // neither gets the unchanged permission refusal, identical whether or not the project
+  // exists. Pre-seeds a 'pending' membership the invitee accepts from My Projects. V1 invites
+  // by github_login and requires the invitee to already have a platform account (they build
+  // on some project); inviting someone entirely new to the platform (GitHub-id resolution) is
+  // a follow-up.
+  router.post(
+    '/projects/invite',
+    requireBuilder,
+    // Ownership is asked FIRST — one client read plus one indexed LIMIT-1 lookup, the SAME two
+    // on every path so the refusal is identical in latency as well as in body. Asking the
+    // permission gate first is not available: a middleware that has denied has already SENT
+    // its response, so there is nothing to fall through from. Paying the round-trip is what
+    // keeps the 403 byte-identical to the one this route has always produced (ADR 0210 D2).
+    // The gate leaves the resolved client on `req.inviteTargetClient` for the handler below.
+    inviteAuthz.requireProjectInviter({ curateGate: api.requirePermission('project.curate'), pool, log }),
+    async (req, res) => {
+      if (validateOrRespond(req, res, {
+        client_id: { required: true, type: 'string', maxLength: 200 },
+        github_login: { required: true, type: 'string', maxLength: 200 },
+      })) return;
+      try {
+        // The gate already resolved this exact row (it must, to answer the ownership
+        // question); reusing it keeps the equalised lookup from becoming a duplicated one.
+        // It is only ever absent when the gate found nothing, so the fallback still reads.
+        const client = req.inviteTargetClient || await pi.getClient(req.body.client_id, { pool });
+        if (!client || client.status !== 'active') return res.fail('unknown_project', 404);
+        const account = await pi.getAccountByLogin(req.body.github_login, { pool });
+        if (!account) return res.fail('account_not_found', { status: 404, message: 'That builder has no platform account yet — they must sign in somewhere once before they can be invited.' });
+        const out = await pi.inviteToProject({ clientId: req.body.client_id, githubId: account.github_id }, { pool });
+        res.status(out.invited ? 201 : 200).json(out);
+      } catch (err) {
+        console.error('[platform-identity] POST /projects/invite', err);
+        res.fail('invite_failed', { status: 500, message: 'internal error' });
+      }
+    },
+  );
 
   // rank: archon — the feature / unfeature control (the ADR 0141 §5 curation gate),
   // BOUNDED BY THE PUBLISH GATE (ADR 0182 D3, task 1002335). Featuring ranks among

package/modules/provisioning/module.json

@@ -14,6 +14,6 @@
     "migrations": true,
     "pollers": ["liveness-sweep"]
   },
-  "provides": ["provisioning.instanceState", "provisioning.projectPlanets"],
+  "provides": ["provisioning.instanceState", "provisioning.projectPlanets", "provisioning.projectOwnedBy"],
   "consumes": []
 }

package/modules/provisioning/provisioning.js

@@ -1180,6 +1180,43 @@ async function instanceStateForSlug(db, slug) {
   };
 }
 
+// The `provisioning.projectOwnedBy` port (task 1003580): is THIS builder the owner of the
+// control-plane project a hub catalog row names? Lets a hub surface own-scope a project it
+// did not create — without importing this module (ADR 0083) and without promoting the hub's
+// own `owner_github_id` columns, which are attribution and never authority (ADR 0238). The
+// fact returned is the one `instanceAccessDenied` already enforces on every owner-facing
+// route here: `provisioning_instances.owner_builder_id`.
+//
+// BOTH HALVES OF THE PROJECTION MUST AGREE, which is why this takes a slug AND a host rather
+// than a slug alone. ADR 0246 projects an instance onto the map as `client_id = slug` at
+// `origin = https://<domain>`, so a caller speaks for a catalog row only when they own the
+// instance carrying BOTH. Matching the slug by itself would let someone who registers an
+// instance NAMED after a client the control plane never created — a hand-seeded row, whose
+// origin the catalog's own claim rule already refuses to overwrite — speak for that project.
+//
+// A BOOLEAN, not the owner's id: the comparison is authority and belongs on the plane that
+// holds the row, so no consumer ever handles an ownership fact it could mis-compare. Read-only
+// and fail-closed on an unidentifiable key or builder id.
+//
+// AN ABSENT HOST IS STILL ASKED, and matches nothing — `domain` is never the empty string (it
+// is a hostname or NULL, and `lower(NULL) = ''` is NULL, i.e. not true). Short-circuiting it
+// would make the caller's work depend on whether the catalog row exists, and a refusal that is
+// byte-identical but measurably FASTER is still an existence oracle. The query is the cheap
+// half of keeping every caller's path the same shape.
+async function projectOwnedBy(db, { slug, host, builderId } = {}) {
+  const wantSlug = typeof slug === 'string' ? slug : '';
+  const wantHost = typeof host === 'string' ? host.toLowerCase() : '';
+  const owner = Number(builderId);
+  if (!wantSlug || !Number.isInteger(owner) || owner <= 0) return false;
+  const { rows } = await db.query(
+    `SELECT 1 FROM provisioning_instances
+      WHERE slug = $1 AND lower(domain) = $2 AND owner_builder_id = $3
+      LIMIT 1`,
+    [wantSlug, wantHost, owner],
+  );
+  return rows.length > 0;
+}
+
 // The `provisioning.projectPlanets` port (task 1003347): the owners' planet
 // choices for a set of HOSTS (the catalog's origins, host-matched — the join the
 // hub's sky makes), so platform-identity's public featured feed can carry them
@@ -1252,7 +1289,7 @@ module.exports = {
   createInstance, setInstanceStatus, updateInstanceDomain, updateInstanceSettings, updateInstanceDetail,
   createInstance, setInstanceStatus, updateInstanceDomain, clearReleasedDomains, updateInstanceSettings,
   enqueueIntent, enqueueTeardown, enqueueSettingsApply, enqueueRestart, getOpenIntent, claimNextIntent, resolveIntent,
-  recordEvent, instanceStateForSlug, planetChoicesForHosts, costLedger,
+  recordEvent, instanceStateForSlug, planetChoicesForHosts, projectOwnedBy, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)
   createOAuthManifest, getOAuthManifestByState, attachManifestCode,
   getLatestOAuthManifestForInstance, claimNextOAuthManifest, resolveOAuthManifest,

package/modules/provisioning/routes/provisioning.js

@@ -159,10 +159,16 @@ function badModuleSelection(modules) {
 //   • PROVIDES port `provisioning.projectPlanets` (hosts[]) → { host: { planet_template,
 //     planet_accent } } — the owners' planet choices (task 1003347), so the hub's
 //     public featured feed can carry them without importing this module.
+//   • PROVIDES port `provisioning.projectOwnedBy` ({ slug, host, builderId }) → boolean —
+//     the OWNERSHIP fact behind a hub catalog row (task 1003580), so a hub surface can
+//     own-scope a project without importing this module and without treating the hub's
+//     `owner_github_id` columns as authority (ADR 0238). See projectOwnedBy for why the
+//     question names both halves of the ADR 0246 projection.
 function registerProvisioningSeams() {
   if (api.hasProvider('provisioning.instanceState')) return;
   api.registerProvider('provisioning.instanceState', (slug) => provisioning.instanceStateForSlug(pool, slug));
   api.registerProvider('provisioning.projectPlanets', (hosts) => provisioning.planetChoicesForHosts(pool, hosts));
+  api.registerProvider('provisioning.projectOwnedBy', (target) => provisioning.projectOwnedBy(pool, target));
 }
 
 // Is this project on the public map, and if not, what is it still missing?

package/modules/public-landing/public/assets/cosmos.css

@@ -411,6 +411,16 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
    task 1003355 moved it to the project's own page, where the section's heading
    is the disclosure and the row it left carries only its two doors. */
 .attachNote{margin:8px 0 0;font-size:13px;line-height:1.45;color:var(--ink-faint);}
+/* invites filed in this session (task 1002346): a hairline ledger under the pair
+   above — one line per person, the name in the body voice, what happened next to
+   it in the faint ink. Shared by the wizard's step and the project's own page. */
+.inviteList{list-style:none;display:grid;margin:12px 0 0;padding:0;}
+.inviteList:empty{display:none;}
+.inviteList>li{display:grid;grid-template-columns:auto 1fr;gap:2px 10px;padding:10px 0 11px;border-top:1px solid var(--rule-soft);}
+.inviteList>li:first-child{border-top:0;}
+.inviteList>li::before{content:"";grid-column:1;grid-row:1;width:7px;height:7px;margin-top:7px;border-radius:50%;border:1px solid var(--accent);background:var(--bg);}
+.inviteList b{grid-column:2;font-family:var(--font-body);font-weight:500;font-size:15px;color:var(--ink);}
+.inviteList small{grid-column:2;font-family:var(--font-body);font-size:13px;font-weight:400;line-height:1.45;color:var(--ink-faint);}
 .attachNote code{font-family:var(--font-mono);}
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
 .projMsg.ok{color:var(--ok);}
@@ -1516,6 +1526,14 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-new #wizSignin:hover{background:color-mix(in srgb,var(--ink) 88%,var(--bg));}
 /* the error alert: the error ink between two hairlines, no plate */
 #view-new .alert{background:none;border:0;border-top:1px solid var(--err);border-bottom:1px solid var(--err);border-radius:0;padding:12px 0;font-weight:400;}
+/* the invite step (task 1002346): the page's own input+button pair, wearing the
+   wizard's hairline field rather than the plated one — the .attach width has to
+   give way to the row's flex, or #view-new's own width:100% overflows it */
+#view-new .attach{gap:10px 14px;margin-top:14px;align-items:center;}
+#view-new .attach input[type=text]{width:auto;flex:1;min-width:220px;}
+#view-new .inviteBox{margin-top:34px;}
+#view-new .inviteBox .finePrint{margin-top:10px;}
+#view-new #wizInviteLater{margin-top:14px;}
 /* one fold for the whole wizard: 840 is where the page's bands and ledger stack
    (cosmos's createSplit collapse), so the rail folds with them, not before them */
 @media (max-width:840px){

package/modules/public-landing/public/projects.html

@@ -849,6 +849,27 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- live since task 1002346 (BV1.R27): the way to invite a builder AFTER
+           creation. The wizard's invite step is skippable, and — the mModules
+           argument beside it — an optional step is a default rather than a dead end
+           only if there is a way back. The SAME widget on the SAME route
+           (POST /projects/invite), admitted here by the project's own ownership
+           (ADR 0248); like its neighbour above, nothing is pushed to the project and
+           nothing restarts, so there is no "what your project runs" read-back line. -->
+      <div class="card mSec" id="mInvite">
+        <h2>Invite a builder</h2>
+        <div id="mInv">
+          <p class="finePrint">By GitHub username. They get an invitation to accept from their own projects page, and they need to have signed in here at least once.</p>
+          <div class="attach">
+            <label class="vh" for="mInviteWho">GitHub username</label>
+            <input type="text" id="mInviteWho" placeholder="GitHub username" autocomplete="off" autocapitalize="off" spellcheck="false" maxlength="200">
+            <button type="button" class="btn small" data-invite-send="mInvite">Invite</button>
+          </div>
+          <ul class="inviteList" id="mInviteList"></ul>
+          <div class="projMsg" id="mInviteMsg" role="status" aria-live="polite"></div>
+        </div>
+      </div>
+
       <!-- the planet picker (task 1003347; direction record §16, v1 the bands): the
            owner's own choice of how the platform draws this project — the sky,
            the list, this page's head and the card read the same row. The pick is
@@ -1203,7 +1224,29 @@ summary{min-height:24px;padding:3px 0;}
             <!-- the STABLE live region: the strip inside is rebuilt every 5s tick,
                  and a live region that is itself replaced never announces -->
             <div id="liveProgress" role="status" aria-live="polite"></div>
-            <h2 class="stepsHead">Your steps — the parts only you can play</h2>
+            <!-- the invite step (task 1002346, BV1.R27) — OPTIONAL, and it stands HERE
+                 rather than in the numbered rail because an invite needs a project that
+                 already exists: the catalog row a client_id resolves is projected at
+                 create (ADR 0246), so before the Create step there is nothing to invite
+                 anyone TO. The whole reasoning is ADR 0249. Hidden until the created
+                 record carries an id and a slug; the script is the only thing that
+                 shows it. -->
+            <div class="inviteBox" id="wizInvite" hidden>
+              <h2 class="stepsHead">Invite builders</h2>
+              <p class="finePrint">Optional — invite people by GitHub username. Each one gets an invitation to accept from their own projects page, and they need to have signed in here at least once. Skip this and invite anyone later; nothing about your project waits on it.</p>
+              <div class="attach">
+                <label class="vh" for="wizInviteWho">GitHub username</label>
+                <input type="text" id="wizInviteWho" placeholder="GitHub username" autocomplete="off" autocapitalize="off" spellcheck="false" maxlength="200">
+                <button type="button" class="btn small" data-invite-send="wizInvite">Invite</button>
+                <button type="button" class="btn small ghost" data-invite-skip="wizInvite">Skip</button>
+              </div>
+              <ul class="inviteList" id="wizInviteList"></ul>
+              <div class="projMsg" id="wizInviteMsg" role="status" aria-live="polite"></div>
+            </div>
+            <!-- the way back, the doneModules idiom: an optional step is a default
+                 rather than a dead end only if the panel names where it lives after -->
+            <p class="samePath" id="wizInviteLater"></p>
+            <h2 class="stepsHead" id="doneStepsHead">Your steps — the parts only you can play</h2>
             <ol class="humanSteps" id="humanSteps"></ol>
             <!-- the modules step was optional (task 1002342, BV1.R23) — one line
                  saying where it lives afterwards, so a skip is never a dead end -->
@@ -4098,6 +4141,14 @@ summary{min-height:24px;padding:3px 0;}
          skippable, so this panel names where it lives afterwards rather than
          leaving an owner to go looking for it. */
       $('doneModules').innerHTML = 'Add or remove modules later in ' + projectPageLink('the project’s settings') + '.';
+      /* the invite step (task 1002346, BV1.R27). The CREATED RECORD is the proof
+         the widget needs and the only one this panel has: no signed-in identity,
+         no filed instance or no slug ⇒ nothing to invite to, and the step stays
+         hidden. It is deliberately NOT keyed on instanceId, which startProgress
+         sets only AFTER this runs. */
+      var created = createdRecord();
+      setInviteSlug('wizInvite', (me && created && created.id && created.slug) ? created.slug : '');
+      $('wizInviteLater').innerHTML = 'You can invite builders any time from ' + projectPageLink('the project’s own page') + '.';
       renderSteps();
     }
 
@@ -5280,6 +5331,11 @@ summary{min-height:24px;padding:3px 0;}
        progress survives the tick because only a different project re-renders it */
     renderPick(inst);
     renderCardPick(inst);
+    /* invite a builder (task 1002346): fetch-free too — the widget needs only the
+       slug, and the API is the wall. This read is own-scoped and 404s for anyone
+       who is not the owner, so reaching renderManage at all IS the ownership
+       answer the widget does not ask for itself. */
+    setInviteSlug('mInvite', inst.slug || '');
     /* the page names its project — the heading holds #mName; and in the tab */
     document.title = (inst.slug ? inst.slug + ' — ' : '') + BASE_TITLE;
     /* the card's own story, on the project's own page (task 1003232): the
@@ -6692,6 +6748,169 @@ summary{min-height:24px;padding:3px 0;}
     goToManage(m.getAttribute('data-manage'));
   });
 
+  /* ══ invite a builder (task 1002346, BV1.R27; goal 1000046 criterion C6, ADR 0249)
+     ONE widget, mounted twice: the creation wizard's optional invite step (on the
+     done panel — an invite needs a project that already exists) and the project's
+     own page, so a skipped step is a default rather than a dead end.
+
+     THE ROUTE IS USED AS IT STANDS: POST /projects/invite { client_id, github_login },
+     where client_id IS the project's slug — ADR 0246 projects a control-plane project
+     onto the catalog under its slug — and the project's owner is admitted by ADR 0248's
+     ownership arm. Nothing here is a second gate; the server owns the answer.
+
+     TWO QUESTIONS THIS WIDGET DELIBERATELY DOES NOT ASK: "is anyone signed in" and
+     "is this their project". Each caller already knows, and hands over a slug or
+     nothing — which is the ONE door in (setInviteSlug). A widget that re-derived
+     ownership on the page would be a second, weaker copy of a server rule.
+
+     THE REFUSALS ARE SAID IN THE ROUTE'S OWN VOCABULARY, and the 403 is said
+     CAREFULLY: it is byte-identical whether the project is real, stealth, or absent
+     (ADR 0248), so this page may never word it as "it exists but you may not" — that
+     would hand back the membership oracle the route equalised away.
+
+     IT NEVER BLOCKS CREATION. The project is filed before the step is shown at all;
+     a refusal leaves the box exactly as it was, ready to try again.
+
+     WHAT IT PUBLISHES OF AN INVITEE is the 201 row's own membership_kind and the
+     login the inviter typed — never the github_id the row carries, which belongs to
+     someone who has accepted nothing yet.
+     Proof: ../../../tests/project_invite_ui.mjs ══ */
+
+  var INVITE_MOUNTS = {
+    wizInvite: { who: 'wizInviteWho', list: 'wizInviteList', msg: 'wizInviteMsg', after: 'doneStepsHead' },
+    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', after: null }
+  };
+  var inviteSlug = {};   /* mount id → the slug it invites to; '' means no step at all */
+  var inviteRows = {};   /* mount id → the invites filed on THIS project this session */
+  var inviteBusy = {};   /* a send is in flight — the mount is inert until it answers */
+
+  /* setInviteSlug(id, slug) — the only door in. A falsy slug closes the mount, which
+     is how "signed out", "not the owner" and "no project yet" all reach this widget.
+     A DIFFERENT slug starts clean: the pending lines belonged to the project they
+     were filed on, and following them to another one would be a lie. */
+  function setInviteSlug(id, slug) {
+    var m = INVITE_MOUNTS[id];
+    if (!m) return;
+    var next = slug || '';
+    if (inviteSlug[id] !== next) {
+      inviteSlug[id] = next;
+      inviteRows[id] = [];
+      inviteSay(id, '', '');
+    }
+    var box = $(id);
+    if (box) box.hidden = !next;
+    renderInviteRows(id);
+  }
+
+  /* One line per invite this session filed: the login the inviter typed, and the
+     WORD THE ROW ITSELF CARRIES — so a membership_kind other than 'pending' shows
+     up here rather than being papered over as one. */
+  function renderInviteRows(id) {
+    var m = INVITE_MOUNTS[id];
+    var list = m && $(m.list);
+    if (!list) return;
+    list.innerHTML = (inviteRows[id] || []).map(function (r) {
+      var said = r.kind === 'pending' ? 'invited — waiting for them to accept.' : r.kind;
+      return '<li><b>' + esc(r.login) + '</b><small>' + esc(said) + '</small></li>';
+    }).join('');
+  }
+
+  function inviteSay(id, text, cls, isHtml) {
+    var m = INVITE_MOUNTS[id];
+    var el = m && $(m.msg);
+    if (!el) return;
+    el.className = 'projMsg' + (cls ? ' ' + cls : '');
+    if (isHtml) el.innerHTML = text; else el.textContent = text;
+  }
+
+  /* inviteRefusal(code, status, message) — the route's refusals as one sentence
+     each. PURE, so the harness reads it directly. A code this page does not know
+     falls through to the SERVER'S own words rather than an invented reason. */
+  function inviteRefusal(code, status, message) {
+    if (status === 404 && code === 'account_not_found') return 'That builder hasn’t signed in here yet — ask them to sign in once, then invite them.';
+    if (status === 404 && code === 'unknown_project') return 'This project isn’t on the map yet — give it a moment and try again.';
+    /* deliberately says nothing about the project: see the header */
+    if (status === 403) return 'This account can’t invite people here.';
+    return message || 'The invitation couldn’t be sent — try again in a moment.';
+  }
+
+  /* doInvite(id) — one builder, one request. */
+  function doInvite(id) {
+    var m = INVITE_MOUNTS[id];
+    var slug = inviteSlug[id] || '';
+    if (!m || !slug || inviteBusy[id]) return;
+    var field = $(m.who);
+    var login = String((field && field.value) || '').replace(/^\s+|\s+$/g, '');
+    if (!login) {
+      inviteSay(id, 'Type the GitHub username of the person you want to invite.', 'err');
+      if (field && field.focus) field.focus();
+      return;
+    }
+    inviteBusy[id] = true;
+    inviteSay(id, 'Sending the invitation…', '');
+    fetch(API + '/projects/invite', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ client_id: slug, github_login: login })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        inviteBusy[id] = false;
+        if (res.ok) {
+          if (data && data.invited && data.row) {
+            inviteRows[id] = (inviteRows[id] || []).concat([{ login: login, kind: String(data.row.membership_kind || 'pending') }]);
+            renderInviteRows(id);
+            if (field) { field.value = ''; if (field.focus) field.focus(); }
+            inviteSay(id, login + ' is invited — they accept it from their own projects page.', 'ok');
+            return;
+          }
+          /* 200 { invited: false, alreadyMember: true } — not a failure, and not a
+             pending invite either: they are already on the project */
+          if (field) field.value = '';
+          inviteSay(id, login + ' is already on this project.', 'ok');
+          return;
+        }
+        if (res.status === 401) { inviteSay(id, signInAgain(), 'err', true); return; }
+        var e = apiError(data, res.status);
+        inviteSay(id, inviteRefusal(e.code, res.status, e.message), 'err');
+      });
+    }).catch(function () {
+      inviteBusy[id] = false;
+      inviteSay(id, 'Couldn’t reach the platform — check your connection and try again.', 'err');
+    });
+  }
+
+  /* skipInvite(id) — the step steps aside having sent NOTHING. Focus moves on
+     rather than being stranded inside the box that just went away. */
+  function skipInvite(id) {
+    var m = INVITE_MOUNTS[id];
+    if (!m || inviteBusy[id]) return;
+    var box = $(id);
+    if (box) box.hidden = true;
+    inviteSay(id, '', '');
+    var after = m.after && $(m.after);
+    if (after && after.focus) { after.setAttribute('tabindex', '-1'); after.focus(); }
+  }
+
+  /* One delegated pair per mount: the buttons name their own mount, so the two
+     surfaces share every line of behaviour above without sharing state. */
+  Object.keys(INVITE_MOUNTS).forEach(function (id) {
+    var box = $(id);
+    if (box) {
+      box.addEventListener('click', function (ev) {
+        var t = ev.target.closest && ev.target.closest('[data-invite-send],[data-invite-skip]');
+        if (!t) return;
+        if (t.hasAttribute('data-invite-skip')) skipInvite(id); else doInvite(id);
+      });
+    }
+    var field = $(INVITE_MOUNTS[id].who);
+    if (field) {
+      field.addEventListener('keydown', function (ev) {
+        if (ev.key !== 'Enter') return;
+        ev.preventDefault();
+        doInvite(id);
+      });
+    }
+  });
+
   /* ── boot: who am I → my instances ────────────────────────────────────── */
 
   function renderWho() {

package/modules/public-landing/public/projects.states.json

@@ -22,6 +22,7 @@
     "in-manage-address": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mAddress", "#mAddress h2", "#mDom .plain", "#mDomName", "#mDom [data-m-attach]", "#mDomWhat summary"], "count": [["#mDom .attach input[type=text]", 1], ["#mDom .attach button", 1]] } },
     "in-manage-planet": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mPlanetPick", "#mPick .pick .pickPreview .worldOrb .disc", "#mPick [data-pick-save]", "#mPick [data-pick-reset]", "#mPickWhat summary"], "count": [["#mPick .pickCells[role=\"radiogroup\"]", 3], ["#mPick .pickCell", 10], ["#mPick .pickCell.on", 3], ["#mPick .pickSw", 5], ["#mPick .pickSw.on", 1]], "attr": [["#mPick .pickPreview .worldOrb", "data-template", "pair-obsidian-tint"], ["#mOrb .worldOrb", "data-template", "pair-obsidian-tint"]], "checked": "#mPick input[name=\"mPickAccent\"][value=\"sea\"]", "text": [["#mPlanet .v small", "your choice."]] } },
     "in-manage-card": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mCard", "#mCardPick .pick .pickPreview .cardBand", "#mCardPick [data-card-save]", "#mCardWhat summary"], "count": [["#mCardPick .pickCells[role=\"radiogroup\"]", 1], ["#mCardPick .pickCell", 5], ["#mCardPick .pickCell.on", 1]], "checked": "#mCardPick input[name=\"mCardBackdrop\"][value=\"\"]", "attr": [["#mCardPick .cardBand", "data-own", ""]] } },
+    "in-manage-invite": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mInvite", "#mInvite h2", "#mInviteWho", "#mInvite [data-invite-send]"] } },
     "in-manage-snag": { "auth": true, "url": "/projects?view=manage&id=103", "expect": { "visible": ["#mMain", "#mErr", "#mActs"], "hidden": ["#mAddress"], "text": [["#mName", "tidepool"]] } },
     "in-manage-gone": { "auth": true, "url": "/projects?view=manage&id=104", "expect": { "visible": ["#mMain", "#mActs"], "hidden": ["#mErr", "#mAddress"], "text": [["#mName", "old-lantern"]] } },
     "in-manage-missing": { "auth": true, "url": "/projects?view=manage&id=999", "expect": { "visible": ["#mMissing"], "hidden": ["#mMain", "#mGate"] } },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.537",
+  "version": "1.19.539",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.537",
+      "version": "1.19.539",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.537",
+  "version": "1.19.539",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",