@bongos/core 1.20.21 → 1.20.22

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.21",
-  "core_contract": "1.20.21",
-  "source_commit": "21843bf1398d569536fc45f748fae3c195be4ba2",
+  "core_version": "1.20.22",
+  "core_contract": "1.20.22",
+  "source_commit": "d79f16096f873c36c2bd963c04d552fa8300497f",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T15:20:08.598Z",
+  "built_at": "2026-09-30T16:20:55.212Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 557,
+    "docs_redacted": 558,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2638,
+    "functional_verbatim": 2641,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3221,
-  "tree_sha256": "07ce496b1770bfc67bcd98bdf44e2bc6a47d1f869682f5fba2db1ded196d0b07",
+  "file_count": 3225,
+  "tree_sha256": "63917bb4f51c192d66139655bbfebd61e0f04299a9f09e5073420a970ee9e39a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -327,12 +327,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "680d37464fa929b11cd7a02af6aa4fb144bedcde5134c3d81edac167d7b95980"
+      "sha256": "ff5585737cc618ca1a24c994a27411a6f4b60192d4904063771744788c0b8002"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "c6dac0dab2b2d5fb996568cff8ead84e7f6ac9e036c3fab6a47893c79a99f8f4"
+      "sha256": "f0a11cd6519a8ba62cb645c8d50da768f00f7252562a8b7a2f6e089ae0040f5e"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -342,17 +342,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "baa7c833c3d18bf8250590fd94c499b3032ba05c6b9aa0af36b4660da295c799"
+      "sha256": "60673c698acad267f556a78b0e4d13b60d5357208a8772fe0d69cbd60b2b1c2c"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "e9b2837873e241f20472ebde570b550718365a663282d4a85c255d98a8c8e21c"
+      "sha256": "2697fd1139e28cf2bf4ca8a5d4218d22060399bb4050cfdaa9457eae6c639b79"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "79240ff449f616e50aca58fc310a3b0670af84dc30d7a93991d84c0d0f4b87d2"
+      "sha256": "37028d9008247d9afd900f38437e1f8e335c19633c55379864177033d4f1bc89"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2147,7 +2147,7 @@
     {
       "path": "docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md",
       "mode": "0000644",
-      "sha256": "ac7b159e2f894e9d9ce4c27506d84709aaa76851e325c5054fd45b619d2fea2a"
+      "sha256": "f22adac7e27f2e83ece9311e44fca35edb0bd571440f108d28a9088775d0b93c"
     },
     {
       "path": "docs/adr/0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md",
@@ -2234,20 +2234,25 @@
       "mode": "0000644",
       "sha256": "d74b4f6262d4f23fd67f73771bbe8187e9cb92fa321b83ffb33ef03cf96d1236"
     },
+    {
+      "path": "docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md",
+      "mode": "0000644",
+      "sha256": "4445d9c306a22fb3b7e72467bedad262f4653c092bf4866f8a39410248da2724"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "943ac0f8c9c0b2dc5ef2a05241b0bac329c5fa986b09425841e12e62f4f9b936"
+      "sha256": "6be10fb1925fd406729e08b4d604569b1123b7c5f6091300559df8532831ab69"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "36a01165649c2ca2f1e29c592332efe08f3cffcd926a547e8de4121ca05c0469"
+      "sha256": "d6a19f9db87e4d936f317efe07e1a4dfaaa75c5a6797a4c3e4939634adec8494"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "37b9cfbb4cce621c7ba60d358a66b618d60f6706b4b1c2dec7215c88451cff1c"
+      "sha256": "f44cf9111baee003af84ab6c83503e97a4a723c4cb2ad59ad367cce75f8f717e"
     },
     {
       "path": "docs/architecture.md",
@@ -2272,12 +2277,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "08ef6d32a1c5cfea14e7ddd54a4e7ab2e34818199a45e0422a4fce31b72567a7"
+      "sha256": "5034d255bbdcdd29c52831ce069561494a5ad7cc028b5e5711a0ab7a95a73a2b"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "a405d02a6308a53e9322437f21daf86cb7e7f0d6d8b15a25639b7fdbcb7c2fd1"
+      "sha256": "e75a8e11138b151ea81f378dde8f4e7fe395b44ba9369e7c98e865ff6516eeb4"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2777,7 +2782,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5be7dcf0c4dbcd61706bbaf8fec0edc509d32b721b7be1abae250dcff896f95e"
+      "sha256": "f721721d1ba698925f1aa8133bb3b5d6ab6c048be0183212c0a89b1ca1d132a0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2862,12 +2867,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "9e3397a30b8fa81b392a32b65f275209cb67021b7e74a4700e0ae9ff6d3c5e6b"
+      "sha256": "7a607ea5f1d29bd078ddbb6bfa5bcfb68e689095ca47bf290194cc7578794ed9"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "6ba44419e75dcb245e386e077eba647e744c56861b8b81c9002bbe7528369f0c"
+      "sha256": "dd7227bb9daface49cfb1e2a8702cb81b95a5d19f0169038ddfd7a6c80e04225"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5717,7 +5722,7 @@
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "65e86c3526dc42eb82d6e7f9df88af5ff4bb8c78aef52326301e1cc57d6d7835"
+      "sha256": "7a5ef4f34be6b0ab7f5b3fa34bf1666c17164a6331031cc908c2791109585b89"
     },
     {
       "path": "modules/hall-ui/public/watch.states.json",
@@ -6807,7 +6812,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "69e0757e08ff5fdac708036cca67a6e11fd26820b683d7f255bc3c1c0e30cce9"
+      "sha256": "1eaac1f70a519ca5a0ea71bb56ab6d33b582f5ff002faf5811fa6c1700480057"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -6894,6 +6899,11 @@
       "mode": "0000644",
       "sha256": "2eb5577450d3bc1d67b7eab9a13256889aca945c6ac6a6a0ca919e195952b7a1"
     },
+    {
+      "path": "modules/platform-identity/invite-notices.js",
+      "mode": "0000644",
+      "sha256": "1391ac415c073c88942f517b4467514142e15fb0fadb2e156c44db4e75ee0763"
+    },
     {
       "path": "modules/platform-identity/invite-suggestions.js",
       "mode": "0000644",
@@ -7037,7 +7047,7 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "48c9d82d9ec647430a97ba19f403b22e7eba13e16ff553b6bbd08691a8918a7b"
+      "sha256": "c5efc01e3be9725d2f78d3cd5f89db68731c2958c627374fc005b5afb1fdc51f"
     },
     {
       "path": "modules/platform-identity/origin-containment.js",
@@ -7047,7 +7057,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "a823bd5e79795f93aa011470088b5840bf2ada6fb696fbf6b9b1c6c2ea85e5ef"
+      "sha256": "9877fd84f74545d96473651cca9d00a76712507e76962c1891d3dd0c3d47e7b2"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -7122,7 +7132,7 @@
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
-      "sha256": "56700357273c03d412afce1ef9937ba811257d0c5110f08d757bbef3e517a416"
+      "sha256": "c9a3541f976aa872d4645dccb6101b5ca046a7ea963b1665e9cb6ed9d3796f5c"
     },
     {
       "path": "modules/platform-identity/routes/profile.js",
@@ -7132,7 +7142,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "575d89666362e57e04ac0fd6dcd13b3f5125ba46e5cdb371cb3456f9ee383d88"
+      "sha256": "094c1d54e11794acb09066d0d95b18dbe9100f8b87a67cd7eb1f56be30026f8e"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -7144,6 +7154,11 @@
       "mode": "0000644",
       "sha256": "3fbaaafe605fd891c449499ca85a716f9b8780bb1869f25b32162593ada8fedd"
     },
+    {
+      "path": "modules/platform-identity/routes/sso-invites.js",
+      "mode": "0000644",
+      "sha256": "af4efb51c20e8cfc3827fbebb17918bcae08f4b07cab982005f52ec34c7c1978"
+    },
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
@@ -7172,7 +7187,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "93d74c10d601eab840da83b5d33d7bbf51907830626401cc27fadb138441fcc3"
+      "sha256": "d9164f9ae4188a313ce55ebc7c670531aa4e47128f85571aaa55730dbabd1dd3"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -7787,7 +7802,7 @@
     {
       "path": "modules/public-landing/public/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "1269d1e7a9e84459ce023a4c385e7f733dc291df5d46276092f47e845f5b55f8"
+      "sha256": "865e576b309a0ad4b160dc10ff8907e2a6210d2aaea7138155d70143caf7686c"
     },
     {
       "path": "modules/public-landing/public/assets/verro-medallion.png",
@@ -8047,7 +8062,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "c80a43d899cd11ab05fa56b35920da0f2ecb661bab6d9b44a515bdba53756dbc"
+      "sha256": "b2780277742b8f560dc431ce77498ffdefaf1a027ffde893caa472e59da512f3"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -8057,7 +8072,7 @@
     {
       "path": "modules/public-landing/public/projects.states.json",
       "mode": "0000644",
-      "sha256": "53529e467824952eca9c4753fb2374caa05f2406aa9b0c03e8824b77e4996540"
+      "sha256": "5ce71b5f4c9cf3b9c955bd6e86a8f9b2c8fc53a917955a57577272972ab31693"
     },
     {
       "path": "modules/public-landing/public/terms.html",
@@ -8582,7 +8597,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "0d039ac06759ab813a4cf67d2c989662280f2c31c625a3e8ca02eb1f2e594418"
+      "sha256": "9b74bbbdaeee790c88a0f6153ff12f8e7062442257542f308a4a9ab188bbbe2d"
     },
     {
       "path": "modules/ui-design/kit/tells.js",
@@ -8892,12 +8907,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7ca4dcc58b8138d0f20002590f565c03952db6a97c8a740c09307c91b24872bf"
+      "sha256": "a4c779e1257097ccfca882fff19eb4475df55ddcec186db467d2efa021e2f32d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fc858fcc7b0fef1d6850cca8b5d5825250568cb16754f3452dc5a5d8f42545d5"
+      "sha256": "90060e42b238486c38227cafbb5d7026e8d4283a3b96508f1617d69f524cdefe"
     },
     {
       "path": "public-docs/index.html",
@@ -8917,7 +8932,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "1739d308859639e1ff64b6716cd4e04f117c094868c1ad8ad1f1fa1272232221"
+      "sha256": "f92a265951d8ff9531bca0803411c8f1a156d3a034c3125a080cf9c65c66c3c5"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10697,7 +10712,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "9fd9311df751a418985073db3aed97825e52d2a45ca7501b93f93cf5019c1fe6"
+      "sha256": "5e8147efb07016de8648dc6d3dc09d437b27dfc768484bc0aa94582acb6774a2"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -10722,7 +10737,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "a46826214509f317fbe982265c0045edf9c3aa4c94bd2fa54232af51cbc51573"
+      "sha256": "fad15cdbd6652b2a699f48769baaaed0e59314ac6bef326e663d6c7b06b1eaae"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -11032,7 +11047,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7e01ad4572ca48ef4dba7c5776246f2e7ba1a251a1bc079f1ae0566b9dc67593"
+      "sha256": "8d944dcbb15babff01a10b3805ccc2fbe79ff903067af22afde12a8a1447b580"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11107,7 +11122,7 @@
     {
       "path": "tests/access_requests_invite.mjs",
       "mode": "0000644",
-      "sha256": "4148ce39a074fa16cb6360027a7fd6c1ea9b26cea6423209591ee45f23ec894f"
+      "sha256": "1044d48504923ec03a8a08303fa12612b2fc02abed32d85be26bf8d5615807ad"
     },
     {
       "path": "tests/accessibility_replay.mjs",
@@ -11327,7 +11342,7 @@
     {
       "path": "tests/application_lifecycle.mjs",
       "mode": "0000644",
-      "sha256": "c13c0a4b5244b72ec093a2d80029bc3b1ceb8f0828aaad69274054be9e927afe"
+      "sha256": "d35db1b125eaee28d3e0af9c1354b36f589a74bca922b22b507fc29b48bb38c4"
     },
     {
       "path": "tests/architect.mjs",
@@ -11702,7 +11717,7 @@
     {
       "path": "tests/catalog_only_client.mjs",
       "mode": "0000644",
-      "sha256": "f973b73aa9c0063dd6a10c60e6ea08729abb5e405e0ff893b2e3c907488d34dc"
+      "sha256": "ea7d5c8546966c84ce8831484355f059b7dc42558954090afa90e17d89165454"
     },
     {
       "path": "tests/category_advisory_guard.mjs",
@@ -13349,6 +13364,11 @@
       "mode": "0000644",
       "sha256": "5daff8488df269752d2e5992e60a03bb75cf85a5b8d5fcaa15703b12a5bb6b94"
     },
+    {
+      "path": "tests/hub_invite_notices.mjs",
+      "mode": "0000644",
+      "sha256": "c79b4101c944110166da2e158bada2192235897887b65bbb7b1f9fae3c61eb13"
+    },
     {
       "path": "tests/hub_map_orb_states.mjs",
       "mode": "0000644",
@@ -13957,7 +13977,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "264d34d76d2112c0c8d118d431f7c53342343928b4b61e13729b146c34acd0e0"
+      "sha256": "be32afe74b2ecd47f136a824c9997b54274b72d41dfe5cd8d1e540e9a05f83f4"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -14072,7 +14092,7 @@
     {
       "path": "tests/my_projects_surface.mjs",
       "mode": "0000644",
-      "sha256": "8aa62a0d98c6f667d66280e13ff849b0a3e7684b528a628042594863b02f63ae"
+      "sha256": "9055da573a4e210daf6d2910938df77f711f54a6701a33ebc8995ef11a95fc52"
     },
     {
       "path": "tests/nav_permission_atoms.mjs",
@@ -14447,7 +14467,7 @@
     {
       "path": "tests/project_invite_ownership.mjs",
       "mode": "0000644",
-      "sha256": "743436b1191353bf687d8fb553d423a6003707a25a548367644928478569f171"
+      "sha256": "bc77a25e814de321faae41780b83504bb4ce87a73bb944d0d231a301532e5364"
     },
     {
       "path": "tests/project_invite_suggestions.mjs",
@@ -14457,7 +14477,7 @@
     {
       "path": "tests/project_invite_ui.mjs",
       "mode": "0000644",
-      "sha256": "36a7ff3e5b8c4b9edd495d8a7e5b50dcecded8e608f148a62b4e37841c0eb36a"
+      "sha256": "2b6d62d93878b43896dbe17247e7879ac86c842d9300cdf34876c5010ab02d1f"
     },
     {
       "path": "tests/project_join_door.mjs",
@@ -16047,7 +16067,7 @@
     {
       "path": "tests/watch_applications_queue.mjs",
       "mode": "0000644",
-      "sha256": "a8020b3e3f30e93a872f94567a03e775d279f130a20a2c61c64caaafa5d752a7"
+      "sha256": "6f0dc184d552c4db4048894286cff96ade91e44c8070fae66fdeef324ba09a7d"
     },
     {
       "path": "tests/watch_roster_self_row.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 462 operations across 70 resource groups
+- 463 operations across 70 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -729,8 +729,6 @@ function createClient(opts = {}) {
       postMyProjectsClientIdLeave: (args) => request("POST", "/my-projects/{clientId}/leave", { hasBody: true }, args),
       // GET /my-projects/invites — rank: any-builder — GET /my-projects/invites
       getMyProjectsInvites: (args) => request("GET", "/my-projects/invites", { hasBody: false }, args),
-      // POST /my-projects/invites/{clientId}/accept — rank: any-builder — POST /my-projects/invites/:clientId/accept
-      postMyProjectsInvitesClientIdAccept: (args) => request("POST", "/my-projects/invites/{clientId}/accept", { hasBody: true }, args),
       // POST /my-projects/invites/{clientId}/decline — rank: any-builder — POST /my-projects/invites/:clientId/decline
       postMyProjectsInvitesClientIdDecline: (args) => request("POST", "/my-projects/invites/{clientId}/decline", { hasBody: true }, args),
       // POST /my-projects/join — rank: any-builder — POST /my-projects/join
@@ -1015,6 +1013,10 @@ function createClient(opts = {}) {
       postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
       // POST /sso/device/start — rank: public — POST /sso/device/start
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
+      postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
+      // POST /sso/invites/notify — rank: public — POST /sso/invites/notify
+      postSsoInvitesNotify: (args) => request("POST", "/sso/invites/notify", { hasBody: true }, args),
       // POST /sso/membership/check-in — rank: public — POST /sso/membership/check-in
       postSsoMembershipCheckIn: (args) => request("POST", "/sso/membership/check-in", { hasBody: true }, args),
       // GET /sso/pubkey — rank: public — GET /sso/pubkey

package/clients/bongos-client/index.cjs

@@ -728,8 +728,6 @@ function createClient(opts = {}) {
       postMyProjectsClientIdLeave: (args) => request("POST", "/my-projects/{clientId}/leave", { hasBody: true }, args),
       // GET /my-projects/invites — rank: any-builder — GET /my-projects/invites
       getMyProjectsInvites: (args) => request("GET", "/my-projects/invites", { hasBody: false }, args),
-      // POST /my-projects/invites/{clientId}/accept — rank: any-builder — POST /my-projects/invites/:clientId/accept
-      postMyProjectsInvitesClientIdAccept: (args) => request("POST", "/my-projects/invites/{clientId}/accept", { hasBody: true }, args),
       // POST /my-projects/invites/{clientId}/decline — rank: any-builder — POST /my-projects/invites/:clientId/decline
       postMyProjectsInvitesClientIdDecline: (args) => request("POST", "/my-projects/invites/{clientId}/decline", { hasBody: true }, args),
       // POST /my-projects/join — rank: any-builder — POST /my-projects/join
@@ -1014,6 +1012,10 @@ function createClient(opts = {}) {
       postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
       // POST /sso/device/start — rank: public — POST /sso/device/start
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
+      postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
+      // POST /sso/invites/notify — rank: public — POST /sso/invites/notify
+      postSsoInvitesNotify: (args) => request("POST", "/sso/invites/notify", { hasBody: true }, args),
       // POST /sso/membership/check-in — rank: public — POST /sso/membership/check-in
       postSsoMembershipCheckIn: (args) => request("POST", "/sso/membership/check-in", { hasBody: true }, args),
       // GET /sso/pubkey — rank: public — GET /sso/pubkey

package/clients/bongos-client/index.d.ts

@@ -382,13 +382,13 @@ export interface PostModulesKeyEnableResponse { ok: boolean; key: unknown; enabl
 export interface PostModulesKeySubmitRequest { signed_by?: string }
 export interface PostModulesKeySubmitResponse { ok: boolean; submission: unknown }
 export interface PostMyProjectsClientIdLeaveResponse { ok: boolean; left: unknown }
-export interface PostMyProjectsInvitesClientIdAcceptResponse { ok: boolean; accepted: boolean }
 export interface PostMyProjectsInvitesClientIdDeclineResponse { ok: boolean; accepted: boolean }
 export interface PostMyProjectsJoinRequest { origin: string; note?: string }
 export interface PostMyProjectsJoinResponse { ok: boolean; status: unknown; project: unknown; message: unknown }
 export interface PostNpmReleasePreviewRequest { version: string }
 export interface PostOverrideRequestsIdDecideRequest { decision: string; note?: string }
 export interface PostProjectsInviteRequest { client_id: string; github_login: string }
+export interface PostProjectsInviteResponse { invited: boolean; invite_url: unknown }
 export interface PostProjectsProjectIdSpecialitiesRequest { name: string; discipline: string; summary?: string; contract_md?: string; visibility?: string; sellable?: boolean; skills?: string[] }
 export interface PostProjectsProjectIdSpecialitiesResponse { speciality: unknown }
 export interface PostProjectsRequest { origin: string; name: string; tagline?: string; description?: string; art_url?: string; type?: string; template?: string }
@@ -443,6 +443,8 @@ export interface PostSsoApplicantProfileRequest { client_id: string; client_secr
 export interface PostSsoApplicantProfileResponse { profile: unknown }
 export interface PostSsoDevicePollRequest { device_code: string }
 export interface PostSsoDeviceStartRequest { origin: string }
+export interface PostSsoInvitesClearRequest { client_id: string; client_secret: string; github_login: string }
+export interface PostSsoInvitesNotifyRequest { client_id: string; client_secret: string; github_login: string }
 export interface PostSsoMembershipCheckInRequest { client_id: string; client_secret: string; github_id: StringifiableId; github_login: string; display_name?: string; avatar_url?: string; membership_kind?: string }
 export interface PostSsoMembershipCheckInResponse { ok: boolean }
 export interface PostSsoTokenRequest { client_id: string; client_secret: string; code: string; redirect_uri: string }
@@ -1156,8 +1158,6 @@ export interface BongosClient {
     postMyProjectsClientIdLeave(args?: RequestArgs): Promise<PostMyProjectsClientIdLeaveResponse>;
     /** GET /my-projects/invites — rank: any-builder */
     getMyProjectsInvites(args?: RequestArgs): Promise<GetMyProjectsInvitesResponse>;
-    /** POST /my-projects/invites/{clientId}/accept — rank: any-builder */
-    postMyProjectsInvitesClientIdAccept(args?: RequestArgs): Promise<PostMyProjectsInvitesClientIdAcceptResponse>;
     /** POST /my-projects/invites/{clientId}/decline — rank: any-builder */
     postMyProjectsInvitesClientIdDecline(args?: RequestArgs): Promise<PostMyProjectsInvitesClientIdDeclineResponse>;
     /** POST /my-projects/join — rank: any-builder */
@@ -1209,7 +1209,7 @@ export interface BongosClient {
     /** GET /projects/featured — rank: public */
     getProjectsFeatured(args?: RequestArgs): Promise<GetProjectsFeaturedResponse>;
     /** POST /projects/invite — rank: metic+archon */
-    postProjectsInvite(args: RequestArgs & { body: PostProjectsInviteRequest }): Promise<ApiResponse>;
+    postProjectsInvite(args: RequestArgs & { body: PostProjectsInviteRequest }): Promise<PostProjectsInviteResponse>;
   };
   "provisioning": {
     /** GET /provisioning/control-plane — rank: archon */
@@ -1442,6 +1442,10 @@ export interface BongosClient {
     postSsoDevicePoll(args: RequestArgs & { body: PostSsoDevicePollRequest }): Promise<ApiResponse>;
     /** POST /sso/device/start — rank: public */
     postSsoDeviceStart(args: RequestArgs & { body: PostSsoDeviceStartRequest }): Promise<ApiResponse>;
+    /** POST /sso/invites/clear — rank: public */
+    postSsoInvitesClear(args: RequestArgs & { body: PostSsoInvitesClearRequest }): Promise<ApiResponse>;
+    /** POST /sso/invites/notify — rank: public */
+    postSsoInvitesNotify(args: RequestArgs & { body: PostSsoInvitesNotifyRequest }): Promise<ApiResponse>;
     /** POST /sso/membership/check-in — rank: public */
     postSsoMembershipCheckIn(args: RequestArgs & { body: PostSsoMembershipCheckInRequest }): Promise<PostSsoMembershipCheckInResponse>;
     /** GET /sso/pubkey — rank: public */

package/clients/bongos-client/index.mjs

@@ -725,8 +725,6 @@ export function createClient(opts = {}) {
       postMyProjectsClientIdLeave: (args) => request("POST", "/my-projects/{clientId}/leave", { hasBody: true }, args),
       // GET /my-projects/invites — rank: any-builder — GET /my-projects/invites
       getMyProjectsInvites: (args) => request("GET", "/my-projects/invites", { hasBody: false }, args),
-      // POST /my-projects/invites/{clientId}/accept — rank: any-builder — POST /my-projects/invites/:clientId/accept
-      postMyProjectsInvitesClientIdAccept: (args) => request("POST", "/my-projects/invites/{clientId}/accept", { hasBody: true }, args),
       // POST /my-projects/invites/{clientId}/decline — rank: any-builder — POST /my-projects/invites/:clientId/decline
       postMyProjectsInvitesClientIdDecline: (args) => request("POST", "/my-projects/invites/{clientId}/decline", { hasBody: true }, args),
       // POST /my-projects/join — rank: any-builder — POST /my-projects/join
@@ -1011,6 +1009,10 @@ export function createClient(opts = {}) {
       postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
       // POST /sso/device/start — rank: public — POST /sso/device/start
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
+      postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
+      // POST /sso/invites/notify — rank: public — POST /sso/invites/notify
+      postSsoInvitesNotify: (args) => request("POST", "/sso/invites/notify", { hasBody: true }, args),
       // POST /sso/membership/check-in — rank: public — POST /sso/membership/check-in
       postSsoMembershipCheckIn: (args) => request("POST", "/sso/membership/check-in", { hasBody: true }, args),
       // GET /sso/pubkey — rank: public — GET /sso/pubkey

package/docs/adr/0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md

@@ -4,6 +4,7 @@
 - **Date:** 2026-09-24
 - **Task:** [task 1002813](https://cloudbongos.com/builders#/task/1002813) (R1 of the project admin console wave, goal 1000110 — BONGOS-V2)
 - **Deciders:** the three decisions come from the spike ([task 1002786](https://cloudbongos.com/builders#/task/1002786), [`docs/specs/<redacted>.md`](../specs/<redacted>.md), 2026-08-14). The spike asked the owner for one sign-off: what "widenable to metics" means. The owner answered on blocker 1000122, and [ADR 0217](0217-rank-gates-inviting-not-viewing.md) D1 records the answer: a per-project invite floor that defaults to archon and is set by that project's own archons. This ADR does three things. It records the decisions, reconciles them with what has shipped in the six weeks since, and says what each build task still has to build.
+- **Followed by:** [ADR 0353](0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md) — R6 (task 1002818): the hub's invite row became a notice the project writes, the hub-side accept was retired, and the wizard's invite step hands the owner to the project's hall. The "Until R6 lands" item below is closed by it.
 - **Supersedes:** only the "Invitations (deferred slice)" paragraph of [ADR 0141](<redacted>.md) §5. The rest of ADR 0141 stands.
 - **Revises:** [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md), [ADR 0215](0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md) and [ADR 0248](0248-a-hub-project-s-owner-is-the-provisioning-row-carried-on-a-port.md) predicted that `project.recruit` would replace `project.curate` on the hub's recruiting doors. D3.6 revises that prediction.
 - **Related:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md), [0108](0108-instance-composition-configurable-root.md), [0112](0112-private-goals-invitations-join-requests.md), [0151](0151-governance-permissions-as-atom-ranks-as-roles.md), [0157](0157-archon-is-rank-and-identity-only.md), [0182](0182-project-visibility-two-axes.md), [0194](0194-joinability-one-door-decision.md), [0201](0201-cross-project-application-vouched-row-live-record.md), [0247](0247-the-join-door-is-one-composed-answer-and-dark-matter-has-no-live-verdict-yet.md), [0328](0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md)

package/docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md

@@ -0,0 +1,70 @@
+# ADR 0353 — A hub invite is a notice of the project's own invite, and signing in accepts it
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1002818](https://cloudbongos.com/builders#/task/1002818) (R6 of the project admin console wave, goal 1000110 — BONGOS-V2)
+- **Builds on:** [ADR 0335](0335-an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md) D1/D2 (authority lives on the project's own instance; an invite is a pre-approved `access_requests` row; signing in is the acceptance act)
+- **Interacts with:** [ADR 0141](<redacted>.md) §3 (membership check-in), [ADR 0205](0205-federated-checkin-needs-the-hubs-own-signin-witness.md) (client credentials never mint a membership), [ADR 0352](0352-a-rollup-report-carries-its-as-of-in-a-header.md) (hub↔instance wire skew)
+- **Decided with:** the owner chose the split in D3 on 2026-09-30, over building the signed-assertion relay in this task.
+
+## Context
+
+ADR 0335 left one dead end that real users could reach. The hub had its own invite, `POST /projects/invite`, called from the creation wizard's invite step and from a project's manage page. It wrote a `pending` row in `<redacted>`, and accepting it (`POST /my-projects/invites/:clientId/accept`) flipped that row to `member`. No project reads that table to decide who may enter. So the invitee "accepted" and then met the project's own sign-in gate, which knew nothing about them. A hosted project's join door defaults to `apply`, so this was the common case, not an edge case.
+
+The project's own invite (`POST /access-requests/invite`, R2) does admit: it writes the `invited` row the sign-in gate reads. But nothing told the invitee it existed, and rescinding it left nothing to clean up on the hub because the hub had never heard of it.
+
+The task's done-when: **no state where an accepted invite leads to a locked door.**
+
+## Decision
+
+### D1 — The hub's `pending` row is a NOTICE of the project's own invite
+
+The row stays, and My Projects lists it as before, but only the project writes it now. Two new server-to-server routes, authenticated by `client_id` + `client_secret` like the membership check-in:
+
+| Route | When the project calls it | What the hub does |
+|---|---|---|
+| `POST /sso/invites/notify` | every outcome of its invite route that leaves the login holding an `invited` row: a fresh invite, a pending application approved in place, and a re-invite of one already standing | `INSERT … 'pending' ON CONFLICT DO NOTHING` for the account that login resolves to |
+| `POST /sso/invites/clear` | a dismissal after which the login holds no `invited` row | `DELETE` that `pending` row, and only a `pending` one |
+
+Both calls touch a `pending` row only, so client credentials still cannot create, change or remove a membership (ADR 0205). A login with no hub account is a no-op, because there is nobody on the hub to notify; the project's row still admits them. **The answer is always `{ ok: true }` once the client authenticates**, whether or not anything was written, so a project cannot use the route to learn which GitHub logins have platform accounts.
+
+The sender is core's `notifyHubOfInvite` (`src/bongos/auth-admission.js`). It sits in the kernel beside the other hub calls that hold the client secret, and modules reach it as a narrow doorway port. It is fire-and-forget, time-bounded and swallows every failure: an invite must never wait on the hub or fail because of it. Re-inviting is how a notice the hub missed is healed, since the hub's insert is idempotent.
+
+Only a dismissal that leaves no `invited` row clears the notice. If two archons invited the same login and one rescinds, the other invite still admits, so the notice stays. A declined application also sends a clear. That is a no-op unless the hub still holds a pre-ADR-0353 row for that login, which would be a dead end anyway.
+
+### D2 — Accepting is signing in to the project; the hub-side accept is retired
+
+`POST /my-projects/invites/:clientId/accept` is deleted, and `resolveInvite` becomes the decline-only `removePendingInvite`. The hub page has not called accept since the invitations list came back (task 1003774): each invitation renders as **Open project →** with "Sign in there to accept." What was missing was the server half, so no caller (an old cached page, a script) can still flip a row and admit nobody.
+
+Signing in closes the loop without any new code. The hub's own sign-in witness (`recordFederatedSignin`, stamped at `/sso/token` and `/sso/device/poll`) already turns a `pending` row into `member` when the invitee signs in to that project.
+
+### D3 — The hub's own invite writes nothing; it hands the owner to the project's hall
+
+`POST /projects/invite` keeps its owner-or-curator gate and its byte-identical 403, and it still resolves the catalog client. It no longer writes. It answers `200 { invited: false, invite_url }`: the project's hall invite box with the login filled in, `<origin>/builders/watch?invite=<login>`. A 200 rather than a refusal, because it is the answer every admitted caller gets, and a 4xx on that path would log a failed request in the owner's browser on every invite. Every instance already canonicalises `/builders/watch` to its hall (a one-host instance serves `/watch`, a two-host one redirects to `builders.<apex>/watch`, both keeping the query), so the hub needs no hall address of its own. The sign-in redirect carries the full URL, so the name survives signing in.
+
+The wizard and manage-page widget keep their field, their suggestions and their Skip button. Each name becomes a line reading "not sent yet — finish it on your project's hall" with a **Send the invite →** link. It is a link the owner clicks, never a window opened for them: an open triggered by a network answer is blocked by browsers, and a surprise navigation would lose the wizard.
+
+The hall's Watch page reads `?invite=` once, only if it is a valid GitHub username, and **only fills the box**. Sending stays the owner's click, because a link anyone can craft must never be the act that admits.
+
+The owner chose this over building the relay ADR 0335 foresaw (see Alternatives) in this task.
+
+### D4 — Wire skew (ADR 0352's rule)
+
+The two notice routes are **new**. An older hub answers 404, the sender swallows it, and the invite still admits: only the notice is lost. A newer hub with an older instance simply receives no notices. Each route's body is validated strictly (three fields), so a field added later must ride a header, or ship on the hub and be released before any instance sends it.
+
+## Consequences
+
+- **The done-when holds for every invite created from now on.** A hub notice exists only because the project wrote an `invited` row, and a rescind that closes the door removes the notice. The hub's own invite creates no row at all.
+- **Rows written before this change are untouched.** Pending rows the old hub invite wrote still render as **Open project →**, and on a door other than `open` they still lead to the project's gate. The invitee can decline them, and the project can clear one by inviting and then rescinding. Deleting them at deploy would need a data migration, and it would also delete notices that do work (on `open` doors). That is left to the owner (see the task's handoff), not done silently here.
+- **The hub's invite now reaches people with no platform account.** The project's own invite takes any GitHub login, so the old `account_not_found` refusal is gone. Such an invitee sees no hub notice, because there is no account to show it to, but they are admitted when they sign in.
+- **Three things still bypass the notice**, all by scope: the reviewer queue's approve (`PATCH` pending → invited), the Discord approval reaction, and R3's future recruiter rescind route. The first two are approvals of an application the applicant already knows about. R3 (task 1002815) must call the same port when it adds its rescind.
+- **The 30-day invite expiry** (task 1002969) is read-time on the instance. An expired invite's hub notice stays until the invitee declines it or the project re-invites and rescinds. Task 1002969 owns closing that.
+
+## Alternatives considered
+
+- **The signed-assertion relay (ADR 0335's foreseen design).** The hub mints a new `purpose: 'invite'` token for the inviter, and a new token-authenticated route on the project checks that builder's own permission and writes the real row. It keeps the in-place form, but it adds an authentication path to every instance (security-sensitive), roughly doubles this task, needs a fallback for every older instance, and cannot work until the owner has signed in to a new project once (there is no local builder to check the permission against). The owner deferred it. D3's hand-off leaves room for it: if it is built, the route's `invited: false` becomes `true` for instances that support it.
+- **Seed the hub row only when the project's door is `open`.** An owner who later closes the door strands every such notice in front of a locked door, and a self-hosted project's door is not known to the hub reliably.
+- **Keep the hub-side accept, but have the instance read hub memberships at sign-in.** This puts a hub call inside the admission gate and moves a verdict onto the hub, which ADR 0335 D1 forbids.
+- **A body field on the membership check-in instead of new routes.** The check-in body is validated strictly, so an older hub would 400 the whole check-in (ADR 0352), and a check-in is sent at sign-in, not at invite time.
+
+Proof: `tests/hub_invite_notices.mjs` (the hub routes over the real domain functions: pending-only writes keyed on the authenticated client, the identical answer for an unknown login, the credential refusals, the three-field body, the hand-off link, and the sender), `tests/access_requests_invite.mjs` and `tests/application_lifecycle.mjs` (which invite outcomes notify and which dismissals clear), `tests/project_invite_ownership.mjs` and `tests/catalog_only_client.mjs` (the gate is unchanged and nothing is written), `tests/project_invite_ui.mjs` (the hand-off line, no non-http link, no window opened), `tests/watch_applications_queue.mjs` (the prefill fills and never sends), `tests/my_projects_surface.mjs` and `modules/platform-identity/tests/platform-identity.mjs` (the accept route and flip are gone).

package/docs/adr/README.md

@@ -471,3 +471,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0350 | [**The hub holds a per-project WRITE deploy key, so a hosted project's upgraded pin always reaches its GitHub repo** ([task 1004291](https://cloudbongos.com/builders#/task/1004291), follow-up to task 1004065). Amends ADR 0176. The owner's token lasts one hour and the checkout's own key is read-only, so most hosted upgrades ended "GitHub was not updated". **D1:** a second deploy key per repo, registered `read_only: false` as `cloudbongos-pin-<slug>`, the pull key untouched. **D2:** kept outside every checkout in the runner's own directory (0700 dir, 0600 key, modes verified), unreadable by the project's account. **D3:** minted at standup and whenever a fresh owner token finds none, so reconnecting GitHub once is enough. **D4:** `pushUpgradePin` tries write key, then owner token, then origin, never forced. **D5:** revoked on teardown and disconnect. **D6:** a project on the shared app user is refused a key: "needs its own account first". **D7:** /deploy says reconnecting sets up lasting access.](0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md) | provisioning / security |
 | 0351 | [**A criterion closes on a UAT, not on its linked tasks shipping** ([task 1004392](https://cloudbongos.com/builders#/task/1004392), goal 1000089 — working area 3). Supersedes ADR 0183's close rule. `wa7-government` had closed on six Board Room navigation tasks while nothing it describes was on the live site. **D1:** three checks — Code (linked tasks done, ≥1 shipped; automatic), Live, UAT — and the sweep closes a criterion only with a CURRENT sign-off (no older than the newest linked ship). **D2 (owner):** "Awaiting UAT" is a visible state. **D3 (owner):** one step; the signer is refused if they shipped linked work, the project owner excepted. **D4 (owner):** an mp4/webm up to 100 MB on the project's own server. **D5 (owner):** backend-only is set while a criterion is open and takes a recording-free sign-off. **D6 (owner):** Live is read via the `deploy.taskWhere` port where the site can tell, attested otherwise. **D7 (owner):** already-closed criteria stay closed ("Closed before UAT"). **D8:** `/satisfy` is a recorded override that needs a reason. **D9:** `/goal-uat` + `scripts/gds/uat.js`; the hall is task 1004402.](0351-a-criterion-closes-on-a-uat.md) | lifecycle / criteria / review |
 | 0352 | [**A rollup report carries its "as of" in a header, and the hub keeps the newest** ([task 1004268](https://cloudbongos.com/builders#/task/1004268), goal 1000110). `POST /sso/activity/rollup` was last-writer-wins with no report timestamp, so a sign-in push read earlier and a ship push read later could land the older totals last. **D1:** the instance's read time rides a `Bongos-Report-As-Of` HEADER, not a body field, because the hub validates the body strictly and hub and instances upgrade independently: a body field from a newer instance would 400 on an older hub and lose the report, while an unknown header is ignored. **D2:** missing or unparseable = unstamped = last-writer-wins, never a 400. **D3:** the guard is a WHERE on the upsert's conflict branch (migration 026, `reported_as_of`, no backfill); a skipped update keeps the row lock, so the task 1004244 snapshot stays in step. **D4:** the stamp is compared only with the same client's, and clamped to the hub's `now()`.](0352-a-rollup-report-carries-its-as-of-in-a-header.md) | platform identity / federation |
+| 0353 | [**A hub invite is a notice of the project's own invite, and signing in accepts it** ([task 1002818](https://cloudbongos.com/builders#/task/1002818), goal 1000110 — R6 of the admin console wave). The hub's own invite wrote a `pending` membership that no project reads, so an "accepted" invite met a locked door (new projects default to `apply`). **D1:** that row is now a NOTICE the PROJECT writes: its invite route calls `POST /sso/invites/notify` and a dismissal that leaves no invited row calls `/sso/invites/clear` (client credentials, pending rows only, always `{ ok: true }` so no account oracle); core's `notifyHubOfInvite` is fire-and-forget. **D2:** the hub-side accept route is deleted; signing in to the project accepts, and the hub's own sign-in witness turns the row into a membership. **D3 (owner):** `POST /projects/invite` writes nothing and answers `{ invited: false, invite_url }`, the project's hall invite link (`/builders/watch?invite=<login>`, which only pre-fills); the signed-assertion relay is deferred. **D4:** new routes, so an older hub 404s and only the notice is lost (ADR 0352).](0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md) | platform identity / federation |