@bongos/core 1.20.20 → 1.20.22

package/modules/hall-ui/public/watch.js

@@ -301,9 +301,32 @@
     );
   }
 
+  // The name another page asked this box to hold: the platform hub's invite widget
+  // links here as /watch?invite=<login> (task 1002818, ADR 0353), because only this
+  // project's own invite lets anyone in. It FILLS the box and nothing more — sending
+  // stays the owner's own click, since a link anyone can craft must never be the act
+  // that admits. Read once and spent on first use, so the re-render after an invite
+  // does not put the name back; anything that is not a GitHub username is ignored.
+  let invitePrefill = (() => {
+    try {
+      const raw = new URLSearchParams(window.location.search).get('invite') || '';
+      const login = raw.trim().replace(/^@/, '');
+      return /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(login) ? login : '';
+    } catch { return ''; }
+  })();
+
   function wireInviteForm(target) {
     const form = target.querySelector('#gate-invite');
     if (!form) return;
+    if (invitePrefill) {
+      const box = form.querySelector('#gate-invite-login');
+      if (box) {
+        box.value = invitePrefill;
+        if (box.focus) box.focus();
+        if (form.scrollIntoView) form.scrollIntoView({ block: 'center' });
+      }
+      invitePrefill = '';
+    }
     form.addEventListener('submit', async (e) => {
       e.preventDefault();
       const input = form.querySelector('#gate-invite-login');

package/modules/onboarding/routes/access-requests.js

@@ -154,6 +154,34 @@ async function attachApplicantProfiles(rows) {
   })));
 }
 
+// THE HUB'S NOTICE OF THIS PROJECT'S INVITES (task 1002818, ADR 0353). On a hosted
+// project the hub lists an invite in the invitee's My Projects so they learn of it;
+// the row HERE is still the only thing that admits, and signing in is what accepts.
+// The notice goes out after the row is written and is never awaited: it rides a
+// doorway port that swallows every failure, so the hub can neither slow nor fail an
+// invite. No hub (self-hosted), or an older one without the route, costs the notice
+// alone.
+const STANDING_INVITE_SQL = `SELECT 1 FROM access_requests
+          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`;
+
+function noticeHubInvited(login) {
+  api.notifyHubOfInvite(login, { invited: true });
+}
+
+// After a dismissal: once the login holds no invited row (a rescind, or the last of two
+// racing invites), the hub's notice would point at a door that no longer opens, so it
+// is dropped. Awaited only so its read is ordered; a failed read drops nothing and fails
+// nothing — the dismissal is already committed, and a stale notice still leads only to
+// this project's own gate.
+async function clearHubNoticeIfUninvited(login) {
+  try {
+    const standing = await pool.query(STANDING_INVITE_SQL, [login]);
+    if (standing.rows.length === 0) api.notifyHubOfInvite(login, { invited: false });
+  } catch (err) {
+    log.warn({ err: err && err.message }, '[gds] hub invite notice check failed (non-blocking)');
+  }
+}
+
 module.exports = function buildAccessRequestsRouter() {
   const router = express.Router();
 
@@ -421,6 +449,7 @@ module.exports = function buildAccessRequestsRouter() {
         [next, req.builder.id, id]
       );
       if (rows.length > 0) {
+        if (next === 'dismissed') await clearHubNoticeIfUninvited(rows[0].github_login);
         return res.json({ ok: true, request: rows[0] });
       }
       const current = await pool.query(
@@ -470,7 +499,8 @@ module.exports = function buildAccessRequestsRouter() {
   // A fresh row is marked kind='invite' with created_by = the sender (a rescind
   // overwrites resolved_by) and the optional note as the inviter's words. A pending
   // request resolved in place stays an application with its applicant's own note
-  // (ADR 0335 D2.1–D2.3; task 1002814).
+  // (ADR 0335 D2.1–D2.3; task 1002814). Every outcome that leaves the login invited
+  // also notifies the hub, so the invitee sees it in My Projects (ADR 0353).
   // body: { github_login, note? }. 201 with a new row; 200 with the row when a
   // pending request was resolved; 200 already_invited when an invite already
   // stands; 409 already_member when they have an account.
@@ -493,12 +523,10 @@ module.exports = function buildAccessRequestsRouter() {
       if (member.rows.length > 0) {
         return res.fail('already_member', { status: 409, message: 'They already have an account here — no invite needed.' });
       }
-      const standing = await pool.query(
-        `SELECT 1 FROM access_requests
-          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`,
-        [login]
-      );
+      const standing = await pool.query(STANDING_INVITE_SQL, [login]);
       if (standing.rows.length > 0) {
+        // Re-sent on purpose: inviting again is how a notice the hub missed is healed.
+        noticeHubInvited(login);
         return res.json({ ok: true, already_invited: true, github_login: login });
       }
       const resolved = await pool.query(
@@ -511,6 +539,7 @@ module.exports = function buildAccessRequestsRouter() {
         [req.builder.id, login]
       );
       if (resolved.rows.length > 0) {
+        noticeHubInvited(login);
         return res.json({ ok: true, request: resolved.rows[0] });
       }
       const { rows } = await pool.query(
@@ -519,6 +548,7 @@ module.exports = function buildAccessRequestsRouter() {
          RETURNING id, github_login, status, kind, resolved_at`,
         [login, note, req.builder.id]
       );
+      noticeHubInvited(login);
       return res.status(201).json({ ok: true, request: rows[0] });
     } catch (err) {
       log.error('[gds] POST /access-requests/invite', err);

package/modules/platform-identity/guild-map.js

@@ -0,0 +1,105 @@
+// modules/platform-identity/guild-map.js — the guild map's data: public guilds,
+// ranked (R30, task 1002306; ADR 0336 D8, amended by ADR 0337 D4.4).
+//
+// WHO. `visibility = 'public'` AND a non-empty public roster. An unlisted guild
+// has no public existence (ADR 0336 D4), so it is never listed. Neither is a
+// public guild whose every member is private or unshown: it would be a name on
+// the map with nobody behind it.
+//
+// TWO ORDERINGS, NO STORED SCORE (D8):
+//   * size    — the public roster's length, computed exactly as getPublicGuild
+//               computes it (shown_publicly AND accountVisibleSql, capped at
+//               guilds.LIST_MAX), so the map and the guild page never disagree.
+//               hide_stats hides numbers, never membership (ADR 0336 D4 §2), so a
+//               member who hides their numbers is still in it; a private one never.
+//   * shipped — the guild's STORED works_shipped band floor (guild-totals.js),
+//               never an exact sum (D4.4). A guild not yet refreshed publishes
+//               null and sorts last.
+// Ties break on slug. Every sort key is a field the row publishes (ADR 0255: a
+// public list's order is a covert column otherwise).
+//
+// COST, AND WHY THERE IS NO CACHE. One aggregate per read, over PUBLIC guilds'
+// memberships only (the roster CTE filters on visibility before it groups, so an
+// unlisted guild's members are never counted, let alone scanned for the map) —
+// at the hub's scale a few index scans, bounded per caller by guild-map-read.
+// D8 decides "computed at read time" and names the revisit trigger: a measured
+// p95. It also rules out the cheap cache: any cache must be INVALIDATED by a hide,
+// a privacy flip, a shown_publicly change, a membership change and a visibility
+// change, because a TTL alone keeps publishing a withdrawn member in a guild's
+// size (the ADR 0202 D3 reason). community-leaderboard.js's 30s memo does not
+// transfer: it caches only NUMBERS and re-reads WHO on every request, and here
+// the expensive half IS who — the roster under the privacy predicates. A cache
+// is therefore a write-path change across guilds.js, the privacy setters and
+// consent, taken when the p95 says so, not a TTL bolted on here.
+//
+// NOTHING HERE IS AUTHORITY (ADR 0016 / ADR 0141). Descriptive only.
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const api = require('../../src/module-api');
+const { accountVisibleSql } = require('./account-visibility');
+const { LIST_MAX } = require('./guilds');
+const { clampOffset, MAX_OFFSET } = require('./builder-search');
+
+const { pool: defaultPool } = api;
+
+const DEFAULT_LIMIT = 25;
+const MAX_LIMIT = 100;
+
+// The orderings, as fixed SQL. A request names a key; it never supplies SQL.
+const ORDERS = {
+  size: 'size DESC, g.slug',
+  shipped: 'shipped DESC NULLS LAST, g.slug',
+};
+const ORDER_KEYS = Object.keys(ORDERS);
+const DEFAULT_ORDER = 'size';
+
+function isOrder(order) {
+  return typeof order === 'string' && Object.prototype.hasOwnProperty.call(ORDERS, order);
+}
+
+function clampLimit(limit) {
+  const n = parseInt(limit, 10);
+  if (!Number.isFinite(n) || n <= 0) return DEFAULT_LIMIT;
+  return Math.min(n, MAX_LIMIT);
+}
+
+// One page of the map. `order` must already be valid (the route 400s first; an
+// invalid one here falls back to the default rather than reaching SQL). Returns
+// { order, results: [{ slug, name, size, shipped }], limit, offset } with the
+// CLAMPED paging, so the route echoes what was actually applied.
+async function listGuildMap({ order = DEFAULT_ORDER, limit, offset } = {}, { pool = defaultPool } = {}) {
+  const key = isOrder(order) ? order : DEFAULT_ORDER;
+  const lim = clampLimit(limit);
+  const off = clampOffset(offset);
+  const { rows } = await pool.query(
+    `WITH roster AS (
+       SELECT m.guild_id, LEAST(count(*), $3)::int AS size
+         FROM platform_identity_guilds pg
+         JOIN platform_identity_guild_members m ON m.guild_id = pg.id
+         JOIN platform_identity_accounts pa ON pa.github_id = m.github_id
+        WHERE pg.visibility = 'public' AND m.shown_publicly AND ${accountVisibleSql('pa')}
+        GROUP BY m.guild_id
+     )
+     SELECT g.slug, g.name, r.size, t.works_shipped AS shipped
+       FROM platform_identity_guilds g
+       JOIN roster r ON r.guild_id = g.id
+       LEFT JOIN platform_identity_guild_totals t ON t.guild_id = g.id
+      WHERE g.visibility = 'public'
+      ORDER BY ${ORDERS[key]}
+      LIMIT $1 OFFSET $2`,
+    [lim, off, LIST_MAX],
+  );
+  return { order: key, results: rows, limit: lim, offset: off };
+}
+
+module.exports = {
+  ORDER_KEYS,
+  DEFAULT_ORDER,
+  DEFAULT_LIMIT,
+  MAX_LIMIT,
+  MAX_OFFSET,
+  isOrder,
+  listGuildMap,
+};

package/modules/platform-identity/invite-notices.js

@@ -0,0 +1,61 @@
+// modules/platform-identity/invite-notices.js — the hub's copy of a project's OWN invite,
+// kept as a NOTICE and never as a way in (task 1002818, R6 of goal 1000110; ADR 0353).
+//
+// A project admits people on its own instance: an invite is an `access_requests` row
+// there, and signing in to the project is what accepts it (ADR 0335 D1/D2). The hub
+// holds no verdict. What it adds is reach — the invitee sees the invitation in My
+// Projects without having to know the project exists. So:
+//
+//   noteProjectInvite  — the project invited this login: seed the hub's `pending`
+//                        membership row, which My Projects lists with an "Open
+//                        project" link. Called by POST /sso/invites/notify.
+//   clearProjectInvite — the project rescinded it: drop that `pending` row, so a
+//                        rescinded invite stops pointing at a door that will not
+//                        open. Called by POST /sso/invites/clear.
+//   hallInviteUrl      — where an invite that CAN let someone in is sent from: the
+//                        project's own hall. POST /projects/invite answers with it
+//                        instead of writing a hub row that admits nobody.
+//
+// Both writers touch ONLY a `pending` row, so a notice can never create, downgrade or
+// remove a real membership (a member is left as-is; the row is not theirs to change).
+// A login with no hub account is a no-op: there is nobody on the hub to notify, and
+// the project's own row still admits them when they sign in there.
+//
+// Its own file because platform-identity.js is at the size ratchet; it reuses that
+// file's account lookup and pending-row writers rather than restating them.
+'use strict';
+
+const pi = require('./platform-identity');
+
+// The project noticed an invite for `githubLogin` → a `pending` hub row, if the login
+// has a hub account and no membership in this project yet. Returns { noted } for the
+// route's own logging; the route never tells the caller which case happened (see it).
+async function noteProjectInvite({ clientId, githubLogin }, { pool } = {}) {
+  const account = await pi.getAccountByLogin(githubLogin, { pool });
+  if (!account) return { noted: false };
+  const out = await pi.inviteToProject({ clientId, githubId: account.github_id }, { pool });
+  return { noted: !!out.invited };
+}
+
+// The project rescinded the invite for `githubLogin` → drop the `pending` hub row.
+async function clearProjectInvite({ clientId, githubLogin }, { pool } = {}) {
+  const account = await pi.getAccountByLogin(githubLogin, { pool });
+  if (!account) return { cleared: false };
+  const out = await pi.removePendingInvite({ clientId, githubId: account.github_id }, { pool });
+  return { cleared: out.removed };
+}
+
+// The project's own invite box for `githubLogin`: its hall's watch page, with the login
+// pre-filled. Built on /builders/watch because every instance canonicalises that path to
+// its hall — a one-host instance serves /watch, a two-host one redirects to
+// builders.<apex>/watch, both keeping the query — so the hub needs no hall address of
+// its own. An origin that is not http(s) yields null: this value becomes an <a href>.
+function hallInviteUrl(origin, githubLogin) {
+  let u;
+  try { u = new URL(String(origin || '')); } catch { return null; }
+  if (u.protocol !== 'https:' && u.protocol !== 'http:') return null;
+  const login = String(githubLogin || '').trim().replace(/^@/, '');
+  return `${u.origin}/builders/watch${login ? `?invite=${encodeURIComponent(login)}` : ''}`;
+}
+
+module.exports = { noteProjectInvite, clearProjectInvite, hallInviteUrl };

package/modules/platform-identity/module.json

@@ -11,7 +11,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile", "connections", "community-search", "community-leaderboard", "guilds", "guilds-public"],
+    "routes": ["sso", "sso-invites", "projects", "my-projects", "scouting", "profile", "public-profile", "connections", "community-search", "community-leaderboard", "guilds", "guilds-public"],
     "migrations": true,
     "pollers": ["code-sweep", "visibility-pull", "guild-totals"]
   },

package/modules/platform-identity/platform-identity.js

@@ -527,8 +527,9 @@ async function listMembershipsForAccount(githubId, { pool = defaultPool } = {})
 // Invitations (ADR 0141 §5, task #1002115) — pre-seed a 'pending' membership
 // -------------------------------------------------------------------------
 
-// Invite a builder into a project they don't yet build on: pre-seed a 'pending'
-// membership. Does NOT clobber an existing membership (ON CONFLICT DO NOTHING) — a
+// Record that a project invited a builder: pre-seed a 'pending' membership, which is
+// a NOTICE shown in My Projects — the project's own row is what admits (ADR 0353;
+// written only from invite-notices.js now). Does NOT clobber an existing membership (ON CONFLICT DO NOTHING) — a
 // current member is left as-is. Returns { invited:true, row } when a pending row was
 // created, or { invited:false, alreadyMember:true } when a membership already existed.
 async function inviteToProject({ clientId, githubId }, { pool = defaultPool } = {}) {
@@ -557,26 +558,19 @@ async function listPendingInvitesForAccount(githubId, { pool = defaultPool } = {
   return rows;
 }
 
-// Resolve a pending invite for (client, builder): accept → flip to 'member' (the
-// membership becomes real; the builder then signs into the project, whose own gate
-// still applies + whose check-in keeps it fresh); decline → delete the pending row.
-// Only ever touches a 'pending' row, so it can't downgrade or remove a real member.
-async function resolveInvite({ clientId, githubId, accept }, { pool = defaultPool } = {}) {
-  if (accept) {
-    const { rows } = await pool.query(
-      `UPDATE platform_identity_project_memberships SET membership_kind = 'member', last_active = now()
-        WHERE client_id = $1 AND github_id = $2 AND membership_kind = 'pending'
-        RETURNING id`,
-      [clientId, githubId],
-    );
-    return { resolved: rows.length > 0, accepted: true };
-  }
+// Drop the pending invite for (client, builder): the invitee declined it, or the
+// project rescinded it (invite-notices.js). There is no hub-side ACCEPT any more
+// (task 1002818, ADR 0353): the hub holds no verdict, so flipping this row to
+// 'member' admitted nobody. Signing in to the project accepts, and the hub's own
+// sign-in witness (recordFederatedSignin) turns the row into a membership then.
+// Only ever touches a 'pending' row, so it can't remove a real member.
+async function removePendingInvite({ clientId, githubId }, { pool = defaultPool } = {}) {
   const { rowCount } = await pool.query(
     `DELETE FROM platform_identity_project_memberships
       WHERE client_id = $1 AND github_id = $2 AND membership_kind = 'pending'`,
     [clientId, githubId],
   );
-  return { resolved: rowCount > 0, accepted: false };
+  return { removed: rowCount > 0 };
 }
 
 // Self-service LEAVE (ADR 0141 §3): remove a builder's membership in a project. The
@@ -1453,7 +1447,7 @@ module.exports = {
   // invitations
   inviteToProject,
   listPendingInvitesForAccount,
-  resolveInvite,
+  removePendingInvite,
   // cross-project activity + scouting + profile rollup
   upsertActivity,
   listScoutingRollup,

package/modules/platform-identity/routes/guilds-public.js

@@ -11,12 +11,17 @@
 //   GET /guilds/:slug/members. The page at /g/<slug> is task 1002301's; this is
 //   its read.
 //
+//   GET /guilds — the guild MAP (task 1002306, R30; ADR 0336 D8): public guilds
+//   with a non-empty public roster, ranked by size or by the stored shipped band
+//   floor, slug tiebreak, paged. Who and how live in ../guild-map.js.
+//
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
 
 const express = require('express');
 const api = require('../../../src/module-api');
 const guilds = require('../guilds');
+const guildMap = require('../guild-map');
 const { createReadRateLimit } = require('../read-rate-limit');
 
 const { pool } = api;
@@ -34,9 +39,40 @@ function logError(msg) {
 // uncapped scraper could walk the slug space at line rate.
 const guildReadRateLimit = createReadRateLimit({ scope: 'guild-public-read', limit: 120 });
 
+// The map's own budget: one read aggregates every public guild's roster, so it
+// gets the community reads' tighter cap rather than the single-guild one.
+const guildMapRateLimit = createReadRateLimit({ scope: 'guild-map-read', limit: 60 });
+
 module.exports = function guildPublicRoutes() {
   const router = express.Router();
 
+  // rank: public — the guild map (?order=size|shipped, default size;
+  // ?limit=&offset=). Viewer-independent: it reads no session. size is the
+  // public roster's length; shipped is R26's stored band floor (ADR 0337 D4.4),
+  // never an exact sum, null before a guild's first refresh. no-store: a hide or
+  // a visibility flip moves size on the very next read (ADR 0171 D5).
+  router.get('/guilds', guildMapRateLimit, async (req, res) => {
+    const order = req.query.order === undefined || req.query.order === ''
+      ? guildMap.DEFAULT_ORDER
+      : req.query.order;
+    if (!guildMap.isOrder(order)) {
+      return res.fail('guild_map_bad_order', { status: 400, message: `order must be one of: ${guildMap.ORDER_KEYS.join(', ')}` });
+    }
+    try {
+      const map = await guildMap.listGuildMap({ order, limit: req.query.limit, offset: req.query.offset }, { pool });
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        order: map.order,
+        count: map.results.length,
+        results: map.results,
+        page: { limit: map.limit, offset: map.offset },
+      });
+    } catch (err) {
+      logError(`GET /guilds failed: ${err && err.message}`);
+      res.fail('guild_map_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // rank: public — a public guild's page data. The roster is the members who
   // agreed to be shown AND whose own accounts are publicly visible (ADR 0336 D4);
   // size is that roster's length; totals are the weekly band floors (ADR 0337

package/modules/platform-identity/routes/my-projects.js

@@ -289,27 +289,18 @@ module.exports = function myProjectsRoutes() {
     }
   });
 
-  // rank: any-builder — accept an invite (pending → builder) for the caller's OWN account.
-  router.post('/my-projects/invites/:clientId/accept', requireBuilder, async (req, res) => {
-    const clientId = String(req.params.clientId || '');
-    if (!clientId) return res.fail('bad_client_id', 400);
-    try {
-      const out = await pi.resolveInvite({ clientId, githubId: req.builder.github_id, accept: true }, { pool });
-      if (!out.resolved) return res.fail('no_pending_invite', 404);
-      res.json({ ok: true, accepted: true });
-    } catch (err) {
-      console.error('[platform-identity] accept invite', err);
-      res.fail('accept_failed', { status: 500, message: 'internal error' });
-    }
-  });
+  // There is deliberately no ACCEPT route (task 1002818, ADR 0353). An invitation here
+  // is a notice of the project's own invite; signing in to the project accepts it, and
+  // that sign-in turns this row into a membership. The old accept flipped the row to
+  // 'member' and admitted nobody, so an accepted invite could still meet a locked door.
 
   // rank: any-builder — decline an invite (delete the pending row) for the caller's OWN account.
   router.post('/my-projects/invites/:clientId/decline', requireBuilder, async (req, res) => {
     const clientId = String(req.params.clientId || '');
     if (!clientId) return res.fail('bad_client_id', 400);
     try {
-      const out = await pi.resolveInvite({ clientId, githubId: req.builder.github_id, accept: false }, { pool });
-      if (!out.resolved) return res.fail('no_pending_invite', 404);
+      const out = await pi.removePendingInvite({ clientId, githubId: req.builder.github_id }, { pool });
+      if (!out.removed) return res.fail('no_pending_invite', 404);
       res.json({ ok: true, accepted: false });
     } catch (err) {
       console.error('[platform-identity] decline invite', err);

package/modules/platform-identity/routes/projects.js

@@ -15,7 +15,8 @@
 //                                join door, and the DERIVED publish verdict — ADR 0182)
 //   POST  /projects            — Archon: create / update a catalog entry
 //   POST  /projects/invite     — a `project.curate` holder OR the project's OWN owner:
-//                                pre-seed a 'pending' membership (invite-authz.js)
+//                                where to invite — the project's hall (invite-authz.js,
+//                                invite-notices.js); writes nothing (ADR 0353)
 //   PATCH /projects/:id/featured — Archon: the feature / unfeature control
 //   PATCH /projects/:id/status   — `project.curate`: the TAKEDOWN lever (R08, ADR 0252
 //                                §5.1). Setting 'hidden' pins the row so the ADR 0246
@@ -31,6 +32,7 @@ const pi = require('../platform-identity');
 const projectCatalog = require('../project-catalog');
 const projectStats = require('../project-stats');
 const inviteAuthz = require('../invite-authz');
+const inviteNotices = require('../invite-notices');
 
 const { pool, requireBuilder, requirePermission, validateOrRespond, parseId, corsPublicGet,
   parsePagination, pageMeta } = api;
@@ -119,16 +121,22 @@ module.exports = function projectsRoutes() {
   // route from its real gate. A helper-hidden gate would record a privileged route
   // as any-builder — wrong in the dangerous direction (the ADR 0210 rule).
 
-  // rank: metic+archon — own-or-metic in effect: invite a builder into a project
-  // (ADR 0141 §5, task 1002115), called by a `project.curate` holder OR the project's OWN
-  // OWNER (task 1003580; the ownership proof is `provisioning_instances.owner_builder_id`,
-  // reached through a port — see invite-authz.js). The wizard's audience is any signed-in
-  // GitHub user, typically a xenos who used to get 403 on their own project. A caller who is
-  // neither gets the unchanged permission refusal, identical whether or not the project
-  // exists. Pre-seeds a 'pending' membership the invitee accepts from My Projects. V1 invites
-  // by github_login and requires the invitee to already have a platform account (they build
-  // on some project); inviting someone entirely new to the platform (GitHub-id resolution) is
-  // a follow-up.
+  // rank: metic+archon — own-or-metic in effect: where to invite a builder into a project,
+  // asked by a `project.curate` holder OR the project's OWN OWNER (task 1003580; the
+  // ownership proof is `provisioning_instances.owner_builder_id`, reached through a port —
+  // see invite-authz.js). The wizard's audience is any signed-in GitHub user, typically a
+  // xenos who used to get 403 on their own project. A caller who is neither gets the
+  // unchanged permission refusal, identical whether or not the project exists.
+  //
+  // IT WRITES NOTHING (task 1002818, ADR 0353). It used to pre-seed a 'pending' hub
+  // membership, but the hub holds no verdict: that row let nobody in, and on any door but
+  // `open` (new projects default to `apply`) the invitee who signed in met a locked door.
+  // Only the project's own invite admits (ADR 0335 D1/D2), so the answer is 200
+  // `{ invited: false, invite_url }` — the project's hall invite box with the login pre-filled.
+  // A 200, not a refusal: it is the answer every admitted caller gets, and a 4xx on the normal
+  // path would log a failed request in the owner's browser on every invite. Sending it there
+  // also reaches this hub: the project notifies it (POST /sso/invites/notify), and the invitee
+  // sees it in My Projects.
   router.post(
     '/projects/invite',
     requireBuilder,
@@ -150,10 +158,9 @@ module.exports = function projectsRoutes() {
         // It is only ever absent when the gate found nothing, so the fallback still reads.
         const client = req.inviteTargetClient || await pi.getClient(req.body.client_id, { pool });
         if (!client || client.status !== 'active') return res.fail('unknown_project', 404);
-        const account = await pi.getAccountByLogin(req.body.github_login, { pool });
-        if (!account) return res.fail('account_not_found', { status: 404, message: 'That builder has no platform account yet — they must sign in somewhere once before they can be invited.' });
-        const out = await pi.inviteToProject({ clientId: req.body.client_id, githubId: account.github_id }, { pool });
-        res.status(out.invited ? 201 : 200).json(out);
+        const inviteUrl = inviteNotices.hallInviteUrl(client.origin, req.body.github_login);
+        if (!inviteUrl) return res.fail('unknown_project', 404);
+        return res.json({ invited: false, invite_url: inviteUrl });
       } catch (err) {
         console.error('[platform-identity] POST /projects/invite', err);
         res.fail('invite_failed', { status: 500, message: 'internal error' });

package/modules/platform-identity/routes/sso-invites.js

@@ -0,0 +1,82 @@
+// modules/platform-identity/routes/sso-invites.js — a project tells the hub about its OWN
+// invites, so the invitee sees them in My Projects (task 1002818, R6 of goal 1000110;
+// ADR 0353). Server-to-server, authenticated by client_id + client_secret like the
+// membership check-in; the sender is core's notifyHubOfInvite (src/bongos/auth-admission.js).
+//
+//   POST /sso/invites/notify — the project invited this GitHub login → a `pending` hub row
+//   POST /sso/invites/clear  — the project rescinded it → that `pending` row is dropped
+//
+// The row is a NOTICE, not a way in: the project's own `access_requests` row admits, and
+// the invitee accepts by signing in to the project, which the hub's own sign-in witness
+// turns into a membership (recordFederatedSignin). Both calls touch a `pending` row only
+// (invite-notices.js), so client credentials still cannot create or change a membership —
+// the ADR 0205 line.
+//
+// THE ANSWER IS ALWAYS { ok: true } once the client authenticates, whether or not the
+// login has a hub account or a row changed. The sender never reads it, and a project must
+// not be able to use this route to learn which GitHub logins have platform accounts.
+//
+// WIRE SKEW (ADR 0352): these routes are NEW, so an older hub answers 404 and the sender
+// swallows it — the invite still admits on the project, only the notice is lost. The body
+// is validated strictly, so a field added later must ride a header, or ship on the hub and
+// be released before any instance sends it.
+//
+// Its own file rather than more of routes/sso.js, which carries the sign-in legs.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+const inviteNotices = require('../invite-notices');
+
+const log = api.logger('platform-identity');
+const { pool, validateOrRespond } = api;
+
+// After each route's own schema (spelled inline, so the API docs read it): authenticate
+// the project, then apply the notice to ITS OWN client_id — never a project named in the
+// body — and answer the same way whether or not anything was written.
+function applyNotice(apply, label) {
+  return async (req, res) => {
+    const { client_id, client_secret, github_login } = req.body;
+    try {
+      const client = await pi.getClient(client_id, { pool });
+      if (!client || client.status !== 'active' || !pi.clientSecretValid(client, client_secret)) {
+        return res.fail('invalid_client', 401);
+      }
+      await apply({ clientId: client.client_id, githubLogin: github_login }, { pool });
+      res.json({ ok: true });
+    } catch (err) {
+      log.error(`[platform-identity] ${label}`, err);
+      res.fail('invite_notice_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+module.exports = function ssoInviteRoutes() {
+  const router = express.Router();
+
+  const notify = applyNotice(inviteNotices.noteProjectInvite, '/sso/invites/notify');
+  const clear = applyNotice(inviteNotices.clearProjectInvite, '/sso/invites/clear');
+
+  // rank: public — authenticated by client_id + client_secret, not a builder rank.
+  router.post('/sso/invites/notify', (req, res) => {
+    if (validateOrRespond(req, res, {
+      client_id: { required: true, type: 'string', maxLength: 200 },
+      client_secret: { required: true, type: 'string', maxLength: 512 },
+      github_login: { required: true, type: 'string', minLength: 1, maxLength: 200 },
+    })) return undefined;
+    return notify(req, res);
+  });
+
+  // rank: public — authenticated by client_id + client_secret, not a builder rank.
+  router.post('/sso/invites/clear', (req, res) => {
+    if (validateOrRespond(req, res, {
+      client_id: { required: true, type: 'string', maxLength: 200 },
+      client_secret: { required: true, type: 'string', maxLength: 512 },
+      github_login: { required: true, type: 'string', minLength: 1, maxLength: 200 },
+    })) return undefined;
+    return clear(req, res);
+  });
+
+  return router;
+};

package/modules/platform-identity/tests/platform-identity.mjs

@@ -529,7 +529,7 @@ await ta('listMembershipsForAccount joins projects + excludes pending', async ()
   assert.deepEqual(c.params, [42]);
 });
 
-console.log('\ninvitations (§5 — pre-seed pending membership):');
+console.log('\ninvitations (§5 — a pending row is a NOTICE of the project\'s own invite, ADR 0353):');
 
 await ta('inviteToProject pre-seeds a pending row, never clobbering an existing member', async () => {
   const pool = mockPool([{ rows: [{ id: '1', membership_kind: 'pending' }] }]);
@@ -547,20 +547,23 @@ await ta('inviteToProject reports already-member when the row exists (DO NOTHING
   assert.deepEqual(out, { invited: false, alreadyMember: true });
 });
 
-await ta('resolveInvite accept flips ONLY a pending row to builder', async () => {
-  const pool = mockPool([{ rows: [{ id: '1' }] }]);
-  const out = await P.resolveInvite({ clientId: 'c1', githubId: 42, accept: true }, { pool });
-  assert.deepEqual(out, { resolved: true, accepted: true });
-  const c = pool.calls[0];
-  assert.match(c.text, /UPDATE platform_identity_project_memberships SET membership_kind = 'member'/);
-  assert.match(c.text, /AND membership_kind = 'pending'/, 'only touches pending — never a real member');
+await ta('there is no hub-side accept any more — signing in to the project accepts (ADR 0353)', async () => {
+  assert.equal(P.resolveInvite, undefined, 'the accept flip admitted nobody and is gone');
+  assert.equal(typeof P.removePendingInvite, 'function');
 });
 
-await ta('resolveInvite decline deletes ONLY a pending row', async () => {
+await ta('removePendingInvite deletes ONLY a pending row (decline, or the project rescinding)', async () => {
   const pool = mockPool([{ rowCount: 1 }]);
-  const out = await P.resolveInvite({ clientId: 'c1', githubId: 42, accept: false }, { pool });
-  assert.deepEqual(out, { resolved: true, accepted: false });
+  const out = await P.removePendingInvite({ clientId: 'c1', githubId: 42 }, { pool });
+  assert.deepEqual(out, { removed: true });
   assert.match(pool.calls[0].text, /DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/);
+  assert.deepEqual(pool.calls[0].params, ['c1', 42]);
+});
+
+await ta('removePendingInvite reports nothing removed when there was no pending row', async () => {
+  const pool = mockPool([{ rowCount: 0 }]);
+  const out = await P.removePendingInvite({ clientId: 'c1', githubId: 42 }, { pool });
+  assert.deepEqual(out, { removed: false });
 });
 
 await ta('getAccountByLogin resolves case-insensitively, newest first', async () => {