@bongos/core 1.17.0

package/scripts/gds/seed-bongos-coreB-tranche2-tasks.js

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+// seed-bongos-coreB-tranche2-tasks.js
+// Seeds BONGOS-V1 criterion C7 (gds-core-modularized) — "Config B" core
+// decomposition, tranche 2: the remaining core domains carved one-by-one on the
+// infrastructure tranche 1 shipped (bounded kernel + doorway/withTx + per-domain
+// db.js slice + fitness ratchet + coreB-carve-proof.sh). Owner greenlit
+// 2026-06-27; sequence fixed in ADR 0093. Idempotent on source_ref; criterion
+// links + dependency edges idempotent too.
+// Run: node scripts/gds/seed-bongos-coreB-tranche2-tasks.js
+const os = require('os');
+const TOKEN = require(os.homedir() + '/.config/otb/gds-session.json').token;
+const BASE = process.env.GDS_BASE || 'https://amazonprimea.com';
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+// ref → task spec. deps are local R## refs resolved after create. Clean-slicing
+// order per ADR 0093 §1 (import-graph evidence, 02-module-map §2): economy first
+// (it registers the `reward` port the lifecycle needs), lifecycle LAST.
+const TASKS = [
+  { ref: 'R76', kind: 'spike', priority: 5, title: 'BV1.R76 — Tranche-2 plan: ADR 0093 (core-carve sequence) + seed R77-R87',
+    description: 'Owner greenlit C7 tranche-2 on 2026-06-27 (deferred in ADR 0091). ADR 0093 (amends 0091) fixes the carve order, the reward economy kernel-port, and the lifecycle-as-module endgame; this seeds the carves. deps: none (R74 confirmed).',
+    deps: [] },
+  { ref: 'R77', kind: 'refactor', priority: 4, title: 'BV1.R77 — Carve economy → modules/economy/ + register the `reward` kernel PORT',
+    description: 'Move credits·cost·streak·achievements·leaderboard (~1.0k LOC) into modules/economy/ with its db.js slice (R69 pattern). Register a `reward` capability via the kernel seam (registerProvider/resolve) — the twin of `grade` (R73); the lifecycle resolves seams.resolveOptional(\'reward\') at ship instead of importing economy. economy is FIRST so the reward port exists before the lifecycle carve (R86). OTB byte-identical (coreB-carve-proof.sh). deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R78', kind: 'refactor', priority: 4, title: 'BV1.R78 — Carve ideas → modules/ideas/',
+    description: 'Move inbox·capture·triage·blockers (~0.9k LOC) into modules/ideas/ with its db.js slice. Retire the ADR-0091 §3 doorway leak `captureIdea` behind an `ideas.*` seam (its sole consumer, discord-bugs, resolves the port). OTB byte-identical. deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R79', kind: 'refactor', priority: 4, title: 'BV1.R79 — Carve security → modules/security/',
+    description: 'Move security-the-FEATURE (red-team reports · bounty, rank-gated Metic+) into modules/security/ with its db.js slice. Note: security-the-PROPERTY (permission-path-check/route-rank-check) stays KERNEL (02-module-map §5) — this carves only the optional feature. OTB byte-identical. deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R80', kind: 'refactor', priority: 4, title: 'BV1.R80 — Carve builder-settings → modules/builder-settings/',
+    description: 'Move prefs (wandering·skill·sound·render) + builder-needs (~1.6k LOC) into modules/builder-settings/ with its db.js slice. The `me`/`public` read-aggregators stay as thin facades that resolve the module (02-module-map §2). OTB byte-identical. deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R81', kind: 'refactor', priority: 4, title: 'BV1.R81 — Carve onboarding → modules/onboarding/',
+    description: 'Move admission·setup·newcomer-floor (~1.9k LOC: onboarding-state.js, newcomer-restock.js, onboarding.js + routes) into modules/onboarding/ with its db.js slice. OTB byte-identical. deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R82', kind: 'refactor', priority: 3, title: 'BV1.R82 — Carve sessions/BFG → modules/sessions/',
+    description: 'Move session records · cost/eval/digest · transcript corpus · BFG (~2k LOC) into modules/sessions/ with its db.js slice. OTB byte-identical. deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R83', kind: 'refactor', priority: 3, title: 'BV1.R83 — Carve autonomy/MAS → modules/autonomy/',
+    description: 'Move conductor-dispatch · architect-audit · autonomy-gate · scheduled-routine wiring (~1.5k LOC) into modules/autonomy/ with its db.js slice. Cross-cutting — wire its seams carefully (it observes lifecycle events). OTB byte-identical. deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R84', kind: 'refactor', priority: 3, title: 'BV1.R84 — Carve status-UI → modules/status-ui/',
+    description: 'Move the public-status web surface (~3k LOC) into modules/status-ui/ as a module (a web surface is first-class, 02-module-map §6). Big but mechanical — mostly static assets + the public read endpoints it renders. OTB byte-identical. deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R85', kind: 'refactor', priority: 3, title: 'BV1.R85 — Carve hall-UI → modules/hall-ui/',
+    description: 'Move the public-builders hall web surface (~13k LOC — the largest module) into modules/hall-ui/. Mechanical (assets + the me/public/leaderboard reads it renders) but large; verify byte-identical carefully. OTB byte-identical. deps: R76.',
+    deps: ['R76'] },
+  { ref: 'R86', kind: 'refactor', priority: 3, title: 'BV1.R86 — Carve lifecycle → modules/lifecycle/ (state machine, LAST)',
+    description: 'Move the build state machine — tasks·claims·versions·ship orchestration (~9k LOC) — into modules/lifecycle/ as ONE module (never split, 02-module-map §4). By now grade (R73) + reward (R77) are kernel ports, so the lifecycle imports only the kernel + resolves those ports. Retire the ADR-0091 §3 leaks `createTask`/`VOTABLE_TASK_STATUSES` behind a `lifecycle.*` seam. The db.js residue after this = the lifecycle slice + db-kernel.js. Most delicate carve — do last. OTB byte-identical. deps: R76, R77.',
+    deps: ['R76', 'R77'] },
+  { ref: 'R87', kind: 'verify', priority: 3, title: 'BV1.R87 — Proof: the whole GDS core is decomposed (C7 satisfied)',
+    description: 'Extend coreB-carve-proof.sh to assert every tranche-2 module (economy·ideas·security·builder-settings·onboarding·sessions·autonomy·status-ui·hall-ui·lifecycle) lives in modules/, owns its db.js slice, resolves its capabilities via kernel ports (grade+reward), and that db.js shrank to the lifecycle+kernel residue — with fitness green + the full carved-surface suite byte-identical. The single live demonstration C7 hinges on. deps: all tranche-2 carves.',
+    deps: ['R77', 'R78', 'R79', 'R80', 'R81', 'R82', 'R83', 'R84', 'R85', 'R86'] },
+];
+
+async function post(path, body) {
+  const r = await fetch(BASE + path, { method: 'POST', headers: H, body: JSON.stringify(body) });
+  return { status: r.status, json: await r.json().catch(() => ({})) };
+}
+
+(async () => {
+  const idByRef = {};
+  // Phase 1: create tasks (idempotent on source_ref), link C7 explicitly.
+  for (const t of TASKS) {
+    const body = {
+      version_id: 'BONGOS-V1', title: t.title, description: t.description,
+      kind: t.kind, discipline: 'engineer', priority: t.priority,
+      criterion_ids: ['C7'],
+      source: 'planning', source_ref: `BONGOS-V1-coreB-${t.ref}`,
+    };
+    let { status, json } = await post('/api/gds/tasks', body);
+    let id = json.id || (json.task && json.task.id);
+    if (!id && t.kind === 'verify') {
+      // memory: kind=verify has 500'd before (idea #357). Fall back, keep going.
+      console.log(`  ${t.ref}: kind=verify failed (${json.error || status}); retrying as kind=feature`);
+      ({ status, json } = await post('/api/gds/tasks', { ...body, kind: 'feature' }));
+      id = json.id || (json.task && json.task.id);
+    }
+    if (!id) { console.log(`  ${t.ref}: CREATE FAILED — ${status} ${JSON.stringify(json).slice(0, 160)}`); continue; }
+    idByRef[t.ref] = id;
+    // Link C7 explicitly (criterion_ids at create is not honored on this build;
+    // the /criteria endpoint is idempotent — re-adding an existing link is a no-op).
+    const link = await post(`/api/gds/tasks/${id}/criteria`, { criterion_ids: ['C7'] });
+    console.log(`  ${t.ref} -> task ${id} (${t.kind}, P${t.priority}) · C7 link ${link.status === 200 ? 'ok' : (link.json.error || link.status)}`);
+  }
+  // Phase 2: wire dependencies (idempotent on (task_id, depends_on_task_id)).
+  console.log('--- dependencies ---');
+  for (const t of TASKS) {
+    const id = idByRef[t.ref];
+    if (!id || !t.deps.length) continue;
+    for (const dep of t.deps) {
+      const depId = idByRef[dep];
+      if (!depId) { console.log(`  ${t.ref}: dep ${dep} not created — skip`); continue; }
+      const { status, json } = await post(`/api/gds/tasks/${id}/dependencies`, { depends_on_task_id: depId });
+      console.log(`  ${t.ref}(${id}) depends on ${dep}(${depId}) -> ${status === 200 || status === 201 ? 'ok' : (json.error || status)}`);
+    }
+  }
+  console.log('refs:', JSON.stringify(idByRef));
+})();

package/scripts/gds/seed-bongos-goal-hierarchy-tasks.js

@@ -0,0 +1,307 @@
+#!/usr/bin/env node
+// Seed the BONGOS-V1 goal-scoped-work-hierarchy build cluster — ADR 0086
+// (docs/adr/0086-goal-scoped-work-hierarchy.md) turned into claimable,
+// dependency-ordered tasks. All link to criterion C6 (goal-scoped-work-hierarchy),
+// added by companion migration 159_bongos_v1_goal_hierarchy_criterion.sql.
+//
+// Covers the ADR's Phases 1-4 (carve+config, goal entity, bounded authoring,
+// deps+achievement) + the deferred Phase-5 ADR spike (G12) + the live proof (G13).
+//
+// Idempotent: skips tasks whose source_ref already exists; dependency wiring is
+// idempotent on (task_id, depends_on_task_id). Display R## numbers are assigned
+// sequentially after the current max BV1.R## (so this composes with the existing
+// R01..R53 without renumbering — expected R54..R66). Dependency edges reference
+// the logical `key`, not the R## — so re-running after a partial seed is safe.
+//
+// Mirrors scripts/gds/seed-bongos-module-system-tasks.js (criterion_ids in the
+// POST body; engineer discipline; deps via POST /tasks/:id/dependencies). Adds
+// optional requires_rank + security_sensitive per task (ADR 0084 floor — explicit
+// value can only RAISE the auto-derived floor; migrations/authz tasks auto-floor
+// to metic from touches anyway, the explicit flag is belt-and-braces).
+//
+// Usage:  node scripts/gds/seed-bongos-goal-hierarchy-tasks.js [--dry-run]
+
+const { cliClient, requireSession } = require('./cli-lib');
+
+const DRY = process.argv.includes('--dry-run');
+
+// Each entry: { key, title, description, kind, discipline, priority,
+//               est_minutes, manual_degree, credits_reward, touches,
+//               criteria: ['C6'], deps: ['<key>', ...],
+//               requires_rank?, security_sensitive? }
+const TASKS = [
+  // ===========================================================================
+  // PHASE 1 — Carve + config (P5, roots — zero-dep, promote immediately)
+  // ===========================================================================
+  {
+    key: 'G01',
+    title: 'module-scope-map.js — the module→globs+protected roster (the scope wall’s source)',
+    description: `Phase 1 of the goal hierarchy (ADR 0086 §4 + §7). Create \`src/bongos/module-scope-map.js\` — each module key from the decided ~16-module roster (docs/design/modular-architecture/02-module-map.md §6: kernel, lifecycle, economy, grading, memory, onboarding, ideas, builder-settings, sessions/BFG, autonomy/MAS, security, hall-UI, status-UI, game, art-pipeline, discord, dev-box) → its path globs + a \`protected\` boolean. Set \`protected: true\` where a module’s globs intersect \`PROTECTED_GLOBS\` (the lifecycle/ship-pipeline, migrations, security, authz core). IMPORT \`PROTECTED_GLOBS\` from src/bongos/permission-path-check.js — never re-declare it (ADR 0086 §7; the SEC #863 second-list failure mode). Auto-tightens as ADR 0083 moves code into modules/<key>/. Carve precedes the feature.
+
+**Done when:** module-scope-map.js exports the roster (key → {globs, protected}); protected flags derive from PROTECTED_GLOBS by import; a fitness check asserts the import (red build if scope code re-declares globs); unit test covers a protected + a non-protected module.`,
+    kind: 'feature', discipline: 'engineer', priority: 5,
+    est_minutes: 180, manual_degree: 2, credits_reward: 30,
+    touches: ['src/bongos/module-scope-map.js', 'scripts/gds/fitness.js', 'tests/'],
+    criteria: ['C6'], deps: [],
+  },
+  {
+    key: 'G02',
+    title: 'config/hierarchy.json + hierarchy-config.js — the six-tier preset (onboarding-edited)',
+    description: `Phase 1 of the goal hierarchy (ADR 0086 §1 — the ADR 0062 core/host pattern applied to the work model). Add \`config/hierarchy.json\` (joins branding.json/modules.json as host config) declaring the tiers — names, order, and which tier carries scope, membership, and criteria. Ship the six-tier Amazonprimea preset: Project → Version → Goal → Criteria → Task → Sub-task. Add \`src/bongos/hierarchy-config.js\` (mirrors src/modules.js) to load + validate it. v1 "editable" = owner-set labels, enable/disable, and which tier owns scope/criteria/membership; arbitrary custom tier graphs are explicitly DEFERRED. Owner fills/edits during onboarding (extend the scripts/gds/init.js interview).
+
+**Done when:** hierarchy.json + hierarchy-config.js exist; the loader validates + exposes the tier set; the six-tier preset is the OTB default; onboarding can set labels/enable/scope-owner; unit test covers a malformed preset rejected.`,
+    kind: 'feature', discipline: 'engineer', priority: 5,
+    est_minutes: 180, manual_degree: 2, credits_reward: 30,
+    touches: ['config/hierarchy.json', 'src/bongos/hierarchy-config.js', 'scripts/gds/init.js', 'tests/'],
+    criteria: ['C6'], deps: [],
+  },
+
+  // ===========================================================================
+  // PHASE 2 — Goal entity (P5)
+  // ===========================================================================
+  {
+    key: 'G03',
+    title: 'Goal-tier migration — goals + goal_members tables, criteria.goal_id (backfill), tasks.goal_id',
+    description: `Phase 2 of the goal hierarchy (ADR 0086 §2). Additive migration + db.js helpers. NEW \`goals\` (id, version_id, title, description, scope_modules text[], status open|achieved|archived, created_by, succeeded_by_goal_id, timestamps). NEW \`goal_members\` (goal_id, builder_id, role lead|member, joined_at; PK (goal_id, builder_id)). ADD \`done_when_criteria.goal_id\` (FK goals) + BACKFILL every existing version criterion under a per-version default goal (one "<version> — general" goal per version, all that version’s criteria linked; members left empty / Archon-owned). ADD \`tasks.goal_id\` (FK goals, nullable). Add db helpers (createGoal/getGoal/listGoals/addGoalMember/removeGoalMember/setGoalStatus...).
+
+**NOTE:** touches migrations/ — gate HARD-FLOOR, needs owner Gate approval at ship (ADR 0043). **Done when:** migration applies additively; goals + goal_members exist; every existing criterion has a goal_id (per-version default goal); tasks.goal_id present; db helpers + hermetic tests green; OTB behaves identically (no route references a goal yet).`,
+    kind: 'feature', discipline: 'engineer', priority: 5,
+    est_minutes: 300, manual_degree: 3, credits_reward: 55,
+    touches: ['migrations/', 'src/bongos/db.js', 'tests/'],
+    criteria: ['C6'], deps: [], security_sensitive: true,
+  },
+  {
+    key: 'G04',
+    title: 'Goal routes — POST /goals (create), join/leave, goal view + ?goal_id= task filter',
+    description: `Phase 2 of the goal hierarchy (ADR 0086 §2/§3). New \`src/bongos/routes/goals.js\`: \`POST /goals\` — requireRank('metic','archon'); ARCHON-ONLY when scope_modules includes a \`protected\` module (checked via module-scope-map, G01). \`POST /goals/:id/join\` + \`/leave\` — open join for normal goals; joining a sensitive-scope (protected-module) goal needs Archon approval (reuse the access-request pattern, src/bongos/routes/access-requests.js + discord-approvals). \`GET /goals?version=\` + \`GET /goals/:id\` (members + linked criteria). Add a \`?goal_id=\` filter to GET /tasks. Mount in routes.js; pin the goal routes’ ranks in route-rank-check EXPECTED_RANKS.
+
+**Done when:** a Metic+ creates a goal (Archon-only for protected scope); members join/leave (sensitive-scope join → access request → Archon approve); goals + members + criteria are viewable; ?goal_id= filters tasks; smoke green.`,
+    kind: 'feature', discipline: 'engineer', priority: 5,
+    est_minutes: 300, manual_degree: 2, credits_reward: 55,
+    touches: ['src/bongos/routes/goals.js', 'src/bongos/db.js', 'src/bongos/routes.js', 'src/bongos/routes/tasks.js', 'src/bongos/route-rank-check.js', 'tests/'],
+    criteria: ['C6'], deps: ['G03', 'G01'],
+  },
+  {
+    key: 'G05',
+    title: '/status rollup through goals — Version → Goals → Criteria → Tasks',
+    description: `Phase 2 of the goal hierarchy (ADR 0086 §2, extends ADR 0025). Extend the done-when rollup (src/bongos/done-when.js criterionProgress/buildCriterionProgress + scripts/gds/status.js) so /status renders Version → Goals → Criteria → Tasks; a version is "done" when all its goals are achieved. Goals with no criteria (e.g. a per-version default before re-parent) render gracefully. Update the public progress surface + status dashboard.
+
+**Done when:** /status --version BONGOS-V1 groups criteria under their goals; goal achieve-state rolls up to version done-ness; the public progress JSON + status dashboard reflect the goal layer; tests cover a multi-goal version.`,
+    kind: 'feature', discipline: 'engineer', priority: 5,
+    est_minutes: 240, manual_degree: 2, credits_reward: 40,
+    touches: ['src/bongos/done-when.js', 'scripts/gds/status.js', 'src/bongos/routes/done-when.js', 'public-status/', 'tests/'],
+    criteria: ['C6'], deps: ['G03', 'G04'],
+  },
+
+  // ===========================================================================
+  // PHASE 3 — Bounded authoring (P4) [routes/goals.js create gate = gate floor]
+  // ===========================================================================
+  {
+    key: 'G06',
+    title: 'goal-scope-check.js (pure) — scope-subset + protected-path gate logic, unit-tested',
+    description: `Phase 3 of the goal hierarchy (ADR 0086 §3). New \`src/bongos/goal-scope-check.js\` — a PURE module the create gate (G07) calls. Given a goal’s scope_modules + a task’s touches[], assert every touches element is covered by the goal’s module globs (resolve modules → globs via module-scope-map G01; use touchesOverlap from src/bongos/path-match.js). Expose the protected-path delegate (wraps checkPermissionPaths from src/bongos/permission-path-check.js) so a sub-Metic member’s task touching the protected core is rejected. No Express, no DB — fully unit-testable in isolation.
+
+**Done when:** goal-scope-check.js exports a pure check(goalScopeModules, touches, builderRank) → {ok, reason}; scope-subset + protected-path both enforced; exhaustive unit tests (in-scope pass, out-of-scope reject, protected-path reject, empty-scope reject).`,
+    kind: 'feature', discipline: 'engineer', priority: 4,
+    est_minutes: 180, manual_degree: 2, credits_reward: 30,
+    touches: ['src/bongos/goal-scope-check.js', 'tests/'],
+    criteria: ['C6'], deps: ['G01'],
+  },
+  {
+    key: 'G07',
+    title: 'POST /goals/:id/tasks — bounded task-authoring gate + one-level sub-tasks',
+    description: `Phase 3 of the goal hierarchy (ADR 0086 §3 — the maneuverability grant). Add \`POST /goals/:id/tasks\` to routes/goals.js: requireBuilder + an in-handler gate, ordered + fail-closed: (a) goal is \`open\` and caller is a member (or Archon); (b) version guards reused from POST /tasks; (c) scope-subset — every touches[] element covered by the goal’s scope_modules (goal-scope-check, G06); (d) protected-path block — checkPermissionPaths so a sub-Metic member cannot author a task touching the protected core; THEN db.createTask stamping goal_id, with requires_rank AUTO-DERIVED (ADR 0084 — a sensitive task auto-floors to metic, which a sub-Metic author then cannot claim — no self-granted escape). Support one-level sub-tasks (parent_task_id, src/bongos/hierarchy.js) authored under a goal. \`POST /tasks\` + \`PATCH /tasks/:id\` stay BYTE-IDENTICAL (Archon-only) for ungoverned creation.
+
+**Done when:** a goal member authors an in-scope task via POST /goals/:id/tasks; an out-of-scope OR protected-path task is rejected (fail-closed); requires_rank auto-derives; sub-tasks attach to a parent under a goal; POST /tasks unchanged.`,
+    kind: 'feature', discipline: 'engineer', priority: 4,
+    est_minutes: 360, manual_degree: 3, credits_reward: 70,
+    touches: ['src/bongos/routes/goals.js', 'src/bongos/db.js', 'src/bongos/goal-scope-check.js', 'tests/'],
+    criteria: ['C6'], deps: ['G04', 'G06'], security_sensitive: true,
+  },
+  {
+    key: 'G08',
+    title: 'Fitness pins + abuse-matrix tests — prove the goal wall holds',
+    description: `Phase 3 of the goal hierarchy (ADR 0086 §7 — how the boundary holds). Two CI fitness checks (scripts/gds/fitness.js): (1) the goal routes are pinned in route-rank-check EXPECTED_RANKS (so a rank drift on a goal route is a red build); (2) the scope code imports PROTECTED_GLOBS, never re-declares it (co-locate with G01’s check if not already present). Plus an abuse-matrix test suite: a sub-Metic member CANNOT author (a) an out-of-scope task, (b) a protected-path task, (c) a task in a goal they have not joined, (d) a self-raised-rank escape; and CAN author an in-scope task. Document the matrix.
+
+**Done when:** both fitness checks live + tested (clean-pass AND catch-violation); the abuse-matrix suite is green and each negative case fails closed; route-rank drift on a goal route is a red build.`,
+    kind: 'feature', discipline: 'engineer', priority: 4,
+    est_minutes: 240, manual_degree: 2, credits_reward: 40,
+    touches: ['scripts/gds/fitness.js', 'src/bongos/route-rank-check.js', 'tests/'],
+    criteria: ['C6'], deps: ['G07'],
+  },
+
+  // ===========================================================================
+  // PHASE 4 — Deps + achievement (P4) [migration + claim gate = gate floor]
+  // ===========================================================================
+  {
+    key: 'G09',
+    title: 'Polymorphic dependencies edge (task/goal/criterion) + claim-gate resolution',
+    description: `Phase 4 of the goal hierarchy (ADR 0086 §5). Migration: NEW \`dependencies(from_kind, from_id, to_kind, to_id)\` over {task, goal, criterion} — one "blocked-until-done" edge; MIGRATE the existing tasks.dependencies[] (task→task) into it. One enforcement point: it resolves down to the existing claim gate (ADR 0015) — claiming a task checks its own deps PLUS deps inherited from its goal/criterion; achieving a goal / satisfying a criterion / shipping a task auto-promotes its dependents. "Done" = task/sub-task shipped, criterion satisfied, goal achieved. Cross-goal + cross-version allowed (a dependency is a REFERENCE, not a grant — it never widens module scope). Containment (the tree) is never a dependency; cycle-check on insert keeps the graph acyclic.
+
+**NOTE:** touches migrations/ + the claim gate — gate HARD-FLOOR, owner Gate approval at ship. **Done when:** the polymorphic edge exists; tasks.dependencies[] migrated in with no behavior change; the claim gate honors task + inherited goal/criterion deps; achieve/satisfy/ship auto-promotes dependents; a cross-goal dep works; a cycle is refused.`,
+    kind: 'feature', discipline: 'engineer', priority: 4,
+    est_minutes: 360, manual_degree: 3, credits_reward: 70,
+    touches: ['migrations/', 'src/bongos/db.js', 'src/bongos/routes/claims.js', 'scripts/gds/claim.js', 'tests/'],
+    criteria: ['C6'], deps: ['G03', 'G04'], security_sensitive: true,
+  },
+  {
+    key: 'G10',
+    title: 'Criterion auto-flag → /goal-review (Metic+ confirm) → goal auto-achieve',
+    description: `Phase 4 of the goal hierarchy (ADR 0086 §6). Auto-flag: when every task linked to a criterion has shipped, the server auto-flags that criterion "met — pending review" (a \`pending_review\` flag, deterministic from task_criteria + ship status; the existing \`satisfied\` bool is still set on confirm). New \`/goal-review\` skill (Metic+) mirroring /idea-triage: walks flagged criteria one-at-a-time (confirm / reject / note) and dispositions achieved goals (archive vs carry forward). Re-rank the criterion-satisfy route from Archon-only to Metic+ (resolves "who confirms" so the Archon is not in every closing loop). Confirming a goal’s LAST criterion auto-flips the goal open→achieved.
+
+**Done when:** a criterion auto-flags pending_review when its tasks ship; /goal-review lists + dispositions flagged criteria (Metic+); the satisfy route is Metic+; the last-criterion confirm flips the goal to achieved; tests cover the auto-flag + the auto-achieve.`,
+    kind: 'feature', discipline: 'engineer', priority: 4,
+    est_minutes: 300, manual_degree: 2, credits_reward: 55,
+    touches: ['src/bongos/done-when.js', 'src/bongos/routes/done-when.js', 'src/bongos/db.js', '.claude/skills/goal-review/SKILL.md', 'tests/'],
+    criteria: ['C6'], deps: ['G03', 'G04'], security_sensitive: true,
+  },
+  {
+    key: 'G11',
+    title: 'Goal lifecycle — archive/reopen, rescope carry-forward, ask-to-widen, ideas→any tier',
+    description: `Phase 4 of the goal hierarchy (ADR 0086 §4/§6). Goal lifecycle open→achieved→archived (archived re-openable). Rescope: at the next /planning-session, achieved goals carry forward (succeeded_by_goal_id) or are replaced — "previous or new" at each tier; wire into the planning-session skill. "Ask to widen": a goal member requests adding a module to scope_modules; a trusted rank approves (Archon for a protected module) — reuse the access-request pattern (scope is NEVER self-granted). Ideas-promote-to-any-tier: extend /idea-triage so an inbox idea can promote into a goal / criterion / task (not just a task). Level /planning-session up to define a version’s GOALS (each with criteria + module scope + optional seed tasks/join policy); sensitive-scope goals get Archon sign-off there.
+
+**Done when:** goals archive/reopen; planning-session rescope carries achieved goals forward; a widen request is approved/denied by a trusted rank (Archon for protected); idea-triage can promote to any tier; planning-session defines goals + scope.`,
+    kind: 'feature', discipline: 'engineer', priority: 4,
+    est_minutes: 300, manual_degree: 2, credits_reward: 55,
+    touches: ['src/bongos/routes/goals.js', 'src/bongos/db.js', 'src/bongos/routes/access-requests.js', 'src/bongos/routes/inbox.js', '.claude/skills/planning-session/SKILL.md', '.claude/skills/idea-triage/SKILL.md', 'tests/'],
+    criteria: ['C6'], deps: ['G04', 'G10'],
+  },
+
+  // ===========================================================================
+  // PHASE 5 — Deferred to its own security-reviewed ADR (P3, spike — stays backlog)
+  // ===========================================================================
+  {
+    key: 'G12',
+    title: 'ADR spike — AI relevance judge + sub-Metic membership in protected-scope goals',
+    description: `Phase 5 of the goal hierarchy — DEFERRED (ADR 0086 §"Deferred" + build-plan Phase 5 "own ADR"). Produce a security-reviewed ADR (+ a child task list) for the deferred non-decisions: (a) an AI relevance / anti-hack judge at goal-task create/claim time (reusing the grader subagent harness; advisory-first → flag-for-Metic, never hard-blocking a newcomer); (b) letting a SUB-METIC builder join a PROTECTED-scope goal under a tightly-scoped, Archon-granted membership — which AMENDS the ADR 0043 hard floor and requires the ship-time gates (grader pre-passes, gate-review ESCALATE, main-audit) to become goal-aware; (c) the deferred REWARD model — does achieving a goal earn anything beyond per-task cost-plus (ADR 0054), and how does any reward split among members (leaning karma + contribution-weighted, NOT decided). Design only — the build rides a future cluster.
+
+kind=spike (stays in backlog; a power-user opens it deliberately — it reshapes downstream work). **Done when:** an ADR is written + accepted recording the relevance-judge design, the sub-Metic-in-protected-scope amendment (with its security review), and the goal-reward model; a child task list is filed; NO enforcement code changes here.`,
+    kind: 'spike', discipline: 'engineer', priority: 3,
+    est_minutes: 240, manual_degree: 2, credits_reward: 40,
+    touches: ['docs/adr/', 'docs/design/'],
+    criteria: ['C6'], deps: ['G07', 'G09'], requires_rank: 'metic',
+  },
+
+  // ===========================================================================
+  // PROOF — the live demonstration C6 is met (P2)
+  // ===========================================================================
+  {
+    key: 'G13',
+    title: 'Proof — sub-Metic authors+claims+ships in-scope, BLOCKED server-side out-of-scope',
+    description: `The live proof of C6 (ADR 0086 Decision point 5). On a staged setup: an Archon creates a module-scoped goal with NON-protected scope (e.g. the \`ideas\` module) and a sub-Metic (xenos/thetes) builder joins it. Prove the member CAN author + claim + ship a task whose touches stay inside the goal’s modules. Prove the member is BLOCKED server-side when authoring a task whose touches reach a protected path OR a module outside scope — fail-closed at POST /goals/:id/tasks AND, if a mis-declared task slips the create gate, at the ship-time gates on the real committed diff (grader permissionPathPrePass + gate-review ESCALATE + main-audit). Capture the transcript in the task notes.
+
+**Done when:** the in-scope author→claim→ship path works for a sub-Metic member; both out-of-scope attempts (protected-path + outside-module) are rejected; BOTH the create-time and ship-time defenses are demonstrated; the walkthrough is documented.`,
+    // NB: kind='feature' — the DB tasks_kind_check constraint has no 'verify' kind
+    // (allowed: feature|bug|infra|refactor|spike|learning-capture|cleanup|decision|
+    // blocker-resolution|unclassified). A proof/verification task lands as 'feature'
+    // (same as the module-system proof task 1424/M16).
+    kind: 'feature', discipline: 'engineer', priority: 2,
+    est_minutes: 240, manual_degree: 3, credits_reward: 45,
+    touches: ['docs/', 'tests/'],
+    criteria: ['C6'], deps: ['G07', 'G08', 'G09'], requires_rank: 'metic',
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Main: post each task with criterion_ids; assign R## after current max; wire deps.
+// ---------------------------------------------------------------------------
+
+async function main() {
+  await requireSession();
+  const api = await cliClient();
+
+  const list = await api.tasks.getTasks({ query: { version: 'BONGOS-V1' } });
+  const existing = list.data?.tasks || [];
+  const bySourceRef = {};
+  let maxR = 0;
+  for (const t of existing) {
+    if (t.source_ref) bySourceRef[t.source_ref] = t;
+    const m = /BV1\.R(\d+)\b/.exec(t.title || '');
+    if (m) { const n = Number(m[1]); if (n > maxR) maxR = n; }
+  }
+  console.log(`context: ${existing.length} BONGOS-V1 tasks, maxR=R${maxR}`);
+
+  const refByKey = {};
+  TASKS.forEach((def, i) => { refByKey[def.key] = `R${String(maxR + 1 + i).padStart(2, '0')}`; });
+
+  const idByKey = {};
+  let created = 0, skipped = 0, errors = 0;
+
+  for (const def of TASKS) {
+    const r = refByKey[def.key];
+    const source_ref = `bongos-v1-${def.key.toLowerCase()}`;
+    if (bySourceRef[source_ref]) {
+      idByKey[def.key] = Number(bySourceRef[source_ref].id);
+      console.log(`SKIP  ${def.key} (${r}) already exists: id=${bySourceRef[source_ref].id}`);
+      skipped++;
+      continue;
+    }
+    const body = {
+      version_id: 'BONGOS-V1',
+      title: `BV1.${r} — ${def.title}`,
+      description: def.description,
+      kind: def.kind,
+      discipline: def.discipline,
+      status: 'backlog',
+      priority: def.priority,
+      est_minutes: def.est_minutes,
+      manual_degree: def.manual_degree,
+      credits_reward: def.credits_reward,
+      touches: def.touches || [],
+      criterion_ids: def.criteria || [],
+      source: 'planning-session',
+      source_ref,
+    };
+    if (def.requires_rank) body.requires_rank = def.requires_rank;
+    if (def.security_sensitive) body.security_sensitive = true;
+    if (DRY) {
+      const deps = (def.deps || []).map((d) => (refByKey[d] ? `${d}=${refByKey[d]}` : d)).join(',');
+      const flags = [def.requires_rank ? `rank≥${def.requires_rank}` : null, def.security_sensitive ? 'sec' : null].filter(Boolean).join(' ');
+      console.log(`DRY   ${def.key} -> ${r}  P${def.priority} ${def.kind}  crit=${(def.criteria || []).join('/')}  deps=[${deps}]  ${flags}  ${def.title.slice(0, 46)}`);
+      continue;
+    }
+    const res = await api.tasks.postTasks({ body });
+    if (res.status !== 201) {
+      console.error(`FAIL  ${def.key}: status=${res.status} ${JSON.stringify(res.data).slice(0, 220)}`);
+      errors++;
+      continue;
+    }
+    idByKey[def.key] = Number(res.data.task.id);
+    console.log(`OK    ${def.key} -> BV1.${r}  task id=${idByKey[def.key]}  (crit ${(def.criteria || []).join('/')}, requires_rank=${res.data.task.requires_rank || 'auto'})`);
+    created++;
+  }
+
+  const resolveDep = (ref) => idByKey[ref] ?? null;
+
+  let depsWired = 0, depErrors = 0;
+  if (!DRY) {
+    for (const def of TASKS) {
+      const deps = def.deps || [];
+      if (deps.length === 0) continue;
+      const taskId = idByKey[def.key];
+      if (!taskId) { console.error(`DEPS  ${def.key}: no task id (create failed?), skipping`); depErrors++; continue; }
+      const depIds = deps.map(resolveDep).filter((n) => Number.isFinite(n));
+      if (depIds.length !== deps.length) {
+        const missing = deps.filter((d) => !Number.isFinite(resolveDep(d)));
+        console.error(`DEPS  ${def.key}: unresolved deps [${missing.join(',')}] — wiring the resolvable ones only`);
+        depErrors++;
+        if (depIds.length === 0) continue;
+      }
+      const res = await api.tasks.postTasksIdDependencies({ id: taskId, body: { depends_on_task_ids: depIds } });
+      if (res.status === 200) {
+        console.log(`DEPS  ${def.key} <- [${deps.join(',')}] (ids ${depIds.join(',')})`);
+        depsWired++;
+      } else {
+        console.error(`DEPS FAIL ${def.key}: ${res.status} ${JSON.stringify(res.data).slice(0, 220)}`);
+        depErrors++;
+      }
+    }
+  }
+
+  const zeroDep = TASKS.filter((d) => (d.deps || []).length === 0).map((d) => `${d.key}=${idByKey[d.key] || '?'}`);
+  console.log(`\nDONE  created=${created} skipped=${skipped} errors=${errors} deps_wired=${depsWired} dep_errors=${depErrors}  (manifest: ${TASKS.length})`);
+  console.log(`NEXT  promote zero-dependency tasks to 'ready' (they never auto-promote): ${zeroDep.join(', ')}`);
+  process.exit(errors === 0 && depErrors === 0 ? 0 : 1);
+}
+
+main().catch((err) => { console.error('FATAL', err); process.exit(1); });