@bongos/core 1.20.21 → 1.20.23

package/migrations/core_265_module_assessments.sql

@@ -0,0 +1,97 @@
+-- core_265_module_assessments.sql — what the module assessment produces: each
+-- part's result, the composed overall score, and the history of both.
+--
+-- task 1003814 (goal 1000091, working area 5). ADR 0343 settled the score: a
+-- Security gate, then the plain average of the other parts that have data;
+-- ADR 0347 D5 adds a Docs part that is shown but never averaged in. These two
+-- tables are the storage only — the signals that fill them (tasks 1003791-3,
+-- 1003806, 1004367), the composition (1003794) and the Metic+ override route
+-- (1003796) are their own tasks and write here.
+--
+-- Everything is scoped per module VERSION (store_module_versions.id), not per
+-- module: a new version is a new thing to judge, which is what lets assessment
+-- re-run on publish.
+--
+--   module_assessment_signals  one row per measurement of one part of one
+--                          version. APPEND-ONLY: a re-run adds a row, never
+--                          UPDATEs one, so a part's score can be seen to move.
+--                          The CURRENT result of a part is the newest row per
+--                          (version, part). `outcome` keeps "no data yet"
+--                          distinct from a low score (ADR 0343 D3/D5 — a missing
+--                          part is never a zero):
+--                            scored      a 0-100 score (Tests, Install,
+--                                        Reliability, Tester feedback, Docs)
+--                            passed /    the Security gate (D2) — pass/fail,
+--                            failed      never a number, never averaged
+--                            no_data     nothing to measure yet (no installs, no
+--                                        testers, a module that declares no tests
+--                                        — task 1003791 says that is not a fail)
+--                            pending     measurement under way ("Docs: pending")
+--                            not_scored  the measurement could not run
+--                          `sample_size` is how many installs / testers / test
+--                          cases the number rests on, so two friendly testers
+--                          cannot outweigh two hundred real ones (task 1003806).
+--   module_assessment_scores  one row per composition of a version's overall
+--                          score. APPEND-ONLY history; the CURRENT score is the
+--                          newest row per version. `overall` is NULL when no
+--                          averaged part has data. `security_passed` NULL means
+--                          the gate has not run. `is_new` is ADR 0343 D5's label
+--                          (no Install or Reliability data yet). `signal_ids`
+--                          names the exact signal rows the number was composed
+--                          from, so "why did I score 71?" is answerable from the
+--                          row. `kind = 'override'` is a Metic+ correction
+--                          (ADR 0343 D6, task 1003796): it must say who and why,
+--                          and it is a new row on top of the computed history,
+--                          never an edit of it.
+--
+-- Nothing here reads price: free and paid are assessed identically (D6).
+-- Additive only (new tables), so forward-safe. Idempotent: safe to re-run.
+
+CREATE TABLE IF NOT EXISTS module_assessment_signals (
+  id              bigserial PRIMARY KEY,
+  version_id      bigint NOT NULL REFERENCES store_module_versions(id),
+  part            text NOT NULL
+                    CHECK (part IN ('security', 'tests', 'install', 'reliability',
+                                    'tester_feedback', 'docs')),
+  outcome         text NOT NULL
+                    CHECK (outcome IN ('scored', 'passed', 'failed', 'no_data',
+                                       'pending', 'not_scored')),
+  score           smallint CHECK (score BETWEEN 0 AND 100),
+  sample_size     integer CHECK (sample_size >= 0),
+  reason          text,
+  detail          jsonb NOT NULL DEFAULT '{}'::jsonb,
+  measured_at     timestamptz NOT NULL DEFAULT now(),
+  -- a number exactly when the outcome is 'scored'
+  CHECK ((outcome = 'scored') = (score IS NOT NULL)),
+  -- Security is a gate (ADR 0343 D2): pass/fail only; no other part passes or fails
+  CHECK ((part = 'security') = (outcome IN ('passed', 'failed'))
+         OR outcome IN ('no_data', 'pending', 'not_scored'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_module_assessment_signals_current
+  ON module_assessment_signals (version_id, part, measured_at DESC, id DESC);
+
+CREATE TABLE IF NOT EXISTS module_assessment_scores (
+  id               bigserial PRIMARY KEY,
+  version_id       bigint NOT NULL REFERENCES store_module_versions(id),
+  kind             text NOT NULL DEFAULT 'computed'
+                     CHECK (kind IN ('computed', 'override')),
+  overall          smallint CHECK (overall BETWEEN 0 AND 100),
+  security_passed  boolean,
+  is_new           boolean NOT NULL,
+  formula          text NOT NULL,
+  signal_ids       bigint[] NOT NULL DEFAULT '{}',
+  override_by      bigint REFERENCES builders(id),
+  override_reason  text,
+  computed_at      timestamptz NOT NULL DEFAULT now(),
+  -- an override names who made it and why; a computed row names neither
+  CHECK ((kind = 'override') = (override_by IS NOT NULL)),
+  CHECK ((kind = 'computed' AND override_reason IS NULL)
+         OR (kind = 'override' AND length(btrim(coalesce(override_reason, ''))) > 0))
+);
+
+CREATE INDEX IF NOT EXISTS idx_module_assessment_scores_current
+  ON module_assessment_scores (version_id, computed_at DESC, id DESC);
+
+INSERT INTO schema_migrations (version) VALUES ('core_265_module_assessments')
+  ON CONFLICT (version) DO NOTHING;

package/modules/hall-ui/public/watch.js

@@ -301,9 +301,32 @@
     );
   }
 
+  // The name another page asked this box to hold: the platform hub's invite widget
+  // links here as /watch?invite=<login> (task 1002818, ADR 0353), because only this
+  // project's own invite lets anyone in. It FILLS the box and nothing more — sending
+  // stays the owner's own click, since a link anyone can craft must never be the act
+  // that admits. Read once and spent on first use, so the re-render after an invite
+  // does not put the name back; anything that is not a GitHub username is ignored.
+  let invitePrefill = (() => {
+    try {
+      const raw = new URLSearchParams(window.location.search).get('invite') || '';
+      const login = raw.trim().replace(/^@/, '');
+      return /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(login) ? login : '';
+    } catch { return ''; }
+  })();
+
   function wireInviteForm(target) {
     const form = target.querySelector('#gate-invite');
     if (!form) return;
+    if (invitePrefill) {
+      const box = form.querySelector('#gate-invite-login');
+      if (box) {
+        box.value = invitePrefill;
+        if (box.focus) box.focus();
+        if (form.scrollIntoView) form.scrollIntoView({ block: 'center' });
+      }
+      invitePrefill = '';
+    }
     form.addEventListener('submit', async (e) => {
       e.preventDefault();
       const input = form.querySelector('#gate-invite-login');

package/modules/onboarding/routes/access-requests.js

@@ -154,6 +154,34 @@ async function attachApplicantProfiles(rows) {
   })));
 }
 
+// THE HUB'S NOTICE OF THIS PROJECT'S INVITES (task 1002818, ADR 0353). On a hosted
+// project the hub lists an invite in the invitee's My Projects so they learn of it;
+// the row HERE is still the only thing that admits, and signing in is what accepts.
+// The notice goes out after the row is written and is never awaited: it rides a
+// doorway port that swallows every failure, so the hub can neither slow nor fail an
+// invite. No hub (self-hosted), or an older one without the route, costs the notice
+// alone.
+const STANDING_INVITE_SQL = `SELECT 1 FROM access_requests
+          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`;
+
+function noticeHubInvited(login) {
+  api.notifyHubOfInvite(login, { invited: true });
+}
+
+// After a dismissal: once the login holds no invited row (a rescind, or the last of two
+// racing invites), the hub's notice would point at a door that no longer opens, so it
+// is dropped. Awaited only so its read is ordered; a failed read drops nothing and fails
+// nothing — the dismissal is already committed, and a stale notice still leads only to
+// this project's own gate.
+async function clearHubNoticeIfUninvited(login) {
+  try {
+    const standing = await pool.query(STANDING_INVITE_SQL, [login]);
+    if (standing.rows.length === 0) api.notifyHubOfInvite(login, { invited: false });
+  } catch (err) {
+    log.warn({ err: err && err.message }, '[gds] hub invite notice check failed (non-blocking)');
+  }
+}
+
 module.exports = function buildAccessRequestsRouter() {
   const router = express.Router();
 
@@ -421,6 +449,7 @@ module.exports = function buildAccessRequestsRouter() {
         [next, req.builder.id, id]
       );
       if (rows.length > 0) {
+        if (next === 'dismissed') await clearHubNoticeIfUninvited(rows[0].github_login);
         return res.json({ ok: true, request: rows[0] });
       }
       const current = await pool.query(
@@ -470,7 +499,8 @@ module.exports = function buildAccessRequestsRouter() {
   // A fresh row is marked kind='invite' with created_by = the sender (a rescind
   // overwrites resolved_by) and the optional note as the inviter's words. A pending
   // request resolved in place stays an application with its applicant's own note
-  // (ADR 0335 D2.1–D2.3; task 1002814).
+  // (ADR 0335 D2.1–D2.3; task 1002814). Every outcome that leaves the login invited
+  // also notifies the hub, so the invitee sees it in My Projects (ADR 0353).
   // body: { github_login, note? }. 201 with a new row; 200 with the row when a
   // pending request was resolved; 200 already_invited when an invite already
   // stands; 409 already_member when they have an account.
@@ -493,12 +523,10 @@ module.exports = function buildAccessRequestsRouter() {
       if (member.rows.length > 0) {
         return res.fail('already_member', { status: 409, message: 'They already have an account here — no invite needed.' });
       }
-      const standing = await pool.query(
-        `SELECT 1 FROM access_requests
-          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`,
-        [login]
-      );
+      const standing = await pool.query(STANDING_INVITE_SQL, [login]);
       if (standing.rows.length > 0) {
+        // Re-sent on purpose: inviting again is how a notice the hub missed is healed.
+        noticeHubInvited(login);
         return res.json({ ok: true, already_invited: true, github_login: login });
       }
       const resolved = await pool.query(
@@ -511,6 +539,7 @@ module.exports = function buildAccessRequestsRouter() {
         [req.builder.id, login]
       );
       if (resolved.rows.length > 0) {
+        noticeHubInvited(login);
         return res.json({ ok: true, request: resolved.rows[0] });
       }
       const { rows } = await pool.query(
@@ -519,6 +548,7 @@ module.exports = function buildAccessRequestsRouter() {
          RETURNING id, github_login, status, kind, resolved_at`,
         [login, note, req.builder.id]
       );
+      noticeHubInvited(login);
       return res.status(201).json({ ok: true, request: rows[0] });
     } catch (err) {
       log.error('[gds] POST /access-requests/invite', err);

package/modules/platform-identity/invite-notices.js

@@ -0,0 +1,61 @@
+// modules/platform-identity/invite-notices.js — the hub's copy of a project's OWN invite,
+// kept as a NOTICE and never as a way in (task 1002818, R6 of goal 1000110; ADR 0353).
+//
+// A project admits people on its own instance: an invite is an `access_requests` row
+// there, and signing in to the project is what accepts it (ADR 0335 D1/D2). The hub
+// holds no verdict. What it adds is reach — the invitee sees the invitation in My
+// Projects without having to know the project exists. So:
+//
+//   noteProjectInvite  — the project invited this login: seed the hub's `pending`
+//                        membership row, which My Projects lists with an "Open
+//                        project" link. Called by POST /sso/invites/notify.
+//   clearProjectInvite — the project rescinded it: drop that `pending` row, so a
+//                        rescinded invite stops pointing at a door that will not
+//                        open. Called by POST /sso/invites/clear.
+//   hallInviteUrl      — where an invite that CAN let someone in is sent from: the
+//                        project's own hall. POST /projects/invite answers with it
+//                        instead of writing a hub row that admits nobody.
+//
+// Both writers touch ONLY a `pending` row, so a notice can never create, downgrade or
+// remove a real membership (a member is left as-is; the row is not theirs to change).
+// A login with no hub account is a no-op: there is nobody on the hub to notify, and
+// the project's own row still admits them when they sign in there.
+//
+// Its own file because platform-identity.js is at the size ratchet; it reuses that
+// file's account lookup and pending-row writers rather than restating them.
+'use strict';
+
+const pi = require('./platform-identity');
+
+// The project noticed an invite for `githubLogin` → a `pending` hub row, if the login
+// has a hub account and no membership in this project yet. Returns { noted } for the
+// route's own logging; the route never tells the caller which case happened (see it).
+async function noteProjectInvite({ clientId, githubLogin }, { pool } = {}) {
+  const account = await pi.getAccountByLogin(githubLogin, { pool });
+  if (!account) return { noted: false };
+  const out = await pi.inviteToProject({ clientId, githubId: account.github_id }, { pool });
+  return { noted: !!out.invited };
+}
+
+// The project rescinded the invite for `githubLogin` → drop the `pending` hub row.
+async function clearProjectInvite({ clientId, githubLogin }, { pool } = {}) {
+  const account = await pi.getAccountByLogin(githubLogin, { pool });
+  if (!account) return { cleared: false };
+  const out = await pi.removePendingInvite({ clientId, githubId: account.github_id }, { pool });
+  return { cleared: out.removed };
+}
+
+// The project's own invite box for `githubLogin`: its hall's watch page, with the login
+// pre-filled. Built on /builders/watch because every instance canonicalises that path to
+// its hall — a one-host instance serves /watch, a two-host one redirects to
+// builders.<apex>/watch, both keeping the query — so the hub needs no hall address of
+// its own. An origin that is not http(s) yields null: this value becomes an <a href>.
+function hallInviteUrl(origin, githubLogin) {
+  let u;
+  try { u = new URL(String(origin || '')); } catch { return null; }
+  if (u.protocol !== 'https:' && u.protocol !== 'http:') return null;
+  const login = String(githubLogin || '').trim().replace(/^@/, '');
+  return `${u.origin}/builders/watch${login ? `?invite=${encodeURIComponent(login)}` : ''}`;
+}
+
+module.exports = { noteProjectInvite, clearProjectInvite, hallInviteUrl };

package/modules/platform-identity/module.json

@@ -11,7 +11,7 @@
   "maintainer": "Cloud Bongos maintainers",
   "maintenance": { "status": "core-maintained" },
   "contributes": {
-    "routes": ["sso", "projects", "my-projects", "scouting", "profile", "public-profile", "connections", "community-search", "community-leaderboard", "guilds", "guilds-public"],
+    "routes": ["sso", "sso-invites", "projects", "my-projects", "scouting", "profile", "public-profile", "connections", "community-search", "community-leaderboard", "guilds", "guilds-public"],
     "migrations": true,
     "pollers": ["code-sweep", "visibility-pull", "guild-totals"]
   },

package/modules/platform-identity/platform-identity.js

@@ -527,8 +527,9 @@ async function listMembershipsForAccount(githubId, { pool = defaultPool } = {})
 // Invitations (ADR 0141 §5, task #1002115) — pre-seed a 'pending' membership
 // -------------------------------------------------------------------------
 
-// Invite a builder into a project they don't yet build on: pre-seed a 'pending'
-// membership. Does NOT clobber an existing membership (ON CONFLICT DO NOTHING) — a
+// Record that a project invited a builder: pre-seed a 'pending' membership, which is
+// a NOTICE shown in My Projects — the project's own row is what admits (ADR 0353;
+// written only from invite-notices.js now). Does NOT clobber an existing membership (ON CONFLICT DO NOTHING) — a
 // current member is left as-is. Returns { invited:true, row } when a pending row was
 // created, or { invited:false, alreadyMember:true } when a membership already existed.
 async function inviteToProject({ clientId, githubId }, { pool = defaultPool } = {}) {
@@ -557,26 +558,19 @@ async function listPendingInvitesForAccount(githubId, { pool = defaultPool } = {
   return rows;
 }
 
-// Resolve a pending invite for (client, builder): accept → flip to 'member' (the
-// membership becomes real; the builder then signs into the project, whose own gate
-// still applies + whose check-in keeps it fresh); decline → delete the pending row.
-// Only ever touches a 'pending' row, so it can't downgrade or remove a real member.
-async function resolveInvite({ clientId, githubId, accept }, { pool = defaultPool } = {}) {
-  if (accept) {
-    const { rows } = await pool.query(
-      `UPDATE platform_identity_project_memberships SET membership_kind = 'member', last_active = now()
-        WHERE client_id = $1 AND github_id = $2 AND membership_kind = 'pending'
-        RETURNING id`,
-      [clientId, githubId],
-    );
-    return { resolved: rows.length > 0, accepted: true };
-  }
+// Drop the pending invite for (client, builder): the invitee declined it, or the
+// project rescinded it (invite-notices.js). There is no hub-side ACCEPT any more
+// (task 1002818, ADR 0353): the hub holds no verdict, so flipping this row to
+// 'member' admitted nobody. Signing in to the project accepts, and the hub's own
+// sign-in witness (recordFederatedSignin) turns the row into a membership then.
+// Only ever touches a 'pending' row, so it can't remove a real member.
+async function removePendingInvite({ clientId, githubId }, { pool = defaultPool } = {}) {
   const { rowCount } = await pool.query(
     `DELETE FROM platform_identity_project_memberships
       WHERE client_id = $1 AND github_id = $2 AND membership_kind = 'pending'`,
     [clientId, githubId],
   );
-  return { resolved: rowCount > 0, accepted: false };
+  return { removed: rowCount > 0 };
 }
 
 // Self-service LEAVE (ADR 0141 §3): remove a builder's membership in a project. The
@@ -1453,7 +1447,7 @@ module.exports = {
   // invitations
   inviteToProject,
   listPendingInvitesForAccount,
-  resolveInvite,
+  removePendingInvite,
   // cross-project activity + scouting + profile rollup
   upsertActivity,
   listScoutingRollup,

package/modules/platform-identity/routes/my-projects.js

@@ -289,27 +289,18 @@ module.exports = function myProjectsRoutes() {
     }
   });
 
-  // rank: any-builder — accept an invite (pending → builder) for the caller's OWN account.
-  router.post('/my-projects/invites/:clientId/accept', requireBuilder, async (req, res) => {
-    const clientId = String(req.params.clientId || '');
-    if (!clientId) return res.fail('bad_client_id', 400);
-    try {
-      const out = await pi.resolveInvite({ clientId, githubId: req.builder.github_id, accept: true }, { pool });
-      if (!out.resolved) return res.fail('no_pending_invite', 404);
-      res.json({ ok: true, accepted: true });
-    } catch (err) {
-      console.error('[platform-identity] accept invite', err);
-      res.fail('accept_failed', { status: 500, message: 'internal error' });
-    }
-  });
+  // There is deliberately no ACCEPT route (task 1002818, ADR 0353). An invitation here
+  // is a notice of the project's own invite; signing in to the project accepts it, and
+  // that sign-in turns this row into a membership. The old accept flipped the row to
+  // 'member' and admitted nobody, so an accepted invite could still meet a locked door.
 
   // rank: any-builder — decline an invite (delete the pending row) for the caller's OWN account.
   router.post('/my-projects/invites/:clientId/decline', requireBuilder, async (req, res) => {
     const clientId = String(req.params.clientId || '');
     if (!clientId) return res.fail('bad_client_id', 400);
     try {
-      const out = await pi.resolveInvite({ clientId, githubId: req.builder.github_id, accept: false }, { pool });
-      if (!out.resolved) return res.fail('no_pending_invite', 404);
+      const out = await pi.removePendingInvite({ clientId, githubId: req.builder.github_id }, { pool });
+      if (!out.removed) return res.fail('no_pending_invite', 404);
       res.json({ ok: true, accepted: false });
     } catch (err) {
       console.error('[platform-identity] decline invite', err);

package/modules/platform-identity/routes/projects.js

@@ -15,7 +15,8 @@
 //                                join door, and the DERIVED publish verdict — ADR 0182)
 //   POST  /projects            — Archon: create / update a catalog entry
 //   POST  /projects/invite     — a `project.curate` holder OR the project's OWN owner:
-//                                pre-seed a 'pending' membership (invite-authz.js)
+//                                where to invite — the project's hall (invite-authz.js,
+//                                invite-notices.js); writes nothing (ADR 0353)
 //   PATCH /projects/:id/featured — Archon: the feature / unfeature control
 //   PATCH /projects/:id/status   — `project.curate`: the TAKEDOWN lever (R08, ADR 0252
 //                                §5.1). Setting 'hidden' pins the row so the ADR 0246
@@ -31,6 +32,7 @@ const pi = require('../platform-identity');
 const projectCatalog = require('../project-catalog');
 const projectStats = require('../project-stats');
 const inviteAuthz = require('../invite-authz');
+const inviteNotices = require('../invite-notices');
 
 const { pool, requireBuilder, requirePermission, validateOrRespond, parseId, corsPublicGet,
   parsePagination, pageMeta } = api;
@@ -119,16 +121,22 @@ module.exports = function projectsRoutes() {
   // route from its real gate. A helper-hidden gate would record a privileged route
   // as any-builder — wrong in the dangerous direction (the ADR 0210 rule).
 
-  // rank: metic+archon — own-or-metic in effect: invite a builder into a project
-  // (ADR 0141 §5, task 1002115), called by a `project.curate` holder OR the project's OWN
-  // OWNER (task 1003580; the ownership proof is `provisioning_instances.owner_builder_id`,
-  // reached through a port — see invite-authz.js). The wizard's audience is any signed-in
-  // GitHub user, typically a xenos who used to get 403 on their own project. A caller who is
-  // neither gets the unchanged permission refusal, identical whether or not the project
-  // exists. Pre-seeds a 'pending' membership the invitee accepts from My Projects. V1 invites
-  // by github_login and requires the invitee to already have a platform account (they build
-  // on some project); inviting someone entirely new to the platform (GitHub-id resolution) is
-  // a follow-up.
+  // rank: metic+archon — own-or-metic in effect: where to invite a builder into a project,
+  // asked by a `project.curate` holder OR the project's OWN OWNER (task 1003580; the
+  // ownership proof is `provisioning_instances.owner_builder_id`, reached through a port —
+  // see invite-authz.js). The wizard's audience is any signed-in GitHub user, typically a
+  // xenos who used to get 403 on their own project. A caller who is neither gets the
+  // unchanged permission refusal, identical whether or not the project exists.
+  //
+  // IT WRITES NOTHING (task 1002818, ADR 0353). It used to pre-seed a 'pending' hub
+  // membership, but the hub holds no verdict: that row let nobody in, and on any door but
+  // `open` (new projects default to `apply`) the invitee who signed in met a locked door.
+  // Only the project's own invite admits (ADR 0335 D1/D2), so the answer is 200
+  // `{ invited: false, invite_url }` — the project's hall invite box with the login pre-filled.
+  // A 200, not a refusal: it is the answer every admitted caller gets, and a 4xx on the normal
+  // path would log a failed request in the owner's browser on every invite. Sending it there
+  // also reaches this hub: the project notifies it (POST /sso/invites/notify), and the invitee
+  // sees it in My Projects.
   router.post(
     '/projects/invite',
     requireBuilder,
@@ -150,10 +158,9 @@ module.exports = function projectsRoutes() {
         // It is only ever absent when the gate found nothing, so the fallback still reads.
         const client = req.inviteTargetClient || await pi.getClient(req.body.client_id, { pool });
         if (!client || client.status !== 'active') return res.fail('unknown_project', 404);
-        const account = await pi.getAccountByLogin(req.body.github_login, { pool });
-        if (!account) return res.fail('account_not_found', { status: 404, message: 'That builder has no platform account yet — they must sign in somewhere once before they can be invited.' });
-        const out = await pi.inviteToProject({ clientId: req.body.client_id, githubId: account.github_id }, { pool });
-        res.status(out.invited ? 201 : 200).json(out);
+        const inviteUrl = inviteNotices.hallInviteUrl(client.origin, req.body.github_login);
+        if (!inviteUrl) return res.fail('unknown_project', 404);
+        return res.json({ invited: false, invite_url: inviteUrl });
       } catch (err) {
         console.error('[platform-identity] POST /projects/invite', err);
         res.fail('invite_failed', { status: 500, message: 'internal error' });

package/modules/platform-identity/routes/sso-invites.js

@@ -0,0 +1,82 @@
+// modules/platform-identity/routes/sso-invites.js — a project tells the hub about its OWN
+// invites, so the invitee sees them in My Projects (task 1002818, R6 of goal 1000110;
+// ADR 0353). Server-to-server, authenticated by client_id + client_secret like the
+// membership check-in; the sender is core's notifyHubOfInvite (src/bongos/auth-admission.js).
+//
+//   POST /sso/invites/notify — the project invited this GitHub login → a `pending` hub row
+//   POST /sso/invites/clear  — the project rescinded it → that `pending` row is dropped
+//
+// The row is a NOTICE, not a way in: the project's own `access_requests` row admits, and
+// the invitee accepts by signing in to the project, which the hub's own sign-in witness
+// turns into a membership (recordFederatedSignin). Both calls touch a `pending` row only
+// (invite-notices.js), so client credentials still cannot create or change a membership —
+// the ADR 0205 line.
+//
+// THE ANSWER IS ALWAYS { ok: true } once the client authenticates, whether or not the
+// login has a hub account or a row changed. The sender never reads it, and a project must
+// not be able to use this route to learn which GitHub logins have platform accounts.
+//
+// WIRE SKEW (ADR 0352): these routes are NEW, so an older hub answers 404 and the sender
+// swallows it — the invite still admits on the project, only the notice is lost. The body
+// is validated strictly, so a field added later must ride a header, or ship on the hub and
+// be released before any instance sends it.
+//
+// Its own file rather than more of routes/sso.js, which carries the sign-in legs.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pi = require('../platform-identity');
+const inviteNotices = require('../invite-notices');
+
+const log = api.logger('platform-identity');
+const { pool, validateOrRespond } = api;
+
+// After each route's own schema (spelled inline, so the API docs read it): authenticate
+// the project, then apply the notice to ITS OWN client_id — never a project named in the
+// body — and answer the same way whether or not anything was written.
+function applyNotice(apply, label) {
+  return async (req, res) => {
+    const { client_id, client_secret, github_login } = req.body;
+    try {
+      const client = await pi.getClient(client_id, { pool });
+      if (!client || client.status !== 'active' || !pi.clientSecretValid(client, client_secret)) {
+        return res.fail('invalid_client', 401);
+      }
+      await apply({ clientId: client.client_id, githubLogin: github_login }, { pool });
+      res.json({ ok: true });
+    } catch (err) {
+      log.error(`[platform-identity] ${label}`, err);
+      res.fail('invite_notice_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+module.exports = function ssoInviteRoutes() {
+  const router = express.Router();
+
+  const notify = applyNotice(inviteNotices.noteProjectInvite, '/sso/invites/notify');
+  const clear = applyNotice(inviteNotices.clearProjectInvite, '/sso/invites/clear');
+
+  // rank: public — authenticated by client_id + client_secret, not a builder rank.
+  router.post('/sso/invites/notify', (req, res) => {
+    if (validateOrRespond(req, res, {
+      client_id: { required: true, type: 'string', maxLength: 200 },
+      client_secret: { required: true, type: 'string', maxLength: 512 },
+      github_login: { required: true, type: 'string', minLength: 1, maxLength: 200 },
+    })) return undefined;
+    return notify(req, res);
+  });
+
+  // rank: public — authenticated by client_id + client_secret, not a builder rank.
+  router.post('/sso/invites/clear', (req, res) => {
+    if (validateOrRespond(req, res, {
+      client_id: { required: true, type: 'string', maxLength: 200 },
+      client_secret: { required: true, type: 'string', maxLength: 512 },
+      github_login: { required: true, type: 'string', minLength: 1, maxLength: 200 },
+    })) return undefined;
+    return clear(req, res);
+  });
+
+  return router;
+};

package/modules/platform-identity/tests/platform-identity.mjs

@@ -529,7 +529,7 @@ await ta('listMembershipsForAccount joins projects + excludes pending', async ()
   assert.deepEqual(c.params, [42]);
 });
 
-console.log('\ninvitations (§5 — pre-seed pending membership):');
+console.log('\ninvitations (§5 — a pending row is a NOTICE of the project\'s own invite, ADR 0353):');
 
 await ta('inviteToProject pre-seeds a pending row, never clobbering an existing member', async () => {
   const pool = mockPool([{ rows: [{ id: '1', membership_kind: 'pending' }] }]);
@@ -547,20 +547,23 @@ await ta('inviteToProject reports already-member when the row exists (DO NOTHING
   assert.deepEqual(out, { invited: false, alreadyMember: true });
 });
 
-await ta('resolveInvite accept flips ONLY a pending row to builder', async () => {
-  const pool = mockPool([{ rows: [{ id: '1' }] }]);
-  const out = await P.resolveInvite({ clientId: 'c1', githubId: 42, accept: true }, { pool });
-  assert.deepEqual(out, { resolved: true, accepted: true });
-  const c = pool.calls[0];
-  assert.match(c.text, /UPDATE platform_identity_project_memberships SET membership_kind = 'member'/);
-  assert.match(c.text, /AND membership_kind = 'pending'/, 'only touches pending — never a real member');
+await ta('there is no hub-side accept any more — signing in to the project accepts (ADR 0353)', async () => {
+  assert.equal(P.resolveInvite, undefined, 'the accept flip admitted nobody and is gone');
+  assert.equal(typeof P.removePendingInvite, 'function');
 });
 
-await ta('resolveInvite decline deletes ONLY a pending row', async () => {
+await ta('removePendingInvite deletes ONLY a pending row (decline, or the project rescinding)', async () => {
   const pool = mockPool([{ rowCount: 1 }]);
-  const out = await P.resolveInvite({ clientId: 'c1', githubId: 42, accept: false }, { pool });
-  assert.deepEqual(out, { resolved: true, accepted: false });
+  const out = await P.removePendingInvite({ clientId: 'c1', githubId: 42 }, { pool });
+  assert.deepEqual(out, { removed: true });
   assert.match(pool.calls[0].text, /DELETE FROM platform_identity_project_memberships[\s\S]*AND membership_kind = 'pending'/);
+  assert.deepEqual(pool.calls[0].params, ['c1', 42]);
+});
+
+await ta('removePendingInvite reports nothing removed when there was no pending row', async () => {
+  const pool = mockPool([{ rowCount: 0 }]);
+  const out = await P.removePendingInvite({ clientId: 'c1', githubId: 42 }, { pool });
+  assert.deepEqual(out, { removed: false });
 });
 
 await ta('getAccountByLogin resolves case-insensitively, newest first', async () => {

package/modules/public-landing/public/assets/cosmos.css

@@ -431,6 +431,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .inviteList>li::before{content:"";grid-column:1;grid-row:1;width:7px;height:7px;margin-top:7px;border-radius:50%;border:1px solid var(--accent);background:var(--bg);}
 .inviteList b{grid-column:2;font-family:var(--font-body);font-weight:500;font-size:15px;color:var(--ink);}
 .inviteList small{grid-column:2;font-family:var(--font-body);font-size:13px;font-weight:400;line-height:1.45;color:var(--ink-faint);}
+.inviteList a{grid-column:2;justify-self:start;margin-top:6px;}
 /* who is worth inviting (task 1002347, BV1.R28) — the recommendation's own
    sentence, in the .modWhy voice: the panel explaining itself, never a thing to
    act on, so it never competes with the names under it. */
@@ -1386,6 +1387,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-mine .addr a,#view-manage .ledger a{font-family:var(--font-mono);font-size:12.5px;color:var(--ink-soft);}
 #view-mine .addr a:hover,#view-manage .ledger a:hover{color:var(--ink);text-decoration:underline;}
 #view-mine .projMsg a,#view-manage .mSec a{color:var(--ink);text-decoration:underline;}
+/* a BUTTON that is a link inside a manage section (the invite hand-off, task 1002818) keeps
+   the button's box: the rule above would make it an underlined inline-block with its label
+   stuck to the top of the pill */
+#view-manage .mSec a.btn{display:inline-flex;text-decoration:none;}
 
 /* ── the lifecycle rail (DESIGN.md): stripMarkup's markup, drawn as three
    hairlines with a 7px dot and one lit step — no plate, no connector, no