@bongos/core 1.20.20 → 1.20.22

package/modules/public-landing/public/assets/cosmos.css

@@ -431,6 +431,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .inviteList>li::before{content:"";grid-column:1;grid-row:1;width:7px;height:7px;margin-top:7px;border-radius:50%;border:1px solid var(--accent);background:var(--bg);}
 .inviteList b{grid-column:2;font-family:var(--font-body);font-weight:500;font-size:15px;color:var(--ink);}
 .inviteList small{grid-column:2;font-family:var(--font-body);font-size:13px;font-weight:400;line-height:1.45;color:var(--ink-faint);}
+.inviteList a{grid-column:2;justify-self:start;margin-top:6px;}
 /* who is worth inviting (task 1002347, BV1.R28) — the recommendation's own
    sentence, in the .modWhy voice: the panel explaining itself, never a thing to
    act on, so it never competes with the names under it. */
@@ -1386,6 +1387,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-mine .addr a,#view-manage .ledger a{font-family:var(--font-mono);font-size:12.5px;color:var(--ink-soft);}
 #view-mine .addr a:hover,#view-manage .ledger a:hover{color:var(--ink);text-decoration:underline;}
 #view-mine .projMsg a,#view-manage .mSec a{color:var(--ink);text-decoration:underline;}
+/* a BUTTON that is a link inside a manage section (the invite hand-off, task 1002818) keeps
+   the button's box: the rule above would make it an underlined inline-block with its label
+   stuck to the top of the pill */
+#view-manage .mSec a.btn{display:inline-flex;text-decoration:none;}
 
 /* ── the lifecycle rail (DESIGN.md): stripMarkup's markup, drawn as three
    hairlines with a 7px dot and one lit step — no plate, no connector, no

package/modules/public-landing/public/projects.html

@@ -998,11 +998,13 @@ summary{min-height:24px;padding:3px 0;}
            only if there is a way back. The SAME widget on the SAME route
            (POST /projects/invite), admitted here by the project's own ownership
            (ADR 0248); like its neighbour above, nothing is pushed to the project and
-           nothing restarts, so there is no "what your project runs" read-back line. -->
+           nothing restarts, so there is no "what your project runs" read-back line.
+           Since task 1002818 (ADR 0353) the route only says WHERE to invite — the
+           project's own hall — and each name becomes a link that finishes it there. -->
       <div class="card mSec" id="mInvite">
         <h2>Invite a builder</h2>
         <div id="mInv">
-          <p class="finePrint">By GitHub username. They get an invitation to accept from their own projects page, and they need to have signed in here at least once.</p>
+          <p class="finePrint">By GitHub username. The invite is sent from your project’s own hall — that is the invite that lets them in — and they see it on their projects page here too.</p>
           <div class="attach">
             <label class="vh" for="mInviteWho">GitHub username</label>
             <input type="text" id="mInviteWho" placeholder="GitHub username" autocomplete="off" autocapitalize="off" spellcheck="false" maxlength="200">
@@ -1490,7 +1492,7 @@ summary{min-height:24px;padding:3px 0;}
                  shows it. -->
             <div class="inviteBox" id="wizInvite" hidden>
               <h2 class="stepsHead">Invite builders</h2>
-              <p class="finePrint">Optional — invite people by GitHub username. Each one gets an invitation to accept from their own projects page, and they need to have signed in here at least once. Skip this and invite anyone later; nothing about your project waits on it.</p>
+              <p class="finePrint">Optional — invite people by GitHub username. Each invite is sent from your project’s own hall, which is what lets them in, and they see it on their projects page here too. Skip this and invite anyone later; nothing about your project waits on it.</p>
               <div class="attach">
                 <label class="vh" for="wizInviteWho">GitHub username</label>
                 <input type="text" id="wizInviteWho" placeholder="GitHub username" autocomplete="off" autocapitalize="off" spellcheck="false" maxlength="200">
@@ -3184,8 +3186,10 @@ summary{min-height:24px;padding:3px 0;}
 
   /* Each invitation renders as a way IN, never an Accept button: the hub's own
      accept flip never admits anyone to the project's own instance (ADR 0335)
-     — signing in there is what actually accepts it (task 1002969). Decline
-     still works; it only clears the hub's own pending row. */
+     — signing in there is what actually accepts it (task 1002969). Since task
+     1002818 (ADR 0353) the row is the project's own notice of its invite and the
+     hub has no accept route at all. Decline still works; it only clears the
+     hub's own pending row. */
   function renderInvitesList(invites) {
     var section = $('mineInvites');
     var ul = $('invitesList');
@@ -8550,9 +8554,17 @@ summary{min-height:24px;padding:3px 0;}
      IT NEVER BLOCKS CREATION. The project is filed before the step is shown at all;
      a refusal leaves the box exactly as it was, ready to try again.
 
-     WHAT IT PUBLISHES OF AN INVITEE is the 201 row's own membership_kind and the
-     login the inviter typed — never the github_id the row carries, which belongs to
-     someone who has accepted nothing yet.
+     THE INVITE ITSELF IS SENT FROM THE PROJECT'S OWN HALL (task 1002818, ADR 0353).
+     Only the project's own invite admits anyone; a hub row never did, so on any door
+     but `open` an invitee who signed in met a locked door. The route now writes
+     nothing and answers `{ invited: false, invite_url }` — the hall's invite box
+     with the login filled in — and each name becomes a line whose
+     link finishes the invite there. It is a link the owner clicks, never a window
+     opened for them: that open would come from a network answer, not a click, and
+     browsers block it. The hall's invite also reaches the invitee's projects page
+     here, because the project notifies the hub (POST /sso/invites/notify).
+
+     WHAT IT PUBLISHES OF AN INVITEE is the login the inviter typed and nothing else.
      Proof: ../../../tests/project_invite_ui.mjs ══ */
 
   var INVITE_MOUNTS = {
@@ -8645,16 +8657,16 @@ summary{min-height:24px;padding:3px 0;}
     }).catch(function () { setInviteSuggestions(id, null); });
   }
 
-  /* One line per invite this session filed: the login the inviter typed, and the
-     WORD THE ROW ITSELF CARRIES — so a membership_kind other than 'pending' shows
-     up here rather than being papered over as one. */
+  /* One line per name handed to the hall this session: the login the inviter
+     typed, and the link that finishes its invite there. The line says the invite is
+     NOT sent yet, because it is not — the hall's Invite button is what sends it. */
   function renderInviteRows(id) {
     var m = INVITE_MOUNTS[id];
     var list = m && $(m.list);
     if (!list) return;
     list.innerHTML = (inviteRows[id] || []).map(function (r) {
-      var said = r.kind === 'pending' ? 'invited — waiting for them to accept.' : r.kind;
-      return '<li><b>' + esc(r.login) + '</b><small>' + esc(said) + '</small></li>';
+      return '<li><b>' + esc(r.login) + '</b><small>not sent yet — finish it on your project’s hall.</small>'
+        + '<a class="btn small" href="' + esc(r.url) + '" target="_blank" rel="noopener">Send the invite →</a></li>';
     }).join('');
     /* the two lists are one answer: a name that just became a pending row is no
        longer a suggestion, and they are always redrawn together. */
@@ -8673,14 +8685,13 @@ summary{min-height:24px;padding:3px 0;}
      each. PURE, so the harness reads it directly. A code this page does not know
      falls through to the SERVER'S own words rather than an invented reason. */
   function inviteRefusal(code, status, message) {
-    if (status === 404 && code === 'account_not_found') return 'That builder hasn’t signed in here yet — ask them to sign in once, then invite them.';
     if (status === 404 && code === 'unknown_project') return 'This project isn’t on the map yet — give it a moment and try again.';
     /* deliberately says nothing about the project: see the header */
     if (status === 403) return 'This account can’t invite people here.';
     return message || 'The invitation couldn’t be sent — try again in a moment.';
   }
 
-  /* doInvite(id) — one builder, one request. */
+  /* doInvite(id) — one builder, one request: where to send their invite. */
   function doInvite(id) {
     var m = INVITE_MOUNTS[id];
     var slug = inviteSlug[id] || '';
@@ -8693,28 +8704,23 @@ summary{min-height:24px;padding:3px 0;}
       return;
     }
     inviteBusy[id] = true;
-    inviteSay(id, 'Sending the invitation…', '');
+    inviteSay(id, 'Finding your project’s invite page…', '');
     fetch(API + '/projects/invite', {
       method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ client_id: slug, github_login: login })
     }).then(function (res) {
       return jsonOrEmpty(res).then(function (data) {
         inviteBusy[id] = false;
-        if (res.ok) {
-          if (data && data.invited && data.row) {
-            inviteRows[id] = (inviteRows[id] || []).concat([{ login: login, kind: String(data.row.membership_kind || 'pending') }]);
-            renderInviteRows(id);
-            if (field) { field.value = ''; if (field.focus) field.focus(); }
-            inviteSay(id, login + ' is invited — they accept it from their own projects page.', 'ok');
-            return;
-          }
-          /* 200 { invited: false, alreadyMember: true } — not a failure, and not a
-             pending invite either: they are already on the project */
-          if (field) field.value = '';
-          inviteSay(id, login + ' is already on this project.', 'ok');
+        if (res.status === 401) { inviteSay(id, signInAgain(), 'err', true); return; }
+        /* the answer an owner is meant to get: the hall's own invite box for this name */
+        var url = res.ok && data ? safeHttpUrl(data.invite_url) : '';
+        if (url) {
+          inviteRows[id] = (inviteRows[id] || []).concat([{ login: login, url: url }]);
+          renderInviteRows(id);
+          if (field) { field.value = ''; if (field.focus) field.focus(); }
+          inviteSay(id, 'One more step: send ' + login + '’s invite from your project’s hall — its page opens with the name filled in. They’ll see it here on their projects page too.', 'ok');
           return;
         }
-        if (res.status === 401) { inviteSay(id, signInAgain(), 'err', true); return; }
         var e = apiError(data, res.status);
         inviteSay(id, inviteRefusal(e.code, res.status, e.message), 'err');
       });

package/modules/public-landing/public/projects.states.json

@@ -24,6 +24,7 @@
     "in-manage-card": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mCard", "#mCardPick .pick .pickPreview .cardBand", "#mCardPick [data-card-save]", "#mCardWhat summary"], "count": [["#mCardPick .pickCells[role=\"radiogroup\"]", 1], ["#mCardPick .pickCell", 5], ["#mCardPick .pickCell.on", 1]], "checked": "#mCardPick input[name=\"mCardBackdrop\"][value=\"\"]", "attr": [["#mCardPick .cardBand", "data-own", ""]] } },
     "in-manage-kind": { "auth": true, "url": "/projects?view=manage&id=101", "expect": {"visible":["#mKind","#mKindPick .modBand","#mKindWhat summary"],"count":[["#mKindPick .modOpt",5],["#mKindPick .modOpt[aria-pressed=\"true\"]",0]],"text":[["#mKindPick .modOpt b","Game"],["#mKindPick .finePrint","This project has never said what kind it is. Saying so puts the word beside its name wherever it is listed; it changes nothing else."]]} },
     "in-manage-invite": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mInvite", "#mInvite h2", "#mInviteWho", "#mInvite [data-invite-send]"] } },
+    "in-manage-invite-handoff": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["fill","#mInviteWho","octo-builder"],["click","#mInvite [data-invite-send]"],["wait",400]], "expect": {"visible":["#mInviteList a","#mInviteMsg"],"hidden":[]} },
     "in-manage-app-live": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStat","#mApp .appVars"],"hidden":[]} },
     "in-manage-app-building": { "auth": true, "url": "/projects?view=manage&id=102", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStages"],"hidden":[]} },
     "in-manage-app-failed": { "auth": true, "url": "/projects?view=manage&id=105", "actions": [["wait",900],["focus","#mApp .appRetryBtn"]], "expect": {"visible":["#mAppCard","#mApp p.err","#mApp .appRetryBtn"],"hidden":["#mApp .appRetry"]} },

package/modules/ui-design/kit/serve.js

@@ -402,6 +402,15 @@ const server = http.createServer((req, res) => {
     }
     if (/^\/my-projects\/[^/]+\/leave$/.test(rest) && req.method === 'POST') return AUTH ? json(res, 200, { ok: true, left: true }) : json(res, 401, UNAUTH);
     if (/^\/my-projects\/invites\/[^/]+\/decline$/.test(rest) && req.method === 'POST') return AUTH ? json(res, 200, { ok: true, accepted: false }) : json(res, 401, UNAUTH);
+    // the hub's invite (task 1002818, ADR 0353) writes nothing and hands the owner to the
+    // project's own hall — the stub answers with that hand-off, so the widget's line and
+    // link render rather than a refusal
+    if (rest === '/projects/invite' && req.method === 'POST') {
+      return AUTH ? readBody(req, (body) => json(res, 200, {
+        invited: false,
+        invite_url: 'https://mercury.example.test/builders/watch?invite=' + encodeURIComponent(body.github_login || ''),
+      })) : json(res, 401, UNAUTH);
+    }
     // the manage flows (task 1003345): every door on a row and on the manage page only ASKS
     // (ADR 0111) — the stub answers each ask with the route's receipt so the probes can drive
     // attach / restart / teardown / revive / join end to end; nothing changes in the fixture

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.20",
+  "version": "1.20.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.20",
+      "version": "1.20.22",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.20",
+  "version": "1.20.22",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8176,5 +8176,17 @@
       "id": "1002302",
       "text": "Guilds now show a combined track record: rounded totals of their members' credits, shipped work and projects, refreshed once a week. Members who keep their numbers private still count, but only when at least three such members"
     }
+  ],
+  "1.20.21": [
+    {
+      "id": "1002306",
+      "text": "The hub can now list guilds ranked by size or by how much their members have shipped, using the rounded weekly totals. Only public guilds with visible members appear, and private members are never counted."
+    }
+  ],
+  "1.20.22": [
+    {
+      "id": "1002818",
+      "text": "When a project invites someone, that person now sees the invitation on their Cloud Bongos projects page, and signing in to the project is what accepts it. Taking an invite back removes it there too. Inviting from the platform'"
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -183,6 +183,10 @@ const INTEGRATION = new Set([
   // re-evaluated against a racing writer's committed row, are planner facts; the
   // DB-free sibling (guild_totals) pins the band scale and statement shapes.
   'guild_totals_db',
+  // task 1002306 (R30): the guild map against real SQL — the INNER join that drops
+  // an empty public roster, the capped roster count, and NULLS LAST on a guild
+  // with no weekly record yet. guilds_api §3b pins the route and statement shape.
+  'guild_map_db',
   // task 1003935: 'linkify_refs' was swept in with the three above without the
   // no-DB check they were being fixed for. It touches no Postgres at all — pure
   // string work plus a filesystem walk — so the DB-free lane skipped it and the

package/src/bongos/auth-admission.js

@@ -475,6 +475,45 @@ async function readApplicantProfileFromHub(githubId) {
   }
 }
 
+// notifyHubOfInvite(githubLogin, { invited }) — tell the hub about THIS project's own
+// invite, so the invitee sees it in My Projects (task 1002818, ADR 0353). `invited:
+// true` after the invite route leaves the login holding an invited row; `false` after
+// a rescind leaves it none, so the hub drops its notice rather than keep pointing at
+// a door that will not open. The hub keeps a notice only — the access_requests row
+// here is what admits, and signing in is what accepts.
+//
+// In the kernel beside the other hub calls, for readApplicantProfileFromHub's reason:
+// it holds this project's hub client secret, and a module reaches it only through
+// the narrow doorway port (one login and one direction in, nothing out).
+//
+// FIRE-AND-FORGET, BOUNDED, SWALLOWED: an invite must never fail or wait because the
+// hub is slow or down, and there is no retry — re-sending the same invite re-notifies
+// (the hub's insert is idempotent). No-op without a hub (idp unset). An OLDER hub has
+// no such route and answers 404; that is swallowed too, and loses only the notice
+// (ADR 0352: the new-route half of the wire-skew rule).
+const HUB_INVITE_NOTICE_TIMEOUT_MS = 5000;
+
+async function notifyHubOfInvite(githubLogin, { invited = true } = {}) {
+  // Everything inside the try, config read included: callers never await this, so a
+  // throw here would surface as an unhandled rejection rather than a log line.
+  try {
+    const idp = loadIdpConfig();
+    if (!idp || !githubLogin) return;
+    await fetch(`${idp.origin}/api/bongos/sso/invites/${invited ? 'notify' : 'clear'}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
+      signal: AbortSignal.timeout(HUB_INVITE_NOTICE_TIMEOUT_MS),
+      body: JSON.stringify({
+        client_id: idp.clientId,
+        client_secret: idp.clientSecret,
+        github_login: String(githubLogin),
+      }),
+    });
+  } catch (err) {
+    log.info('[auth] hub invite notice failed (non-blocking):', err.message);
+  }
+}
+
 module.exports = {
   firstAdminLogin,
   firstTimeAdmissionBlocked,
@@ -488,6 +527,7 @@ module.exports = {
   maybeSeatFirstAdmin,
   seedKickoffChecklist,
   membershipKind,
+  notifyHubOfInvite,
   openEnrollmentEnabled,
   reportActivityRollup,
   reportActivityRollupForShippedTask,

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, readApplicationVouch, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -828,6 +828,7 @@ module.exports = {
   openEnrollmentEnabled,
   joinabilityMode,
   readApplicantProfileFromHub,
+  notifyHubOfInvite,
   readApplicationVouch,
   firstTimeAdmissionBlocked,
   instanceNeedsFirstAdmin,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.20'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.22'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -362,6 +362,13 @@ module.exports = {
   //     re-address it. Fails soft to null on every error, so a hub outage costs
   //     the profile block and never the queue.
   get readApplicantProfileFromHub() { return require('./bongos/auth').readApplicantProfileFromHub; },
+  // notifyHubOfInvite(githubLogin, { invited }) — tell the hub about one of THIS
+  //     project's invites (true) or its rescind (false), so the invitee sees it in
+  //     My Projects (task 1002818, ADR 0353). The same narrow-port reason as the
+  //     read above: the call is authenticated with this instance's hub client secret,
+  //     and a module passes one login and one direction — it can neither widen nor
+  //     re-address it. Fire-and-forget; never throws, never gates the invite.
+  get notifyHubOfInvite() { return require('./bongos/auth').notifyHubOfInvite; },
   // readApplicationVouch(token, { githubLogin }) — the write-side twin (task
   //     1002285, ADR 0201 D2): verify the hub's application vouch on a public
   //     access request → { githubId, handle } or null. Core supplies this

package/tests/access_requests_invite.mjs

@@ -29,6 +29,8 @@ const realApi = require(apiPath);
 let calls = [];
 let script = [];
 let mode = 'apply';
+// The hub notice port (task 1002818, ADR 0353), recorded instead of sent.
+let notices = [];
 const pool = {
   async query(sql, params) {
     calls.push({ sql, params });
@@ -42,6 +44,7 @@ require.cache[apiPath].exports = {
   ...realApi,
   pool,
   projectJoinDoor: () => mode,
+  notifyHubOfInvite: (login, opts) => { notices.push({ login, invited: opts && opts.invited }); },
   requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'archon' }; next(); },
   requirePermission: () => (_req, _res, next) => next(),
 };
@@ -87,7 +90,7 @@ function get(pathname) {
     }).on('error', reject);
   });
 }
-const reset = (m, s) => { mode = m; script = s; calls = []; };
+const reset = (m, s) => { mode = m; script = s; calls = []; notices = []; };
 const none = { rows: [] };
 const one = (row = {}) => ({ rows: [row] });
 
@@ -163,6 +166,41 @@ test('invite: resolving a pending application in place leaves it an application
   assert.doesNotMatch(update, /\bnote\b/, 'the applicant’s note is theirs — an inviter’s note never overwrites it');
 });
 
+// ── the hub hears about every invite that stands (task 1002818, ADR 0353) ────
+// The invitee sees it in My Projects; the row above is still the only thing that admits.
+
+test('invite: a fresh invite notifies the hub, after the row is written', async () => {
+  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited', kind: 'invite' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: '@octocat' });
+  assert.equal(r.status, 201);
+  assert.deepEqual(notices, [{ login: 'octocat', invited: true }], 'the normalised login, once');
+});
+
+test('invite: resolving a pending request in place notifies the hub too', async () => {
+  reset('invite_only', [none, none, one({ id: 7, github_login: 'octocat', status: 'invited', kind: 'application' })]);
+  await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.deepEqual(notices, [{ login: 'octocat', invited: true }]);
+});
+
+test('invite: re-inviting a standing invite re-notifies — that is how a missed notice heals', async () => {
+  reset('invite_only', [none, one()]);
+  await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.deepEqual(notices, [{ login: 'octocat', invited: true }]);
+});
+
+test('invite: nothing that leaves no invited row tells the hub anything', async () => {
+  reset('invite_only', [one()]);
+  await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.deepEqual(notices, [], 'already a member — there is no invite to announce');
+  reset('invite_only', [none, none, none, new Error('insert failed')]);
+  const failed = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(failed.status, 500);
+  assert.deepEqual(notices, [], 'a failed write announces nothing');
+  reset('invite_only', []);
+  await post('/api/gds/access-requests/invite', { github_login: 'not a login!' });
+  assert.deepEqual(notices, []);
+});
+
 // ── GET /access-requests/invites — the sender's outstanding list ─────────────
 
 test('invites list: outstanding invites only, each naming who sent it', async () => {

package/tests/application_lifecycle.mjs

@@ -336,6 +336,8 @@ let actingRank = 'archon';
 // Which builder is acting — switched only to prove an invite keeps its SENDER
 // when a different archon rescinds it.
 let actingId = 42;
+// The hub notice port (task 1002818, ADR 0353), recorded instead of sent.
+let notices = [];
 
 require.cache[apiPath].exports = {
   ...realApi,
@@ -348,6 +350,7 @@ require.cache[apiPath].exports = {
   // below is the production denial.
   readApplicationVouch: (token, { githubLogin } = {}) =>
     applicationVouchIdentity(token, { githubLogin, publicKey: hubPublicKey, clientId: SELF_CLIENT_ID }),
+  notifyHubOfInvite: (login, opts) => { notices.push({ login, invited: opts && opts.invited }); },
 };
 
 seams._reset();
@@ -392,7 +395,7 @@ function call(method, pathname, body, extraHeaders = {}) {
     req.end(payload);
   });
 }
-const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; };
+const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; };
 
 // ===========================================================================
 // The interpreter is the instrument, so it is calibrated first
@@ -699,6 +702,43 @@ test('decline: a PENDING request from someone who is already a member is still d
   assert.equal(row(1).status, 'dismissed');
 });
 
+// ── the hub's notice follows the door (task 1002818, ADR 0353) ──────────────
+// The hub lists an invite in the invitee's My Projects. Once this project holds no
+// invited row for that login, the notice would lead to a locked door, so a dismissal
+// takes it back — and only then.
+
+test('rescind: the hub is told to drop its notice once the login holds no invite', async () => {
+  reset();
+  const r = await call('PATCH', '/api/gds/access-requests/3', { status: 'dismissed' });
+  assert.equal(r.status, 200);
+  assert.deepEqual(notices, [{ login: 'cy', invited: false }]);
+});
+
+test('rescind: a second invite still standing keeps the notice — the invitee can still get in', async () => {
+  reset();
+  // Two archons invited cy at once (the invite route takes no lock, by design).
+  rows.push({ ...row(3), id: 5, kind: 'invite', created_by: 42 });
+  const r = await call('PATCH', '/api/gds/access-requests/3', { status: 'dismissed' });
+  assert.equal(r.status, 200);
+  assert.equal(await dbKernel.hasInvitedAccessRequest('cy'), true, 'precondition of the claim: the door is still open');
+  assert.deepEqual(notices, [], 'the notice stays true, so it stays');
+});
+
+test('the hub hears nothing from a refused rescind, an approval, or an idempotent re-click', async () => {
+  reset();
+  builders.push({ github_login: 'cy' });
+  await call('PATCH', '/api/gds/access-requests/3', { status: 'dismissed' });
+  assert.deepEqual(notices, [], 'a member was not rescinded, so nothing is taken back');
+
+  reset();
+  await call('PATCH', '/api/gds/access-requests/1', { status: 'invited' });
+  assert.deepEqual(notices, [], 'an approval is not a rescind');
+
+  reset();
+  await call('PATCH', '/api/gds/access-requests/4', { status: 'dismissed' });
+  assert.deepEqual(notices, [], 'already dismissed — nothing changed');
+});
+
 test('a declined request is NOT revived by a PATCH — that path is the invite route (D4.2)', async () => {
   reset();
   const before = { ...row(4) };

package/tests/catalog_only_client.mjs

@@ -202,11 +202,13 @@ test('POST /projects/invite no longer 404s for a wizard-made project', async ()
   // now is. The route's `project.curate` gate is deliberately untouched — widening it to the
   // project's own owner is 1003580's job, and this test stubs the permission middleware so
   // the assertion is about the TARGET resolving, not about who may call it.
+  // Since task 1002818 (ADR 0353) a resolved target is answered with where the invite that
+  // admits is sent — the catalog row's origin is what the hand-off link is built from.
   const res = await call('POST', '/projects/invite', { client_id: 'spike-harbor', github_login: 'someone' });
   assert.notEqual(res.status, 404);
-  assert.equal(res.status, 201);
-  assert.equal(res.body.invited, true);
-  assert.equal(res.body.clientId, 'spike-harbor');
+  assert.equal(res.status, 200);
+  assert.equal(res.body.invited, false, 'the hub writes nothing');
+  assert.equal(res.body.invite_url, 'https://spike-harbor.cloudbongos.test/builders/watch?invite=someone');
 });
 
 test('an unknown project still 404s — the catalog row is what resolves, not the route', async () => {