@bongos/core 1.20.27 → 1.20.29

package/modules/onboarding/routes/access-requests.js

@@ -61,6 +61,9 @@ const api = require('../../../src/module-api');
 const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requirePermission };
 const { pool } = api;
 const { validateOrRespond, parseId, accountExistenceReadRateLimit } = api;
+// A recruit invite's door closes 30 days after it is sent, computed at read time
+// (task 1002969, ADR 0356): one definition, shared with the sign-in gate itself.
+const { inviteLiveSql, inviteExpiredSql, inviteExpiresAtSql } = api.inviteExpiry;
 const approvalBroadcast = require('../approval-broadcast');
 const log = api.logger('onboarding');
 
@@ -161,8 +164,10 @@ async function attachApplicantProfiles(rows) {
 // doorway port that swallows every failure, so the hub can neither slow nor fail an
 // invite. No hub (self-hosted), or an older one without the route, costs the notice
 // alone.
+// "Standing" means the door still opens, so an expired invite neither blocks a
+// re-invite nor keeps the hub's notice alive.
 const STANDING_INVITE_SQL = `SELECT 1 FROM access_requests
-          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`;
+          WHERE lower(github_login) = lower($1) AND status = 'invited' AND ${inviteLiveSql()} LIMIT 1`;
 
 function noticeHubInvited(login) {
   api.notifyHubOfInvite(login, { invited: true });
@@ -223,11 +228,8 @@ module.exports = function buildAccessRequestsRouter() {
         return res.fail('already_member', { status: 409, message: 'You already have an account — just sign in with GitHub.' });
       }
       // Already approved (invited) but not yet signed in? No new request needed.
-      const invited = await pool.query(
-        `SELECT 1 FROM access_requests
-          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`,
-        [login]
-      );
+      // An expired invite is not an approval any more, so its invitee may ask.
+      const invited = await pool.query(STANDING_INVITE_SQL, [login]);
       if (invited.rows.length > 0) {
         return res.fail('already_approved', { status: 409, message: "You're already approved — sign in with GitHub to enter." });
       }
@@ -267,7 +269,9 @@ module.exports = function buildAccessRequestsRouter() {
   // (the device_code is spent), so the CLI can't re-poll the flow — it polls this
   // instead, then restarts sign-in once admitted. Exposes nothing the public POST
   // above doesn't already reveal through its 409s (already_member / already_approved).
-  // status ∈ member | invited | pending | dismissed | none; admitted = member||invited.
+  // status ∈ member | invited | expired | pending | dismissed | none; admitted =
+  // member||invited. `expired` is an invite past its 30 days (task 1002969): the door
+  // is shut, and the CLI stops waiting rather than polling a door that will not open.
   // rank: public — a would-be builder is by definition outside the system.
   // Declared BEFORE `GET /access-requests` so the literal `/status` path is matched
   // as its own route (not swallowed as a query on the list route).
@@ -294,15 +298,17 @@ module.exports = function buildAccessRequestsRouter() {
       if (member.rows.length > 0) {
         return res.json({ github_login: login, status: 'member', admitted: true });
       }
-      // Prefer an 'invited' row if one exists, else the most recent request.
+      // Prefer an invite that still admits, else the most recent request.
       const ar = await pool.query(
-        `SELECT status FROM access_requests
+        `SELECT status, (status = 'invited' AND ${inviteExpiredSql()}) AS expired
+           FROM access_requests
           WHERE lower(github_login) = lower($1)
-          ORDER BY (status = 'invited') DESC, created_at DESC
+          ORDER BY (status = 'invited' AND ${inviteLiveSql()}) DESC, created_at DESC
           LIMIT 1`,
         [login]
       );
-      const status = ar.rows.length > 0 ? ar.rows[0].status : 'none';
+      const top = ar.rows[0];
+      const status = !top ? 'none' : top.expired ? 'expired' : top.status;
       return res.json({ github_login: login, status, admitted: status === 'invited' });
     } catch (err) {
       console.error('[gds] GET /access-requests/status', err);
@@ -335,9 +341,13 @@ module.exports = function buildAccessRequestsRouter() {
     try {
       // `kind` + `invited_by_login` let the invited history tell an invite from
       // an approved application (ADR 0335 D2) — descriptive, like the vouch.
+      // `expired` + `expires_at` mark an invite whose 30 days are up (task 1002969):
+      // still 'invited' in storage, but its door no longer opens.
       const { rows } = await pool.query(
         `SELECT ar.id, ar.github_login, ar.display_name, ar.note, ar.status,
                 ar.created_at, ar.resolved_at, ar.kind,
+                (ar.status = 'invited' AND ${inviteExpiredSql('ar')}) AS expired,
+                ${inviteExpiresAtSql('ar')} AS expires_at,
                 ar.applicant_github_id, ar.applicant_handle, ar.vouched_at,
                 (ar.applicant_github_id IS NOT NULL) AS vouched,
                 rb.github_login AS resolved_by_login,
@@ -560,21 +570,34 @@ module.exports = function buildAccessRequestsRouter() {
   // still 'invited' (not rescinded), and no builder row yet (not yet accepted by
   // signing in), each naming its sender; ?mine=1 keeps only the caller's own
   // (ADR 0335 D2; task 1002814). Rescind one with PATCH /access-requests/:id.
+  // Each carries `expires_at`, and `expired` once its 30 days are up (task 1002969):
+  // listed so the sender knows to invite again, and dropped once a newer invite
+  // for the same login is live, since that one already replaced it.
   // rank: archon — it names logins that are not members yet.
   router.get('/access-requests/invites', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     const mine = req.query.mine === '1';
-    const mineClause = mine ? 'AND ar.created_by = $1' : '';
+    // `login_has_live` is a window over the rows this scan already reads, not a
+    // lookup per row: access_requests has no index on lower(github_login) outside
+    // pending rows, and invite rows are kept as history. The sender filter sits
+    // OUTSIDE the window, so another sender's live re-invite still retires yours.
+    const mineClause = mine ? 'AND inv.created_by = $1' : '';
     try {
       const { rows } = await pool.query(
-        `SELECT ar.id, ar.github_login, ar.note, ar.created_at,
-                ib.github_login AS invited_by_login
-           FROM access_requests ar
-           LEFT JOIN builders ib ON ib.id = ar.created_by
-          WHERE ar.kind = 'invite' AND ar.status = 'invited'
-            AND NOT EXISTS (SELECT 1 FROM builders b
-                             WHERE lower(b.github_login) = lower(ar.github_login))
+        `SELECT inv.id, inv.github_login, inv.note, inv.created_at,
+                inv.expires_at, inv.expired, inv.invited_by_login
+           FROM (SELECT ar.id, ar.github_login, ar.note, ar.created_at, ar.created_by,
+                        ${inviteExpiresAtSql('ar')} AS expires_at,
+                        ${inviteExpiredSql('ar')} AS expired,
+                        bool_or(${inviteLiveSql('ar')}) OVER (PARTITION BY lower(ar.github_login)) AS login_has_live,
+                        ib.github_login AS invited_by_login
+                   FROM access_requests ar
+                   LEFT JOIN builders ib ON ib.id = ar.created_by
+                  WHERE ar.kind = 'invite' AND ar.status = 'invited'
+                    AND NOT EXISTS (SELECT 1 FROM builders b
+                                     WHERE lower(b.github_login) = lower(ar.github_login))) inv
+          WHERE NOT (inv.expired AND inv.login_has_live)
             ${mineClause}
-          ORDER BY ar.created_at DESC
+          ORDER BY inv.created_at DESC
           LIMIT 200`,
         mine ? [req.builder.id] : []
       );

package/modules/platform-identity/platform-identity.js

@@ -529,22 +529,25 @@ async function listMembershipsForAccount(githubId, { pool = defaultPool } = {})
 
 // Record that a project invited a builder: pre-seed a 'pending' membership, which is
 // a NOTICE shown in My Projects — the project's own row is what admits (ADR 0353;
-// written only from invite-notices.js now). Does NOT clobber an existing membership (ON CONFLICT DO NOTHING) — a
-// current member is left as-is. Returns { invited:true, row } when a pending row was
-// created, or { invited:false, alreadyMember:true } when a membership already existed.
+// written only from invite-notices.js now). Never clobbers a membership: a member is
+// left as-is, and a pending notice is restamped only once its invite's 30 days are up,
+// so a re-invite shows again (ADR 0356). Returns { invited:true, row } when it wrote,
+// or { invited:false, alreadyMember:true } when a membership or live notice stood.
 async function inviteToProject({ clientId, githubId }, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind)
+    `INSERT INTO platform_identity_project_memberships AS m (client_id, github_id, membership_kind)
      VALUES ($1, $2, 'pending')
-     ON CONFLICT (client_id, github_id) DO NOTHING
+     ON CONFLICT (client_id, github_id) DO UPDATE SET joined_at = now()
+       WHERE m.membership_kind = 'pending' AND m.joined_at <= now() - make_interval(days => $3)
      RETURNING id, client_id, github_id, membership_kind`,
-    [clientId, githubId],
+    [clientId, githubId, api.inviteExpiry.INVITE_EXPIRY_DAYS],
   );
   if (rows[0]) return { invited: true, row: rows[0] };
   return { invited: false, alreadyMember: true };
 }
 
-// The pending invitations for one account (joined to the project display fields).
+// The pending invitations for one account (joined to the project display fields),
+// minus any past its invite's 30 days: that door no longer opens (ADR 0356).
 async function listPendingInvitesForAccount(githubId, { pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `SELECT m.client_id, m.joined_at AS invited_at,
@@ -552,8 +555,9 @@ async function listPendingInvitesForAccount(githubId, { pool = defaultPool } = {
        FROM platform_identity_project_memberships m
        LEFT JOIN platform_identity_sso_clients c ON c.client_id = m.client_id
       WHERE m.github_id = $1 AND m.membership_kind = 'pending'
+        AND m.joined_at > now() - make_interval(days => $2)
       ORDER BY m.joined_at DESC`,
-    [githubId],
+    [githubId, api.inviteExpiry.INVITE_EXPIRY_DAYS],
   );
   return rows;
 }

package/modules/platform-identity/tests/platform-identity.mjs

@@ -538,10 +538,12 @@ await ta('inviteToProject pre-seeds a pending row, never clobbering an existing
   const c = pool.calls[0];
   assert.match(c.text, /INSERT INTO platform_identity_project_memberships/);
   assert.match(c.text, /VALUES \(\$1, \$2, 'pending'\)/);
-  assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO NOTHING/, 'must not downgrade an existing member');
+  // Only joined_at, only on an expired pending notice (task 1002969); real SQL in
+  // ../../tests/invite_expiry_db.mjs.
+  assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE SET joined_at = now\(\)\s+WHERE m\.membership_kind = 'pending' AND/, 'must not downgrade an existing member');
 });
 
-await ta('inviteToProject reports already-member when the row exists (DO NOTHING → no row)', async () => {
+await ta('inviteToProject reports already-member when the row exists (no row returned)', async () => {
   const pool = mockPool([{ rows: [] }]);
   const out = await P.inviteToProject({ clientId: 'c1', githubId: 42 }, { pool });
   assert.deepEqual(out, { invited: false, alreadyMember: true });

package/modules/provisioning/core-upgrade.js

@@ -318,6 +318,9 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     slug: inst.slug,
     hosting_shape: inst.hosting_shape,
     served_version: served,
+    // The rule the runner bounds this project's moves by (task 1004445) — what the page
+    // shows beside the offer, so "nothing to deploy" can say WHICH rule made it so.
+    update_channel: updateChannelOf(inst),
     recommended_version: recommended,
     available_count: available.length,
     behind: !!behind,
@@ -429,5 +432,71 @@ function makeControlPlaneHandler({ provisioning, pool, log }) {
   };
 }
 
-module.exports = { CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+// ---- the project's update rule (task 1004445) -------------------------------------
+//
+// RE-STATED, NOT REQUIRED. The list is update-channel.js VALID_CHANNELS / DEFAULT_CHANNEL,
+// which lives in scripts/gds/ and a module may not require (ADR 0083) — the same reason
+// parseRepoNote re-states the runner's note shape. tests/core_upgrade_door.mjs asserts the
+// two lists are equal, so they cannot drift apart silently; migration provisioning_029's
+// CHECK is the third copy, and the database refuses anything outside it.
+const UPDATE_CHANNELS = Object.freeze(['pinned', 'patch', 'minor']);
+const DEFAULT_UPDATE_CHANNEL = 'patch';
+
+/** The row's update rule, or the default for a row read before the column existed. PURE. */
+function updateChannelOf(inst) {
+  const c = inst && typeof inst.update_channel === 'string' ? inst.update_channel : '';
+  return UPDATE_CHANNELS.includes(c) ? c : DEFAULT_UPDATE_CHANNEL;
+}
+
+/**
+ * POST /provisioning/instances/:id/update-channel — set how far this project's core
+ * may move (task 1004445). Body: { channel: 'pinned' | 'patch' | 'minor' }.
+ *
+ * WHY IT EXISTS. The runner's channel refusal told the owner to "change the channel
+ * first", and until this route there was no channel to change: every project was held to
+ * patch-only, so a step-up release (1.19 → 1.20) could never land through the door.
+ *
+ * It changes a RULE, never the core: nothing is queued and nothing restarts. The next
+ * runner tick re-resolves what is on offer under the new rule, which is why the reply
+ * says the offer updates on the next check rather than claiming it already has.
+ */
+function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespond, log }) {
+  return async function updateChannelHandler(req, res) {
+    const id = parseId(req, res);
+    if (!id) return;
+    if (validateOrRespond(req, res, { channel: { type: 'string', maxLength: 16 } }, { strict: true })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst) return res.fail('instance_not_found', 404);
+      const channel = req.body && typeof req.body.channel === 'string' ? req.body.channel.trim().toLowerCase() : '';
+      if (!UPDATE_CHANNELS.includes(channel)) {
+        return res.fail('bad_update_channel', {
+          status: 400,
+          message: `Choose one of: ${UPDATE_CHANNELS.join(', ')} — pinned moves nothing, patch takes fixes within the same release line, minor also takes the next step up.`,
+          details: { valid: UPDATE_CHANNELS },
+        });
+      }
+      const was = updateChannelOf(inst);
+      if (was !== channel) {
+        await pool.query('UPDATE provisioning_instances SET update_channel = $2, updated_at = now() WHERE id = $1', [id, channel]);
+        const actor = require('./core-upgrade-authz').coreUpgradeActor(req);
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'update-channel-changed',
+          detail: `update rule changed from ${was} to ${channel}`, actor,
+        }).catch(() => {});
+      }
+      return res.json({
+        ok: true, update_channel: channel, previous: was, changed: was !== channel,
+        message: was === channel
+          ? `This project already follows the '${channel}' rule — nothing changed.`
+          : `This project now follows the '${channel}' rule. What it can move to updates on the next check, within a few minutes.`,
+      });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/update-channel', err);
+      return failFrom(res, err, 'update_channel_failed');
+    }
+  };
+}
+
+module.exports = { UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/migrations/provisioning_029_update_channel.sql

@@ -0,0 +1,24 @@
+-- provisioning_029_update_channel.sql — each project's own core update rule (task 1004445).
+--
+-- WHY. The deploy runner bounded every project by the platform default (update-channel.js
+-- DEFAULT_CHANNEL, patch-only), because nothing per-project existed to read. So a step-up
+-- release (1.19.x -> 1.20.0) could never reach ANY project through the deploy door: the
+-- runner refused it with "outside this project's 'patch' update channel ... Change the
+-- channel first", and there was no channel anywhere to change. This column is that channel.
+--
+-- Values are update-channel.js VALID_CHANNELS: pinned (the door moves nothing), patch
+-- (same major.minor — the old behaviour, hence the default), minor (any higher minor within
+-- the major). A major bump is never admitted by any channel. The CHECK mirrors the list so a
+-- hand-written UPDATE cannot store a value the runner would silently normalise away.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS update_channel text NOT NULL DEFAULT 'patch';
+
+ALTER TABLE provisioning_instances DROP CONSTRAINT IF EXISTS provisioning_instances_update_channel_check;
+ALTER TABLE provisioning_instances ADD CONSTRAINT provisioning_instances_update_channel_check
+  CHECK (update_channel IN ('pinned', 'patch', 'minor'));
+
+COMMIT;

package/modules/provisioning/routes/core-upgrade.js

@@ -25,7 +25,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
-const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler } = require('../core-upgrade');
+const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler, makeUpdateChannelHandler } = require('../core-upgrade');
 const { requireOwnProjectOrPin } = require('../core-upgrade-authz');
 
 const log = api.logger('provisioning');
@@ -86,6 +86,26 @@ module.exports = function buildCoreUpgradeRouter() {
     makeCoreUpgradePreviewHandler({ provisioning, pool: api.pool, parseId: api.parseId, log }),
   );
 
+  // POST /provisioning/instances/:id/update-channel — set the project's update rule
+  // (task 1004445). Body: { channel: "pinned" | "patch" | "minor" }.
+  //
+  // rank: `core.pin.move`, OR THE PROJECT'S OWN OWNER — the same two doors as the move,
+  // because the rule decides which moves the runner will perform: whoever may press
+  // Move may choose how far it reaches, and nobody else may. The platform's own row
+  // stays on the atom alone (OWNER_SHAPES excludes it), exactly as for the move.
+  router.post(
+    '/provisioning/instances/:id/update-channel',
+    api.requireBuilder,
+    requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
+    makeUpdateChannelHandler({
+      provisioning,
+      pool: api.pool,
+      parseId: api.parseId,
+      validateOrRespond: api.validateOrRespond,
+      log,
+    }),
+  );
+
   // GET /provisioning/control-plane — "which row is this platform, and where does it
   // stand?" The deploy page's first call: the self row is created once by hand at
   // install time, so its id is per-install and nobody's to memorise. The atom ALONE

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.27",
+  "version": "1.20.29",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.27",
+      "version": "1.20.29",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.27",
+  "version": "1.20.29",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8218,6 +8218,10 @@
     }
   ],
   "1.20.27": [
+    {
+      "id": "1004431",
+      "text": "The new profile and leaderboard design is approved. Every builder keeps one profile that leads with the role they choose, and shows their other roles only once those have earned credits. Ideators get a small version of the sky"
+    },
     {
       "id": "1004416",
       "text": "A new project can now store the seven startup answers: new or existing, where everyone is, whether under-18s are building, what the entity is, how many builders, how they'll be rewarded, and how much Bongos should run. A wrong"
@@ -8230,5 +8234,17 @@
       "id": "1004408",
       "text": "Old project invitations that led to a locked door are cleared from people's My Projects list."
     }
+  ],
+  "1.20.28": [
+    {
+      "id": "1002969",
+      "text": "An invitation to join a project now expires after 30 days; the person who sent it can simply invite again."
+    }
+  ],
+  "1.20.29": [
+    {
+      "id": "1004445",
+      "text": "Each project now has its own update rule. A project can be allowed to take bigger step-up updates (like 1.19 to 1.20) instead of being stuck on small fixes only, and its owner can change the rule."
+    }
   ]
 }

package/scripts/gds/fitness.js

@@ -558,6 +558,10 @@ const KERNEL_FILES = [
   // the import-direction guarantee on a file two surfaces now trust.
   'src/bongos/middleware/rate-limit.js',     // the sliding-window abuse ceilings (write + per-surface read)
   'src/bongos/db-kernel.js',                 // the kernel db slice — identity/audit/rank/withTx (BV1.R69)
+  // task 1002969 (ADR 0356): when an invite's door closes is part of the admission
+  // gate db-kernel.js runs, and the doorway hands the same definition to the
+  // onboarding and hub modules. It requires NOTHING, so joining costs nothing.
+  'src/bongos/invite-expiry.js',             // the read-time invite expiry (INVITE_EXPIRY_DAYS + its SQL)
   'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
   // config / identity (host context a module reads, never hardcodes)
   'src/instance-config.js',

package/scripts/gds/login.js

@@ -49,6 +49,8 @@ function pollDecision(body) {
   if (body.admitted === true) return 'admitted';
   if (body.status === 'member' || body.status === 'invited') return 'admitted';
   if (body.status === 'dismissed') return 'dismissed';
+  // An invite past its 30 days (task 1002969): the door is shut until they invite again.
+  if (body.status === 'expired') return 'expired';
   return 'wait';
 }
 
@@ -302,6 +304,10 @@ async function main() {
         console.error('\n✖ your access request was declined.');
         process.exit(1);
       }
+      if (decision === 'expired') {
+        console.error('\n✖ your invite has expired — ask the project to invite you again.');
+        process.exit(1);
+      }
       if (Date.now() > admitDeadline) {
         console.error('\n✖ timed out waiting for approval — re-run `bongos login` once an Archon has approved you.');
         process.exit(1);

package/scripts/gds/provision-core-upgrade.js

@@ -141,6 +141,15 @@ function targetFault(to, available, installed, channel, channelAllows) {
   return null;
 }
 
+// The update channel that bounds a move for THIS instance (task 1004445): the row's own
+// `update_channel`, normalised by update-channel.js so anything unknown or absent (a row
+// read before migration provisioning_029) falls back to DEFAULT_CHANNEL. PURE. One helper
+// for the move and the snapshot, so the button's offer and the runner's refusal cannot
+// disagree about which rule applies.
+function instanceChannel(inst, channelMod) {
+  return channelMod.normalizeChannel(inst && inst.update_channel != null ? inst.update_channel : channelMod.DEFAULT_CHANNEL);
+}
+
 // The builder id a queued move is attributed to, from the actor the web tier recorded.
 // PURE. Two doors reach the move (ADR 0339): an Archon (`api:archon:<id>`) and, since
 // task 1004174, the project's own owner (`api:owner:<id>`). Both carry the id, because
@@ -209,15 +218,12 @@ async function coreUpgradeInstance(inst, deps, intent) {
   const instanceDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : selfRoot();
   const readInstalled = deps.readInstalledCoreVersion || require('./upgrade.js').readInstalledCoreVersion;
   const installed = readInstalled(instanceDir);
-  // THE PLATFORM DEFAULT, NOT A PER-INSTANCE CHANNEL — and saying so beats implying
-  // otherwise. provisioning_instances carries no channel column; the subscription
-  // roster update-channel.js reads is a control-plane file, not a per-row setting. So
-  // this bounds every instance by the same policy (DEFAULT_CHANNEL: patch-only), which
-  // is a real bound — it refuses a prerelease or a major jump — and is the honest one
-  // available today. When a per-instance channel lands, this line is where it is read;
-  // writing `inst.update_channel ||` now would only have created a guard that reads as
-  // present and can never fire, which is the trap the web-tier half already documents.
-  const channel = channelMod.normalizeChannel(channelMod.DEFAULT_CHANNEL);
+  // THIS PROJECT'S OWN UPDATE RULE (task 1004445, migration provisioning_029). Before it
+  // every instance was bounded by DEFAULT_CHANNEL (patch-only), so a step-up release
+  // could reach no project through the door and the refusal's "change the channel first"
+  // pointed at nothing. A row from before the column (undefined) still normalises to that
+  // default, so an old runner schema reads exactly as it always did.
+  const channel = instanceChannel(inst, channelMod);
   const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
   const available = (listed && listed.versions) || [];
   const fault = targetFault(to, available, installed, channel, channelMod.channelAllows);
@@ -977,7 +983,7 @@ async function snapshotCoreVersions(inst, deps) {
     // admits nothing newer — "already current" and "nothing to take" are the same
     // answer here, and both correctly leave `recommended` NULL.
     const recommended = served
-      ? channelMod.resolveChannelTarget({ installed: served, channel: channelMod.DEFAULT_CHANNEL, available })
+      ? channelMod.resolveChannelTarget({ installed: served, channel: instanceChannel(inst, channelMod), available })
       : null;
     // THE TICK DOES NOT DRY-RUN. The verdict is produced on demand (preflightCoreUpgrade),
     // because a check re-run every tick for a box that has been behind for hours spends a
@@ -1021,4 +1027,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { pushUpgradePin, UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { pushUpgradePin, UPGRADE_SHAPES, instanceChannel, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/scripts/gds/run-unit-tests.js

@@ -208,6 +208,10 @@ const INTEGRATION = new Set([
   // prove the CHECK actually refuses a stored fourth state, that the backfill lands on a
   // pre-migration row, and that publishableSql and projectPublishability agree.
   'project_visibility_db',
+  // task 1002969 (ADR 0356): the invite expiry against real SQL — the router's and the
+  // admission reads' statements run on Postgres, and the hub's notice restamp and
+  // listing. The DB-free sibling (application_lifecycle) interprets the same WHEREs.
+  'invite_expiry_db',
   // task 1004408: migration platform_identity_028 deletes the old hub invite's
   // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
   // engine runs the DO block, the numeric version compare and the one-shot guard.

package/src/bongos/db-kernel.js

@@ -25,6 +25,7 @@
 
 const crypto = require('node:crypto');
 const { pool } = require('./pool');
+const { inviteLiveSql } = require('./invite-expiry');
 const seams = require('../module-seams');
 
 // withTx(fn, {pool}) — run fn(client) inside BEGIN/COMMIT, ROLLBACK+rethrow on
@@ -232,11 +233,12 @@ async function getBuilderByGithubId(githubId) {
 
 // hasInvitedAccessRequest — has an Archon approved this login (an access_requests
 // row at status='invited', case-insensitive)? The approval signal that lets a
-// first-time web sign-in through.
+// first-time web sign-in through. An invite older than 30 days no longer counts
+// (inviteLiveSql, task 1002969 / ADR 0356); an approved application never expires.
 async function hasInvitedAccessRequest(login) {
   const { rows } = await pool.query(
     `SELECT 1 FROM access_requests
-      WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`,
+      WHERE lower(github_login) = lower($1) AND status = 'invited' AND ${inviteLiveSql()} LIMIT 1`,
     [login]
   );
   return rows.length > 0;
@@ -259,7 +261,8 @@ async function accessStateByLogin(login) {
        EXISTS (SELECT 1 FROM builders
                 WHERE lower(github_login) = lower($1))                        AS member,
        EXISTS (SELECT 1 FROM access_requests
-                WHERE lower(github_login) = lower($1) AND status = 'invited') AS invited,
+                WHERE lower(github_login) = lower($1) AND status = 'invited'
+                  AND ${inviteLiveSql()})                                     AS invited,
        EXISTS (SELECT 1 FROM access_requests
                 WHERE lower(github_login) = lower($1) AND status = 'pending') AS pending`,
     [login]

package/src/bongos/invite-expiry.js

@@ -0,0 +1,47 @@
+// src/bongos/invite-expiry.js — a recruit invite's door closes 30 days after it is
+// sent, decided when it is READ (task 1002969; privacy spec D4, ADR 0356).
+//
+// There is no sweeper and no stored "expired" state. Every read that asks "does this
+// invite still open the door" computes the answer from created_at, so the sign-in
+// gate, the queues and the hub notice cannot disagree about the day it closed, and a
+// re-invite (a fresh row) opens a fresh door.
+//
+// ONLY `kind = 'invite'` ROWS EXPIRE. An approved application stays open: its
+// applicant asked, and spec D4 is about invites. Reading `kind` here makes it part
+// of admission for the first time (core_255 called it descriptive only), which is
+// safe for one reason: the predicate can only CLOSE a door. A row that is anything
+// but an invite behaves exactly as it did before this rule, so a mis-kinded row fails
+// toward the old gate, never past it (ADR 0356).
+'use strict';
+
+// The owner-signed window (spec D4). One constant, not per-instance config.
+const INVITE_EXPIRY_DAYS = 30;
+
+const ALIAS_RE = /^[a-z_][a-z0-9_]*$/;
+function columnPrefix(alias) {
+  if (alias == null || alias === '') return '';
+  if (!ALIAS_RE.test(alias)) throw new Error(`invite-expiry: bad table alias ${JSON.stringify(alias)}`);
+  return `${alias}.`;
+}
+
+// SQL: this access_requests row is an invite whose door has closed. `alias` names the
+// table in the caller's statement ('ar' → ar.kind); omit it for an unaliased table.
+function inviteExpiredSql(alias) {
+  const a = columnPrefix(alias);
+  return `(${a}kind = 'invite' AND ${a}created_at <= now() - interval '${INVITE_EXPIRY_DAYS} days')`;
+}
+
+// SQL: this row has not expired. ANDed beside `status = 'invited'` wherever the
+// question is "does it still admit".
+function inviteLiveSql(alias) {
+  return `NOT ${inviteExpiredSql(alias)}`;
+}
+
+// SQL: when this row's door closes if it is an invite, else NULL (an application
+// never expires). What a queue shows beside `expired`.
+function inviteExpiresAtSql(alias) {
+  const a = columnPrefix(alias);
+  return `(CASE WHEN ${a}kind = 'invite' THEN ${a}created_at + interval '${INVITE_EXPIRY_DAYS} days' END)`;
+}
+
+module.exports = { INVITE_EXPIRY_DAYS, inviteExpiredSql, inviteLiveSql, inviteExpiresAtSql };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.27'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.29'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -375,6 +375,15 @@ module.exports = {
   //     instance's hub key and client_id itself, so a module can neither
   //     substitute a key nor re-address the check. Null is never a refusal.
   get readApplicationVouch() { return require('./bongos/auth').readApplicationVouch; },
+  // inviteExpiry — { INVITE_EXPIRY_DAYS, inviteExpiredSql, inviteLiveSql }: a recruit
+  //     invite's door closes 30 days after it is sent, computed at read time (task
+  //     1002969, ADR 0356). The sign-in gate, the onboarding queues and the hub's
+  //     notice list all read this one definition, so no two can close on different days.
+  //     Destructured rather than returned whole so knip can see which exports are used.
+  get inviteExpiry() {
+    const { INVITE_EXPIRY_DAYS, inviteExpiredSql, inviteLiveSql, inviteExpiresAtSql } = require('./bongos/invite-expiry');
+    return { INVITE_EXPIRY_DAYS, inviteExpiredSql, inviteLiveSql, inviteExpiresAtSql };
+  },
   // userAgent — the instance's HTTP User-Agent string (branding-derived). The
   // carved lifecycle module's github-push.js stamps every GitHub API request with
   // it instead of reaching into src/branding.js directly (BV1.R86).

package/tests/access_requests_invite.mjs

@@ -225,7 +225,8 @@ test('invites list ?mine=1: only the caller’s own invites', async () => {
   const r = await get('/api/gds/access-requests/invites?mine=1');
   assert.equal(r.status, 200);
   assert.deepEqual(r.json.invites, []);
-  assert.match(calls[0].sql, /AND ar\.created_by = \$1/);
+  // Outside the expiry window (task 1002969), so another sender's live re-invite still counts.
+  assert.match(calls[0].sql, /\) inv\s+WHERE NOT \(inv\.expired AND inv\.login_has_live\)\s+AND inv\.created_by = \$1/);
   assert.deepEqual(calls[0].params, [42], 'narrowed to the acting builder, never to a caller-supplied id');
 });