@bongos/core 1.21.62 → 1.21.64

package/modules/public-landing/public/projects.probes.json

@@ -187,6 +187,24 @@
     { "name": "guild cards: the invited card applies on its own, with no note", "continue": true,
       "steps": [["click","#engageList .engageRow:nth-child(2) .btn"],["wait",400]],
       "expect": { "text": [["#engageList .engageRow:nth-child(2) .btn", "Applied"]], "hasClass": [["#engageList .engageRow:nth-child(2) .projMsg", "ok"]] } },
+    {"name": "guild invite cards (task 1004583): each says what joining shows and, before accept, that your numbers count — with the switch right there, set to count", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",900]],
+      "expect": {"visible": ["#guildInviteList", "#guildInviteList .guildRow:first-child .guildCount"], "count": [["#guildInviteList .guildRow", 2], ["#guildInviteList .guildRow:first-child a.linklike:not([hidden])", 1], ["#guildInviteList .guildRow:nth-child(2) a.linklike:not([hidden])", 0]], "text": [["#guildInviteList .guildRow:first-child .mineRow__name", "You’re invited to join Open Hands"], ["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. Leave them out of any guild you’d rather not share them with."]], "checked": "#guildInviteList .guildRow:first-child input[value=\"on\"]"} },
+    {"name": "guild invite: Leave them out says what that means before anything is sent", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"],["wait",150]],
+      "expect": {"checked": "#guildInviteList .guildRow:first-child input[value=\"off\"]", "text": [["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers are left out of this guild’s totals, from its next weekly count."]]} },
+    {"name": "guild invite: Accept sends the card's visibility and the switch (the stub refuses an accept without the card's visibility) and the card says where your numbers went", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:first-child .btn"],["wait",400]],
+      "expect": {"hasClass": [["#guildInviteList .guildRow:first-child .projMsg", "ok"], ["#guildInviteList .guildRow:first-child .btn", "ghost"]], "text": [["#guildInviteList .guildRow:first-child .btn", "Joined"], ["#guildInviteList .guildRow:first-child .projMsg", "You’ve joined Open Hands, and your numbers are left out of its totals."]]} },
+    {"name": "guild invite: Decline drops the card, silently", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:nth-child(2) .btn.ghost"],["wait",400]],
+      "expect": {"count": [["#guildInviteList .guildRow", 1]]} },
+    {"name": "join request (task 1004583): the owner of Night Shift accepts one and declines the other, from the hub", "continue": true,
+      "steps": [["click","#guildRequestList .guildRow:first-child .btn"],["wait",400],["click","#guildRequestList .guildRow:nth-child(2) .btn.ghost"],["wait",400]],
+      "expect": {"count": [["#guildRequestList .guildRow", 1]], "hasClass": [["#guildRequestList .guildRow:first-child .projMsg", "ok"]], "text": [["#guildRequestList .guildRow:first-child .btn", "Accepted"], ["#guildRequestList .guildRow:first-child .projMsg", "Tomás Ek is in Night Shift now."]]} },
+    {"name": "guild cards at 320: the switch stacks and nothing scrolls sideways", "auth": true, "width": 320, "url": "/projects?view=mine",
+      "steps": [["wait",900]],
+      "expect": {"noOverflow": true, "visible": ["#guildInviteList .guildRow:first-child .guildCount"]} },
     { "name": "invite a guild (task 1002303, R27): a /g/ address gives one pending line per member on its public page, each a link to the hall", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
       "steps": [["wait",900],["fill","#mInviteGuild","/g/forge-crew"],["click","#mInvite [data-invite-guild]"],["wait",400]],
       "expect": { "count": [["#mInviteList li", 4]], "value": [["#mInviteGuild", ""]],

package/modules/public-landing/public/projects.states.json

@@ -30,6 +30,9 @@
     "in-mine-engagements": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["focus","#engageList .engageRow:first-child .btn"],["wait",200]], "expect": { "visible": ["#mineInvites", "#invitesList", "#engageList"], "count": [["#engageList .engageRow", 2], ["#engageList .engageRow .mineJoinNote:not([hidden])", 0]], "text": [["#engageList .engageRow:nth-child(1) .mineRow__name", "Forge Crew is applying to Tidepool — apply with them?"], ["#engageList .engageRow:nth-child(1) .mineRow__host", "tidepool.cloudbongos.com"], ["#engageList .engageRow:nth-child(2) .mineRow__name", "Lantern Works invited Forge Crew"], ["#engageList .engageRow:nth-child(1) .mineRow__hint", "You apply as yourself — add a note for the owner if you like."], ["#engageList .engageRow:nth-child(1) .btn", "Apply"]] } },
     "in-mine-engagement-note": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","I like the boring parts too: migrations and the deploy path."],["wait",150]], "expect": { "visible": ["#engageList .engageRow:first-child .mineJoinNote"], "hidden": ["#engageList .engageRow:first-child .linklike"], "value": [["#engageList .engageRow:first-child .mineJoinNote", "I like the boring parts too: migrations and the deploy path."]] } },
     "in-mine-engagement-applied": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","I like the boring parts too: migrations and the deploy path."],["click","#engageList .engageRow:first-child .btn"],["wait",400]], "expect": { "hidden": ["#engageList .engageRow:first-child .mineJoinNote", "#engageList .engageRow:first-child .linklike"], "hasClass": [["#engageList .engageRow:first-child .projMsg", "ok"], ["#engageList .engageRow:first-child .btn", "ghost"]], "text": [["#engageList .engageRow:first-child .btn", "Applied"], ["#engageList .engageRow:first-child .projMsg", "Requested access. The project’s owner admits new builders; once approved, sign in to enter."], ["#engageList .engageRow:nth-child(2) .btn", "Apply"]] } },
+    "in-mine-guild-cards": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["focus", "#guildInviteList .guildRow:first-child .btn"], ["wait", 200]], "expect": {"visible": ["#mineInvites", "#guildInviteList", "#guildRequestList", "#guildInviteList .guildRow:first-child .guildCount"], "count": [["#guildInviteList .guildRow", 2], ["#guildRequestList .guildRow", 2], ["#guildInviteList .guildRow .guildCount", 2], ["#guildRequestList .guildRow .guildCount", 0]], "text": [["#guildInviteList .guildRow:nth-child(1) .mineRow__name", "You’re invited to join Open Hands"], ["#guildInviteList .guildRow:nth-child(2) .mineRow__name", "You’re invited to join Quiet Room"], ["#guildInviteList .guildRow:nth-child(1) .guildCount__what", "Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. Leave them out of any guild you’d rather not share them with."], ["#guildRequestList .guildRow:nth-child(1) .mineRow__name", "Tomás Ek asked to join Night Shift"], ["#guildRequestList .guildRow:nth-child(2) .mineRow__name", "@kai-lowe asked to join Night Shift"]], "checked": "#guildInviteList .guildRow:first-child input[value=\"on\"]"}},
+    "in-mine-guild-count-off": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["click", "#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"], ["wait", 150]], "expect": {"checked": "#guildInviteList .guildRow:first-child input[value=\"off\"]", "text": [["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers are left out of this guild’s totals, from its next weekly count."], ["#guildInviteList .guildRow:first-child .btn", "Accept"]]}},
+    "in-mine-guild-joined": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["click", "#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"], ["click", "#guildInviteList .guildRow:first-child .btn"], ["wait", 400]], "expect": {"hidden": ["#guildInviteList .guildRow:first-child .btn.ghost + .btn"], "hasClass": [["#guildInviteList .guildRow:first-child .projMsg", "ok"], ["#guildInviteList .guildRow:first-child .btn", "ghost"]], "text": [["#guildInviteList .guildRow:first-child .btn", "Joined"], ["#guildInviteList .guildRow:first-child .projMsg", "You’ve joined Open Hands, and your numbers are left out of its totals."]]}},
     "in-manage-app-live": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStat","#mApp .appVars"],"hidden":[]} },
     "in-manage-app-building": { "auth": true, "url": "/projects?view=manage&id=102", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStages"],"hidden":[]} },
     "in-manage-app-failed": { "auth": true, "url": "/projects?view=manage&id=105", "actions": [["wait",900],["focus","#mApp .appRetryBtn"]], "expect": {"visible":["#mAppCard","#mApp p.err","#mApp .appRetryBtn"],"hidden":["#mApp .appRetry"]} },

package/modules/ui-design/kit/fixtures/guilds.json

@@ -51,6 +51,13 @@
         { "handle": "sol-reyes", "display_name": "Sol Reyes", "avatar_url": null, "membership_kind": "member" }
       ],
       "count": 3
+    },
+    "requests": {
+      "incoming": [
+        { "id": "601", "created_at": "2026-10-04T19:20:00.000Z", "seen_at": null, "handle": "tomas-ek", "display_name": "Tomás Ek", "avatar_url": null },
+        { "id": "602", "created_at": "2026-10-02T11:05:00.000Z", "seen_at": null, "handle": "kai-lowe", "display_name": null, "avatar_url": null }
+      ],
+      "outgoing": []
     }
   },
   "open-hands": {

package/modules/ui-design/kit/fixtures/me__guild-requests.json

@@ -0,0 +1,9 @@
+{
+  "incoming": [
+    { "id": "501", "created_at": "2026-10-04T15:10:00.000Z", "seen_at": null, "slug": "open-hands", "name": "Open Hands", "description": "A newer guild for first-time builders. Ask anything.", "visibility": "public" },
+    { "id": "502", "created_at": "2026-10-03T08:45:00.000Z", "seen_at": "2026-10-03T09:00:00.000Z", "slug": "quiet-room", "name": "Quiet Room", "description": "", "visibility": "unlisted" }
+  ],
+  "outgoing": [],
+  "incoming_count": 2,
+  "outgoing_count": 0
+}

package/modules/ui-design/kit/serve.js

@@ -512,6 +512,44 @@ function guildInvitePost(res, body) {
   const invites = (g.public.members || []).map((m) => ({ handle: m.handle, display_name: m.display_name || null, invite_url: 'https://mercury.example.test/builders/watch?invite=' + encodeURIComponent(m.handle) }));
   return json(res, 200, { invited: false, guild: { slug: g.public.guild.slug, name: g.public.guild.name }, invites, count: invites.length });
 }
+// The guild cards in the mine view's invitations (task 1004583): GET /me/guild-requests is
+// the invites to the builder (me__guild-requests.json, each card with the guild's CURRENT
+// visibility) plus `owner_incoming`, the join requests to every held guild they own (its
+// `requests` in guilds.json), each naming its guild — one read, as the route answers it. The
+// stub mirrors the routes' refusals: an invitee's accept must echo the card's visibility (400
+// without one, 409 with the guild's current one when it differs), only `visibility` and
+// `counted_in_totals` are taken, a row the caller may not answer is one 404, and a decline is
+// a SILENT 204. Nothing is written: a reload draws the same cards, as the join relay's
+// 'requested' does.
+function ownedRequests() {
+  return Object.values(guildsHeld()).filter((g) => g.members && g.members.you.membership_kind === 'owner')
+    .flatMap((g) => ((g.requests && g.requests.incoming) || []).map((r) => ({ ...r, guild: { slug: g.members.guild.slug, name: g.members.guild.name } })));
+}
+function myGuildRequests(res) {
+  const q = heldFixture('me__guild-requests');
+  const owner = ownedRequests();
+  return json(res, 200, { ...q, owner_incoming: owner, owner_incoming_count: owner.length });
+}
+function guildRequestAnswer(res, id, verb, body) {
+  const notFound = () => refuse(res, 404, 'guild_request_not_found', 'guild_request_not_found');
+  if (!/^\d{1,19}$/.test(id)) return notFound();
+  const bad = Object.keys(body).find((k) => !['visibility', 'counted_in_totals'].includes(k));
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  if (body.visibility !== undefined && !['public', 'unlisted'].includes(body.visibility)) return refuse(res, 400, 'validation_failed', 'visibility must be public or unlisted');
+  if (body.counted_in_totals !== undefined && typeof body.counted_in_totals !== 'boolean') return refuse(res, 400, 'validation_failed', 'counted_in_totals must be a boolean');
+  const invite = (heldFixture('me__guild-requests').incoming || []).find((r) => r.id === id);
+  const request = Object.values(guildsHeld()).some((g) => g.members && g.members.you.membership_kind === 'owner'
+    && ((g.requests && g.requests.incoming) || []).some((r) => r.id === id));
+  if (!invite && !request) return notFound();
+  if (verb === 'decline') { res.writeHead(204, { 'cache-control': 'no-store' }); return res.end(); }
+  if (invite) {
+    if (!body.visibility) return refuse(res, 400, 'guild_card_visibility_required', 'send the visibility your invite card showed');
+    const held = guildsHeld()[invite.slug];
+    const now = (held && held.members && held.members.guild.visibility) || invite.visibility;
+    if (body.visibility !== now) return json(res, 409, { error: { code: 'guild_visibility_changed', message: 'guild_visibility_changed', details: { visibility: now } } });
+  }
+  return json(res, 200, { status: 'accepted' });
+}
 function guildEngagementLive(slug, origin) {
   const g = typeof slug === 'string' && guildsHeld()[slug.toLowerCase()];
   if (!g || !g.members) return false;
@@ -540,6 +578,9 @@ const server = http.createServer((req, res) => {
     if (guild && guild[2] === '/members' && req.method === 'GET') return AUTH ? guildRead(res, guild[1], 'members', origin) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/membership' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => guildMembershipPatch(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/engagements' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildEngagementPost(res, guild[1], body)) : json(res, 401, UNAUTH);
+    if (rest === '/me/guild-requests' && req.method === 'GET') return AUTH ? myGuildRequests(res) : json(res, 401, UNAUTH);
+    const answer = rest.match(/^\/guild-requests\/([^/]+)\/(accept|decline)$/);
+    if (answer && req.method === 'POST') return AUTH ? readBody(req, (body) => guildRequestAnswer(res, answer[1], answer[2], body)) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);
     // the planet-physics questions' pre-create check (task 1004418): nothing stops here —
     // the kit carries no screen. Of the soft-limit table it mirrors only the three hide

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.62",
+  "version": "1.21.64",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.62",
+      "version": "1.21.64",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
@@ -772,9 +772,9 @@
       "license": "MIT"
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -782,6 +782,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/qs": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.62",
+  "version": "1.21.64",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9148,5 +9148,17 @@
       "id": "1004584",
       "text": "Shipping finished tasks now works for projects that install Bongos as a package, so their work lands instead of getting stuck halfway."
     }
+  ],
+  "1.21.63": [
+    {
+      "id": "1004583",
+      "text": "Builders can now accept or decline a guild invite from their projects page, choosing first whether their numbers count toward the guild's totals, and guild owners can answer join requests there too."
+    }
+  ],
+  "1.21.64": [
+    {
+      "id": "1002304",
+      "text": "Owners now see people who applied with a guild grouped under that guild's name in the applications queue, with one \"Invite all\" button that still admits each person individually."
+    }
   ]
 }

package/src/bongos/auth-admission.js

@@ -534,7 +534,29 @@ async function safeSyncRankRole(builder) {
 // null this function already promises on every other failure.
 const APPLICANT_PROFILE_TIMEOUT_MS = 5000;
 
-async function readApplicantProfileFromHub(githubId) {
+// The guild an applicant applied with, as the hub labels it beside their profile
+// (ADR 0365 D5, task 1002304): { slug, name }, or null. Cross-instance input, so
+// it is re-bounded here rather than trusted — the hub's own caps mirrored (a guild
+// name is at most 80 characters, a slug is the handle charset). A slug that does
+// not fit is dropped to null, which the queue already reads as "no public page";
+// a name that does not fit drops the whole label, and the row simply shows no
+// guild. An OLDER hub sends no `guild` at all, which is the same null.
+const GUILD_LABEL_NAME_MAX = 80;
+const GUILD_LABEL_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$/;
+
+function applicantGuildLabel(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const name = typeof raw.name === 'string' ? raw.name.trim() : '';
+  if (!name || name.length > GUILD_LABEL_NAME_MAX) return null;
+  const slug = typeof raw.slug === 'string' && GUILD_LABEL_SLUG_RE.test(raw.slug) ? raw.slug : null;
+  return { slug, name };
+}
+
+// readApplicantViewFromHub(githubId) → { profile, guild } | null — the same live
+// read, with the guild label the hub sends beside the profile (ADR 0365 D5). The
+// label rides ONLY beside a profile, here as on the hub: an applicant who
+// discloses nothing discloses no guild either, so a null profile is a null view.
+async function readApplicantViewFromHub(githubId) {
   const idp = loadIdpConfig();
   if (!idp || githubId == null) return null;
   try {
@@ -550,13 +572,21 @@ async function readApplicantProfileFromHub(githubId) {
     });
     if (!r.ok) return null;
     const body = await r.json().catch(() => null);
-    return (body && body.profile) || null;
+    const profile = (body && body.profile) || null;
+    return profile ? { profile, guild: applicantGuildLabel(body.guild) } : null;
   } catch (err) {
     log.info('[auth] hub applicant-profile read failed (non-blocking):', err.message);
     return null;
   }
 }
 
+// The profile half alone — the doorway port this read first shipped as, kept so
+// a module on it reads exactly what it always did.
+async function readApplicantProfileFromHub(githubId) {
+  const view = await readApplicantViewFromHub(githubId);
+  return view ? view.profile : null;
+}
+
 // notifyHubOfInvite(githubLogin, { invited }) — tell the hub about THIS project's own
 // invite, so the invitee sees it in My Projects (task 1002818, ADR 0353). `invited:
 // true` after the invite route leaves the login holding an invited row; `false` after
@@ -601,6 +631,7 @@ module.exports = {
   firstTimeAdmissionBlocked,
   instanceNeedsFirstAdmin,
   readApplicantProfileFromHub,
+  readApplicantViewFromHub,
   // Re-exported, not defined here (task 1003579 moved it to project-door.js with
   // the two knobs it composes against). auth.js, the doorway's api.joinabilityMode
   // and four test files import it by this path, and the read-back it answers —

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readApplicantProfileFromHub, readApplicantViewFromHub, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, readApplicationVouch, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -828,6 +828,7 @@ module.exports = {
   openEnrollmentEnabled,
   joinabilityMode,
   readApplicantProfileFromHub,
+  readApplicantViewFromHub,
   notifyHubOfInvite,
   readApplicationVouch,
   firstTimeAdmissionBlocked,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.62'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.64'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -362,6 +362,12 @@ module.exports = {
   //     re-address it. Fails soft to null on every error, so a hub outage costs
   //     the profile block and never the queue.
   get readApplicantProfileFromHub() { return require('./bongos/auth').readApplicantProfileFromHub; },
+  // readApplicantViewFromHub(githubId) — the same read and the same narrow port,
+  //     answering { profile, guild } | null: the profile above plus the guild the
+  //     applicant applied with, { slug, name } or null (ADR 0365 D5, task
+  //     1002304). The guild rides only beside a profile, so a null profile is a
+  //     null view; an older hub that sends no guild answers guild: null.
+  get readApplicantViewFromHub() { return require('./bongos/auth').readApplicantViewFromHub; },
   // notifyHubOfInvite(githubLogin, { invited }) — tell the hub about one of THIS
   //     project's invites (true) or its rescind (false), so the invitee sees it in
   //     My Projects (task 1002818, ADR 0353). The same narrow-port reason as the

package/tests/applicant_view_guild.mjs

@@ -0,0 +1,101 @@
+// tests/applicant_view_guild.mjs — the guild label reaches the project (task
+// 1002304, R28 of goal 1000110; ADR 0365 D5).
+//
+// THE GAP. The hub's POST /sso/applicant-profile answers { profile, guild } since
+// task 1002303, and core kept only `body.profile` — so the reviewer queue could
+// never know which applicants came as a guild. readApplicantViewFromHub is the
+// same live read answering both halves, and readApplicantProfileFromHub is kept
+// for any module on the older port.
+//
+// WHAT IS PINNED. The label is cross-instance input, so it is re-bounded here
+// (the hub's own caps mirrored) rather than trusted; it rides only beside a
+// profile, as it does on the hub; and an older hub that sends no guild is a
+// guild of null, never an error.
+//
+// DB-free and network-free: auth-config is pinned in require.cache so the
+// federation config resolves without env, and global fetch is a spy (the
+// tests/applicant_profile_read_bounds.mjs idiom).
+//
+// Run:  node --test --test-reporter=tap tests/applicant_view_guild.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const cfgPath = require.resolve('../src/bongos/auth-config.js');
+const realCfg = require('../src/bongos/auth-config.js');
+require.cache[cfgPath] = {
+  id: cfgPath,
+  filename: cfgPath,
+  loaded: true,
+  exports: {
+    ...realCfg,
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'cid', clientSecret: 'sec' }),
+  },
+};
+
+const admission = require('../src/bongos/auth-admission.js');
+const api = require('../src/module-api.js');
+
+const PROFILE = { view: 'sliver', sliver: { handle: 'bo' } };
+
+// The hub answers `body` for every call; the result is what the read returns.
+async function viewFor(body) {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, json: async () => body });
+  try { return await admission.readApplicantViewFromHub(42); } finally { globalThis.fetch = real; }
+}
+
+test('the guild the hub names rides beside the profile', async () => {
+  const view = await viewFor({ profile: PROFILE, guild: { slug: 'lantern-works', name: 'Lantern Works' } });
+  assert.deepEqual(view, { profile: PROFILE, guild: { slug: 'lantern-works', name: 'Lantern Works' } });
+});
+
+test('an unlisted guild keeps its name and its null slug', async () => {
+  const view = await viewFor({ profile: PROFILE, guild: { slug: null, name: 'Night Shift' } });
+  assert.deepEqual(view.guild, { slug: null, name: 'Night Shift' });
+});
+
+test('an OLDER hub that sends no guild is guild null, and the profile is untouched', async () => {
+  const view = await viewFor({ profile: PROFILE });
+  assert.deepEqual(view, { profile: PROFILE, guild: null });
+});
+
+test('no profile, no view — a guild never rides alone (the hub’s own rule, restated here)', async () => {
+  assert.equal(await viewFor({ profile: null, guild: { slug: 'lantern-works', name: 'Lantern Works' } }), null);
+});
+
+test('a label outside the hub’s own caps is not trusted', async () => {
+  const name81 = 'x'.repeat(81);
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: name81 } })).guild, null, 'a name over 80 characters drops the label');
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: '   ' } })).guild, null, 'a blank name is no name');
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: 7 } })).guild, null, 'a name must be text');
+  assert.equal((await viewFor({ profile: PROFILE, guild: 'Lantern Works' })).guild, null, 'a label must be an object');
+  for (const slug of ['Lantern Works', '-lead', 'trail-', '<script>', 'x'.repeat(40), 42]) {
+    assert.deepEqual((await viewFor({ profile: PROFILE, guild: { slug, name: 'Lantern' } })).guild, { slug: null, name: 'Lantern' },
+      `a slug outside the handle charset (${JSON.stringify(slug)}) is no address — the name still labels the row`);
+  }
+});
+
+test('the older port answers the profile alone, exactly as it always did', async () => {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, json: async () => ({ profile: PROFILE, guild: { slug: 'a1', name: 'A' } }) });
+  try {
+    assert.deepEqual(await admission.readApplicantProfileFromHub(42), PROFILE);
+  } finally { globalThis.fetch = real; }
+});
+
+test('a failed hub read is a null view, like every other failure here', async () => {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => { throw new Error('ECONNREFUSED'); };
+  try {
+    assert.equal(await admission.readApplicantViewFromHub(42), null);
+  } finally { globalThis.fetch = real; }
+});
+
+test('a module reaches it through the doorway, the same narrow port as the profile read', () => {
+  assert.equal(api.readApplicantViewFromHub, admission.readApplicantViewFromHub);
+  assert.equal(api.readApplicantProfileFromHub, admission.readApplicantProfileFromHub);
+});

package/tests/application_lifecycle.mjs

@@ -390,6 +390,10 @@ let actingRank = 'archon';
 let actingId = 42;
 // The hub notice port (task 1002818, ADR 0353), recorded instead of sent.
 let notices = [];
+// The hub's applicant view (task 1002304, ADR 0365 D5): github_id → what the hub
+// answers, recorded so a test can see WHICH ids were asked about. Empty = no hub.
+let hubViews = {};
+let hubAsked = [];
 
 require.cache[apiPath].exports = {
   ...realApi,
@@ -403,6 +407,7 @@ require.cache[apiPath].exports = {
   readApplicationVouch: (token, { githubLogin } = {}) =>
     applicationVouchIdentity(token, { githubLogin, publicKey: hubPublicKey, clientId: SELF_CLIENT_ID }),
   notifyHubOfInvite: (login, opts) => { notices.push({ login, invited: opts && opts.invited }); },
+  readApplicantViewFromHub: async (githubId) => { hubAsked.push(githubId); return hubViews[githubId] || null; },
 };
 
 seams._reset();
@@ -447,7 +452,7 @@ function call(method, pathname, body, extraHeaders = {}) {
     req.end(payload);
   });
 }
-const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; };
+const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; hubViews = {}; hubAsked = []; };
 
 // ===========================================================================
 // The interpreter is the instrument, so it is calibrated first
@@ -670,6 +675,38 @@ test('list-pending: the queue filters on status and NOTHING else', async () => {
     'an extra predicate here would hide rows from the owner, and a placeholder-free one is invisible to the fake pool');
 });
 
+// The guild label (task 1002304, R28; ADR 0365 D5): the hub answers { profile,
+// guild } and core used to keep only the profile. It rides the SAME vouch-keyed
+// read, so it can reach a row only the way the profile can.
+test('list-pending: a vouched applicant’s guild rides onto the row beside their profile', async () => {
+  reset();
+  const profile = { view: 'sliver', sliver: { handle: 'bo-h' } };
+  hubViews['9002'] = { profile, guild: { slug: 'lantern-works', name: 'Lantern Works' } };
+  const r = await call('GET', '/api/gds/access-requests');
+  const bo = r.json.requests.find((x) => x.github_login === 'bo');
+  assert.deepEqual(bo.profile, profile);
+  assert.deepEqual(bo.guild, { slug: 'lantern-works', name: 'Lantern Works' });
+});
+
+test('list-pending: an unvouched row is never asked about, and carries guild null', async () => {
+  reset();
+  hubViews['9002'] = { profile: { view: 'sliver', sliver: {} }, guild: { slug: null, name: 'Night Shift' } };
+  const r = await call('GET', '/api/gds/access-requests');
+  const ada = r.json.requests.find((x) => x.github_login === 'ada');
+  assert.equal(ada.guild, null, 'a login anybody could have typed must not borrow a guild');
+  assert.equal(ada.profile, null);
+  assert.deepEqual(hubAsked, ['9002'], 'only the vouched row reached the hub');
+});
+
+test('list-pending: a hub that answers nothing (or an older one) leaves every row as it was', async () => {
+  reset();
+  const r = await call('GET', '/api/gds/access-requests');
+  for (const row of r.json.requests) {
+    assert.equal(row.guild, null, `${row.github_login}: no view, no guild`);
+    assert.equal(row.profile, null);
+  }
+});
+
 test('list-pending: ?status=invited|dismissed reads the audit trail, and a bad status is refused', async () => {
   reset();
   const invited = await call('GET', '/api/gds/access-requests?status=invited');

package/tests/guilds_api.mjs

@@ -578,6 +578,37 @@ test('the owner\'s invite list names only invitees THIS owner could address (a t
     'public, or connected to the viewing owner — the addressableAccount rule, reusing the one symmetric-edge fragment');
 });
 
+test('GET /me/guild-requests carries the requests to EVERY guild I own in one statement keyed on the session, each naming its guild (task 1004583)', async () => {
+  const OWNED = (t) => /WHERE r\.kind = 'request' AND r\.status = 'pending'/.test(t);
+  on(base((t) => (OWNED(t) && /^\s*SELECT/.test(t)
+    ? result([{ id: '601', created_at: 'c', seen_at: null, slug: 'night-shift', name: 'Night Shift', handle: 'tomas-ek', display_name: 'Tomás Ek', avatar_url: null },
+      { id: '602', created_at: 'c', seen_at: 's', slug: 'lamp-room', name: 'Lamp Room', handle: 'kai-lowe', display_name: null, avatar_url: null }])
+    : null)));
+  const res = await call('GET', '/api/bongos/me/guild-requests');
+  assert.equal(res.status, 200);
+  assert.equal(res.headers['cache-control'], 'no-store');
+  assert.deepEqual(res.json.owner_incoming[0], { id: '601', created_at: 'c', seen_at: null, handle: 'tomas-ek', display_name: 'Tomás Ek', avatar_url: null, guild: { slug: 'night-shift', name: 'Night Shift' } });
+  assert.equal(res.json.owner_incoming_count, res.json.owner_incoming.length);
+  assert.equal(res.json.incoming_count, res.json.incoming.length, 'the invite half is unchanged');
+
+  const reads = calls.filter((c) => OWNED(c.text) && /^\s*SELECT/.test(c.text));
+  assert.equal(reads.length, 1, 'one statement for every guild I own — never one per guild');
+  const [read] = reads;
+  assert.equal(read.params[0], ME, 'keyed on the SESSION’s github_id');
+  assert.equal(read.params[2], guilds.LIST_MAX, 'capped as every queue is');
+  assert.ok(read.text.includes(require('../modules/platform-identity/account-visibility.js').accountActiveSql('pa')),
+    'a requester floors on an active account, as the per-guild queue does');
+  assert.match(read.text, /o\.guild_id = r\.guild_id AND o\.github_id = \$1::bigint\s+AND o\.membership_kind = 'owner'/, 'the owner test, per row, in the statement');
+  assert.match(read.text, /JOIN platform_identity_accounts pa ON pa\.github_id = r\.github_id/);
+  assert.doesNotMatch(read.text, /github_login|pa\.github_id AS|r\.github_id AS/, 'no GitHub identity leaves the module');
+  assert.match(read.text, /pa\.handle, pa\.display_name, pa\.avatar_url/, 'the person columns a guild list carries, no more');
+
+  const stamp = calls.find((c) => /^\s*UPDATE platform_identity_guild_requests r SET seen_at = now\(\)/.test(c.text));
+  assert.ok(stamp, 'the unseen request is stamped, as the per-guild read stamps it');
+  assert.deepEqual(stamp.params, [['601'], ME], 'only the unseen row, by the same owner');
+  assert.match(stamp.text, /r\.kind = 'request'[\s\S]*o\.github_id = \$2::bigint\s+AND o\.membership_kind = 'owner'/, 'the stamp re-asserts the owner test');
+});
+
 // ===========================================================================
 // 7. Nothing here is authority; counts are lengths
 // ===========================================================================

package/tests/guilds_db.mjs

@@ -160,6 +160,13 @@ try {
     'the requester\'s own counted_in_totals choice rides the request — the owner cannot override it');
 
   ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'created', 'Bob asks');
+  const ownerQ = await guilds.listOwnedRequests({ githubId: OWNER }, { pool });
+  const bobAsk = ownerQ.find((r) => r.handle === 'r24bob');
+  ok(bobAsk && bobAsk.guild.slug === 'r24-pub' && !('github_id' in bobAsk) && !('kind' in bobAsk),
+    'the owner\'s ONE read across every guild they own carries Bob\'s request, naming its guild, by handle never github_id (task 1004583)');
+  ok((await guilds.listOwnedRequests({ githubId: ALICE }, { pool })).every((r) => r.guild.slug !== 'r24-pub'),
+    'a member who is not the owner reads none of its requests (the owner gate is in the statement)');
+  ok((await openRows('r24-pub', BOB))[0].seen_at !== null, 'reading it stamps seen_at on the request, as the per-guild queue does');
   ok(await guilds.declineRequest({ id: await pendingId('r24-pub', BOB), githubId: OWNER }, { pool }), 'the owner declines');
   const before = (await openRows('r24-pub', BOB)).length;
   ok((await guilds.requestToJoin({ slug: 'r24-pub', githubId: BOB }, { pool })).outcome === 'swallowed',

package/tests/hub_engagement_cards.mjs

@@ -37,11 +37,13 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
 
-// the rows region: mineEl/mineRow, the two lists, the section, and the guild cards
+// the rows region: mineEl/mineRow, the lists, the section, and the guild cards —
+// through the guild invite and request cards (task 1004583), which loadInvites
+// also reads; tests/hub_guild_cards.mjs drives those
 const START = SCRIPT.indexOf('  function mineEl(tag, cls)');
-const END = SCRIPT.indexOf('\n  }\n', SCRIPT.indexOf('  function loadEngagements() {')) + 5;
+const END = SCRIPT.indexOf('\n  }\n', SCRIPT.indexOf('  function loadGuildQueue() {')) + 5;
 assert.ok(START > 0, 'the region starts at mineEl');
-assert.ok(END > START, 'and ends with loadEngagements');
+assert.ok(END > START, 'and ends with loadGuildQueue');
 const REGION = SCRIPT.slice(START, END);
 for (const fn of ['function mineRow(', 'function renderInvitesList(', 'function paintInvitesSection(', 'function loadInvites(',
   'function engageLine(', 'function engageRow(', 'function renderEngagements(', 'function loadEngagements(']) {
@@ -81,7 +83,7 @@ const REQUESTED = { ok: true, status: 200, body: { ok: true, status: 'requested'
 
 function boot({ answers = [] } = {}) {
   const ids = new Map();
-  for (const id of ['mineInvites', 'invitesList', 'engageList', 'buildingList', 'buildingEmpty']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
+  for (const id of ['mineInvites', 'invitesList', 'guildInviteList', 'engageList', 'guildRequestList', 'buildingList', 'buildingEmpty']) ids.set(id, el(id === 'mineInvites' ? 'section' : 'ul'));
   ids.get('mineInvites').hidden = true;
   const requests = [];
   const queued = answers.slice();
@@ -173,7 +175,8 @@ test('loadInvites reads both lists, and a guild read that fails is silent', asyn
   ] });
   await ui.sandbox.loadInvites();
   await ui.settle();
-  assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`).sort(), ['GET /api/bongos/me/guild-engagements', 'GET /api/bongos/my-projects/invites']);
+  assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`).sort(),
+    ['GET /api/bongos/me/guild-engagements', 'GET /api/bongos/me/guild-requests', 'GET /api/bongos/my-projects/invites']);
   for (const r of ui.requests) assert.equal(r.credentials, 'same-origin', 'own-scope reads, on the cookie session');
   assert.equal(ui.cards().length, 0);
   assert.equal(ui.section().hidden, true);
@@ -291,7 +294,7 @@ test('the cards are a real list inside the Invitations section, built with creat
   assert.doesNotMatch(CARDS, /innerHTML|insertAdjacentHTML|outerHTML/, 'no markup built from strings');
   assert.match(SCRIPT, /if \(v === 'mine' && me\) \{ refreshList\(\); loadMemberships\(\); loadInvites\(\); \}/, 'the mine view re-reads both lists on entry, through loadInvites');
   const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
-  assert.match(COSMOS, /\.mineRows:not\(:empty\)\+\.mineRows \.mineRow:first-child\{border-top:1px solid var\(--rule-soft\);\}/, 'one hairline between the two lists when both have rows');
+  assert.match(COSMOS, /\.mineRows:not\(:empty\)~\.mineRows \.mineRow:first-child\{border-top:1px solid var\(--rule-soft\);\}/, 'one hairline between any two lists that have rows');
   assert.doesNotMatch(HUB.slice(0, HUB.indexOf('</head>')), /engageRow/, 'styled in cosmos.css, not in the page head');
 });