@bongos/core 1.21.63 → 1.21.64

package/modules/hall-ui/public/watch.css

@@ -71,3 +71,18 @@
 /* A link inside a ledger cell (a session's tasks) is a control at a 13.5px line
    box: the padding buys the 24px floor and the negative margin hands it back. */
 .ledger td a:not(.lb-name) { display: inline-block; min-height: 24px; padding: 3px 0; margin: -3px 0; line-height: 18px; }
+
+/* A guild's applicants under one head (task 1002304, ADR 0365 D5): the guild's
+   name, the count, and "Invite all" at the inline end. The head wraps at phone
+   width so the button drops under the name rather than overflowing, and centres
+   because a pill on the label's baseline sits low. */
+.gate-guild .ov-group__head { flex-wrap: wrap; align-items: center; row-gap: 8px; }
+.gate-guild .ov-group__head .btn-ghost { margin-left: auto; }
+/* The name is a link to the guild's hub page when it has one — a control, so it
+   owes the 24px floor: the padding buys the box, the margin hands it back. */
+a.gate-guild__link { display: inline-block; min-height: 24px; min-width: 24px; padding: 3px 0; margin: -3px 0; text-decoration: none; }
+a.gate-guild__link:hover { color: var(--accent-ink); text-decoration: underline; text-underline-offset: 3px; }
+/* The profile block's sentences ("Private account — …", "hides their record")
+   ride .ov-row__when, which never wraps; at 320px they pushed the page 54px
+   sideways. Inside the profile they are prose, so they wrap. */
+.ov-row__profile .ov-row__when { white-space: normal; }

package/modules/hall-ui/public/watch.html

@@ -5,6 +5,9 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Watch — {{worldName}}</title>
   <meta name="description" content="Archon oversight for {{worldName}} — access requests, security, roster, reviews, and repo health.">
+  <!-- The hub's origin, for the link from a guild's head in the applications queue to
+       its page on the hub (task 1002304). Empty on a vanilla instance: no link. -->
+  <meta name="hub-origin" content="{{hubOrigin}}">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

package/modules/hall-ui/public/watch.js

@@ -523,6 +523,90 @@
     );
   }
 
+  // ---- a guild's applicants, together (task 1002304, ADR 0365 D5) ----------
+  //
+  // An applicant who applied WITH their guild carries the hub's label for it,
+  // { slug, name } (slug null for an unlisted guild), and the queue gathers those
+  // rows under the guild's name so an owner reads a guild's application as one
+  // thing. "Invite all" is N ordinary invites — one PATCH per row, the same
+  // write the row's own button sends — because admission stays per person on the
+  // project (ADR 0365: N clicks, not one, is the honest cost; this only makes the
+  // N clicks one gesture). Nothing here is authority (ADR 0016): every row keeps
+  // its own pill, profile and buttons.
+  //
+  // The label counts only on a VOUCHED row. The server resolves it from the vouch
+  // alone, and an unvouched row wearing a guild would be the impersonation shape
+  // the vouch pill exists to expose. When no row carries a guild (an older hub, no
+  // hub, nobody applied with one) the list is exactly what it always was: one
+  // list, no group heads.
+  function guildOf(r) {
+    const g = r && r.vouched ? r.guild : null;
+    return g && typeof g.name === 'string' && g.name ? g : null;
+  }
+
+  // Groups in the order their newest applicant arrived; rows keep the server's
+  // order inside each. Two unlisted guilds that share a name share a head — the
+  // hub names an unlisted guild without an address, so the name is all there is.
+  function groupByGuild(requests) {
+    const groups = new Map();
+    const solo = [];
+    for (const r of requests) {
+      const g = guildOf(r);
+      if (!g) { solo.push(r); continue; }
+      const key = g.slug ? `slug:${g.slug}` : `name:${g.name}`;
+      if (!groups.has(key)) groups.set(key, { guild: g, rows: [] });
+      groups.get(key).rows.push(r);
+    }
+    return { groups: [...groups.values()], solo };
+  }
+
+  // The guild's own page on the hub when it has one. An unlisted guild has no
+  // slug and a vanilla instance has no hub; either way the name is plain text,
+  // never a link to nowhere.
+  function guildNameHtml(g) {
+    const hub = typeof window.OTB.hubOrigin === 'function' ? window.OTB.hubOrigin() : null;
+    const name = escapeHtml(g.name);
+    return hub && g.slug
+      ? `<a class="ov-group__name gate-guild__link" href="${escapeHtml(`${hub}/g/${encodeURIComponent(g.slug)}`)}">${name}</a>`
+      : `<span class="ov-group__name">${name}</span>`;
+  }
+
+  // "Invite all" covers the rows still waiting, and only two or more of them —
+  // a lone applicant already has their own Invite. The decided views offer no
+  // bulk move at all: a mass rescind is not a gesture this queue makes.
+  function bulkInviteHtml(rows) {
+    if (gateView !== 'pending') return '';
+    const ids = rows.filter((r) => r.status === 'pending').map((r) => r.id);
+    if (ids.length < 2) return '';
+    return ghost(`data-gate-bulk="invited" data-ids="${escapeHtml(ids.join(','))}"`, `Invite all ${ids.length}`);
+  }
+
+  function gateListHtml(requests) {
+    const list = (rows) => '<ul class="ov-rows">' + rows.map(gateRowHtml).join('') + '</ul>';
+    const { groups, solo } = groupByGuild(requests);
+    if (!groups.length) return list(solo);
+    const head = (name, n, extra) => `<div class="ov-group__head">${name}<span class="ov-group__n">${n}</span>${extra}</div>`;
+    return groups.map(({ guild, rows }) => (
+      `<section class="ov-group gate-guild">${head(guildNameHtml(guild), rows.length, bulkInviteHtml(rows))}${list(rows)}</section>`
+    )).join('') + (solo.length
+      ? `<section class="ov-group">${head('<span class="ov-group__name">On their own</span>', solo.length, '')}${list(solo)}</section>`
+      : '');
+  }
+
+  // Each invite settles on its own, so one refusal cannot strand the rest; the
+  // toast says how many landed, and the re-read shows exactly which.
+  async function inviteAll(ids) {
+    const settled = await Promise.allSettled(ids.map((id) =>
+      patchJson(`/access-requests/${encodeURIComponent(id)}`, { status: 'invited' })));
+    const failed = settled.filter((s) => s.status === 'rejected').map((s) => s.reason);
+    if (failed.some((e) => e && e.kind === '401')) throw failed.find((e) => e && e.kind === '401');
+    if (failed.length === ids.length) throw failed[0];
+    toast(failed.length
+      ? `Invited ${ids.length - failed.length} of ${ids.length} — ${failed[0].message || failed[0]}`
+      : `Invited all ${ids.length}.`);
+    await loadGate();
+  }
+
   function renderGate(data, target) {
     const requests = Array.isArray(data.requests) ? data.requests : [];
     // The attention tile counts WAITING work, never whatever list is on screen:
@@ -531,10 +615,12 @@
     if (gateView === 'pending') setAttention('att-access', requests.length);
     const head = inviteFormHtml() + '<div id="gate-view"></div>';
     target.innerHTML = requests.length
-      ? head + '<ul class="ov-rows">' + requests.map(gateRowHtml).join('') + '</ul>'
+      ? head + gateListHtml(requests)
       : head + emptyStateHtml(gateEmptyMsg());
 
     if (requests.length) {
+      wireActions(target, '[data-gate-bulk]', (btn) =>
+        inviteAll(String(btn.getAttribute('data-ids') || '').split(',').filter(Boolean)), 'Could not invite');
       wireActions(target, '[data-gate-action]', async (btn) => {
         const id = btn.getAttribute('data-id');
         const status = btn.getAttribute('data-gate-action');

package/modules/hall-ui/records/oversight-family.md

@@ -16,4 +16,10 @@ Also gone, and the one rule in that list: a sealed state is a `.scroll` panel wh
 - **The three lifecycle states sit behind one `makeFilterBar` switch**, so the decided history is readable and the RESCIND (`invited → dismissed`) the route has always taken is finally offered — ADR 0208 recorded that nothing on this page did. A declined row offers no button: reviving one is the invite form above, which is what the server's own 409 names. The switch is rebuilt each render (the same lifecycle `wireInviteForm` lives with, since `section` replaces the whole body).
 - **The `att-access` tile counts pending only.** Its sub line says "pending", so the count is guarded on the pending view — reading the history must not repaint the board with a number that means something else.
 
+**The queue gathers a guild's applicants under the guild's name (task 1002304, R28; ADR 0365 D5).** Rows carry the hub's `guild` label beside `profile`, and `gateListHtml` groups the VOUCHED rows that have one into `.ov-group` sections — the guild's name (a link to `<hub>/g/<slug>` when the page carries a hub origin and the guild is public), the count, and, on the pending view with two or more waiting, an "Invite all N" that sends N ordinary `PATCH {status:'invited'}`s and re-reads once. Three rules it keeps:
+
+- **No guild anywhere means no group heads at all** — an older hub, no hub, or nobody applying with a guild renders the one list it always did. The rest sit under "On their own" only when at least one guild group exists.
+- **An unvouched row is never filed under a guild**, even if it carries one: the server resolves the label from the vouch alone, and a guild head over an unvouched name would be the impersonation shape the pill exists to expose.
+- **Admission stays per person.** Every grouped row keeps its own pill, profile and buttons; "Invite all" is N clicks made one gesture, never a new write, and the decided views offer no bulk move. `tests/watch_applications_queue.mjs` drives all of it; the harness fixture `access-requests.json` carries a three-member public guild and a one-member unlisted one.
+
 Also gone: harbor's 280px card deck with a 4px coloured "roof" band per box and gate's crate with a verdict band (state is a `.fact-pill`; the fleet reads in three grouped runs — running, parked or in transition, no box); government's bordered `.gov-section` boxes and the one `.gov-assign-row` five unrelated lists shared (each renders as the row it is); watch's third copy of the stat tile, its `table.watch`, its `.watch-btn`; three bare `<p>` sealed states (each is a `.scroll` panel whose lede is written from `OTB.rankLabel('metic')`, so the floor cannot drift from ADR 0157). The harness gained fixtures for `/boxes`, `/gate-approvals` and five session rows, because a page that only ever renders its error state cannot be redesigned by looking.

package/modules/onboarding/routes/access-requests.js

@@ -139,6 +139,12 @@ const MAX_LIVE_PROFILE_READS = 25;
 //
 // Each read fails soft to null independently (the doorway port swallows), so one
 // slow or missing account cannot fail the others or the listing.
+//
+// THE GUILD LABEL RIDES THE SAME READ (ADR 0365 D5, task 1002304): `guild` is
+// { slug, name } when the applicant applied with their guild, else null — so it
+// is keyed on the vouch and budgeted by the cap exactly as the profile is, and
+// the queue groups a guild's applicants by it. An older hub sends no guild, and
+// every row then carries `guild: null` and renders as it always did.
 async function attachApplicantProfiles(rows) {
   // The budget is spent UP FRONT, by index, rather than by decrementing a shared
   // counter inside the concurrent callbacks. Both are correct today — `.map`
@@ -151,10 +157,10 @@ async function attachApplicantProfiles(rows) {
   rows.forEach((r, i) => {
     if (r.applicant_github_id && resolvable.size < MAX_LIVE_PROFILE_READS) resolvable.add(i);
   });
-  return Promise.all(rows.map(async (r, i) => ({
-    ...r,
-    profile: resolvable.has(i) ? await api.readApplicantProfileFromHub(r.applicant_github_id) : null,
-  })));
+  return Promise.all(rows.map(async (r, i) => {
+    const view = resolvable.has(i) ? await api.readApplicantViewFromHub(r.applicant_github_id) : null;
+    return { ...r, profile: view ? view.profile : null, guild: view ? view.guild : null };
+  }));
 }
 
 // THE HUB'S NOTICE OF THIS PROJECT'S INVITES (task 1002818, ADR 0353). On a hosted

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.63",
+  "version": "1.21.64",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.63",
+      "version": "1.21.64",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
@@ -772,9 +772,9 @@
       "license": "MIT"
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -782,6 +782,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/qs": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.63",
+  "version": "1.21.64",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9154,5 +9154,11 @@
       "id": "1004583",
       "text": "Builders can now accept or decline a guild invite from their projects page, choosing first whether their numbers count toward the guild's totals, and guild owners can answer join requests there too."
     }
+  ],
+  "1.21.64": [
+    {
+      "id": "1002304",
+      "text": "Owners now see people who applied with a guild grouped under that guild's name in the applications queue, with one \"Invite all\" button that still admits each person individually."
+    }
   ]
 }

package/src/bongos/auth-admission.js

@@ -534,7 +534,29 @@ async function safeSyncRankRole(builder) {
 // null this function already promises on every other failure.
 const APPLICANT_PROFILE_TIMEOUT_MS = 5000;
 
-async function readApplicantProfileFromHub(githubId) {
+// The guild an applicant applied with, as the hub labels it beside their profile
+// (ADR 0365 D5, task 1002304): { slug, name }, or null. Cross-instance input, so
+// it is re-bounded here rather than trusted — the hub's own caps mirrored (a guild
+// name is at most 80 characters, a slug is the handle charset). A slug that does
+// not fit is dropped to null, which the queue already reads as "no public page";
+// a name that does not fit drops the whole label, and the row simply shows no
+// guild. An OLDER hub sends no `guild` at all, which is the same null.
+const GUILD_LABEL_NAME_MAX = 80;
+const GUILD_LABEL_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$/;
+
+function applicantGuildLabel(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const name = typeof raw.name === 'string' ? raw.name.trim() : '';
+  if (!name || name.length > GUILD_LABEL_NAME_MAX) return null;
+  const slug = typeof raw.slug === 'string' && GUILD_LABEL_SLUG_RE.test(raw.slug) ? raw.slug : null;
+  return { slug, name };
+}
+
+// readApplicantViewFromHub(githubId) → { profile, guild } | null — the same live
+// read, with the guild label the hub sends beside the profile (ADR 0365 D5). The
+// label rides ONLY beside a profile, here as on the hub: an applicant who
+// discloses nothing discloses no guild either, so a null profile is a null view.
+async function readApplicantViewFromHub(githubId) {
   const idp = loadIdpConfig();
   if (!idp || githubId == null) return null;
   try {
@@ -550,13 +572,21 @@ async function readApplicantProfileFromHub(githubId) {
     });
     if (!r.ok) return null;
     const body = await r.json().catch(() => null);
-    return (body && body.profile) || null;
+    const profile = (body && body.profile) || null;
+    return profile ? { profile, guild: applicantGuildLabel(body.guild) } : null;
   } catch (err) {
     log.info('[auth] hub applicant-profile read failed (non-blocking):', err.message);
     return null;
   }
 }
 
+// The profile half alone — the doorway port this read first shipped as, kept so
+// a module on it reads exactly what it always did.
+async function readApplicantProfileFromHub(githubId) {
+  const view = await readApplicantViewFromHub(githubId);
+  return view ? view.profile : null;
+}
+
 // notifyHubOfInvite(githubLogin, { invited }) — tell the hub about THIS project's own
 // invite, so the invitee sees it in My Projects (task 1002818, ADR 0353). `invited:
 // true` after the invite route leaves the login holding an invited row; `false` after
@@ -601,6 +631,7 @@ module.exports = {
   firstTimeAdmissionBlocked,
   instanceNeedsFirstAdmin,
   readApplicantProfileFromHub,
+  readApplicantViewFromHub,
   // Re-exported, not defined here (task 1003579 moved it to project-door.js with
   // the two knobs it composes against). auth.js, the doorway's api.joinabilityMode
   // and four test files import it by this path, and the read-back it answers —

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readApplicantProfileFromHub, readApplicantViewFromHub, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, readApplicationVouch, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -828,6 +828,7 @@ module.exports = {
   openEnrollmentEnabled,
   joinabilityMode,
   readApplicantProfileFromHub,
+  readApplicantViewFromHub,
   notifyHubOfInvite,
   readApplicationVouch,
   firstTimeAdmissionBlocked,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.63'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.64'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -362,6 +362,12 @@ module.exports = {
   //     re-address it. Fails soft to null on every error, so a hub outage costs
   //     the profile block and never the queue.
   get readApplicantProfileFromHub() { return require('./bongos/auth').readApplicantProfileFromHub; },
+  // readApplicantViewFromHub(githubId) — the same read and the same narrow port,
+  //     answering { profile, guild } | null: the profile above plus the guild the
+  //     applicant applied with, { slug, name } or null (ADR 0365 D5, task
+  //     1002304). The guild rides only beside a profile, so a null profile is a
+  //     null view; an older hub that sends no guild answers guild: null.
+  get readApplicantViewFromHub() { return require('./bongos/auth').readApplicantViewFromHub; },
   // notifyHubOfInvite(githubLogin, { invited }) — tell the hub about one of THIS
   //     project's invites (true) or its rescind (false), so the invitee sees it in
   //     My Projects (task 1002818, ADR 0353). The same narrow-port reason as the

package/tests/applicant_view_guild.mjs

@@ -0,0 +1,101 @@
+// tests/applicant_view_guild.mjs — the guild label reaches the project (task
+// 1002304, R28 of goal 1000110; ADR 0365 D5).
+//
+// THE GAP. The hub's POST /sso/applicant-profile answers { profile, guild } since
+// task 1002303, and core kept only `body.profile` — so the reviewer queue could
+// never know which applicants came as a guild. readApplicantViewFromHub is the
+// same live read answering both halves, and readApplicantProfileFromHub is kept
+// for any module on the older port.
+//
+// WHAT IS PINNED. The label is cross-instance input, so it is re-bounded here
+// (the hub's own caps mirrored) rather than trusted; it rides only beside a
+// profile, as it does on the hub; and an older hub that sends no guild is a
+// guild of null, never an error.
+//
+// DB-free and network-free: auth-config is pinned in require.cache so the
+// federation config resolves without env, and global fetch is a spy (the
+// tests/applicant_profile_read_bounds.mjs idiom).
+//
+// Run:  node --test --test-reporter=tap tests/applicant_view_guild.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const cfgPath = require.resolve('../src/bongos/auth-config.js');
+const realCfg = require('../src/bongos/auth-config.js');
+require.cache[cfgPath] = {
+  id: cfgPath,
+  filename: cfgPath,
+  loaded: true,
+  exports: {
+    ...realCfg,
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'cid', clientSecret: 'sec' }),
+  },
+};
+
+const admission = require('../src/bongos/auth-admission.js');
+const api = require('../src/module-api.js');
+
+const PROFILE = { view: 'sliver', sliver: { handle: 'bo' } };
+
+// The hub answers `body` for every call; the result is what the read returns.
+async function viewFor(body) {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, json: async () => body });
+  try { return await admission.readApplicantViewFromHub(42); } finally { globalThis.fetch = real; }
+}
+
+test('the guild the hub names rides beside the profile', async () => {
+  const view = await viewFor({ profile: PROFILE, guild: { slug: 'lantern-works', name: 'Lantern Works' } });
+  assert.deepEqual(view, { profile: PROFILE, guild: { slug: 'lantern-works', name: 'Lantern Works' } });
+});
+
+test('an unlisted guild keeps its name and its null slug', async () => {
+  const view = await viewFor({ profile: PROFILE, guild: { slug: null, name: 'Night Shift' } });
+  assert.deepEqual(view.guild, { slug: null, name: 'Night Shift' });
+});
+
+test('an OLDER hub that sends no guild is guild null, and the profile is untouched', async () => {
+  const view = await viewFor({ profile: PROFILE });
+  assert.deepEqual(view, { profile: PROFILE, guild: null });
+});
+
+test('no profile, no view — a guild never rides alone (the hub’s own rule, restated here)', async () => {
+  assert.equal(await viewFor({ profile: null, guild: { slug: 'lantern-works', name: 'Lantern Works' } }), null);
+});
+
+test('a label outside the hub’s own caps is not trusted', async () => {
+  const name81 = 'x'.repeat(81);
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: name81 } })).guild, null, 'a name over 80 characters drops the label');
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: '   ' } })).guild, null, 'a blank name is no name');
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: 7 } })).guild, null, 'a name must be text');
+  assert.equal((await viewFor({ profile: PROFILE, guild: 'Lantern Works' })).guild, null, 'a label must be an object');
+  for (const slug of ['Lantern Works', '-lead', 'trail-', '<script>', 'x'.repeat(40), 42]) {
+    assert.deepEqual((await viewFor({ profile: PROFILE, guild: { slug, name: 'Lantern' } })).guild, { slug: null, name: 'Lantern' },
+      `a slug outside the handle charset (${JSON.stringify(slug)}) is no address — the name still labels the row`);
+  }
+});
+
+test('the older port answers the profile alone, exactly as it always did', async () => {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, json: async () => ({ profile: PROFILE, guild: { slug: 'a1', name: 'A' } }) });
+  try {
+    assert.deepEqual(await admission.readApplicantProfileFromHub(42), PROFILE);
+  } finally { globalThis.fetch = real; }
+});
+
+test('a failed hub read is a null view, like every other failure here', async () => {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => { throw new Error('ECONNREFUSED'); };
+  try {
+    assert.equal(await admission.readApplicantViewFromHub(42), null);
+  } finally { globalThis.fetch = real; }
+});
+
+test('a module reaches it through the doorway, the same narrow port as the profile read', () => {
+  assert.equal(api.readApplicantViewFromHub, admission.readApplicantViewFromHub);
+  assert.equal(api.readApplicantProfileFromHub, admission.readApplicantProfileFromHub);
+});

package/tests/application_lifecycle.mjs

@@ -390,6 +390,10 @@ let actingRank = 'archon';
 let actingId = 42;
 // The hub notice port (task 1002818, ADR 0353), recorded instead of sent.
 let notices = [];
+// The hub's applicant view (task 1002304, ADR 0365 D5): github_id → what the hub
+// answers, recorded so a test can see WHICH ids were asked about. Empty = no hub.
+let hubViews = {};
+let hubAsked = [];
 
 require.cache[apiPath].exports = {
   ...realApi,
@@ -403,6 +407,7 @@ require.cache[apiPath].exports = {
   readApplicationVouch: (token, { githubLogin } = {}) =>
     applicationVouchIdentity(token, { githubLogin, publicKey: hubPublicKey, clientId: SELF_CLIENT_ID }),
   notifyHubOfInvite: (login, opts) => { notices.push({ login, invited: opts && opts.invited }); },
+  readApplicantViewFromHub: async (githubId) => { hubAsked.push(githubId); return hubViews[githubId] || null; },
 };
 
 seams._reset();
@@ -447,7 +452,7 @@ function call(method, pathname, body, extraHeaders = {}) {
     req.end(payload);
   });
 }
-const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; };
+const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; hubViews = {}; hubAsked = []; };
 
 // ===========================================================================
 // The interpreter is the instrument, so it is calibrated first
@@ -670,6 +675,38 @@ test('list-pending: the queue filters on status and NOTHING else', async () => {
     'an extra predicate here would hide rows from the owner, and a placeholder-free one is invisible to the fake pool');
 });
 
+// The guild label (task 1002304, R28; ADR 0365 D5): the hub answers { profile,
+// guild } and core used to keep only the profile. It rides the SAME vouch-keyed
+// read, so it can reach a row only the way the profile can.
+test('list-pending: a vouched applicant’s guild rides onto the row beside their profile', async () => {
+  reset();
+  const profile = { view: 'sliver', sliver: { handle: 'bo-h' } };
+  hubViews['9002'] = { profile, guild: { slug: 'lantern-works', name: 'Lantern Works' } };
+  const r = await call('GET', '/api/gds/access-requests');
+  const bo = r.json.requests.find((x) => x.github_login === 'bo');
+  assert.deepEqual(bo.profile, profile);
+  assert.deepEqual(bo.guild, { slug: 'lantern-works', name: 'Lantern Works' });
+});
+
+test('list-pending: an unvouched row is never asked about, and carries guild null', async () => {
+  reset();
+  hubViews['9002'] = { profile: { view: 'sliver', sliver: {} }, guild: { slug: null, name: 'Night Shift' } };
+  const r = await call('GET', '/api/gds/access-requests');
+  const ada = r.json.requests.find((x) => x.github_login === 'ada');
+  assert.equal(ada.guild, null, 'a login anybody could have typed must not borrow a guild');
+  assert.equal(ada.profile, null);
+  assert.deepEqual(hubAsked, ['9002'], 'only the vouched row reached the hub');
+});
+
+test('list-pending: a hub that answers nothing (or an older one) leaves every row as it was', async () => {
+  reset();
+  const r = await call('GET', '/api/gds/access-requests');
+  for (const row of r.json.requests) {
+    assert.equal(row.guild, null, `${row.github_login}: no view, no guild`);
+    assert.equal(row.profile, null);
+  }
+});
+
 test('list-pending: ?status=invited|dismissed reads the audit trail, and a bad status is refused', async () => {
   reset();
   const invited = await call('GET', '/api/gds/access-requests?status=invited');

package/tests/module_api.mjs

@@ -48,6 +48,7 @@ const PUBLISHED_SURFACE = [
   'projectJoinDoor', // added by task 1002331 (ADR 0182 D6 / ADR 0247): the COMPOSED join/apply door — visibility × join grant × joinability, one answer, so a module reading a single knob cannot re-open a door the other two closed
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
+  'readApplicantViewFromHub', // added by task 1002304 (ADR 0365 D5): the same NARROW hub read as readApplicantProfileFromHub, answering { profile, guild } so the reviewer queue can group a guild's applicants. The guild rides only beside a profile, and the older port is kept so a module on it reads exactly what it did
   'notifyHubOfInvite', // added by task 1002818 (ADR 0353): tell the hub about one of THIS project's invites (or its rescind) so the invitee sees it in My Projects. The same NARROW-port reason as readApplicantProfileFromHub: the call carries this instance's hub client secret, so a module passes one login and one direction and can neither widen nor re-address it
   'inviteExpiry', // added by task 1002969 (ADR 0356): the ONE read-time definition of when a recruit invite's door closes. The sign-in gate reads it in core; the onboarding queues and the hub's notice list are modules, so without the doorway each would restate the 30 days and the predicate, and two copies can close a door on different days
   'readApplicationVouch', // added by task 1002285 (ADR 0201 D2): the public access-request write's check of the hub's application vouch. NARROW for the same reason — core supplies the hub key and this instance's client_id, so a module passes a token and a login and can neither swap the key nor re-address the audience