@bongos/core 1.17.0

package/modules/discord/discord-role-sync.js

@@ -0,0 +1,318 @@
+'use strict';
+
+// Discord role-sync — Phase 3 F5 (ADR 0033 §4).
+//
+// ONE-WAY: GDS → Discord. The bot sets a member's Discord rank-role
+// (Xenos / Metic / Archon) from the LIVE `builders.rank`. It READS the GDS and
+// WRITES Discord — never the reverse — so a Discord role can never feed
+// authority back into the GDS (ADR 0016 / 0032 §2: roles are cosmetic
+// reflections, never keys). Role badges become continuously honest.
+//
+// Fired on three triggers (ADR 0033 §4): on link (F2 callback), on rank change
+// (PATCH /builders/:id/rank), and on a periodic reconcile (the bot's interval +
+// on-ready sweep). All best-effort: a Discord-side failure (missing Manage
+// Roles, hierarchy, member left the guild) logs and moves on — it must never
+// break a rank change or a link.
+//
+// The FOUR live ranks have Discord roles (xenos/thetes/metic/archon). Any other
+// rank value maps to NO managed role, and the sync strips the managed roles.
+//
+// Requires (go-live, not code): the GuildMembers privileged intent, the bot to
+// hold Manage Roles, and the bot's own role positioned ABOVE the three rank
+// roles in the guild hierarchy. Without those the role writes 403 and are
+// logged — the GDS is unaffected.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const db = require('./db');
+const ic = require('../../src/module-api');
+
+// The live ranks that map to a Discord role badge = the full rank ladder, in
+// order low→high. Sourced from db.LIVE_RANK_LADDER — the server-side single
+// source (D1) — so a ladder change (e.g. thetes, ADR 0034) lands in one place.
+const MANAGED_RANKS = db.LIVE_RANK_LADDER;
+
+// PURE — the rank→role-id map from env (DISCORD_ROLE_XENOS/METIC/ARCHON) or
+// ~/.config/otb/discord-bot.json `role_ids: { xenos, metic, archon }`. Returns
+// only the keys actually configured; an empty map means role-sync is inert.
+function loadRoleMap(env = process.env) {
+  const out = {};
+  const envKeys = { xenos: 'DISCORD_ROLE_XENOS', thetes: 'DISCORD_ROLE_THETES', metic: 'DISCORD_ROLE_METIC', archon: 'DISCORD_ROLE_ARCHON' };
+  for (const rank of MANAGED_RANKS) {
+    if (env[envKeys[rank]]) out[rank] = String(env[envKeys[rank]]);
+  }
+  if (Object.keys(out).length) return out;
+  try {
+    const raw = ic.readConfigFileSync('discord-bot.json');
+    const cfg = JSON.parse(raw);
+    if (cfg.role_ids && typeof cfg.role_ids === 'object') {
+      for (const rank of MANAGED_RANKS) {
+        if (cfg.role_ids[rank]) out[rank] = String(cfg.role_ids[rank]);
+      }
+    }
+  } catch (_) { /* not configured */ }
+  return out;
+}
+
+// PURE — the guild id the bot manages roles in. Env DISCORD_GUILD_ID, else the
+// file's guild_id, else null (caller falls back to the bot's single cached guild).
+function loadGuildId(env = process.env) {
+  if (env.DISCORD_GUILD_ID) return String(env.DISCORD_GUILD_ID);
+  try {
+    const raw = ic.readConfigFileSync('discord-bot.json');
+    const cfg = JSON.parse(raw);
+    if (cfg.guild_id) return String(cfg.guild_id);
+  } catch (_) { /* not configured */ }
+  return null;
+}
+
+// PURE — a rank's Discord role id, or null if it isn't a managed live rank or
+// has no configured mapping.
+function rankToRoleId(rank, roleMap) {
+  if (!MANAGED_RANKS.includes(rank)) return null;
+  return roleMap[rank] || null;
+}
+
+// PURE — given the member's CURRENT role ids and their target rank, compute the
+// minimal change: which managed role to add (the target, if missing) and which
+// managed roles to remove (any other rank role they currently hold). Idempotent:
+// a member already holding exactly their rank role yields { add:null, remove:[] }.
+// Never touches non-managed roles — we only ever own the three rank badges.
+function computeRoleChange(currentRoleIds, rank, roleMap) {
+  const managedIds = MANAGED_RANKS.map((r) => roleMap[r]).filter(Boolean);
+  const target = rankToRoleId(rank, roleMap);
+  const current = new Set((currentRoleIds || []).map(String));
+  const remove = managedIds.filter((id) => id !== target && current.has(id));
+  const add = target && !current.has(target) ? target : null;
+  return { add, remove };
+}
+
+// The bot's managed guild, or null if the bot isn't connected / not in it.
+// Lazy-requires discord-bot to avoid a require cycle (bot → role-sync on its
+// reconcile path; role-sync → bot here).
+function getGuild() {
+  const bot = require('./discord-bot');
+  const client = bot.getClient && bot.getClient();
+  if (!client) return null;
+  const gid = loadGuildId();
+  return gid ? client.guilds.cache.get(gid) || null : client.guilds.cache.first() || null;
+}
+
+const realDeps = {
+  getDiscordLink: db.getDiscordLink,
+  getBuilderById: db.getBuilderById,
+  listDiscordLinks: db.listDiscordLinks,
+  loadRoleMap,
+  getGuild,
+};
+
+// Sync ONE builder's Discord rank-role from their live rank. Best-effort, never
+// throws. Returns a small status object for logging/tests.
+async function syncBuilderRole(builderId, deps = realDeps) {
+  try {
+    const link = await deps.getDiscordLink(builderId);
+    if (!link) return { ok: false, reason: 'not_linked' };
+    const builder = await deps.getBuilderById(builderId);
+    if (!builder) return { ok: false, reason: 'no_builder' };
+
+    const roleMap = deps.loadRoleMap();
+    if (!Object.keys(roleMap).length) return { ok: false, reason: 'no_role_map' };
+
+    const guild = deps.getGuild();
+    if (!guild) return { ok: false, reason: 'no_guild' };
+
+    const member = await guild.members.fetch(link.discord_user_id).catch(() => null);
+    if (!member) return { ok: false, reason: 'member_not_found' };
+
+    const current = [...member.roles.cache.keys()];
+    const { add, remove } = computeRoleChange(current, builder.rank, roleMap);
+    if (!add && !remove.length) return { ok: true, noop: true };
+
+    if (remove.length) await member.roles.remove(remove, 'GDS role-sync (ADR 0033 §4)');
+    if (add) await member.roles.add(add, 'GDS role-sync (ADR 0033 §4)');
+    return { ok: true, add, removed: remove };
+  } catch (err) {
+    // Most likely a Discord permission/hierarchy problem — log, don't throw.
+    console.error(`[discord-bot] role-sync failed for builder ${builderId}:`, err.message);
+    return { ok: false, reason: 'error', error: err.message };
+  }
+}
+
+// Display colors for each managed rank role (Discord uses decimal integers).
+// These mirror the hall badge palette in modules/hall-ui/public/style.css
+// (.rank-badge--<rank> background) so a builder's Discord role color matches the
+// badge they see in the builders' hall; 0 = Discord default if a rank is missing.
+//   xenos  #d4ae7a (weathered bronze)   thetes #c98a5e (polished copper)
+//   metic  #e6e1d3 (weathered marble)   archon #e7c14a (sun gold)
+const RANK_COLORS = { xenos: 0xD4AE7A, thetes: 0xC98A5E, metic: 0xE6E1D3, archon: 0xE7C14A };
+
+// Create any managed rank roles that are missing from the guild and save their
+// ids back to ~/.config/otb/discord-bot.json. Called once on bot ready so the
+// config stays self-maintaining — no manual copy-paste of role ids needed.
+// Best-effort: a Discord 403 (missing Manage Roles) logs and returns the
+// partial map rather than crashing the reconcile that follows. Env-sourced role
+// ids are never overwritten (env wins over file per loadRoleMap convention).
+async function ensureRankRoles(guild) {
+  if (!guild) return {};
+  const botToken = require('./auth').loadDiscordBotToken();
+  if (!botToken) return {};
+
+  // Load existing map; determine which ranks have no id yet.
+  const existing = loadRoleMap();
+  const missing = MANAGED_RANKS.filter((r) => !existing[r]);
+
+  const created = {};
+  for (const rank of missing) {
+    try {
+      const res = await fetch(`https://discord.com/api/guilds/${guild.id}/roles`, {
+        method: 'POST',
+        headers: { Authorization: `Bot ${botToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          name: rank.charAt(0).toUpperCase() + rank.slice(1),
+          color: RANK_COLORS[rank] || 0,
+          hoist: false,
+          mentionable: false,
+        }),
+      });
+      if (!res.ok) {
+        const text = await res.text();
+        console.error(`[discord-bot] ensureRankRoles: failed to create ${rank} role (${res.status}): ${text}`);
+        continue;
+      }
+      const role = await res.json();
+      created[rank] = role.id;
+      console.log(`[discord-bot] ensureRankRoles: created ${rank} role (id=${role.id})`);
+    } catch (e) {
+      console.error(`[discord-bot] ensureRankRoles: error creating ${rank} role:`, e.message);
+    }
+  }
+
+  if (Object.keys(created).length) {
+    // Persist the new ids into the config file so the next boot finds them.
+    // File-only: we never overwrite env vars. If the file isn't writable, log
+    // and continue — the ids will be recreated on the next boot instead.
+    const cfgPath = ic.configPath('discord-bot.json');
+    try {
+      // Read the existing config from wherever it lives (configured or legacy
+      // dir) so we preserve its other fields, then write to the configured dir.
+      const cfg = JSON.parse(ic.readConfigFileSync('discord-bot.json') || '{}');
+      cfg.role_ids = Object.assign({}, cfg.role_ids || {}, created);
+      fs.writeFileSync(cfgPath, JSON.stringify(cfg, null, 4), 'utf8');
+      console.log(`[discord-bot] ensureRankRoles: saved ${Object.keys(created).join(', ')} to config.`);
+    } catch (e) {
+      console.error('[discord-bot] ensureRankRoles: could not save role ids to config:', e.message);
+    }
+  }
+
+  const finalMap = Object.assign({}, existing, created);
+
+  // Reorder managed roles in Discord to match the rank ladder (MANAGED_RANKS is
+  // low→high; archon must sit above metic above thetes above xenos). Discord
+  // allows partial PATCH — we only send the 4 managed roles; others are untouched.
+  // Strategy: fetch all guild roles, collect the positions currently occupied by
+  // managed roles, sort them descending, and assign archon→metic→thetes→xenos
+  // from highest to lowest. This keeps managed roles in the same position band
+  // while making their relative order correct.
+  const managedIds = MANAGED_RANKS.map((r) => finalMap[r]).filter(Boolean);
+  if (managedIds.length >= 2) {
+    try {
+      const allRolesRes = await fetch(`https://discord.com/api/guilds/${guild.id}/roles`, {
+        headers: { Authorization: `Bot ${botToken}` },
+      });
+      if (allRolesRes.ok) {
+        const allRoles = await allRolesRes.json();
+        const posMap = {};
+        const colorMap = {};
+        for (const r of allRoles) { posMap[r.id] = r.position; colorMap[r.id] = r.color; }
+
+        // Recolor managed roles whose color has drifted from RANK_COLORS. Color
+        // is only set at creation (above), so a palette change here wouldn't
+        // otherwise reach roles that already exist — PATCH each one individually
+        // (the bulk roles endpoint only moves positions, not colors).
+        for (const rank of MANAGED_RANKS) {
+          const id = finalMap[rank];
+          const desired = RANK_COLORS[rank];
+          if (!id || desired === undefined || colorMap[id] === desired) continue;
+          try {
+            const recolorRes = await fetch(`https://discord.com/api/guilds/${guild.id}/roles/${id}`, {
+              method: 'PATCH',
+              headers: { Authorization: `Bot ${botToken}`, 'Content-Type': 'application/json' },
+              body: JSON.stringify({ color: desired }),
+            });
+            if (recolorRes.ok) {
+              console.log(`[discord-bot] ensureRankRoles: recolored ${rank} role to #${desired.toString(16).padStart(6, '0')}`);
+            } else {
+              const text = await recolorRes.text();
+              console.error(`[discord-bot] ensureRankRoles: recolor ${rank} failed (${recolorRes.status}): ${text}`);
+            }
+          } catch (e) {
+            console.error(`[discord-bot] ensureRankRoles: error recoloring ${rank} role:`, e.message);
+          }
+        }
+
+        // Gather positions currently occupied by managed roles, sorted desc.
+        const managedPositions = managedIds
+          .map((id) => posMap[id])
+          .filter((p) => p !== undefined)
+          .sort((a, b) => b - a);
+
+        // MANAGED_RANKS is low→high, so reverse for highest→lowest assignment.
+        const highToLow = [...MANAGED_RANKS].reverse();
+        const patch = [];
+        for (let i = 0; i < highToLow.length; i++) {
+          const id = finalMap[highToLow[i]];
+          if (id && managedPositions[i] !== undefined) patch.push({ id, position: managedPositions[i] });
+        }
+
+        if (patch.length >= 2) {
+          const patchRes = await fetch(`https://discord.com/api/guilds/${guild.id}/roles`, {
+            method: 'PATCH',
+            headers: { Authorization: `Bot ${botToken}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify(patch),
+          });
+          if (patchRes.ok) {
+            const order = highToLow.filter((r) => finalMap[r]).join(' > ');
+            console.log(`[discord-bot] ensureRankRoles: reordered roles (${order})`);
+          } else {
+            const text = await patchRes.text();
+            console.error(`[discord-bot] ensureRankRoles: role reorder failed (${patchRes.status}): ${text}`);
+          }
+        }
+      }
+    } catch (e) {
+      console.error('[discord-bot] ensureRankRoles: error reordering roles:', e.message);
+    }
+  }
+
+  return finalMap;
+}
+
+// Sweep every linked builder. Used on-ready + on the periodic interval. Returns
+// counts for the log line. Sequential to stay gentle on Discord's rate limits;
+// the link table is tiny.
+async function reconcileAll(deps = realDeps) {
+  const links = await deps.listDiscordLinks();
+  let synced = 0;
+  for (const l of links) {
+    const r = await syncBuilderRole(l.builder_id, deps);
+    if (r.ok) synced++;
+  }
+  return { total: links.length, synced };
+}
+
+module.exports = {
+  // pure (unit-tested)
+  MANAGED_RANKS,
+  RANK_COLORS,
+  loadRoleMap,
+  loadGuildId,
+  rankToRoleId,
+  computeRoleChange,
+  // effectful
+  getGuild,
+  ensureRankRoles,
+  syncBuilderRole,
+  reconcileAll,
+  realDeps,
+};

package/modules/discord/module.json

@@ -0,0 +1,14 @@
+{
+  "key": "discord",
+  "title": "Discord",
+  "description": "Outbound ship broadcast + the inbound #ideas/#bugs bot + role-sync + channel management + account-link state. Mirror only, never authority (ADR 0033).",
+  "coreVersion": "^1.4.0",
+  "default": false,
+  "contributes": {
+    "routes": ["discord", "bug-attachments"],
+    "pollers": ["discord-bot"],
+    "uiSections": []
+  },
+  "provides": ["discord.isLinked"],
+  "consumes": ["ideas.capture"]
+}

package/modules/discord/pollers/discord-bot.js

@@ -0,0 +1,19 @@
+// modules/discord/pollers/discord-bot.js — the web-process poller entry the loader
+// starts/stops (BV1.R47 / task 1416).
+//
+// The module manifest declares contributes.pollers:["discord-bot"]; the loader
+// (src/module-loader/loader.js startModulePollers) requires THIS file and calls
+// start(deps) at boot, stop() at shutdown — the module-agnostic successor to the
+// hardcoded `discordBot.start()` block server.js used to carry. A thin shim over
+// the bot itself: start() is non-blocking + failure-isolated by the loader (a
+// Discord gateway problem must never take the game/API down), and stop() closes
+// the gateway socket cleanly so a systemd restart leaves no zombie session.
+
+'use strict';
+
+const bot = require('../discord-bot');
+
+module.exports = {
+  start: () => bot.start(),
+  stop: () => bot.stop(),
+};

package/modules/discord/routes/bug-attachments.js

@@ -0,0 +1,44 @@
+// src/bongos/routes/bug-attachments.js — serve re-hosted #bugs screenshots (task
+// #936, follow-on to ADR 0047).
+//
+// The bot downloads images posted in #bugs and re-hosts them here (durable —
+// Discord CDN links expire). A bug-task's description embeds
+// /api/bongos/bug-attachments/<file>, so when a builder opens the task in the hall
+// the <img> loads from this route. The browser sends the gds_session cookie on
+// the same-origin image request, so requireBuilder gates it: builders-only,
+// exactly the access posture for the rest of the GDS surface.
+//
+// rank: the route is auth.requireBuilder — any authenticated builder may VIEW a
+// bug screenshot (there's no rank-restricted content here; bugs are builder
+// work). Writes happen only via the bot (bug-attachments.js), never this route.
+
+const express = require('express');
+const fs = require('node:fs/promises');
+const auth = require('../auth');
+const attach = require('../bug-attachments');
+
+module.exports = function buildBugAttachmentsRouter() {
+  const router = express.Router();
+
+  // GET /api/bongos/bug-attachments/:name — stream one stored image.
+  router.get('/bug-attachments/:name', auth.requireBuilder, async (req, res) => {
+    const p = attach.resolveSafe(req.params.name);
+    if (!p) return res.fail('bad_name', 400);
+    try {
+      const data = await fs.readFile(p);
+      res.setHeader('Content-Type', attach.contentTypeForName(req.params.name));
+      // Never let a browser sniff these into something executable, and keep them
+      // inline (so they render in the hall) but explicitly not as a download.
+      res.setHeader('X-Content-Type-Options', 'nosniff');
+      res.setHeader('Content-Disposition', 'inline');
+      res.setHeader('Cache-Control', 'private, max-age=86400');
+      res.send(data);
+    } catch (err) {
+      if (err.code === 'ENOENT') return res.fail('not_found', 404);
+      console.error('[gds] GET /bug-attachments', err);
+      res.fail('read_failed', 500);
+    }
+  });
+
+  return router;
+};

package/modules/discord/routes/discord.js

@@ -0,0 +1,102 @@
+'use strict';
+
+// Discord admin command surface — ADR 0037, task #727.
+//
+// The ONLY command path by which a human triggers the bot to act on channels.
+// Both routes are Archon-gated: requireBuilder resolves the live builder, then
+// requireRank('archon') re-checks builders.rank server-side (ADR 0016). A
+// Metic, Thetes, Xenos, or unauthenticated caller gets a 403 — this is the
+// "lower ranks cannot command the bot" rule from task #727, enforced where it
+// is load-bearing (the server) rather than in Discord roles.
+//
+// Passive bot features (ship-feed applause, #ideas inbound, role badges) are
+// untouched by this file — they remain open to everyone by design.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const auth = require('../auth');
+const db = require('../db');
+const shipBroadcast = require('../ship-broadcast');
+const roleSync = require('../discord-role-sync');
+
+// The module's kernel seams, registered when this factory runs (the loader runs
+// it at boot, already gated to enabled instances — ADR 0083 / BV1.R47). They are
+// how core reaches discord WITHOUT importing it:
+//   • PORT discord.isLinked(builderId) → bool — core (routes/me.js, builders.js)
+//     reads it via resolveOptional to render the hall's Connect/Unlink state and
+//     auto-clear onboarding's discord step; degrades to false when discord is off.
+//   • PORT discord.guildJoinSpec(rank) → { guildId, roleIds } — the OAuth link
+//     callback (core routes/auth.js) reads it to auto-join the just-linked builder
+//     to the guild with their rank role at add-time, and to pick the guild on
+//     unlink; degrades to { guildId: null } so the callback simply skips the join.
+//   • EVENT task.shipped — core (publish-reconciler / routes/tasks) emits it on the
+//     confirmed→shipped transition; we post the #ship-news / #ship-feed broadcast.
+//   • EVENT builder.role-sync-needed { builderId } — core emits it on a rank change
+//     (routes/builders.js) + after a link (routes/auth.js); we repair the Discord
+//     rank-role badge. Fire-and-forget; the listener owns its own error handling.
+// All replace former direct core→discord requires. Idempotent: ports are
+// hasProvider-guarded; listeners are replaced (off→on) so a test re-instantiating
+// the router never accumulates duplicates.
+let _shipListenerOff = null;
+let _roleSyncListenerOff = null;
+function registerSeams() {
+  if (!api.hasProvider('discord.isLinked')) {
+    api.registerProvider('discord.isLinked', async (builderId) => !!(await db.getDiscordLink(builderId)));
+  }
+  if (!api.hasProvider('discord.guildJoinSpec')) {
+    api.registerProvider('discord.guildJoinSpec', async (rank) => {
+      const guildId = roleSync.loadGuildId() || null;
+      const roleId = rank ? roleSync.rankToRoleId(rank, roleSync.loadRoleMap()) : null;
+      return { guildId, roleIds: roleId ? [roleId] : [] };
+    });
+  }
+  if (_shipListenerOff) _shipListenerOff();
+  _shipListenerOff = api.on('task.shipped', (task) => shipBroadcast.postShipBroadcast(task));
+  if (_roleSyncListenerOff) _roleSyncListenerOff();
+  _roleSyncListenerOff = api.on('builder.role-sync-needed', ({ builderId }) =>
+    roleSync.syncBuilderRole(builderId).catch((e) =>
+      console.log('[discord] role-sync (non-blocking):', e && e.message)));
+}
+
+module.exports = function buildDiscordRouter() {
+  registerSeams();
+  const router = express.Router();
+
+  // GET /api/bongos/discord/channels/plan — dry run. Returns the ops the bot WOULD
+  // apply to make Discord match docs/discord/channels.json, plus warnings. No
+  // writes. 503 when the bot is disabled / not connected to a guild.
+  // rank: archon — channel administration command.
+  router.get('/discord/channels/plan', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+    try {
+      const channels = require('../discord-channels');
+      const plan = channels.computePlan();
+      if (!plan.ok) {
+        return res.fail('bot_unavailable', 503, { reason: plan.reason });
+      }
+      return res.json({ ok: true, guild_id: plan.guildId, op_count: plan.ops.length, ops: plan.ops, warnings: plan.warnings });
+    } catch (err) {
+      console.error('[gds] GET /discord/channels/plan', err);
+      return res.fail('internal_error', 500);
+    }
+  });
+
+  // POST /api/bongos/discord/channels/reconcile — apply the config to Discord now.
+  // Best-effort; returns how many ops applied/failed. 503 when the bot is
+  // disabled / not connected.
+  // rank: archon — channel administration command.
+  router.post('/discord/channels/reconcile', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+    try {
+      const channels = require('../discord-channels');
+      const result = await channels.reconcileChannels();
+      if (!result.ok) {
+        return res.fail('bot_unavailable', 503, { reason: result.reason });
+      }
+      return res.json({ ok: true, applied: result.applied, failed: result.failed, total: result.total, warnings: result.warnings });
+    } catch (err) {
+      console.error('[gds] POST /discord/channels/reconcile', err);
+      return res.fail('internal_error', 500);
+    }
+  });
+
+  return router;
+};

package/modules/discord/ship-broadcast.js

@@ -0,0 +1,78 @@
+// Shared ship-broadcast routing + the server-side broadcast poster.
+//
+// chooseBroadcastTargets is the PURE channel-routing decision (task 990): given a
+// shipped task's security flag, which Discord channels + lines the broadcast goes
+// to. It lived in scripts/gds/ship.js; task 1045 extracted it here so BOTH the
+// laptop-local ship.js path AND the server-mediated publish path (ADR 0055) route
+// by the EXACT same rule — a security fix must never leak to a public channel from
+// either path. ship.js re-exports it so its existing regression test is unchanged.
+//
+// postShipBroadcast is the SERVER-SIDE poster (task 1045). On the server-mediated
+// publish path a dev box cannot post the broadcast — it holds no webhook secret
+// (ADR 0053 "box holds nothing"), which is exactly why a box ship was silently
+// skipping the public announcement. So when the GDS server confirms the deploy
+// landed (publish-status reconcile, confirmed→shipped), the server — which holds
+// the webhook secrets and just deployed — fires the broadcast instead. Best-effort:
+// it never throws, so a Discord hiccup can never undo a ship.
+
+// PURE. Returns the array of { channel, line } the caller posts, in order:
+//   - no summary              → [] (the long-standing "no summary, no broadcast").
+//   - securitySensitive=true  → ONLY the Archon-only #security-ship-feed. This
+//     branch can NEVER return ship_news or ship_feed — a security fix must not
+//     advertise the shape of an exploit on a public/builder channel before it is
+//     live (the owner requirement behind task 990).
+//   - otherwise               → the builder #ship-feed only.
+// #ship-feed / #security-ship-feed lines are PREFIXED with `#<taskId>` so the
+// upvote bot can map a 👍 back to the task (discord-reaction.parseShipMarker).
+//
+// #ship-news is PAUSED (task 1749, owner ask 2026-07-03): per-ship broadcast was
+// too spammy (it posted to #ship-news AND #ship-feed, ×2 posters = 4 messages).
+// For now #ship-news gets nothing so exactly one #ship-feed message fires per
+// ship. The broader "make the two channels genuinely different + filter by task
+// type" work is idea 458 — un-pause by restoring the ship_news entry below.
+function chooseBroadcastTargets({ securitySensitive, taskId, summary }) {
+  if (!summary) return [];
+  if (securitySensitive) {
+    return [{ channel: 'security_ship_feed', line: `#${taskId} shipped (security) — ${summary}` }];
+  }
+  return [
+    // { channel: 'ship_news', line: summary },  // PAUSED — task 1749 / idea 458
+    { channel: 'ship_feed', line: `#${taskId} shipped — ${summary}` },
+  ];
+}
+
+// Best-effort server-side broadcast for a task that just landed via server-
+// mediated publish. `task` is the shipTask() row: { id, value_summary,
+// security_sensitive, ... }. deps.postWebhook (the scripts/discord/lib poster) and
+// deps.log are injectable for tests.
+//
+// FAIL CLOSED on the security flag, exactly like ship.js's local block: if the
+// flag is not a definite boolean we SUPPRESS the broadcast entirely rather than
+// risk advertising an unpatched exploit on a public channel. Returns
+// { posted: [channels], skipped: reason|null } so the behavior is unit-testable;
+// never throws (a single channel's failure is logged and swallowed).
+async function postShipBroadcast(task, deps = {}) {
+  const result = { posted: [], skipped: null };
+  if (!task || task.id == null) { result.skipped = 'no_task'; return result; }
+  const summary = task.value_summary;
+  if (!summary) { result.skipped = 'no_summary'; return result; }
+  const sec = task.security_sensitive;
+  if (sec !== true && sec !== false) { result.skipped = 'security_flag_indeterminate'; return result; }
+
+  const postWebhook = deps.postWebhook || require('./webhook').postWebhook;
+  const log = deps.log || console.log;
+  const targets = chooseBroadcastTargets({ securitySensitive: sec, taskId: task.id, summary });
+  for (const { channel, line } of targets) {
+    try {
+      await postWebhook(channel, line);
+      result.posted.push(channel);
+    } catch (e) {
+      // A channel's failure (e.g. no webhook configured on this host) must never
+      // throw into the ship/reconcile path — log + continue (#94 / ADR 0032).
+      log(`[gds] ship broadcast: #${channel.replace(/_/g, '-')} post failed (non-blocking): ${e && e.message ? e.message : e}`);
+    }
+  }
+  return result;
+}
+
+module.exports = { chooseBroadcastTargets, postShipBroadcast };

package/modules/discord/webhook.js

@@ -0,0 +1,74 @@
+// modules/discord/webhook.js — the module's outbound Discord webhook poster
+// (BV1.R47 / task 1416).
+//
+// A near-verbatim twin of scripts/discord/lib.js. Why a copy and not a shared
+// require: the module boundary (ADR 0083) forbids a module reaching into core or
+// scripts/, and the kernel doorway must not name a module — so the poster a
+// module needs lives IN the module. scripts/discord/lib.js stays for the two CORE
+// consumers that still post webhooks (src/bongos/approval-broadcast.js + the
+// scripts/discord/post.js CLI). KEEP THE TWO IN SYNC — same channels, same
+// 2000-char cap, same allowed_mentions suppression (#871). Config is read through
+// the published doorway (configPath) so the path resolves identically.
+//
+// Discord is a one-way window into the GDS (the trust-boundary ADR): this only
+// ever POSTs outward — it never reads authority or state back.
+
+'use strict';
+
+const fs = require('node:fs');
+const api = require('../../src/module-api');
+
+// The configured instance config dir (OTB → ~/.config/otb, unchanged). R61.
+const WEBHOOKS_PATH = api.configPath('discord-webhooks.json');
+
+// Known channel keys. Each maps to a webhook URL in the file above, or to the
+// env var DISCORD_<KEY>_WEBHOOK (upper-cased), which wins when set. Mirrors
+// scripts/discord/lib.js exactly.
+const CHANNELS = new Set([
+  'ship_news', 'ship_feed', 'security_ship_feed',
+  'member_approvals',
+]);
+
+function loadWebhooks() {
+  let cfg = {};
+  try {
+    cfg = JSON.parse(fs.readFileSync(WEBHOOKS_PATH, 'utf8'));
+  } catch {
+    // File is optional when the URLs are provided via env vars instead.
+  }
+  for (const ch of CHANNELS) {
+    const envVal = process.env[`DISCORD_${ch.toUpperCase()}_WEBHOOK`];
+    if (envVal) cfg[ch] = envVal;
+  }
+  return cfg;
+}
+
+async function postWebhook(channel, text) {
+  if (!CHANNELS.has(channel)) {
+    throw new Error(`Unknown Discord channel '${channel}'. Known: ${[...CHANNELS].join(', ')}`);
+  }
+  const url = loadWebhooks()[channel];
+  if (!url) {
+    throw new Error(
+      `No webhook URL for channel '${channel}'. Set it in ${WEBHOOKS_PATH} ` +
+      `or env DISCORD_${channel.toUpperCase()}_WEBHOOK. See scripts/discord/README.md.`
+    );
+  }
+  // Discord hard-caps message content at 2000 chars.
+  const content = String(text).slice(0, 2000);
+  // SECURITY (#871): suppress ALL mention pings. The content is DB-sourced and
+  // attacker-influenceable; allowed_mentions:{parse:[]} renders text verbatim but
+  // fires zero notifications. (Discord defaults to parsing mentions when omitted.)
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ content, allowed_mentions: { parse: [] } }),
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    throw new Error(`Discord webhook POST -> ${res.status}: ${body.slice(0, 300)}`);
+  }
+  return { ok: true, status: res.status }; // 204 No Content on success
+}
+
+module.exports = { CHANNELS, WEBHOOKS_PATH, loadWebhooks, postWebhook };