@bongos/core 1.17.0

package/migrations/124_cost_baseline.sql

@@ -0,0 +1,45 @@
+-- 124_cost_baseline.sql — the savings counterfactual ledger (GDS-V4 task 1345,
+-- System 1: Cost Attribution & Savings Ledger).
+--
+-- Every later LLM-reduction system (compaction, value-gate, deterministic cron,
+-- LLM cache) needs to PROVE its savings in dollars, not assert them. This tiny
+-- table is where each records a counterfactual: "this run cost amount_usd; had
+-- the system not acted it would have cost baseline_usd". The saving is
+-- SUM(baseline_usd - amount_usd) grouped by system tag (db.costSummary().savings,
+-- surfaced on /public/cost-summary).
+--
+-- CONTRACT (enforced by the writing code, not the schema): baseline_usd is
+-- ALWAYS computed server-side from token counts via src/bongos/llm-pricing.js
+-- priceUsage() — NEVER a client-supplied dollar figure (the same trust rule as
+-- the cost-plus reward, ADR 0054). A system records here only what it can price
+-- from real usage.
+--
+--   system        — the system/lever claiming the saving, e.g.
+--                   'system2:compaction', 'system5:llm-cache'. Free text tag.
+--   baseline_usd  — counterfactual cost had the system NOT acted (priced).
+--   amount_usd    — what it actually cost (priced; 0 for a full elimination).
+--   source_ref    — per-event idempotency key (e.g. a tree-SHA or session id).
+--   description   — optional human note.
+--
+-- Idempotent unique index on (system, source_ref) so a system can safely
+-- re-record the same event without double-counting (mirrors cost_log's pattern).
+-- Additive, new table, safe to re-run.
+
+CREATE TABLE IF NOT EXISTS cost_baseline (
+  id           bigserial PRIMARY KEY,
+  system       text NOT NULL,
+  baseline_usd numeric NOT NULL,
+  amount_usd   numeric NOT NULL DEFAULT 0,
+  source_ref   text,
+  description  text,
+  task_id      integer,
+  builder_id   integer,
+  recorded_at  timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_cost_baseline_system_ref
+  ON cost_baseline (system, source_ref)
+  WHERE source_ref IS NOT NULL;
+
+INSERT INTO schema_migrations (version) VALUES ('124_cost_baseline')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/125_llm_cache.sql

@@ -0,0 +1,54 @@
+-- 125_llm_cache.sql — content-addressed LLM result cache (GDS-V4 task 1358,
+-- System 5: Content-Addressed LLM Cache).
+--
+-- Memoizes idempotent model runs at the shared spawn primitive
+-- (grader.runSubagent). An identical (normalized-prompt-hash, model, task_type,
+-- git-tree-sha) invocation — e.g. a nightly architect-audit / audit-cron over an
+-- UNCHANGED main, or an onboarding-analyze re-run on the same immutable session —
+-- returns the stored result with ZERO new tokens. Validity is bound to the git
+-- SHA of the embedded inputs (scope_sha), so a stale answer is only ever returned
+-- when the inputs are provably unchanged (ADR — task 1360). Cannot touch the
+-- interactive marathon (that path does not call runSubagent); this is the
+-- residual safety net behind Systems 3 + 4.
+--
+-- Mirrors the content-addressed convention of migrations/103_search_chunks.sql:
+-- one table in the EXISTING GDS Postgres, no new service, no new monthly cost.
+--
+--   cache_key        — sha256(normalized_prompt | model | task_type | scope_sha);
+--                      the PRIMARY KEY (the content address). The store path
+--                      upserts ON CONFLICT (cache_key).
+--   prompt_hash      — sha256 of the normalized prompt alone (debug / collisions).
+--   model            — the model the cached result was produced on (part of the key).
+--   task_type        — which normalizer produced the key (architect-audit, …).
+--   scope_sha        — git tree-hash of the embedded inputs; the invalidation key.
+--   result_stdout    — the cached subagent stdout (the thing we replay on a hit).
+--   result_cost_usd  — what the ORIGINAL run cost (priced); a hit replays it at $0
+--                      and counts result_cost_usd toward tokens_saved/savings.
+--   hit_count        — number of $0 replays served (bumped on each hit).
+--   tokens_saved_est — cumulative estimated tokens NOT re-billed across hits.
+--   owner_builder_id — nullable; non-null only for a per-builder-private cached run.
+--   created_at / last_hit_at / expires_at — lifecycle; expires_at indexed for a
+--                      cheap TTL sweep (a future reaper; null = no expiry).
+--
+-- Additive, new table + index, idempotent: safe to re-run.
+
+CREATE TABLE IF NOT EXISTS llm_cache (
+  cache_key        text PRIMARY KEY,
+  prompt_hash      text NOT NULL,
+  model            text,
+  task_type        text,
+  scope_sha        text,
+  result_stdout    text NOT NULL,
+  result_cost_usd  numeric NOT NULL DEFAULT 0,
+  hit_count        integer NOT NULL DEFAULT 0,
+  tokens_saved_est bigint  NOT NULL DEFAULT 0,
+  owner_builder_id integer,
+  created_at       timestamptz NOT NULL DEFAULT now(),
+  last_hit_at      timestamptz,
+  expires_at       timestamptz
+);
+
+CREATE INDEX IF NOT EXISTS idx_llm_cache_expires ON llm_cache (expires_at);
+
+INSERT INTO schema_migrations (version) VALUES ('125_llm_cache')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/126_autonomy_runs.sql

@@ -0,0 +1,33 @@
+-- 126_autonomy_runs.sql — observability for the autonomy precheck (GDS-V4 task
+-- 1351, System 3: Value-Gated Autonomous Engagement).
+--
+-- The $0 deterministic precheck (scripts/gds/autonomy-gate.js) decides, before
+-- any model boots, whether a nightly routine should fire (signal present) or skip
+-- (no claimable work + main unchanged, or no open ideas, or the autonomous
+-- month-to-date spend has hit its ceiling). Every decision — especially every
+-- SKIP — lands here so the gate is auditable: "why didn't overnight-builder run
+-- last night?" is a query, not a guess. The latest `go` row's head_sha is also
+-- the "stored last_head" the next precheck compares origin/main against.
+--
+-- SYSTEM 3 IS BUILT DISABLED (owner directive): the gate is inert until
+-- OTB_AUTONOMY_ENABLED=1, so `enabled` records whether it was armed at decision
+-- time. While off, every row is decision='go', reason='disabled' — proving the
+-- wiring changes nothing until the owner arms it alongside the grader rework.
+--
+-- Additive, new table + index, idempotent: safe to re-run.
+
+CREATE TABLE IF NOT EXISTS autonomy_runs (
+  id              bigserial PRIMARY KEY,
+  routine         text NOT NULL,
+  decision        text NOT NULL,            -- 'go' | 'no-go'
+  reason          text,
+  head_sha        text,
+  claimable_count integer,
+  enabled         boolean NOT NULL DEFAULT false,
+  created_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_autonomy_runs_routine ON autonomy_runs (routine, created_at DESC);
+
+INSERT INTO schema_migrations (version) VALUES ('126_autonomy_runs')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/143_cost_calibration.sql

@@ -0,0 +1,63 @@
+-- 143_cost_calibration.sql — cost calibration medians (cost-per-task / cost-per-credit).
+--
+-- The cost-side analogue of migration 015's pms_calibrated_minutes. Recommended
+-- by the 2026-05-30 spend audit, finding F6: "migration 015's calibration is the
+-- model the COST side should imitate: collect real samples, derive a ratio,
+-- expose a calibrated figure. Extend the same pattern to cost-per-task and
+-- cost-per-credit once real api spend lands." That spend has now landed (ADR 0028
+-- session-cost capture → cost_log.category='api'), so this exposes the medians.
+--
+-- Unlike est calibration there is no per-row input to calibrate (a task has no
+-- "cost estimate" to multiply by a ratio), so the deliverable is the SUMMARY
+-- function only — mirroring pms_calibration_summary(), not pms_calibrated_minutes.
+--
+-- cost_calibration_summary() returns one row per task kind PLUS an overall '(all)'
+-- row (GROUPING SETS), each carrying:
+--   median_cost_per_task   — median of SUM(amount_usd) per task, in USD.
+--   median_cost_per_credit — median of (task cost / credits_reward), USD per credit;
+--                            NULL when a kind has no credit-bearing samples.
+--   sample_size            — number of tasks contributing (judge confidence by it,
+--                            the same way pms_calibrated_minutes gates on n).
+--
+-- Sample set mirrors migration 015 exactly: shipped+confirmed tasks only, smoke
+-- rows excluded, and only tasks that actually incurred cost (HAVING cost > 0).
+-- Idempotent: CREATE OR REPLACE.
+
+CREATE OR REPLACE FUNCTION cost_calibration_summary()
+RETURNS TABLE (
+  kind text,
+  median_cost_per_task numeric,
+  median_cost_per_credit numeric,
+  sample_size integer
+)
+LANGUAGE sql
+STABLE
+AS $$
+  WITH task_costs AS (
+    SELECT t.id,
+           t.kind,
+           t.credits_reward,
+           SUM(cl.amount_usd) AS task_cost
+      FROM cost_log cl
+      JOIN tasks t ON t.id = cl.task_id
+     WHERE t.status IN ('shipped', 'confirmed')
+       AND t.title NOT LIKE '\_\_smoke\_\_%' ESCAPE '\'
+     GROUP BY t.id, t.kind, t.credits_reward
+    HAVING SUM(cl.amount_usd) > 0
+  )
+  SELECT COALESCE(kind, '(all)') AS kind,
+         ROUND((percentile_cont(0.5) WITHIN GROUP (ORDER BY task_cost))::numeric, 4)
+           AS median_cost_per_task,
+         ROUND(
+           (percentile_cont(0.5) WITHIN GROUP (ORDER BY task_cost / credits_reward)
+             FILTER (WHERE credits_reward > 0))::numeric,
+           4
+         ) AS median_cost_per_credit,
+         COUNT(*)::integer AS sample_size
+    FROM task_costs
+   GROUP BY GROUPING SETS ((kind), ())
+   ORDER BY (kind IS NULL) DESC, sample_size DESC, kind;
+$$;
+
+INSERT INTO schema_migrations (version) VALUES ('143_cost_calibration')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/145_backfill_task_requires_rank.sql

@@ -0,0 +1,84 @@
+-- 145_backfill_task_requires_rank.sql — task 1498 / ADR 0084.
+--
+-- WHY: tasks.requires_rank (V3.R82, migration 044/068) shipped INERT — no
+-- create/edit path ever set it, so every task sits at the 'xenos' default and
+-- the claim-time rank gate (db.claimTask / claimTasksBatch) never bites. Going
+-- forward db.deriveRequiredRank (reusing permission-path-check.matchProtected)
+-- is the LIVE authority: it derives a floor on every create/PATCH. This one-time
+-- pass brings EXISTING open tasks up to the same floor so the whole board is
+-- correctly rank-scoped now, not just new work (Lars's directive, 2026-06-23).
+--
+-- RULE (mirrors deriveRequiredRank): a non-terminal task floors at 'metic' when
+-- it is security_sensitive OR any touches[] entry hits the permission-sensitive
+-- set. The conditions below are GENERATED from PROTECTED_GLOBS in
+-- src/bongos/permission-path-check.js (the single source of truth) as of 2026-06-23
+-- — every glob there is an exact file or a trailing-'/' directory prefix with no
+-- '*'/'**' wildcard and no LIKE-special char, so prefix LIKE / exact '=' is an
+-- exact translation (the generator asserts this). permission-path-check.js stays
+-- authoritative: a future glob change does NOT rewrite this historical snapshot
+-- (new/edited tasks re-derive through the JS helper). Regenerate with
+-- the throwaway gen step if you ever need to re-snapshot.
+--
+-- SAFE + IDEMPOTENT: only raises the default ('xenos' -> 'metic'); never lowers
+-- a floor and never touches a deliberate override. Re-running matches no rows.
+
+UPDATE tasks
+   SET requires_rank = 'metic', updated_at = now()
+ WHERE status NOT IN ('shipped', 'abandoned')
+   AND requires_rank = 'xenos'        -- only raise the default; leave overrides alone
+   AND (
+        security_sensitive = true
+     OR EXISTS (
+          SELECT 1 FROM unnest(touches) AS f
+           WHERE
+              f LIKE 'src/bongos/middleware/%'
+           OR f LIKE 'src/bongos/routes/%'
+           OR f LIKE 'src/bongos/grader-workers/%'
+           OR f LIKE 'scripts/gds/hooks/%'
+           OR f LIKE 'scripts/deploy/%'
+           OR f LIKE 'migrations/%'
+           OR f LIKE 'infra/%'
+           OR f LIKE '.github/%'
+           OR f LIKE '.husky/%'
+           OR f LIKE '.claude/hooks/%'
+           OR f = 'src/bongos/auth.js'
+           OR f = 'src/bongos/db.js'
+           OR f = 'src/bongos/route-rank-check.js'
+           OR f = 'src/bongos/permission-path-check.js'
+           OR f = 'src/bongos/routes.js'
+           OR f = 'server.js'
+           OR f = 'src/bongos/boxes.js'
+           OR f = 'src/bongos/box-access.js'
+           OR f = 'src/bongos/box-credential.js'
+           OR f = 'src/bongos/grader.js'
+           OR f = 'src/bongos/grader-rubric.json'
+           OR f = 'scripts/gds/ship.js'
+           OR f = 'scripts/gds/confirm.js'
+           OR f = 'scripts/gds/merge-mode.js'
+           OR f = 'scripts/gds/ci-grade.js'
+           OR f = 'scripts/gds/grade-smoke.js'
+           OR f = 'scripts/gds/conductor-dispatch.js'
+           OR f = 'scripts/gds/main-audit.js'
+           OR f = 'scripts/gds/push-main.js'
+           OR f = 'scripts/gds/run-unit-tests.js'
+           OR f = 'scripts/gds/gate-review.js'
+           OR f = 'scripts/gds/setup.js'
+           OR f = 'scripts/gds/install-git-hooks.js'
+           OR f = 'scripts/gds/cli-lib.js'
+           OR f = 'scripts/migrate.sh'
+           OR f = 'src/bongos/merge-lock.js'
+           OR f = 'src/bongos/ship-preflight.js'
+           OR f = 'CODEOWNERS'
+           OR f = 'config/deploy.json'
+           OR f = 'package.json'
+           OR f = 'package-lock.json'
+           OR f = 'docs/canonical-permissions.md'
+           OR f = 'docs/adr/0016-trust-boundary-server-enforced-permissions.md'
+           OR f = 'docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md'
+           OR f = 'CLAUDE.md'
+           OR f = '.claude/settings.json'
+        )
+       );
+
+INSERT INTO schema_migrations (version) VALUES ('145_backfill_task_requires_rank')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/160_goal_tier.sql

@@ -0,0 +1,88 @@
+-- 160_goal_tier.sql — the Goal tier (ADR 0086 §2, BV1.R56 / task 1510).
+--
+-- Phase 2 of the goal-scoped work hierarchy: the one genuinely-new tier, sitting
+-- between `versions` and `done_when_criteria`. A goal is a SHARED, joinable,
+-- module-scoped workspace — membership (not a single assignee) is what later
+-- grants bounded task authoring within the goal's `scope_modules` wall (R57/R60).
+--
+-- This migration is PURELY ADDITIVE and changes no behaviour: it creates the two
+-- new tables, adds a nullable `goal_id` to `done_when_criteria` and `tasks`, and
+-- backfills every existing criterion under a per-version default "<version> —
+-- general" goal so the not-yet-built `/status` rollup (R58) has a goal to roll up
+-- through. No route references a goal yet, so OTB behaves identically.
+--
+-- created_by is NULLABLE and the backfilled default goals leave it NULL =
+-- system-attributed (Archon-owned in practice); a migration must never hard-code
+-- a specific builder id (fresh-DB replay safety — see learning 1238). The backfill
+-- is data-safe on a fresh DB too: INSERT..SELECT FROM versions yields zero rows if
+-- no versions are seeded yet, and the UPDATE then touches nothing.
+--
+-- Idempotent: tables/columns use IF NOT EXISTS; the default-goal insert is guarded
+-- by NOT EXISTS on (version_id, title); the criterion link only fills NULLs.
+
+BEGIN;
+
+-- 1. goals — the new tier. scope_modules is the wall (module keys from
+--    module-scope-map.js, R54); empty for the Archon-owned default goals.
+CREATE TABLE IF NOT EXISTS goals (
+  id                    bigserial PRIMARY KEY,
+  version_id            text NOT NULL REFERENCES versions(id),
+  title                 text NOT NULL,
+  description           text,
+  scope_modules         text[] NOT NULL DEFAULT '{}',
+  status                text NOT NULL DEFAULT 'open' CHECK (status IN ('open', 'achieved', 'archived')),
+  created_by            bigint REFERENCES builders(id),   -- NULL = system-attributed
+  succeeded_by_goal_id  bigint REFERENCES goals(id),      -- rescope carry-forward
+  created_at            timestamptz NOT NULL DEFAULT now(),
+  updated_at            timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_goals_version ON goals (version_id);
+
+-- 2. goal_members — many builders <-> one goal; membership grants the (later)
+--    bounded authoring authority. lead|member roles; one row per (goal, builder).
+CREATE TABLE IF NOT EXISTS goal_members (
+  goal_id     bigint NOT NULL REFERENCES goals(id) ON DELETE CASCADE,
+  builder_id  bigint NOT NULL REFERENCES builders(id) ON DELETE CASCADE,
+  role        text NOT NULL DEFAULT 'member' CHECK (role IN ('lead', 'member')),
+  joined_at   timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (goal_id, builder_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_goal_members_builder ON goal_members (builder_id);
+
+-- 3. done_when_criteria re-parent under goals (nullable; backfilled below).
+ALTER TABLE done_when_criteria
+  ADD COLUMN IF NOT EXISTS goal_id bigint REFERENCES goals(id);
+
+-- 4. tasks gain goal_id (nullable — a task may exist with no goal, as today).
+ALTER TABLE tasks
+  ADD COLUMN IF NOT EXISTS goal_id bigint REFERENCES goals(id);
+
+-- 5. Backfill: one default "<version> — general" goal per version, then link
+--    every still-unlinked criterion of that version to it. Idempotent.
+INSERT INTO goals (version_id, title, description, status, scope_modules)
+SELECT v.id,
+       v.id || ' — general',
+       'Default catch-all goal for ' || v.id || ', auto-created by migration 160 (ADR 0086 §2). '
+         || 'Holds the criteria that predate the goal tier; Archon-owned, members empty.',
+       'open',
+       '{}'
+  FROM versions v
+ WHERE NOT EXISTS (
+   SELECT 1 FROM goals g
+    WHERE g.version_id = v.id
+      AND g.title = v.id || ' — general'
+ );
+
+UPDATE done_when_criteria c
+   SET goal_id = g.id
+  FROM goals g
+ WHERE g.version_id = c.version_id
+   AND g.title = c.version_id || ' — general'
+   AND c.goal_id IS NULL;
+
+INSERT INTO schema_migrations (version) VALUES ('160_goal_tier')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/migrations/163_polymorphic_dependencies.sql

@@ -0,0 +1,187 @@
+-- 163_polymorphic_dependencies.sql — ADR 0086 §5 / Phase 4 / BV1.R62 / task 1516.
+--
+-- One polymorphic "blocked-until-done" edge over {task, goal, criterion}, taking
+-- over from the task-only task_dependencies table (020) as the canonical edge for
+-- the claim gate + auto-promotion. Read it as "FROM is blocked until TO is done":
+--   TO is "done"  <=>  task status='shipped' | criterion satisfied | goal status='achieved'.
+--
+-- ADR 0086 §5 prose says "tasks.dependencies[] migrates in" — there is NO such
+-- column; the real task->task edges live in the task_dependencies join table (020),
+-- and we migrate THOSE in here. task_dependencies is RETAINED, not dropped:
+-- migration 021 still seeds it on a fresh DB, and `dependencies` is a superset, so
+-- the move is reversible (stop reading the new table → fall back to the old one).
+--
+-- Inheritance: a task is gated by edges FROM itself, FROM its goal (tasks.goal_id),
+-- and FROM every criterion it fulfils (task_criteria). One enforcement point — the
+-- claim gate (db.js unsatisfiedDeps) — resolves all three. The promotion trigger
+-- fires on each "done" event (task ship / criterion satisfy / goal achieve) and
+-- promotes any backlog (non-spike) task whose FULL resolved dep set is now done.
+
+BEGIN;
+
+-- ============================================================================
+-- 1. dependencies — the polymorphic edge
+-- ============================================================================
+-- No FK is possible (the target table varies by *_kind), so the CHECK constrains
+-- the kinds and `kind` disambiguates ids across tasks/goals/criteria (all bigint).
+-- The criterion referent is done_when_criteria.id — the numeric id that
+-- task_criteria.criterion_id also holds — NEVER the criterion_id text slug.
+CREATE TABLE IF NOT EXISTS dependencies (
+  from_kind  text   NOT NULL CHECK (from_kind IN ('task', 'goal', 'criterion')),
+  from_id    bigint NOT NULL,
+  to_kind    text   NOT NULL CHECK (to_kind   IN ('task', 'goal', 'criterion')),
+  to_id      bigint NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (from_kind, from_id, to_kind, to_id),
+  CONSTRAINT no_self_dep CHECK (NOT (from_kind = to_kind AND from_id = to_id))
+);
+
+-- "What does X depend on?" (forward, gate read) + "what depends on Y?" (reverse,
+-- promotion read).
+CREATE INDEX IF NOT EXISTS idx_dependencies_from ON dependencies (from_kind, from_id);
+CREATE INDEX IF NOT EXISTS idx_dependencies_to   ON dependencies (to_kind, to_id);
+
+-- ============================================================================
+-- 2. Migrate the existing task->task edges in (additive superset of 020)
+-- ============================================================================
+-- A SELECT-backfill (not literal VALUES): empty on a fresh DB where
+-- task_dependencies is empty, and re-runnable (ON CONFLICT DO NOTHING).
+INSERT INTO dependencies (from_kind, from_id, to_kind, to_id, created_at)
+SELECT 'task', td.task_id, 'task', td.depends_on_task_id, td.created_at
+  FROM task_dependencies td
+ON CONFLICT DO NOTHING;
+
+-- ============================================================================
+-- 3. Resolution predicate + generalized auto-promotion
+-- ============================================================================
+-- task_is_fully_unblocked(T): TRUE iff NONE of T's gating edges points at an
+-- un-done node. Gating edges = FROM the task itself, FROM its goal, or FROM any
+-- criterion it fulfils. Shared by all three promotion triggers below, and it
+-- mirrors the claim gate's unsatisfiedDeps in db.js (same three-source union, same
+-- done-ness test) so promotion and the gate can never disagree. An orphaned `to`
+-- (no FK; row deleted) yields no EXISTS match → counts as un-done → task stays
+-- blocked (fail-closed).
+CREATE OR REPLACE FUNCTION task_is_fully_unblocked(p_task_id bigint)
+RETURNS boolean AS $$
+  SELECT NOT EXISTS (
+    WITH gating AS (
+      SELECT d.to_kind, d.to_id
+        FROM dependencies d
+        JOIN tasks t ON t.id = p_task_id
+       WHERE (d.from_kind = 'task'      AND d.from_id = t.id)
+          OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+          OR (d.from_kind = 'criterion' AND d.from_id IN (
+                SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id))
+    )
+    SELECT 1
+      FROM gating g
+     WHERE NOT (
+          (g.to_kind = 'task'      AND EXISTS (SELECT 1 FROM tasks              x WHERE x.id = g.to_id AND x.status = 'shipped'))
+       OR (g.to_kind = 'criterion' AND EXISTS (SELECT 1 FROM done_when_criteria x WHERE x.id = g.to_id AND x.satisfied))
+       OR (g.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = g.to_id AND x.status = 'achieved'))
+     )
+  );
+$$ LANGUAGE sql STABLE;
+
+-- Each trigger fn scopes candidates to backlog (non-spike) tasks actually gated by
+-- the node that just became done (direct, or inherited via goal/criterion), then
+-- re-checks the FULL dep set with task_is_fully_unblocked. Promotion only flips
+-- backlog -> ready (never to a "done" state), so the AFTER triggers cannot recurse.
+
+-- (a) a task shipped
+CREATE OR REPLACE FUNCTION promote_dependents_on_ship()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.status = 'shipped' AND (OLD.status IS DISTINCT FROM 'shipped') THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'task' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- (b) a criterion satisfied
+CREATE OR REPLACE FUNCTION promote_dependents_on_criterion_satisfy()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.satisfied = true AND (OLD.satisfied IS DISTINCT FROM true) THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'criterion' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- (c) a goal achieved
+CREATE OR REPLACE FUNCTION promote_dependents_on_goal_achieve()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.status = 'achieved' AND (OLD.status IS DISTINCT FROM 'achieved') THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'goal' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Replace 020's single task-only trigger; add the criterion + goal triggers.
+DROP TRIGGER IF EXISTS trg_promote_dependents_on_ship ON tasks;
+CREATE TRIGGER trg_promote_dependents_on_ship
+  AFTER UPDATE OF status ON tasks
+  FOR EACH ROW
+  EXECUTE FUNCTION promote_dependents_on_ship();
+
+DROP TRIGGER IF EXISTS trg_promote_dependents_on_crit_satisfy ON done_when_criteria;
+CREATE TRIGGER trg_promote_dependents_on_crit_satisfy
+  AFTER UPDATE OF satisfied ON done_when_criteria
+  FOR EACH ROW
+  EXECUTE FUNCTION promote_dependents_on_criterion_satisfy();
+
+DROP TRIGGER IF EXISTS trg_promote_dependents_on_goal_achieve ON goals;
+CREATE TRIGGER trg_promote_dependents_on_goal_achieve
+  AFTER UPDATE OF status ON goals
+  FOR EACH ROW
+  EXECUTE FUNCTION promote_dependents_on_goal_achieve();
+
+-- ============================================================================
+-- 4. Bump migration counter + record
+-- ============================================================================
+UPDATE migration_counter SET next_number = GREATEST(next_number, 164) WHERE id = 1;
+
+INSERT INTO schema_migrations (version) VALUES ('163_polymorphic_dependencies')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/migrations/164_event_sound_prefs.sql

@@ -0,0 +1,20 @@
+-- 164_event_sound_prefs.sql — per-builder per-event sound variant selection (task 582).
+--
+-- Extends the mute-toggle system (migration 075, sound_prefs) to also support
+-- variant picking: for each of 5 build events a builder can choose WHICH
+-- world-themed sound variant plays (e.g. 'lyre-pluck' vs 'chime-soft' for the
+-- user-input event). Schema: { "user-input": "lyre-pluck", ... } where values
+-- are variant IDs defined in src/bongos/event-sound-prefs.js.
+--
+-- NULL/missing key = system default for that event. The two columns compose:
+-- the mute-toggle in sound_prefs still wins over the variant — if a builder
+-- mutes 'alert' and their user-input event resolves to a variant backed by
+-- alert.wav, it will be silent.
+--
+-- Idempotent: safe to re-run.
+
+ALTER TABLE builders
+  ADD COLUMN IF NOT EXISTS event_sound_prefs jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+INSERT INTO schema_migrations (version) VALUES ('164_event_sound_prefs')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/165_task_module_key.sql

@@ -0,0 +1,15 @@
+-- BV1.R53 — task→module affinity (task 1422).
+--
+-- A task can be labelled with a module key to declare which module it belongs to.
+-- This drives: (1) module-disjointness parallel-safety at claim time (two tasks
+-- in the SAME module → conflict; different modules → always safe); (2) claim-time
+-- context scoped to that module's directory tree; (3) ship-time diff⊆module
+-- drift detection ("you said game, you touched dev-box"); (4) soft deprecation of
+-- touches[] for module-bound tasks (module globs supersede predicted file paths).
+--
+-- No FK or CHECK against a modules registry — module keys are validated in
+-- application code against MODULE_SCOPE_MAP, which is the live source of truth.
+-- The column is nullable: tasks without a module_key fall back to the existing
+-- touches[]-based parallel-safety and context behaviour.
+
+ALTER TABLE tasks ADD COLUMN IF NOT EXISTS module_key text;

package/migrations/171_claims_published_head_sha.sql

@@ -0,0 +1,24 @@
+-- Task 1547 — record the tip sha the SERVER actually pushed for a claim's
+-- server-mediated publish (ADR 0055), so the confirmed->shipped reconcile can
+-- prove the land from THIS task's own commit instead of from a branch-name match.
+--
+-- WHY. claims.head_sha is the claim-TIME base (the worktree HEAD when the task was
+-- claimed), NOT the graded/published tip. ship.js sends the real tip to
+-- POST /tasks/:id/publish-branch, but it was discarded after the push. The
+-- reconcile-on-read (routes/tasks.js) and the publish-reconciler therefore had no
+-- reliable per-task commit to verify against, so a reused worktree branch could
+-- match an OLDER task's already-merged PR and false-flip confirmed->shipped (the
+-- BV1.R04/R05 strand: branch claude/jovial-rosalind-84d6c3 had earlier been
+-- PR #386 / task 1297). This column holds the pushed tip; the reconcile gates on
+-- isAncestorOfDefaultBranch(published_head_sha) before shipping. Additive + nullable
+-- so legacy rows (no recorded publish) are simply un-provable via the tip path and
+-- fall back to the PR-references-this-task check.
+
+BEGIN;
+
+ALTER TABLE claims ADD COLUMN IF NOT EXISTS published_head_sha TEXT;
+
+COMMENT ON COLUMN claims.published_head_sha IS
+  'Tip sha the server pushed for this claim via POST /tasks/:id/publish-branch (ADR 0055). NULL until a server-mediated publish succeeds. The confirmed->shipped reconcile proves a per-task land from this commit (task 1547).';
+
+COMMIT;

package/migrations/174_close_orphaned_claims_on_terminal_tasks.sql

@@ -0,0 +1,30 @@
+-- 174_close_orphaned_claims_on_terminal_tasks.sql
+-- task 1643 — one-shot backfill that pairs with the shipTask claim-close safety
+-- net (src/bongos/db.js).
+--
+-- THE STRAND CLASS. A claim is normally closed by db.resolveClaim
+-- (claimed→completed: UPDATE claims SET released_at=now()). The confirm paths
+-- (confirmTask / override-confirm / grader-confirm) and shipTask
+-- (confirmed→shipped) flip task status + award credits but never touch the
+-- claim. So a task that reaches a terminal state WITHOUT going through
+-- resolveClaim on that claim (strand recovery, direct-SQL fixups) leaves the
+-- claim dangling released_at=NULL forever, and every claim-aware view (builder
+-- dashboard, parallel-safety) keeps showing the shipped/confirmed task as
+-- actively claimed. The stale-claim sweeper can't repair it — its release resets
+-- the task to 'ready', which would un-ship a shipped task.
+--
+-- Live repro: task 1300 (BV1.R05) is correctly shipped (PR #410, on main) but
+-- claim #1292 (builder 95) is still open. This closes #1292 and any siblings.
+--
+-- Going forward, shipTask closes open claims in the ship txn, so new ships can't
+-- strand. This statement mops up the EXISTING backlog on terminal tasks.
+-- Idempotent: a second run matches no rows (every such claim is already closed).
+-- COALESCE preserves any outcome already recorded; an open claim has
+-- outcome=NULL, so it lands 'shipped' (a valid claims.outcome CHECK value).
+UPDATE claims c
+   SET released_at = now(),
+       outcome     = COALESCE(c.outcome, 'shipped')
+  FROM tasks t
+ WHERE c.task_id = t.id
+   AND c.released_at IS NULL
+   AND t.status IN ('shipped', 'confirmed');

package/migrations/175_task_grades_diff_hash.sql

@@ -0,0 +1,9 @@
+-- 175_task_grades_diff_hash.sql — store a diff fingerprint alongside each grade (V4.R08).
+--
+-- Adds diff_hash TEXT to task_grades so ship.js can detect "same diff as the
+-- last PASS" and skip re-running the adversarial panel. NULL for rows written
+-- before this migration (pre-R08 grades).
+--
+-- Idempotent: safe to re-run.
+
+ALTER TABLE task_grades ADD COLUMN IF NOT EXISTS diff_hash TEXT;