mrhid6andClaude Opus 5
0c663945ee
An invitation carries no password. The HQ password is what signs someone into every instance they are granted, so a password the inviter chose would be a shared credential to all of them — the invited row has an empty hash, which cannot authenticate, until /accept-invite sets one. Removing a person revokes every projected instance user first, and refuses outright if any of those is an instance's last owner. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>