@bongos/core 1.21.63 → 1.21.65

package/modules/memory/module.json

@@ -18,6 +18,8 @@
       "search-index"
     ]
   },
-  "provides": [],
+  "provides": [
+    "memory.searchPublicDocs"
+  ],
   "consumes": []
 }

package/modules/memory/routes/search.js

@@ -58,6 +58,15 @@ function searchRateLimit(req, res, next) {
 }
 
 module.exports = function buildSearchRouter() {
+  // Port `memory.searchPublicDocs` (task 1002534, ADR 0367): recall for the
+  // Discord #support answerer, which has no session. Its scope (public docs on
+  // the caller's allowlist, nothing rank-gated, nothing owned) is fixed inside
+  // searchPublicDocs; this is an in-process port, not an HTTP surface, so the
+  // "no public search route" rule above still holds. hasProvider-guarded so a
+  // test that rebuilds the router never double-registers.
+  if (!api.hasProvider('memory.searchPublicDocs')) {
+    api.registerProvider('memory.searchPublicDocs', (args) => search.searchPublicDocs(args));
+  }
   const router = express.Router();
 
   // POST /search — two modes (ADR 0095 C1 / task 1658, progressive disclosure):

package/modules/memory/search.js

@@ -84,7 +84,7 @@ function clampLimit(limit) {
 //   builderRank — the caller's LIVE rank (min_rank scoping).
 // Optional: limit (clamped 1..50), sourceKind ('doc' | 'db' | null = both).
 async function searchChunks(
-  { q, limit = DEFAULT_LIMIT, sourceKind = null, builderId, builderRank } = {},
+  { q, limit = DEFAULT_LIMIT, sourceKind = null, builderId, builderRank, sourceRefPatterns = null } = {},
   { pool: p = pool, client = null } = {}
 ) {
   const query = typeof q === 'string' ? q.trim() : '';
@@ -93,9 +93,13 @@ async function searchChunks(
   const allowedRanks = ranksAtOrBelow(builderRank);
   const ownerId = Number.isInteger(builderId) ? builderId : (Number(builderId) || null);
   const kind = sourceKind === 'doc' || sourceKind === 'db' ? sourceKind : null;
+  // An optional source_ref allowlist (LIKE patterns from refPatterns), applied in
+  // the same scoped CTE as the rank/owner predicate. Null = no narrowing (the
+  // route never passes it); searchPublicDocs always does.
+  const refs = Array.isArray(sourceRefPatterns) ? sourceRefPatterns : null;
 
   // $1 q · $2 allowedRanks[] · $3 ownerId · $4 sourceKind|null · $5 legCandidates · $6 finalLimit
-  // · $7 RRF_K · $8 usefulnessWeight · $9 usefulnessScale (ADR 0095 C3)
+  // · $7 RRF_K · $8 usefulnessWeight · $9 usefulnessScale (ADR 0095 C3) · $10 refPatterns[]|null
   // The scope predicate is shared by both legs (built once as a SQL fragment).
   // websearch_to_tsquery tolerates arbitrary user input (no tsquery syntax to
   // escape); the `<%` operator uses pg_trgm.word_similarity_threshold.
@@ -106,6 +110,7 @@ async function searchChunks(
        WHERE min_rank = ANY($2::text[])
          AND (owner_builder_id IS NULL OR owner_builder_id = $3::bigint)
          AND ($4::text IS NULL OR source_kind = $4::text)
+         AND ($10::text[] IS NULL OR source_ref LIKE ANY($10::text[]))
     ),
     fts AS (
       SELECT id,
@@ -150,7 +155,7 @@ async function searchChunks(
      ORDER BY score DESC, c.id
      LIMIT $6;
   `;
-  const params = [query, allowedRanks, ownerId, kind, LEG_CANDIDATES, lim, RRF_K, USEFULNESS_WEIGHT, USEFULNESS_SCALE];
+  const params = [query, allowedRanks, ownerId, kind, LEG_CANDIDATES, lim, RRF_K, USEFULNESS_WEIGHT, USEFULNESS_SCALE, refs];
   let rows;
   if (client) {
     // Test seam (#950 isolation suite): the caller owns the transaction AND the
@@ -204,6 +209,64 @@ async function searchChunks(
   });
 }
 
+// refPatterns — a docs allowlist as SQL LIKE patterns. An entry ending in '/' is
+// a folder (prefix match); any other entry is one exact file. LIKE's own
+// wildcards are escaped so a path with '_' or '%' in it matches only itself.
+// Anything that is not a plain repo-relative path (absolute, '..', a backslash,
+// empty) is dropped, so a malformed entry narrows the corpus, never widens it.
+function refPatterns(refs) {
+  if (!Array.isArray(refs)) return [];
+  const out = [];
+  for (const raw of refs) {
+    const ref = typeof raw === 'string' ? raw.trim() : '';
+    if (!ref || ref.startsWith('/') || ref.includes('\\') || ref.split('/').includes('..')) continue;
+    const escaped = ref.replace(/[%_]/g, (c) => `\\${c}`);
+    out.push(ref.endsWith('/') ? `${escaped}%` : escaped);
+  }
+  return out;
+}
+
+// searchPublicDocs — recall for someone with NO session: the Discord #support
+// answerer (task 1002534, ADR 0367), served through the `memory.searchPublicDocs`
+// port. Its scope is FIXED HERE and never taken from the caller:
+//   source_kind = 'doc'   (no DB prose: task bodies, learnings, session rows)
+//   min_rank    = 'xenos' (no rank-gated doc: ADR 0043's protected set is metic)
+//   owner       = none    (no builder's private chunk)
+//   source_ref  ∈ refs    (the caller's allowlist of public docs; REQUIRED)
+// xenos is still a signed-in rank, which is why the allowlist is required: an
+// empty or missing list returns [] rather than everything a xenos may read.
+// Returns up to `limit` hits with the chunk body (capped at maxChars), and the
+// body read re-applies the whole scope, so it can't widen what search found.
+async function searchPublicDocs(
+  { q, refs, limit = 5, maxChars = 1500 } = {},
+  { pool: p = pool, client = null } = {}
+) {
+  const patterns = refPatterns(refs);
+  if (!patterns.length) return [];
+  const hits = await searchChunks(
+    { q, limit: Math.min(clampLimit(limit), 10), sourceKind: 'doc', builderId: null, builderRank: 'xenos', sourceRefPatterns: patterns },
+    { pool: p, client }
+  );
+  if (!hits.length) return [];
+  const cap = Math.max(200, Math.min(Number(maxChars) || 1500, 4000));
+  const sql = `
+    SELECT id, source_ref, heading_path, title, left(body, $2::int) AS body
+      FROM search_chunks
+     WHERE id = ANY($1::bigint[])
+       AND source_kind = 'doc'
+       AND min_rank = 'xenos'
+       AND owner_builder_id IS NULL
+       AND source_ref LIKE ANY($3::text[])`;
+  const params = [hits.map((h) => h.id), cap, patterns];
+  const { rows } = client ? await client.query(sql, params) : await p.query(sql, params);
+  const byId = new Map(rows.map((r) => [Number(r.id), r]));
+  // Keep the search's ranking order.
+  return hits.filter((h) => byId.has(h.id)).map((h) => {
+    const r = byId.get(h.id);
+    return { id: h.id, source_ref: r.source_ref, heading_path: r.heading_path, title: r.title, body: r.body || '', score: h.score };
+  });
+}
+
 // fetchChunkBody — the EXPAND half of progressive disclosure (ADR 0095 C1 / task
 // 1658). Given a chunk id, return its FULL body — but scoped exactly like
 // searchChunks (same min_rank + owner predicate built from the authenticated
@@ -505,6 +568,8 @@ function classifyEmptyResult(health) {
 
 module.exports = {
   searchChunks,
+  searchPublicDocs,
+  refPatterns,
   // task 1003097: a zero-result search must say WHICH of three things happened —
   // a dead index, a scoping wall, or a genuine miss.
   corpusHealth,

package/modules/onboarding/routes/access-requests.js

@@ -139,6 +139,12 @@ const MAX_LIVE_PROFILE_READS = 25;
 //
 // Each read fails soft to null independently (the doorway port swallows), so one
 // slow or missing account cannot fail the others or the listing.
+//
+// THE GUILD LABEL RIDES THE SAME READ (ADR 0365 D5, task 1002304): `guild` is
+// { slug, name } when the applicant applied with their guild, else null — so it
+// is keyed on the vouch and budgeted by the cap exactly as the profile is, and
+// the queue groups a guild's applicants by it. An older hub sends no guild, and
+// every row then carries `guild: null` and renders as it always did.
 async function attachApplicantProfiles(rows) {
   // The budget is spent UP FRONT, by index, rather than by decrementing a shared
   // counter inside the concurrent callbacks. Both are correct today — `.map`
@@ -151,10 +157,10 @@ async function attachApplicantProfiles(rows) {
   rows.forEach((r, i) => {
     if (r.applicant_github_id && resolvable.size < MAX_LIVE_PROFILE_READS) resolvable.add(i);
   });
-  return Promise.all(rows.map(async (r, i) => ({
-    ...r,
-    profile: resolvable.has(i) ? await api.readApplicantProfileFromHub(r.applicant_github_id) : null,
-  })));
+  return Promise.all(rows.map(async (r, i) => {
+    const view = resolvable.has(i) ? await api.readApplicantViewFromHub(r.applicant_github_id) : null;
+    return { ...r, profile: view ? view.profile : null, guild: view ? view.guild : null };
+  }));
 }
 
 // THE HUB'S NOTICE OF THIS PROJECT'S INVITES (task 1002818, ADR 0353). On a hosted

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.63",
+  "version": "1.21.65",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.63",
+      "version": "1.21.65",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
@@ -772,9 +772,9 @@
       "license": "MIT"
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -782,6 +782,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/qs": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.63",
+  "version": "1.21.65",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9154,5 +9154,17 @@
       "id": "1004583",
       "text": "Builders can now accept or decline a guild invite from their projects page, choosing first whether their numbers count toward the guild's totals, and guild owners can answer join requests there too."
     }
+  ],
+  "1.21.64": [
+    {
+      "id": "1002304",
+      "text": "Owners now see people who applied with a guild grouped under that guild's name in the applications queue, with one \"Invite all\" button that still admits each person individually."
+    }
+  ],
+  "1.21.65": [
+    {
+      "id": "1002534",
+      "text": "The Discord bot can now answer questions in #support when someone @-mentions it, using only the project's public newcomer docs. It ships switched off: it starts answering once the owner adds an Anthropic key and turns it on, a"
+    }
   ]
 }

package/scripts/gds/credential-presence.js

@@ -96,6 +96,11 @@ const CREDENTIALS = [
     names: ['DISCORD_BOT_TOKEN'],
     purpose: 'the Discord bot (modules/discord); also readable from discord-bot.json in the config dir',
   },
+  {
+    id: 'discord-support', file: 'web.env', need: 'optional',
+    names: ['DISCORD_SUPPORT_ANTHROPIC_API_KEY'],
+    purpose: 'the #support answerer (modules/discord/discord-support.js, ADR 0367); its own key, never a host-wide ANTHROPIC_API_KEY',
+  },
   {
     id: 'discord-oauth', file: 'web.env', need: 'optional',
     names: ['DISCORD_CLIENT_ID', 'DISCORD_CLIENT_SECRET'],

package/src/bongos/auth-admission.js

@@ -534,7 +534,29 @@ async function safeSyncRankRole(builder) {
 // null this function already promises on every other failure.
 const APPLICANT_PROFILE_TIMEOUT_MS = 5000;
 
-async function readApplicantProfileFromHub(githubId) {
+// The guild an applicant applied with, as the hub labels it beside their profile
+// (ADR 0365 D5, task 1002304): { slug, name }, or null. Cross-instance input, so
+// it is re-bounded here rather than trusted — the hub's own caps mirrored (a guild
+// name is at most 80 characters, a slug is the handle charset). A slug that does
+// not fit is dropped to null, which the queue already reads as "no public page";
+// a name that does not fit drops the whole label, and the row simply shows no
+// guild. An OLDER hub sends no `guild` at all, which is the same null.
+const GUILD_LABEL_NAME_MAX = 80;
+const GUILD_LABEL_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,37}[a-z0-9])?$/;
+
+function applicantGuildLabel(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const name = typeof raw.name === 'string' ? raw.name.trim() : '';
+  if (!name || name.length > GUILD_LABEL_NAME_MAX) return null;
+  const slug = typeof raw.slug === 'string' && GUILD_LABEL_SLUG_RE.test(raw.slug) ? raw.slug : null;
+  return { slug, name };
+}
+
+// readApplicantViewFromHub(githubId) → { profile, guild } | null — the same live
+// read, with the guild label the hub sends beside the profile (ADR 0365 D5). The
+// label rides ONLY beside a profile, here as on the hub: an applicant who
+// discloses nothing discloses no guild either, so a null profile is a null view.
+async function readApplicantViewFromHub(githubId) {
   const idp = loadIdpConfig();
   if (!idp || githubId == null) return null;
   try {
@@ -550,13 +572,21 @@ async function readApplicantProfileFromHub(githubId) {
     });
     if (!r.ok) return null;
     const body = await r.json().catch(() => null);
-    return (body && body.profile) || null;
+    const profile = (body && body.profile) || null;
+    return profile ? { profile, guild: applicantGuildLabel(body.guild) } : null;
   } catch (err) {
     log.info('[auth] hub applicant-profile read failed (non-blocking):', err.message);
     return null;
   }
 }
 
+// The profile half alone — the doorway port this read first shipped as, kept so
+// a module on it reads exactly what it always did.
+async function readApplicantProfileFromHub(githubId) {
+  const view = await readApplicantViewFromHub(githubId);
+  return view ? view.profile : null;
+}
+
 // notifyHubOfInvite(githubLogin, { invited }) — tell the hub about THIS project's own
 // invite, so the invitee sees it in My Projects (task 1002818, ADR 0353). `invited:
 // true` after the invite route leaves the login holding an invited row; `false` after
@@ -601,6 +631,7 @@ module.exports = {
   firstTimeAdmissionBlocked,
   instanceNeedsFirstAdmin,
   readApplicantProfileFromHub,
+  readApplicantViewFromHub,
   // Re-exported, not defined here (task 1003579 moved it to project-door.js with
   // the two knobs it composes against). auth.js, the doorway's api.joinabilityMode
   // and four test files import it by this path, and the read-back it answers —

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readApplicantProfileFromHub, readApplicantViewFromHub, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, readApplicationVouch, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -828,6 +828,7 @@ module.exports = {
   openEnrollmentEnabled,
   joinabilityMode,
   readApplicantProfileFromHub,
+  readApplicantViewFromHub,
   notifyHubOfInvite,
   readApplicationVouch,
   firstTimeAdmissionBlocked,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.63'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.65'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -362,6 +362,12 @@ module.exports = {
   //     re-address it. Fails soft to null on every error, so a hub outage costs
   //     the profile block and never the queue.
   get readApplicantProfileFromHub() { return require('./bongos/auth').readApplicantProfileFromHub; },
+  // readApplicantViewFromHub(githubId) — the same read and the same narrow port,
+  //     answering { profile, guild } | null: the profile above plus the guild the
+  //     applicant applied with, { slug, name } or null (ADR 0365 D5, task
+  //     1002304). The guild rides only beside a profile, so a null profile is a
+  //     null view; an older hub that sends no guild answers guild: null.
+  get readApplicantViewFromHub() { return require('./bongos/auth').readApplicantViewFromHub; },
   // notifyHubOfInvite(githubLogin, { invited }) — tell the hub about one of THIS
   //     project's invites (true) or its rescind (false), so the invitee sees it in
   //     My Projects (task 1002818, ADR 0353). The same narrow-port reason as the

package/tests/applicant_view_guild.mjs

@@ -0,0 +1,101 @@
+// tests/applicant_view_guild.mjs — the guild label reaches the project (task
+// 1002304, R28 of goal 1000110; ADR 0365 D5).
+//
+// THE GAP. The hub's POST /sso/applicant-profile answers { profile, guild } since
+// task 1002303, and core kept only `body.profile` — so the reviewer queue could
+// never know which applicants came as a guild. readApplicantViewFromHub is the
+// same live read answering both halves, and readApplicantProfileFromHub is kept
+// for any module on the older port.
+//
+// WHAT IS PINNED. The label is cross-instance input, so it is re-bounded here
+// (the hub's own caps mirrored) rather than trusted; it rides only beside a
+// profile, as it does on the hub; and an older hub that sends no guild is a
+// guild of null, never an error.
+//
+// DB-free and network-free: auth-config is pinned in require.cache so the
+// federation config resolves without env, and global fetch is a spy (the
+// tests/applicant_profile_read_bounds.mjs idiom).
+//
+// Run:  node --test --test-reporter=tap tests/applicant_view_guild.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const cfgPath = require.resolve('../src/bongos/auth-config.js');
+const realCfg = require('../src/bongos/auth-config.js');
+require.cache[cfgPath] = {
+  id: cfgPath,
+  filename: cfgPath,
+  loaded: true,
+  exports: {
+    ...realCfg,
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'cid', clientSecret: 'sec' }),
+  },
+};
+
+const admission = require('../src/bongos/auth-admission.js');
+const api = require('../src/module-api.js');
+
+const PROFILE = { view: 'sliver', sliver: { handle: 'bo' } };
+
+// The hub answers `body` for every call; the result is what the read returns.
+async function viewFor(body) {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, json: async () => body });
+  try { return await admission.readApplicantViewFromHub(42); } finally { globalThis.fetch = real; }
+}
+
+test('the guild the hub names rides beside the profile', async () => {
+  const view = await viewFor({ profile: PROFILE, guild: { slug: 'lantern-works', name: 'Lantern Works' } });
+  assert.deepEqual(view, { profile: PROFILE, guild: { slug: 'lantern-works', name: 'Lantern Works' } });
+});
+
+test('an unlisted guild keeps its name and its null slug', async () => {
+  const view = await viewFor({ profile: PROFILE, guild: { slug: null, name: 'Night Shift' } });
+  assert.deepEqual(view.guild, { slug: null, name: 'Night Shift' });
+});
+
+test('an OLDER hub that sends no guild is guild null, and the profile is untouched', async () => {
+  const view = await viewFor({ profile: PROFILE });
+  assert.deepEqual(view, { profile: PROFILE, guild: null });
+});
+
+test('no profile, no view — a guild never rides alone (the hub’s own rule, restated here)', async () => {
+  assert.equal(await viewFor({ profile: null, guild: { slug: 'lantern-works', name: 'Lantern Works' } }), null);
+});
+
+test('a label outside the hub’s own caps is not trusted', async () => {
+  const name81 = 'x'.repeat(81);
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: name81 } })).guild, null, 'a name over 80 characters drops the label');
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: '   ' } })).guild, null, 'a blank name is no name');
+  assert.equal((await viewFor({ profile: PROFILE, guild: { slug: 'ok', name: 7 } })).guild, null, 'a name must be text');
+  assert.equal((await viewFor({ profile: PROFILE, guild: 'Lantern Works' })).guild, null, 'a label must be an object');
+  for (const slug of ['Lantern Works', '-lead', 'trail-', '<script>', 'x'.repeat(40), 42]) {
+    assert.deepEqual((await viewFor({ profile: PROFILE, guild: { slug, name: 'Lantern' } })).guild, { slug: null, name: 'Lantern' },
+      `a slug outside the handle charset (${JSON.stringify(slug)}) is no address — the name still labels the row`);
+  }
+});
+
+test('the older port answers the profile alone, exactly as it always did', async () => {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: true, json: async () => ({ profile: PROFILE, guild: { slug: 'a1', name: 'A' } }) });
+  try {
+    assert.deepEqual(await admission.readApplicantProfileFromHub(42), PROFILE);
+  } finally { globalThis.fetch = real; }
+});
+
+test('a failed hub read is a null view, like every other failure here', async () => {
+  const real = globalThis.fetch;
+  globalThis.fetch = async () => { throw new Error('ECONNREFUSED'); };
+  try {
+    assert.equal(await admission.readApplicantViewFromHub(42), null);
+  } finally { globalThis.fetch = real; }
+});
+
+test('a module reaches it through the doorway, the same narrow port as the profile read', () => {
+  assert.equal(api.readApplicantViewFromHub, admission.readApplicantViewFromHub);
+  assert.equal(api.readApplicantProfileFromHub, admission.readApplicantProfileFromHub);
+});

package/tests/application_lifecycle.mjs

@@ -390,6 +390,10 @@ let actingRank = 'archon';
 let actingId = 42;
 // The hub notice port (task 1002818, ADR 0353), recorded instead of sent.
 let notices = [];
+// The hub's applicant view (task 1002304, ADR 0365 D5): github_id → what the hub
+// answers, recorded so a test can see WHICH ids were asked about. Empty = no hub.
+let hubViews = {};
+let hubAsked = [];
 
 require.cache[apiPath].exports = {
   ...realApi,
@@ -403,6 +407,7 @@ require.cache[apiPath].exports = {
   readApplicationVouch: (token, { githubLogin } = {}) =>
     applicationVouchIdentity(token, { githubLogin, publicKey: hubPublicKey, clientId: SELF_CLIENT_ID }),
   notifyHubOfInvite: (login, opts) => { notices.push({ login, invited: opts && opts.invited }); },
+  readApplicantViewFromHub: async (githubId) => { hubAsked.push(githubId); return hubViews[githubId] || null; },
 };
 
 seams._reset();
@@ -447,7 +452,7 @@ function call(method, pathname, body, extraHeaders = {}) {
     req.end(payload);
   });
 }
-const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; };
+const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; hubViews = {}; hubAsked = []; };
 
 // ===========================================================================
 // The interpreter is the instrument, so it is calibrated first
@@ -670,6 +675,38 @@ test('list-pending: the queue filters on status and NOTHING else', async () => {
     'an extra predicate here would hide rows from the owner, and a placeholder-free one is invisible to the fake pool');
 });
 
+// The guild label (task 1002304, R28; ADR 0365 D5): the hub answers { profile,
+// guild } and core used to keep only the profile. It rides the SAME vouch-keyed
+// read, so it can reach a row only the way the profile can.
+test('list-pending: a vouched applicant’s guild rides onto the row beside their profile', async () => {
+  reset();
+  const profile = { view: 'sliver', sliver: { handle: 'bo-h' } };
+  hubViews['9002'] = { profile, guild: { slug: 'lantern-works', name: 'Lantern Works' } };
+  const r = await call('GET', '/api/gds/access-requests');
+  const bo = r.json.requests.find((x) => x.github_login === 'bo');
+  assert.deepEqual(bo.profile, profile);
+  assert.deepEqual(bo.guild, { slug: 'lantern-works', name: 'Lantern Works' });
+});
+
+test('list-pending: an unvouched row is never asked about, and carries guild null', async () => {
+  reset();
+  hubViews['9002'] = { profile: { view: 'sliver', sliver: {} }, guild: { slug: null, name: 'Night Shift' } };
+  const r = await call('GET', '/api/gds/access-requests');
+  const ada = r.json.requests.find((x) => x.github_login === 'ada');
+  assert.equal(ada.guild, null, 'a login anybody could have typed must not borrow a guild');
+  assert.equal(ada.profile, null);
+  assert.deepEqual(hubAsked, ['9002'], 'only the vouched row reached the hub');
+});
+
+test('list-pending: a hub that answers nothing (or an older one) leaves every row as it was', async () => {
+  reset();
+  const r = await call('GET', '/api/gds/access-requests');
+  for (const row of r.json.requests) {
+    assert.equal(row.guild, null, `${row.github_login}: no view, no guild`);
+    assert.equal(row.profile, null);
+  }
+});
+
 test('list-pending: ?status=invited|dismissed reads the audit trail, and a bad status is refused', async () => {
   reset();
   const invited = await call('GET', '/api/gds/access-requests?status=invited');