@bongos/core 1.24.2 → 1.24.4

package/modules/market-watch/public/hall-widget.js

@@ -0,0 +1,271 @@
+// modules/market-watch/public/hall-widget.js — the weekly ask card in the hall (task 1004940).
+//
+// WHERE IT SHOWS. An action awaiting a member goes in the hall's "Needs your attention" card
+// (goal-inbox.js), never in a new Home card (hall-ui/CLAUDE.md, Placement). So this file adds
+// one SLICE to that card (#attention-market-watch), drawn as the hall's ask card (hall-ask.css
+// `.hask` on an inbox row, the same shape the Blockers slice uses), and calls
+// OTBAttention.refresh() so the card's count and visibility include it. The server injects
+// this file only while Market Watch is enabled (src/module-loader/loader.js
+// hallWidgetScripts); module off, there is no slice.
+//
+// No card this week, a closed week or an answered one: GET /market-watch/ask says
+// { card: null } and the slice stays empty. It never reminds anyone.
+//
+// Design of record: docs/design/mocks/market-watch/weekly-ask.html (option A, quick-tap
+// chips). Every string from the server is escaped here (window.OTB.escapeHtml) — chip
+// labels come from tracked items and the team rows carry members' own words.
+//
+// Under Node this file is require()d for its pure parts (cardHtml, answerBody), the
+// hall-ask.js precedent; nothing touches the DOM until the browser half runs.
+(function () {
+  'use strict';
+  const isNode = typeof window === 'undefined';
+  const esc = (s) => (isNode ? require('../../../src/module-api').escapeHtml : window.OTB.escapeHtml)(s);
+  const API = '/api/bongos/market-watch';
+  const SLICE_ID = 'attention-market-watch';
+  const MAX_TEXT = 80;
+  const MONTHS = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct', 'nov', 'dec'];
+  const DAYS = ['sunday', 'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday'];
+
+  // "monday 3 nov", the mock's way of naming the next ask's day.
+  function dayName(iso) {
+    const d = new Date(`${String(iso).slice(0, 10)}T00:00:00Z`);
+    if (Number.isNaN(d.getTime())) return '';
+    return `${DAYS[d.getUTCDay()]} ${d.getUTCDate()} ${MONTHS[d.getUTCMonth()]}`;
+  }
+
+  const ADD = {
+    rival: { chip: '+ name one', placeholder: 'e.g. Kilo Code', aria: 'name a competitor' },
+    watch: { chip: '+ a topic', placeholder: 'e.g. EU AI Act rules', aria: 'name a topic' },
+  };
+
+  function streakHtml(n) {
+    if (!(n > 0)) return '';
+    const bars = [0, 1, 2, 3, 4].map((i) => `<i${i < Math.min(n, 5) ? '' : ' class="off"'}></i>`).join('');
+    return `<span class="mwask__streak" title="${esc(`${n} week${n === 1 ? '' : 's'} in a row`)}">${bars} ${esc(`${n}-week streak`)}</span>`;
+  }
+
+  function chipHtml(q, o) {
+    return `<button class="mwask__chip" type="button" aria-pressed="false" data-mwask-q="${esc(q)}" data-mwask-choice="${esc(o.label)}">`
+      + `${esc(o.label)}${o.example ? ` <small>${esc(o.example)}</small>` : ''}</button>`;
+  }
+
+  function questionHtml(q, i) {
+    const add = ADD[q.key] || ADD.watch;
+    const head = i === 0
+      ? `<h4 class="hask__q">${esc(q.prompt)}</h4><p class="hask__said">Tap any that fit. Each tap becomes a proposal the owner sees.</p>`
+      : `<p class="mwask__sub">${esc(`and ${q.prompt}`)}</p>`;
+    return head
+      + `<div class="mwask__chips" data-mwask-group="${esc(q.key)}">${(q.options || []).map((o) => chipHtml(q.key, o)).join('')}`
+      + `<button class="mwask__chip mwask__chip--add" type="button" data-mwask-add="${esc(q.key)}">${esc(add.chip)}</button></div>`
+      + `<div class="mwask__add" data-mwask-addrow="${esc(q.key)}" hidden><input type="text" maxlength="${MAX_TEXT}" placeholder="${esc(add.placeholder)}" aria-label="${esc(add.aria)}">`
+      + `<button class="btn-ghost" type="button" data-mwask-ok="${esc(q.key)}">add</button></div>`;
+  }
+
+  // A decided proposal's pill, in words, never the status column itself.
+  const DECIDED = { approved: 'approved', applied: 'now watched' };
+
+  function rowHtml(r) {
+    const decided = r.status !== 'open';
+    const dot = decided ? ' mwask__dot--done' : (r.verb === 'Watch' ? ' mwask__dot--watch' : '');
+    const what = `${esc(r.verb)} <b>${esc(r.name)}</b>${r.tail ? ` ${esc(r.tail)}` : ''}`;
+    const pill = decided
+      ? `<span class="mwask__pill">${esc(DECIDED[r.status] || 'decided')}</span>`
+      : `<span class="mwask__pill${r.agree >= 2 ? ' mwask__pill--hot' : ''}">${esc(`${r.agree} agree`)}</span>`;
+    return `<li class="mwask__row"><span class="mwask__dot${dot}" aria-hidden="true"></span><span class="mwask__what">${what}</span>`
+      + (r.who ? `<span class="mwask__who">${esc(r.who)}</span>` : '') + `${pill}</li>`;
+  }
+
+  // cardHtml(card, human) → the slice's markup. `human` is the HUMAN DECISION badge markup
+  // (OTBAsk.human), already safe; '' draws the plain dot.
+  function cardHtml(card, human = '') {
+    if (!card || !Array.isArray(card.questions) || !card.questions.length) return '';
+    const where = `market watch · week ${Number(card.week_no) || ''} · about 30 seconds`;
+    return '<h3 class="ginbox__sec-h">This week\'s market ask <span class="ginbox__sub">— about 30 seconds</span></h3>'
+      + '<ul class="ginbox">'
+      + `<li class="hask ginbox__item mwask" data-mwask data-mwask-week="${esc(card.week_of)}" data-mwask-streak="${Number(card.streak) || 0}" data-mwask-next="${esc(dayName(card.next_on))}">`
+      + `<div class="hask__where">${human || '<span class="hask__dot" aria-hidden="true"></span>'}<span class="hask__where-t">${esc(where)}</span><span class="mwask__sp"></span>${streakHtml(Number(card.streak) || 0)}</div>`
+      + '<div class="mwask__body">'
+      + card.questions.map(questionHtml).join('')
+      + '<p class="mwask__err" role="alert"></p>'
+      + '<div class="hask__opts hask__opts--row">'
+      + '<button class="hask__opt hask__opt--rec" type="button" data-mwask-send><span class="hask__label">Pick at least one</span><span class="hask__result">or skip below</span></button>'
+      + '<button class="hask__opt" type="button" data-mwask-nothing><span class="hask__label">Nothing new this week</span><span class="hask__result">keeps your streak</span></button>'
+      + '</div></div>'
+      + '<div class="mwask__done" hidden><h4 class="hask__q" data-mwask-donet></h4><p class="hask__said" data-mwask-dones></p></div>'
+      + '</li></ul>'
+      + (card.team && card.team.length
+        ? `<div class="mwask__lbl">this week's proposals from the team</div><ul class="mwask__rows">${card.team.map(rowHtml).join('')}</ul>`
+        : '');
+  }
+
+  // answerBody(weekOf, pressed) → the POST body. `pressed` is [{ question, choice } | { question, text }]:
+  // a chip carries its label as `choice`, an entry its words as `text`. No builder id: the
+  // server records the caller and refuses a body that names anyone else.
+  function answerBody(weekOf, pressed, nothing = false) {
+    if (nothing) return { week_of: weekOf, nothing: true };
+    const picks = [];
+    const names = [];
+    for (const p of pressed || []) {
+      if (typeof p.text === 'string') names.push({ question: p.question, text: p.text.slice(0, MAX_TEXT) });
+      else picks.push({ question: p.question, choice: p.choice });
+    }
+    return { week_of: weekOf, picks, names };
+  }
+
+  function sendLabel(n) {
+    return n
+      ? { label: `Send ${n} proposal${n > 1 ? 's' : ''}`, result: 'the owner sees each one' }
+      : { label: 'Pick at least one', result: 'or skip below' };
+  }
+
+  if (isNode) {
+    module.exports = { cardHtml, answerBody, sendLabel, dayName };
+    return;
+  }
+
+  // ---- the browser half -------------------------------------------------------
+
+  if (!window.OTB) return;
+  const client = window.BongosClient && window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  let box = null;
+
+  function css() {
+    if (document.querySelector('link[data-mwask-css]')) return;
+    const l = document.createElement('link');
+    l.rel = 'stylesheet';
+    l.href = '/modules/market-watch/public/weekly-ask.css';
+    l.setAttribute('data-mwask-css', '1');
+    document.head.appendChild(l);
+  }
+
+  const refresh = () => { if (window.OTBAttention) window.OTBAttention.refresh(); };
+
+  function pressedIn(li) {
+    return [...li.querySelectorAll('.mwask__chip[aria-pressed="true"]')].map((c) => (c.hasAttribute('data-mwask-free')
+      ? { question: c.getAttribute('data-mwask-q'), text: c.getAttribute('data-mwask-free') }
+      : { question: c.getAttribute('data-mwask-q'), choice: c.getAttribute('data-mwask-choice') }));
+  }
+
+  function recount(li) {
+    const s = sendLabel(pressedIn(li).length);
+    const btn = li.querySelector('[data-mwask-send]');
+    btn.querySelector('.hask__label').textContent = s.label;
+    btn.querySelector('.hask__result').textContent = s.result;
+  }
+
+  function done(li, title) {
+    const streak = (Number(li.getAttribute('data-mwask-streak')) || 0) + 1;
+    const next = li.getAttribute('data-mwask-next');
+    li.querySelector('.mwask__body').hidden = true;
+    li.querySelector('.mwask__body').style.display = 'none';
+    li.querySelector('[data-mwask-donet]').textContent = title;
+    li.querySelector('[data-mwask-dones]').textContent = `${streak}-week streak${next ? ` · next ask on ${next}` : ''}`;
+    li.querySelector('.mwask__done').hidden = false;
+  }
+
+  async function post(li, body) {
+    const err = li.querySelector('.mwask__err');
+    err.textContent = '';
+    li.querySelectorAll('.hask__opt').forEach((b) => { b.disabled = true; });
+    const res = client ? await client.request('POST', `${API}/ask/answer`, { body }) : { ok: false };
+    li.querySelectorAll('.hask__opt').forEach((b) => { b.disabled = false; });
+    if (!res.ok) {
+      const msg = res.data && res.data.error && res.data.error.message;
+      err.textContent = msg || 'Could not send that. Try again in a moment.';
+      return null;
+    }
+    return res.data;
+  }
+
+  function addEntry(li, q) {
+    const row = li.querySelector(`[data-mwask-addrow="${q}"]`);
+    const input = row && row.querySelector('input');
+    const v = input ? input.value.replace(/\s+/g, ' ').trim().slice(0, MAX_TEXT) : '';
+    if (!v) return;
+    const c = document.createElement('button');
+    c.type = 'button';
+    c.className = 'mwask__chip';
+    c.setAttribute('aria-pressed', 'true');
+    c.setAttribute('data-mwask-q', q);
+    c.setAttribute('data-mwask-free', v);
+    c.textContent = v; // textContent: a member's words are never markup
+    const plus = li.querySelector(`[data-mwask-add="${q}"]`);
+    plus.parentNode.insertBefore(c, plus);
+    input.value = '';
+    row.hidden = true;
+    recount(li);
+  }
+
+  async function onClick(e) {
+    const li = e.target.closest('[data-mwask]');
+    if (!li) return;
+    const chip = e.target.closest('.mwask__chip:not(.mwask__chip--add)');
+    if (chip) { chip.setAttribute('aria-pressed', chip.getAttribute('aria-pressed') === 'true' ? 'false' : 'true'); recount(li); return; }
+    const plus = e.target.closest('[data-mwask-add]');
+    if (plus) {
+      const row = li.querySelector(`[data-mwask-addrow="${plus.getAttribute('data-mwask-add')}"]`);
+      row.hidden = false;
+      row.querySelector('input').focus();
+      return;
+    }
+    const ok = e.target.closest('[data-mwask-ok]');
+    if (ok) { addEntry(li, ok.getAttribute('data-mwask-ok')); return; }
+    const week = li.getAttribute('data-mwask-week');
+    if (e.target.closest('[data-mwask-send]')) {
+      const pressed = pressedIn(li);
+      if (!pressed.length) return;
+      const r = await post(li, answerBody(week, pressed));
+      if (r) done(li, `sent. ${pressed.length} proposal${pressed.length > 1 ? 's' : ''} in the queue.`);
+      return;
+    }
+    if (e.target.closest('[data-mwask-nothing]')) {
+      const r = await post(li, answerBody(week, [], true));
+      if (r) done(li, 'noted. nothing new this week.');
+    }
+  }
+
+  function onKey(e) {
+    if (e.key !== 'Enter' || !e.target.matches('.mwask__add input')) return;
+    e.preventDefault();
+    const li = e.target.closest('[data-mwask]');
+    if (li) addEntry(li, e.target.closest('[data-mwask-addrow]').getAttribute('data-mwask-addrow'));
+  }
+
+  async function load() {
+    if (!client || !box) return;
+    const res = await client.request('GET', `${API}/ask`);
+    const card = res && res.ok && res.data ? res.data.card : null;
+    const human = window.OTBAsk && typeof window.OTBAsk.human === 'function' ? window.OTBAsk.human('decision') : '';
+    box.innerHTML = cardHtml(card, human);
+    refresh();
+  }
+
+  // The attention card builds its slices when the hall mounts its widgets, which is after
+  // this file runs (both are deferred, this one first). Wait for the container, once.
+  function mount(slices) {
+    if (box || !slices) return;
+    css();
+    box = document.createElement('div');
+    box.id = SLICE_ID;
+    // Beside the other personal asks (the profile nudge), ahead of project-wide queues.
+    const anchor = slices.querySelector('#attention-ideas');
+    slices.insertBefore(box, anchor || null);
+    box.addEventListener('click', onClick);
+    box.addEventListener('keydown', onKey);
+    load().catch(() => { box.innerHTML = ''; refresh(); });
+  }
+
+  function watch() {
+    const found = document.getElementById('attention-slices');
+    if (found) { mount(found); return; }
+    const mo = new MutationObserver(() => {
+      const s = document.getElementById('attention-slices');
+      if (s) { mo.disconnect(); mount(s); }
+    });
+    mo.observe(document.documentElement, { childList: true, subtree: true });
+  }
+
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', watch);
+  else watch();
+})();

package/modules/market-watch/public/weekly-ask.css

@@ -0,0 +1,39 @@
+/* modules/market-watch/public/weekly-ask.css — the weekly ask card's chips (task 1004940).
+   The card itself is the hall's ask card (hall-ask.css `.hask`, drawn as an inbox row);
+   this sheet adds only what option A (docs/design/mocks/market-watch/weekly-ask.html)
+   has that the hall card does not: the tap-to-toggle chips, the inline add, the streak
+   bars and the team's proposal rows. Colours are the hall's own tokens, never the mock's. */
+
+.mwask__sp { flex: 1; }
+.mwask__streak { display: inline-flex; gap: 6px; align-items: center; flex: none; font-size: 13px; color: var(--ink-soft); white-space: nowrap; }
+.mwask__streak i { width: 18px; height: 6px; border-radius: 3px; background: var(--accent); display: inline-block; }
+.mwask__streak i.off { background: var(--hask-edge); }
+.mwask .hask__where { flex-wrap: wrap; row-gap: 6px; }
+.mwask .hask__where-t { flex: 1 1 auto; min-width: 12ch; }
+.mwask__body { display: contents; }
+.mwask__chips { display: flex; flex-wrap: wrap; gap: 8px; }
+.mwask__chip { display: inline-block; max-width: 100%; min-height: 36px; padding: 8px 14px; box-sizing: border-box; border-radius: 999px; border: 1px solid var(--hask-edge); background: transparent; color: var(--ink); font-family: var(--font-body); font-size: 14px; text-align: left; cursor: pointer; overflow-wrap: anywhere; }
+.mwask__chip:hover { background: var(--hask-chip-pick); }
+.mwask__chip small { margin-left: 4px; color: var(--ink-faint); font-size: 12px; }
+.mwask__chip[aria-pressed="true"] { background: var(--accent-tint); border-color: var(--accent); }
+.mwask__chip[aria-pressed="true"]::before { content: "\2713"; margin-right: 6px; color: var(--accent-ink); font-weight: 600; }
+.mwask__chip--add { border-style: dashed; color: var(--ink-soft); }
+.mwask__chip:focus-visible, .mwask__add input:focus-visible { outline: 2px solid var(--accent); outline-offset: 3px; }
+.mwask__sub { margin: 2px 0 -4px; font-size: 13px; color: var(--ink-soft); }
+.mwask__add { display: flex; gap: 8px; }
+.mwask__add[hidden] { display: none; }
+.mwask__add input { flex: 1; min-width: 0; min-height: 36px; padding: 8px 14px; box-sizing: border-box; border-radius: 999px; border: 1px solid var(--hask-edge-pick); background: transparent; color: var(--ink); font: inherit; font-size: 14px; }
+.mwask__done { display: flex; flex-direction: column; gap: 6px; }
+.mwask__done[hidden] { display: none; }
+.mwask__err { margin: 0; font-size: 13px; color: var(--danger); }
+.mwask__err:empty { display: none; }
+.mwask__lbl { margin: 18px 0 8px; font-size: 12px; letter-spacing: .06em; color: var(--ink-faint); }
+.mwask__rows { list-style: none; margin: 0; padding: 0; border-top: 1px solid var(--rule-soft); }
+.mwask__row { display: flex; align-items: center; gap: 12px; min-height: 46px; padding: 8px 2px; border-bottom: 1px solid var(--rule-soft); white-space: nowrap; overflow: hidden; }
+.mwask__row .mwask__what { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; }
+.mwask__row .mwask__who { color: var(--ink-soft); min-width: 0; overflow: hidden; text-overflow: ellipsis; max-width: 30%; }
+.mwask__dot { flex: none; display: inline-block; width: 7px; height: 7px; border-radius: 50%; background: var(--accent); }
+.mwask__dot--watch { background: var(--info); }
+.mwask__dot--done { background: var(--hask-edge-pick); }
+.mwask__pill { flex: none; font-size: 12px; padding: 2px 9px; border-radius: 999px; border: 1px solid var(--hask-edge); color: var(--ink-soft); white-space: nowrap; }
+.mwask__pill--hot { background: var(--accent-tint); border-color: transparent; color: var(--accent-ink); }

package/modules/market-watch/routes/ask.js

@@ -0,0 +1,95 @@
+'use strict';
+
+// modules/market-watch/routes/ask.js — the weekly ask card's two routes (task 1004940).
+//
+//   GET  /market-watch/ask         the caller's card this week, or { card: null }
+//   POST /market-watch/ask/answer  the caller's taps and entries
+//
+// MEMBERS ONLY, SERVER-CHECKED. requireBuilder resolves the session (a signed-out caller is
+// 401, a deactivated builder 403) and the handler's gate() runs `isMember`, which admits
+// exactly the active builders on the rank ladder, so a reserved or unknown rank is refused.
+// No requireRank here: tests/government_require_permission.mjs refuses it under
+// modules/*/routes, and no catalog permission names a module's member-only action.
+//
+// NOBODY ANSWERS FOR ANYONE ELSE. The answer is always recorded under req.builder.id. A body
+// that names another builder (`builder_id`) is refused 403 rather than quietly re-pointed,
+// so a client that tries it learns it cannot.
+//
+// The project is this instance's own public origin (seed.js projectKey), never the body's.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const ask = require('../ask');
+const { projectKey } = require('../seed');
+
+const log = api.logger('market-watch');
+
+function defaultProject() {
+  try { return projectKey(api.branding().domains.publicOrigin); } catch { return null; }
+}
+
+// isMember(builder) — an active builder on this project's rank ladder.
+function isMember(builder) {
+  if (!builder || builder.id == null) return false;
+  if (builder.status === 'inactive') return false;
+  return api.rankMeetsThreshold(builder.rank, ['xenos']);
+}
+
+const fail = (res, status, code, message) => res.status(status).json({ error: { code, message } });
+
+module.exports = function buildMarketWatchAskRouter(deps = {}) {
+  const router = express.Router();
+  // deps (tests only): store — a store or a function returning one; project; now.
+  const store = () => (typeof deps.store === 'function' ? deps.store() : deps.store) || ask.createAskStore(api.pool);
+  const project = () => (deps.project !== undefined ? deps.project : defaultProject());
+  const now = () => (typeof deps.now === 'function' ? deps.now() : new Date());
+
+  function gate(req, res) {
+    if (!isMember(req.builder)) { fail(res, 403, 'not_a_member', 'Only members of this project get the weekly ask. Ask the project owner to add you.'); return null; }
+    const p = project();
+    if (!p) { fail(res, 503, 'no_project_origin', 'This project has no public origin set.'); return null; }
+    return p;
+  }
+
+  // rank: any-builder — every member reads their own card; nobody else's (isMember in gate()).
+  router.get('/market-watch/ask', api.requireBuilder, async (req, res) => {
+    const p = gate(req, res);
+    if (!p) return;
+    try {
+      res.set('Cache-Control', 'private, no-store');
+      res.json({ card: await ask.cardFor(store(), { project: p, builderId: req.builder.id, now: now() }) });
+    } catch (e) {
+      log.error(`weekly ask read failed: ${e && e.message}`);
+      fail(res, 500, 'ask_read_failed', "Could not read this week's ask.");
+    }
+  });
+
+  // rank: any-builder — a member answers for themselves only (isMember in gate()).
+  router.post('/market-watch/ask/answer', api.requireBuilder, express.json({ limit: '16kb' }), async (req, res) => {
+    const p = gate(req, res);
+    if (!p) return;
+    const body = req.body || {};
+    if (body.builder_id != null && String(body.builder_id) !== String(req.builder.id)) {
+      fail(res, 403, 'not_your_answer', 'You can only answer for yourself.');
+      return;
+    }
+    // The envelope's shape, strict (an unknown field is refused). Each entry's own fields,
+    // lengths and the chip-must-be-offered rule are ask.js parseAnswer's and answer's.
+    if (api.validateOrRespond(req, res, {
+      week_of: { type: 'string', maxLength: 10 },
+      picks: { type: 'array', maxItems: 20 },
+      names: { type: 'array', maxItems: 6 },
+      nothing: { type: 'boolean' },
+      builder_id: { type: 'integer' },
+    })) return;
+    try {
+      const r = await ask.answer(store(), { project: p, builderId: req.builder.id, body, now: now() });
+      res.status(r.status).json(r.body);
+    } catch (e) {
+      log.error(`weekly ask answer failed: ${e && e.message}`);
+      fail(res, 500, 'ask_answer_failed', 'Could not save your answer.');
+    }
+  });
+
+  return router;
+};

package/modules/onboarding/routes/access-requests.js

@@ -83,6 +83,16 @@ const DOOR_REFUSAL = {
 // GitHub usernames: 1–39 chars, alphanumeric or single hyphens, no leading/
 // trailing hyphen. We accept a leading '@' and strip it (people paste "@name").
 const GITHUB_LOGIN_RE = /^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?=[a-zA-Z0-9])){0,38}$/;
+// A person who joined with Google has no GitHub login; their builder row carries
+// the stand-in `~<handle>` core's standInLogin writes (ADR 0396). `~` is never in
+// a GitHub login, so the two shapes cannot be confused.
+const STAND_IN_LOGIN_RE = /^~[a-z0-9-]{1,39}$/;
+
+// A login as people should read it: the stand-in's handle without its `~`.
+function shownLogin(login) {
+  const s = String(login || '');
+  return STAND_IN_LOGIN_RE.test(s) ? s.slice(1) : s;
+}
 
 function normalizeLogin(raw) {
   return String(raw || '').trim().replace(/^@/, '');
@@ -176,6 +186,10 @@ async function attachApplicantProfiles(rows) {
 // re-invite nor keeps the hub's notice alive.
 const STANDING_INVITE_SQL = `SELECT 1 FROM access_requests
           WHERE lower(github_login) = lower($1) AND status = 'invited' AND ${inviteLiveSql()} LIMIT 1`;
+// The same, for a person who joined with Google: keyed on the vouched person key,
+// never the stand-in handle (task 1004994; mirrors core hasInvitedAccessRequest).
+const STAND_IN_INVITE_SQL = `SELECT 1 FROM access_requests
+          WHERE applicant_github_id = $1 AND status = 'invited' AND ${inviteLiveSql()} LIMIT 1`;
 
 function noticeHubInvited(login) {
   api.notifyHubOfInvite(login, { invited: true });
@@ -235,8 +249,8 @@ function accessRequestDocketMatter(r) {
     id: r.id,
     rule: 'decide',
     state: 'needs',
-    title: `Admit ${r.display_name || r.github_login} as a builder`,
-    short: `admit ${r.github_login}`,
+    title: `Admit ${r.display_name || shownLogin(r.github_login)} as a builder`,
+    short: `admit ${shownLogin(r.github_login)}`,
     where: r.vouched ? 'people · waiting to join · vouched' : 'people · waiting to join',
     opened_at: r.created_at,
     deadline: null,
@@ -287,29 +301,42 @@ module.exports = function buildAccessRequestsRouter() {
     })) return;
 
     const login = normalizeLogin(req.body.github_login);
-    if (!GITHUB_LOGIN_RE.test(login)) {
+    const standIn = STAND_IN_LOGIN_RE.test(login);
+    if (!standIn && !GITHUB_LOGIN_RE.test(login)) {
       return res.fail('bad_github_login', { status: 400, message: 'That does not look like a GitHub username.' });
     }
     const displayName = (req.body.display_name || '').trim() || null;
     const note = (req.body.note || '').trim() || null;
     // A verified vouch that names this login → the account the hub confirmed; anything
     // else → null, and the unvouched row this route always wrote (never a refusal,
-    // ADR 0201 D2.3). Descriptive only: no admission path reads it (ADR 0016).
+    // ADR 0201 D2.3). Descriptive only for a GitHub login: no admission path reads it
+    // (ADR 0016).
     const vouch = api.readApplicationVouch(req.get(APPLICATION_VOUCH_HEADER), { githubLogin: login });
+    // A person who joined with Google applies by their stand-in `~handle`, and only
+    // through the hub's vouch for their person key (task 1004994): a stand-in is
+    // not an identity anyone may type, and their approval is matched on the key.
+    if (standIn && !vouch) {
+      return res.fail('bad_github_login', { status: 400, message: 'Apply to this project from your Cloud Bongos account.' });
+    }
 
     try {
       // Already a builder? They have an account — point them at sign-in instead
-      // of opening a redundant request. (2026-05-30)
-      const member = await pool.query(
-        `SELECT 1 FROM builders WHERE lower(github_login) = lower($1) LIMIT 1`,
-        [login]
-      );
+      // of opening a redundant request. (2026-05-30) A stand-in is matched on the
+      // vouched person key, since a handle can change hands.
+      const member = standIn
+        ? await pool.query(`SELECT 1 FROM builders WHERE github_id = $1 LIMIT 1`, [vouch.githubId])
+        : await pool.query(`SELECT 1 FROM builders WHERE lower(github_login) = lower($1) LIMIT 1`, [login]);
       if (member.rows.length > 0) {
         return res.fail('already_member', { status: 409, message: 'You already have an account — just sign in with GitHub.' });
       }
       // Already approved (invited) but not yet signed in? No new request needed.
       // An expired invite is not an approval any more, so its invitee may ask.
-      const invited = await pool.query(STANDING_INVITE_SQL, [login]);
+      // A stand-in's approval is the vouched person's, so it is found by their key —
+      // the same match the sign-in gate makes (hasInvitedAccessRequest) — and a
+      // stale approval left under a handle someone else now holds never answers.
+      const invited = standIn
+        ? await pool.query(STAND_IN_INVITE_SQL, [vouch.githubId])
+        : await pool.query(STANDING_INVITE_SQL, [login]);
       if (invited.rows.length > 0) {
         return res.fail('already_approved', { status: 409, message: "You're already approved — sign in with GitHub to enter." });
       }
@@ -675,5 +702,6 @@ module.exports = function buildAccessRequestsRouter() {
 };
 
 module.exports.accessRequestDocketMatter = accessRequestDocketMatter;
+module.exports.shownLogin = shownLogin;
 
 module.exports.INVITE_DESK_ROW = INVITE_DESK_ROW;

package/modules/platform-identity/account-logins.js

@@ -58,6 +58,17 @@ function isMintedPersonKey(key) {
   return /^-\d+$/.test(String(key ?? ''));
 }
 
+// A project's hall that can take a minted key says so on its authorize link
+// (`person_keys=1`, added by core's idpAuthorizeUrl from task 1004994). An older
+// hall would store a negative key as a GitHub id, so it is never sent one
+// (ADR 0393). Boundary-forced mirror of core's PERSON_KEYS_PARAM.
+const PERSON_KEYS_PARAM = 'person_keys';
+
+// May the hub hand this person's key to the hall whose authorize query this is?
+function hallTakesPersonKey(key, query) {
+  return !isMintedPersonKey(key) || String((query && query[PERSON_KEYS_PARAM]) ?? '') === '1';
+}
+
 // An email as a provider vouched for it, trimmed and capped, or null. Shown to
 // the person in their own settings and nothing else.
 function cleanEmail(email) {
@@ -185,6 +196,8 @@ module.exports = {
   LOGIN_PROVIDERS,
   normalizeLogin,
   isMintedPersonKey,
+  PERSON_KEYS_PARAM,
+  hallTakesPersonKey,
   findPersonByLogin,
   createAccountForLogin,
   signInWithLogin,

package/modules/platform-identity/routes/my-projects.js

@@ -77,8 +77,12 @@ const RELAY_SENTENCE = {
   // because the fall-through is a 502 "could not be reached" — the exact lie about
   // someone else's door that ADR 0194 D5 forbids.
   not_published: 'This project isn’t published yet, so it isn’t taking anyone on. Its owner has to finish setting it up first.',
+  // A hall on a core older than task 1004994 refuses a Google-only person's
+  // stand-in `~handle` as "not a GitHub username". It is the project's version,
+  // not the person, so say that rather than "could not be reached".
+  needs_update: 'This project runs an older version that can’t take a Google sign-in yet. Ask its owner to update it, or apply with GitHub.',
 };
-function joinRelayOutcome(status, body) {
+function joinRelayOutcome(status, body, { standIn = false } = {}) {
   const err = (body && body.error) || null;
   const code = err && (err.code || err);
   let outcome;
@@ -86,6 +90,7 @@ function joinRelayOutcome(status, body) {
   else if (code === 'invite_only' || code === 'open_enrollment' || code === 'not_published') outcome = code;
   else if (status === 409) outcome = 'already_member';
   else if (status === 401) outcome = 'members_only';
+  else if (status === 400 && code === 'bad_github_login' && standIn) outcome = 'needs_update';
   else return null;
   return { status: outcome, message: RELAY_SENTENCE[outcome] };
 }
@@ -227,11 +232,9 @@ module.exports = function myProjectsRoutes() {
       note: { type: 'string', maxLength: APPLICANT_NOTE_MAX },
       guild: { type: 'string', maxLength: 39 },
     })) return;
-    // A Google-only person (a minted key) cannot be relayed to a project yet:
-    // halls learn to take one in task 1004994 (ADR 0393). Refuse before relaying.
-    if (isMintedPersonKey(req.builder.github_id)) {
-      return res.fail('google_join_not_yet', { status: 409, message: 'Projects can’t be joined with a Google sign-in yet. That is coming soon.' });
-    }
+    // A Google-only person is relayed like anyone else, by their stand-in login
+    // and a vouch for their person key (task 1004994). A hall too old to take
+    // one answers bad_github_login, which joinRelayOutcome reads as needs_update.
     try {
       const client = await pi.getClientByOrigin(req.body.origin, { pool });
       if (!client || client.status !== 'active' || !client.origin) {
@@ -274,7 +277,7 @@ module.exports = function myProjectsRoutes() {
           }),
         });
         const body = await r.json().catch(() => null);
-        outcome = joinRelayOutcome(r.status, body);
+        outcome = joinRelayOutcome(r.status, body, { standIn: isMintedPersonKey(req.builder.github_id) });
       } catch (e) {
         console.log('[platform-identity] join relay failed (non-fatal):', e.message);
       }

package/modules/platform-identity/routes/sso.js

@@ -32,7 +32,11 @@ const guildEngagements = require('../guild-engagements');
 const instanceFeedback = require('../instance-feedback');
 const projectStats = require('../project-stats');
 // Ways in other than GitHub (task 1004993, ADR 0393/0396).
-const { signInWithLogin, isMintedPersonKey } = require('../account-logins');
+const { signInWithLogin, hallTakesPersonKey } = require('../account-logins');
+
+// What a Google-only person reads when a project's hall runs a core too old to
+// take them (task 1004994).
+const OLDER_HALL_SENTENCE = 'This project runs an older version that can’t take a Google sign-in yet. Ask its owner to update it, or sign in to it with GitHub.';
 
 // One limiter per hub process for POST /sso/feedback (task 1004462).
 const feedbackLimiter = instanceFeedback.makeFeedbackLimiter();
@@ -327,11 +331,12 @@ module.exports = function ssoRoutes() {
           : 'This session type cannot be used for cross-project sign-in.';
       return res.status(403).type('text/html').send(errorPage(msg));
     }
-    // A person who signed up with Google has a minted key, which a project's hall
-    // cannot take yet (ADR 0393: an older core must not be sent one). Task 1004994
-    // opens this door; until then say so plainly instead of sending the key.
-    if (isMintedPersonKey(session.github_id)) {
-      return res.status(403).type('text/html').send(errorPage('Projects can’t be joined with a Google sign-in yet. That is coming soon; for now, sign in to the project with GitHub.'));
+    // A person who signed up with Google has a minted key. A hall takes one only
+    // when its authorize link says it can (`person_keys=1`, task 1004994): an older
+    // core would store the negative key as a GitHub id (ADR 0393). Say so plainly
+    // instead of sending it.
+    if (!hallTakesPersonKey(session.github_id, req.query)) {
+      return res.status(403).type('text/html').send(errorPage(OLDER_HALL_SENTENCE));
     }
 
     // A live hub session — record/refresh the platform account and mint a

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.2",
+  "version": "1.24.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.2",
+      "version": "1.24.4",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.2",
+  "version": "1.24.4",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",