@bongos/core 1.19.562 → 1.19.563

package/docs/module-api-changelog.md

@@ -1573,5 +1573,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.560 with no explicit bump. run 34048169727. (task 1002620)
   1.19.562 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.561 with no explicit bump. run 34048961786. (task 1002620)
+  1.19.563 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.562 with no explicit bump. run 34049959536. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -676,6 +676,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
+      // GET /provisioning/instances/{id}/invite-suggestions — rank: any-builder — GET /provisioning/instances/:id/invite-suggestions
+      getProvisioningInstancesIdInviteSuggestions: (args) => request("GET", "/provisioning/instances/{id}/invite-suggestions", { hasBody: false }, args),
       // POST /provisioning/instances/{id}/restart — rank: any-builder — POST /provisioning/instances/:id/restart
       postProvisioningInstancesIdRestart: (args) => request("POST", "/provisioning/instances/{id}/restart", { hasBody: true }, args),
       // GET /provisioning/instances/{id}/settings — rank: any-builder — GET /provisioning/instances/:id/settings

package/modules/lifecycle/db-versions.js

@@ -81,6 +81,27 @@ async function versionProgress() {
 // commit together, so a bad criterion leaves nothing half-created. Criteria are
 // idempotent on (version_id, criterion_id) so a re-run can't double-insert.
 
+// versionsWithStatus — the versions currently in a given state, id + name only.
+// Added for the one-planning-version rule (BV1.R04, task 1003592, goal 1000086,
+// ADR 0250 D5): with R03 closing a building version's goal set, cutting a second
+// planning version is the obvious way around it — file the goal on a fresh
+// version instead. One planning version means one queue for future work and no
+// parallel escape hatch.
+//
+// NOTE ON "per project": this instance's `versions` table has no project column
+// (migration 003) — a Bongos database IS one project — so "for a project" and
+// "in this instance" are the same question here. If a project column ever lands,
+// this is the read that needs the extra predicate, and the route above it needs
+// nothing.
+async function versionsWithStatus(status, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const { rows } = await activePool.query(
+    `SELECT id, name FROM versions WHERE status = $1 ORDER BY id`,
+    [status]
+  );
+  return rows;
+}
+
 async function createVersion({ id, name, status = 'planning', track = 'product', scopeDocPath = null, doneWhen = null, criteria = [] }) {
   // versions.track is NOT NULL with no DB default (migration 003) — omitting it
   // here made every create 500. An instance's first version is its product
@@ -115,4 +136,5 @@ module.exports = {
   getVersion,
   listVersions,
   versionProgress,
+  versionsWithStatus,
 };

package/modules/lifecycle/db.js

@@ -63,7 +63,7 @@ const {
   singleRungPromotionError,
   xenosClaimAllowed,
 } = require('./db-rank-authz.js');
-const { createVersion, getVersion, listVersions, versionProgress } = require('./db-versions.js');
+const { createVersion, getVersion, listVersions, versionProgress, versionsWithStatus } = require('./db-versions.js');
 const {
   acceptMembershipRequestAndAddMember,
   achieveGoalIfComplete,
@@ -213,6 +213,7 @@ module.exports = {
   listVersions,
   getVersion,
   versionProgress,
+  versionsWithStatus,
   createVersion,
   createGoal,
   getGoal,

package/modules/lifecycle/routes/version-route-authz.js

@@ -0,0 +1,56 @@
+'use strict';
+
+// modules/lifecycle/routes/version-route-authz.js — the PURE predicates behind
+// the version routes. Sibling of goal-route-authz.js, same contract: no express,
+// no DB, no pool — the route gathers the facts, this decides, the route renders
+// the decision verbatim.
+//
+// Carved on the same argument that file was: a decision expressed as a pure
+// function has its whole truth table exercised by a DB-free unit test, including
+// the shapes a live-Postgres test would never bother to set up (an unrecognised
+// status, a null, a value that merely coerces to true). Inlining the same rule in
+// the handler leaves it testable only by string-matching the source, which passes
+// just as happily on a wrong branch or dead code.
+
+// authorizeVersionCreate — may a version be created in this state?
+// (BV1.R04, task 1003592, goal 1000086, ADR 0250 D5.)
+//
+// THE RULE: exactly one version sits in `planning` at a time. This is the second
+// half of R03 (`authorizeGoalCreate`). Once a building version's goal set is
+// closed, the first thing a refused caller reaches for is a NEW version to put
+// the goal on — and the scope gate becomes decorative. One planning version means
+// one queue for future work and no parallel escape hatch.
+//
+// Guards the PLANNING slot only: creating a `shipped` or `frozen` version is
+// archival bookkeeping and no business of this rule. Refusing a second BUILDING
+// version is D5's other half, task 1003606 (R19).
+//
+// `planning` is the versions already in that state (id + name), which the route
+// reads. Passing the rows rather than a boolean is what lets the refusal NAME the
+// version already holding the queue: "one version plans at a time" without saying
+// which one sends the caller off to look it up, and a caller who looks it up is
+// one step from cutting a version anyway.
+//
+// ON "per project": this instance's `versions` table has no project column
+// (migration 003) — a Bongos database IS one project — so "for a project" and
+// "in this instance" are the same question here. If a project column ever lands,
+// the READ the route performs grows a predicate; this function does not change.
+//
+// Returns { ok: true } or { ok: false, status, body } — the exact HTTP status and
+// JSON the route sends.
+function authorizeVersionCreate({ status, planning = [] }) {
+  if (status !== 'planning') return { ok: true };
+  const existing = Array.isArray(planning) ? planning.filter(Boolean) : [];
+  if (existing.length === 0) return { ok: true };
+  return {
+    ok: false,
+    status: 409,
+    body: {
+      error: 'planning_version_exists',
+      message: `Version '${existing[0].id}' is already in planning — scope this work onto it, or ship it first. One version plans at a time.`,
+      planning: existing,
+    },
+  };
+}
+
+module.exports = { authorizeVersionCreate };

package/modules/lifecycle/routes/versions.js

@@ -23,6 +23,7 @@ const auth = api;
 const db = require('../db');
 const versionClose = require('../version-close');
 const doneWhen = require('../done-when');
+const { authorizeVersionCreate } = require('./version-route-authz.js');
 const { asyncHandler, validateOrRespond } = api;
 
 // versions.status CHECK (migration 003). A new version starts 'planning' or
@@ -114,6 +115,27 @@ module.exports = function buildVersionsRouter() {
       return res.fail('version_exists', { status: 409, message: `Version '${id}' already exists.` });
     }
 
+    // BV1.R04 (task 1003592, goal 1000086, ADR 0250 D5): exactly one version may
+    // sit in `planning`. The decision is the pure authorizeVersionCreate, the
+    // sibling of R03's authorizeGoalCreate — the route gathers the facts and
+    // renders the verdict, it does not carry the rule.
+    //
+    // RACE, ACCEPTED AND UNMITIGATED: this is check-then-insert, and no database
+    // constraint backs it — two concurrent POST /versions with status=planning
+    // could both pass. Unlike the id collision above, which Postgres catches on
+    // the primary key, nothing catches this one. The real fix is a partial unique
+    // index (`ON versions (status) WHERE status = 'planning'`), which is a
+    // migration this task did not reserve a number for; task 1003606 (R19) adds
+    // the second-BUILDING-version rule of the same shape and is the natural place
+    // to add the index for both. Until then the exposure is bounded by the route
+    // being Archon-gated and used a few times a year — small, not zero.
+    const versionDecision = authorizeVersionCreate({
+      status,
+      planning: status === 'planning' ? await db.versionsWithStatus('planning') : [],
+    });
+    if (!versionDecision.ok) {
+      return res.status(versionDecision.status).json(versionDecision.body);
+    }
     // Normalize criteria: each { criterion_id, criterion_md } (+ optional sort_order).
     const rawCriteria = Array.isArray(body.criteria) ? body.criteria : [];
     const criteria = [];

package/modules/platform-identity/invite-suggestions.js

@@ -0,0 +1,57 @@
+// modules/platform-identity/invite-suggestions.js — WHO is worth inviting to a
+// project (BV1.R28, task 1002347, ADR 0251): the names behind the creation
+// wizard's `invites.seeking`.
+//
+// The wizard's rule engine (modules/provisioning/recommendations.js) states WHAT
+// to look for and cannot run the lookup — it is a pure file, and the directory
+// lives in a module `provisioning` may not import (ADR 0239 §6, ADR 0083). This
+// is the lookup, reached through the `platform-identity.hub` port.
+//
+// Its own file rather than another function in platform-identity.js: that file
+// sits at the size ceiling, and this is a cohesive unit with one caller.
+
+const { listScoutingRollup } = require('./platform-identity');
+
+// Never suggest more than this many people however large a seek asks for — a
+// suggestion is a short list, and the ceiling is what keeps the route from being
+// turned into a directory dump by a caller that controls the limit.
+const MAX_SUGGESTIONS = 25;
+
+// listInviteSuggestions({ limit, exclude, pool }) → [{ github_login, display_name,
+// avatar_url, disciplines, project_count, total_tasks_shipped }]
+//
+// IT READS listScoutingRollup AND NOT THE LEADERBOARD, WHICH IS THE WHOLE POINT.
+// A suggestion of who to invite IS the recruiting surface, so it owes the
+// recruiting opt-out — the axis `scoutingListableSql` carries and the economy
+// leaderboard deliberately does not (community spec D3). Sourcing this from the
+// public leaderboard would be cheaper, ungated, and would hand an owner the name
+// of every builder who asked not to be recruited.
+//
+// `github_id` DOES NOT CROSS THE PORT. Callers get the login (what the invite
+// route actually takes), the display name and the avatar — the same whitelist the
+// invite widget already renders. The id identifies someone who has consented to
+// nothing here, and the surface has a test pinning that it never appears.
+//
+// `exclude` is matched INSIDE, against the ids this function can see, so a caller
+// can drop the owner from their own suggestion list without ever holding one.
+async function listInviteSuggestions({ limit = 5, exclude = [], pool } = {}) {
+  const want = Math.max(0, Math.min(MAX_SUGGESTIONS, Number(limit) || 0));
+  if (want === 0) return [];
+  const skip = new Set((Array.isArray(exclude) ? exclude : [exclude]).map((v) => String(v ?? '')));
+  // Over-read by the exclusion count so filtering cannot return short of `want`
+  // when the owner is themselves near the top of their own directory.
+  const rows = await listScoutingRollup({ limit: want + skip.size, pool });
+  return rows
+    .filter((r) => !skip.has(String(r.github_id)) && r.github_login)
+    .slice(0, want)
+    .map((r) => ({
+      github_login: r.github_login,
+      display_name: r.display_name,
+      avatar_url: r.avatar_url,
+      disciplines: Array.isArray(r.disciplines) ? r.disciplines : [],
+      project_count: r.project_count,
+      total_tasks_shipped: r.total_tasks_shipped,
+    }));
+}
+
+module.exports = { listInviteSuggestions, MAX_SUGGESTIONS };

package/modules/platform-identity/routes/sso.js

@@ -20,6 +20,7 @@ const pi = require('../platform-identity');
 const projectCatalog = require('../project-catalog');
 const scoutingAuthz = require('../scouting-authz');
 const canonicalProfile = require('../canonical-profile');
+const inviteSuggestions = require('../invite-suggestions');
 const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -122,6 +123,13 @@ function registerSeams() {
       // The ownership fact lives in this module, so the answer does too; core
       // asks through the port and treats an absent one as a denial.
       isProjectOwner: (githubId) => scoutingAuthz.hasOwnerMembership(githubId, { pool }),
+      // task 1002347 (BV1.R28, ADR 0251): the names behind `invites.seeking` —
+      // the creation wizard's "who is worth inviting" list. Consent-filtered by
+      // construction (it reads the recruiting directory, never the leaderboard)
+      // and projected without `github_id`. Provisioning asks through the port
+      // because the directory lives here; an absent provider means an instance
+      // with no hub to ask, which is "no suggestions", never an error.
+      listInviteSuggestions: (opts) => inviteSuggestions.listInviteSuggestions({ ...opts, pool }),
       // task 1002804 (P08, ADR 0214 D3): the account's PUBLIC handle — the
       // canonical profile address — so the numeric profile route can name a
       // builder by the rename-proof key instead of a mutable github_login.

package/modules/provisioning/routes/provisioning.js

@@ -17,6 +17,7 @@
 //                                                     (also SELF-HEALS its catalog projection,
 //                                                      task 1003581 — see the handler)
 //     POST   /provisioning/instances/:id/teardown  — request teardown of one's own
+//     GET    /provisioning/instances/:id/invite-suggestions — who is worth inviting (R28, ADR 0251)
 //   Archon-scoped (requireRank('archon') — the fleet, the /boxes precedent):
 //     GET    /provisioning/fleet                    — the full instance roster
 //     GET    /provisioning/fleet/cost-ledger        — per-instance + total cost estimate
@@ -771,6 +772,61 @@ module.exports = function provisioningRoutes() {
     }
   });
 
+  // ── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ────────
+  // GET /provisioning/instances/:id/invite-suggestions — turn the engine's
+  // `invites.seeking` into NAMES. ADR 0239 §6 left `invites.suggested` empty on
+  // purpose: ranking builders is a directory read the pure engine may not run.
+  // This is the resolution, and ADR 0251 is why it looks like this.
+  //
+  // rank: any authenticated builder, own resource — `instanceAccessDenied`, the
+  // same gate and the same 404 as the manage read above. That is deliberate and
+  // not a new authorization idea: REACHING this route IS the ownership answer
+  // (ADR 0249 §4), so the surface never re-derives "is this theirs" and can never
+  // become a weaker second copy of a server rule (ADR 0016). It also 404s rather
+  // than 403s, so it leaks no more instance existence than the read beside it.
+  //
+  // `seeking: null` COSTS NOTHING AND ASKS NOBODY. A solo owner is suggested
+  // nobody on purpose (ADR 0239 §6), which is a different statement from an empty
+  // list nobody filled — so that answer returns its own reason and never touches
+  // the directory at all.
+  router.get('/provisioning/instances/:id/invite-suggestions', auth.requireBuilder, async (req, res) => {
+    const id = parseId(req, res);
+    if (!id) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
+
+      const detail = provisioning.projectDetail(inst) || {};
+      const { invites } = recommendationsForDetails({ type: inst.type, ...detail });
+
+      // Nobody to look for — the engine's own answer, returned with its reason.
+      if (!invites.seeking) {
+        return res.json({ suggested: [], seeking: null, reason: invites.reason });
+      }
+
+      // resolveOptional, not resolve, and NOT declared in `consumes` — the
+      // catalog-bridge precedent: platform-identity is hub-only (`default:
+      // false`), so an instance running provisioning without it has no directory
+      // to ask and the honest answer is "no suggestions", never a 500.
+      const hub = api.resolveOptional('platform-identity.hub');
+      if (!hub || typeof hub.listInviteSuggestions !== 'function') {
+        return res.json({ suggested: [], seeking: invites.seeking, reason: invites.reason, unavailable: 'no_directory' });
+      }
+
+      // The owner is dropped from their own list. They are frequently the top
+      // builder on their own hub, and "invite yourself" is noise on the one
+      // screen whose whole job is naming other people.
+      const suggested = await hub.listInviteSuggestions({
+        limit: invites.seeking.limit,
+        exclude: [req.builder.github_id].filter(Boolean),
+      });
+      res.json({ suggested, seeking: invites.seeking, reason: invites.reason });
+    } catch (err) {
+      log.error('[provisioning] GET /provisioning/instances/:id/invite-suggestions', err);
+      res.fail('invite_suggestions_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // ── Per-project settings (task 1003040, goal 1000058) ─────────────────────
   // The foundation the manage-page wave hangs off: effective settings are the
   // DEFAULTS (today's behavior — public surfaces, apply-to-join) overlaid with

package/modules/public-landing/public/assets/cosmos.css

@@ -421,6 +421,22 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .inviteList>li::before{content:"";grid-column:1;grid-row:1;width:7px;height:7px;margin-top:7px;border-radius:50%;border:1px solid var(--accent);background:var(--bg);}
 .inviteList b{grid-column:2;font-family:var(--font-body);font-weight:500;font-size:15px;color:var(--ink);}
 .inviteList small{grid-column:2;font-family:var(--font-body);font-size:13px;font-weight:400;line-height:1.45;color:var(--ink-faint);}
+/* who is worth inviting (task 1002347, BV1.R28) — the recommendation's own
+   sentence, in the .modWhy voice: the panel explaining itself, never a thing to
+   act on, so it never competes with the names under it. */
+.inviteWhy{display:none;}
+.inviteWhy.on{display:block;margin:12px 0 0;max-width:62ch;font-size:13.5px;font-weight:400;color:var(--ink-soft);line-height:1.5;}
+/* the suggested names. The SAME hairline ledger as .inviteList — they are two
+   halves of one answer and stack directly on each other — with the action on the
+   end of the row instead of a dot on the front of it. */
+.suggList{list-style:none;display:grid;margin:10px 0 0;padding:0;}
+.suggList:empty{display:none;}
+.suggList>li{display:flex;align-items:center;gap:12px;padding:10px 0 11px;border-top:1px solid var(--rule-soft);}
+.suggList>li:first-child{border-top:0;}
+.suggWho{display:grid;gap:2px;flex:1 1 auto;min-width:0;}
+.suggWho b,.suggWho{font-family:var(--font-body);font-weight:500;font-size:15px;color:var(--ink);}
+.suggWho small{font-family:var(--font-body);font-size:13px;font-weight:400;line-height:1.45;color:var(--ink-faint);}
+.suggList .btn{flex:0 0 auto;}
 .attachNote code{font-family:var(--font-mono);}
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
 .projMsg.ok{color:var(--ok);}

package/modules/public-landing/public/projects.html

@@ -865,6 +865,8 @@ summary{min-height:24px;padding:3px 0;}
             <input type="text" id="mInviteWho" placeholder="GitHub username" autocomplete="off" autocapitalize="off" spellcheck="false" maxlength="200">
             <button type="button" class="btn small" data-invite-send="mInvite">Invite</button>
           </div>
+          <div class="inviteWhy" id="mInviteWhy"></div>
+          <ul class="suggList" id="mInviteSugg"></ul>
           <ul class="inviteList" id="mInviteList"></ul>
           <div class="projMsg" id="mInviteMsg" role="status" aria-live="polite"></div>
         </div>
@@ -1240,6 +1242,8 @@ summary{min-height:24px;padding:3px 0;}
                 <button type="button" class="btn small" data-invite-send="wizInvite">Invite</button>
                 <button type="button" class="btn small ghost" data-invite-skip="wizInvite">Skip</button>
               </div>
+              <div class="inviteWhy" id="wizInviteWhy"></div>
+              <ul class="suggList" id="wizInviteSugg"></ul>
               <ul class="inviteList" id="wizInviteList"></ul>
               <div class="projMsg" id="wizInviteMsg" role="status" aria-live="polite"></div>
             </div>
@@ -4148,6 +4152,7 @@ summary{min-height:24px;padding:3px 0;}
          sets only AFTER this runs. */
       var created = createdRecord();
       setInviteSlug('wizInvite', (me && created && created.id && created.slug) ? created.slug : '');
+      loadInviteSuggestions('wizInvite', (me && created && created.slug) ? created.id : '');
       $('wizInviteLater').innerHTML = 'You can invite builders any time from ' + projectPageLink('the project’s own page') + '.';
       renderSteps();
     }
@@ -5336,6 +5341,7 @@ summary{min-height:24px;padding:3px 0;}
        who is not the owner, so reaching renderManage at all IS the ownership
        answer the widget does not ask for itself. */
     setInviteSlug('mInvite', inst.slug || '');
+    loadInviteSuggestions('mInvite', inst.slug ? inst.id : '');
     /* the page names its project — the heading holds #mName; and in the tab */
     document.title = (inst.slug ? inst.slug + ' — ' : '') + BASE_TITLE;
     /* the card's own story, on the project's own page (task 1003232): the
@@ -6777,12 +6783,13 @@ summary{min-height:24px;padding:3px 0;}
      Proof: ../../../tests/project_invite_ui.mjs ══ */
 
   var INVITE_MOUNTS = {
-    wizInvite: { who: 'wizInviteWho', list: 'wizInviteList', msg: 'wizInviteMsg', after: 'doneStepsHead' },
-    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', after: null }
+    wizInvite: { who: 'wizInviteWho', list: 'wizInviteList', msg: 'wizInviteMsg', after: 'doneStepsHead', why: 'wizInviteWhy', sugg: 'wizInviteSugg' },
+    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', after: null, why: 'mInviteWhy', sugg: 'mInviteSugg' }
   };
   var inviteSlug = {};   /* mount id → the slug it invites to; '' means no step at all */
   var inviteRows = {};   /* mount id → the invites filed on THIS project this session */
   var inviteBusy = {};   /* a send is in flight — the mount is inert until it answers */
+  var inviteSugg = {};   /* mount id → { suggested, reason } — who is worth inviting (R28) */
 
   /* setInviteSlug(id, slug) — the only door in. A falsy slug closes the mount, which
      is how "signed out", "not the owner" and "no project yet" all reach this widget.
@@ -6795,6 +6802,7 @@ summary{min-height:24px;padding:3px 0;}
     if (inviteSlug[id] !== next) {
       inviteSlug[id] = next;
       inviteRows[id] = [];
+      inviteSugg[id] = null;
       inviteSay(id, '', '');
     }
     var box = $(id);
@@ -6802,6 +6810,68 @@ summary{min-height:24px;padding:3px 0;}
     renderInviteRows(id);
   }
 
+  /* setInviteSuggestions(id, payload) — the SECOND door in, and deliberately a
+     separate one. The widget still answers neither "is anyone signed in" nor "is
+     this their project" (ADR 0249): the caller has already been told both by the
+     route it fetched, and hands over the answer or nothing.
+
+     `payload.suggested` empty with a reason is a real answer, not a blank state —
+     a solo owner is suggested nobody ON PURPOSE (ADR 0239 §6), and the reason is
+     the sentence that says so in their own words. */
+  function setInviteSuggestions(id, payload) {
+    if (!INVITE_MOUNTS[id]) return;
+    inviteSugg[id] = payload || null;
+    renderInviteSugg(id);
+  }
+
+  /* The suggestion rows, each carrying its own Invite button. A name already
+     invited this session drops out — the pending line below IS its receipt, and
+     offering the same person twice invites a refusal the owner cannot act on. */
+  function renderInviteSugg(id) {
+    var m = INVITE_MOUNTS[id];
+    var list = m && $(m.sugg);
+    var why = m && $(m.why);
+    if (!list || !why) return;
+    var payload = inviteSugg[id];
+    var reason = (payload && payload.reason) || '';
+    why.textContent = reason;
+    why.classList.toggle('on', !!reason);
+    var already = {};
+    (inviteRows[id] || []).forEach(function (r) { already[String(r.login).toLowerCase()] = true; });
+    var rows = ((payload && payload.suggested) || []).filter(function (b) {
+      return b && b.github_login && !already[String(b.github_login).toLowerCase()];
+    });
+    list.innerHTML = rows.map(function (b) {
+      /* the login is the address AND the label: display_name is a nicety the row
+         may not carry, and github_id is never shown (it names someone who has
+         accepted nothing — the same pin the pending lines carry). */
+      var named = b.display_name && b.display_name !== b.github_login
+        ? esc(b.display_name) + ' <small>@' + esc(b.github_login) + '</small>'
+        : '<b>@' + esc(b.github_login) + '</b>';
+      var shipped = Number(b.total_tasks_shipped || 0);
+      var projects = Number(b.project_count || 0);
+      var record = shipped
+        ? shipped + (shipped === 1 ? ' task shipped' : ' tasks shipped') + (projects ? ' across ' + projects + (projects === 1 ? ' project' : ' projects') : '')
+        : '';
+      return '<li><span class="suggWho">' + named + (record ? '<small>' + esc(record) + '</small>' : '') + '</span>'
+        + '<button type="button" class="btn small ghost" data-invite-pick="' + esc(b.github_login) + '">Invite</button></li>';
+    }).join('');
+  }
+
+  /* loadInviteSuggestions(id, instanceId) — ask the own-scoped route who is worth
+     inviting. Every failure is SILENT by construction: a suggestion is an extra,
+     and a project that was just created successfully must never look broken
+     because an optional directory read did not answer. */
+  function loadInviteSuggestions(id, instanceId) {
+    if (!instanceId) { setInviteSuggestions(id, null); return; }
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(instanceId) + '/invite-suggestions', {
+      credentials: 'same-origin'
+    }).then(function (res) {
+      if (!res.ok) { setInviteSuggestions(id, null); return; }
+      return res.json().then(function (data) { setInviteSuggestions(id, data); });
+    }).catch(function () { setInviteSuggestions(id, null); });
+  }
+
   /* One line per invite this session filed: the login the inviter typed, and the
      WORD THE ROW ITSELF CARRIES — so a membership_kind other than 'pending' shows
      up here rather than being papered over as one. */
@@ -6813,6 +6883,9 @@ summary{min-height:24px;padding:3px 0;}
       var said = r.kind === 'pending' ? 'invited — waiting for them to accept.' : r.kind;
       return '<li><b>' + esc(r.login) + '</b><small>' + esc(said) + '</small></li>';
     }).join('');
+    /* the two lists are one answer: a name that just became a pending row is no
+       longer a suggestion, and they are always redrawn together. */
+    renderInviteSugg(id);
   }
 
   function inviteSay(id, text, cls, isHtml) {
@@ -6896,8 +6969,17 @@ summary{min-height:24px;padding:3px 0;}
     var box = $(id);
     if (box) {
       box.addEventListener('click', function (ev) {
-        var t = ev.target.closest && ev.target.closest('[data-invite-send],[data-invite-skip]');
+        var t = ev.target.closest && ev.target.closest('[data-invite-send],[data-invite-skip],[data-invite-pick]');
         if (!t) return;
+        /* a picked suggestion fills the field and takes the SAME path as a typed
+           name — one write path, so the refusal vocabulary, the busy guard and the
+           pending receipt can never drift into a second copy. */
+        if (t.hasAttribute('data-invite-pick')) {
+          var field = $(INVITE_MOUNTS[id].who);
+          if (field) field.value = t.getAttribute('data-invite-pick') || '';
+          doInvite(id);
+          return;
+        }
         if (t.hasAttribute('data-invite-skip')) skipInvite(id); else doInvite(id);
       });
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.562",
+  "version": "1.19.563",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.562",
+      "version": "1.19.563",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.562",
+  "version": "1.19.563",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.562'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.563'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');