@bongos/core 1.18.0 → 1.18.18

package/scripts/gds/regen-instance-docs.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+'use strict';
+// regen-instance-docs.js — regenerate a STANDALONE instance's live navigation docs (task 1002314).
+//
+// THE GAP. On the monorepo, the gitignored whole-file navigation docs are regenerated at deploy by
+// scripts/deploy/deploy-prod.sh + infra/box-source-fetch.sh (ADR 0110 §2/§3). STANDALONE instances
+// (ADR 0108 — their own lean repo with @bongos/core vendored) never got that step: their bespoke
+// pull-deploy regenerated NOTHING, so a fresh instance shipped with an empty docs/ and nothing kept
+// the session-log index live. This script is the STANDALONE analogue of deploy-prod.sh's regen block
+// — one line for an instance's deploy.sh to call after `git reset --hard` + migrate.
+//
+// USAGE (from the instance repo, core vendored in node_modules):
+//   node node_modules/@bongos/core/scripts/gds/regen-instance-docs.js
+// It resolves the INSTANCE root (bongos.config.json instanceRoot / <PREFIX>_INSTANCE_ROOT / cwd) and
+// writes docs/session-log-index.md THERE (gitignored on the instance, so the next
+// `git reset --hard origin/main` never wipes it and no branch can ever diff it).
+//
+// SCOPE + CONTRACT: see regenerateNavDocs() in upgrade.js — it owns the generator list and the
+// rationale for what is and isn't deploy-regenerated (repo-map is core-scoped; file-map + API docs
+// are tracked/committed; diagrams are the headless-browser exception). Best-effort + LOUD per
+// ADR 0110 §2 "accepted staleness": a broken generator prints `::ERROR::` (journald greps it) but
+// this script ALWAYS exits 0 — a stale nav doc is tolerable; a failed deploy is not.
+
+const path = require('node:path');
+const { resolveInstanceRoot } = require('../../src/instance-config');
+const { regenerateNavDocs } = require('./upgrade');
+
+function main() {
+  const coreRoot = path.resolve(__dirname, '..', '..'); // the @bongos/core package this script ships in
+  const instanceDir = resolveInstanceRoot();
+  const res = regenerateNavDocs({ instanceDir, coreRoot });
+  if (res.ran.length) {
+    console.log(`regen-instance-docs: regenerated ${res.ran.join(', ')} → ${instanceDir}/docs/`);
+  }
+  if (!res.ok) {
+    for (const f of res.failed) {
+      // LOUD (ADR 0110 §2): journald greps ::ERROR:: so a broken generator surfaces.
+      console.error(`::ERROR:: regen-instance-docs: ${f.gen} failed — ${f.reason}`);
+    }
+  }
+  // Best-effort: NEVER fail the deploy. A stale/absent nav doc is tolerable; the ::ERROR:: is the alarm.
+  process.exit(0);
+}
+
+if (require.main === module) main();
+
+module.exports = { main };

package/scripts/gds/run-unit-tests.js

@@ -31,6 +31,10 @@ const { isModuleEnabled } = require('../../src/modules');
 const TESTS_DIR = path.resolve(__dirname, '..', '..', 'tests');
 const MODULES_DIR = path.resolve(__dirname, '..', '..', 'modules');
 const PER_TEST_TIMEOUT_MS = 90_000;
+// Integration tests (package build + `npm install` + a spawned server) are far heavier than a
+// DB-free unit file, so the `--integration` gate (task 1002221 / audit H1) gives each one a much
+// longer budget than the 90s unit cap.
+const INTEGRATION_TIMEOUT_MS = 300_000;
 
 // Feature-module test sets (R59 / task 1198). A test that exercises a feature
 // MODULE runs only when this instance enables that module — a vanilla Cloud
@@ -69,8 +73,10 @@ const INTEGRATION = new Set([
   // platform-server — network + package build + a spawned server, run by its own
   // .github/workflows/consumer-layout-boot.yml, not this DB-free gate (task 2142).
   'consumer_layout_boot',
-  'discord_autojoin', 'discord_oauth', 'linkify_refs', 'memory_isolation',
-  'memory_pull', 'parallel-load', 'session_records', 'setup_smoke',
+  'claim_gate_rebase', 'clawback_confirmed_backlog', 'discord_autojoin', 'discord_oauth',
+  'linkify_refs', 'memory_isolation',
+  'memory_pull', 'needs_rebase', 'parallel-load', 'reward_mode_cost_plus_only',
+  'session_records', 'setup_smoke',
   'status-probe', 'subdomain_auth',
 ]);
 
@@ -128,31 +134,50 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 }
 
 function main() {
+  // Two gates from one runner (task 1002221 / audit H1):
+  //   default        — the DB-free UNIT gate: every test file MINUS the integration set (+ known-
+  //                     failing / support / disabled-module). Fast, runs in a clean checkout / per PR.
+  //   --integration  — the standing INTEGRATION-SMOKE gate: ONLY the integration set (package build +
+  //                     `npm install` + live boot etc.). Heavier, longer per-test budget; run per
+  //                     release / on a schedule in an env that provides the services (DB/network). This
+  //                     is what promotes tests/consumer_layout_boot.mjs from "excluded + ad-hoc" to a
+  //                     first-class gate a release step can invoke with one command.
+  const integrationMode = process.argv.includes('--integration');
+  const perTestTimeout = integrationMode ? INTEGRATION_TIMEOUT_MS : PER_TEST_TIMEOUT_MS;
+
   const files = fs
     .readdirSync(TESTS_DIR)
     .filter((f) => f.endsWith('.mjs'))
     .map((f) => f.replace(/\.mjs$/, ''))
-    .filter((name) => !INTEGRATION.has(name) && !KNOWN_FAILING.has(name)
-      && !SUPPORT_MODULES.has(name) && !MODULE_DISABLED.has(name))
+    .filter((name) => integrationMode
+      ? (INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !SUPPORT_MODULES.has(name))
+      : (!INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !SUPPORT_MODULES.has(name) && !MODULE_DISABLED.has(name)))
     .sort();
 
-  const { included: moduleTests, skippedDisabled: moduleTestsSkipped } = discoverModuleTests();
-
-  const moduleNote = MODULE_DISABLED.size
-    ? ` + ${MODULE_DISABLED.size} disabled-module (${[...MODULE_DISABLED].sort().join(', ')})`
-    : '';
-  const modOwnedSkipNote = moduleTestsSkipped.length
-    ? ` + ${moduleTestsSkipped.length} module-owned test(s) skipped (module disabled: ${[...new Set(moduleTestsSkipped.map((t) => t.key))].sort().join(', ')})`
-    : '';
+  // Module-owned tests are DB-free unit tests — only the default gate runs them.
+  const { included: moduleTests, skippedDisabled: moduleTestsSkipped } = integrationMode
+    ? { included: [], skippedDisabled: [] }
+    : discoverModuleTests();
+
+  if (integrationMode) {
+    console.log(`run-unit-tests --integration: ${files.length} integration-smoke test file(s) (${files.join(', ') || 'none found'}); per-test budget ${INTEGRATION_TIMEOUT_MS / 1000}s`);
+  } else {
+    const moduleNote = MODULE_DISABLED.size
+      ? ` + ${MODULE_DISABLED.size} disabled-module (${[...MODULE_DISABLED].sort().join(', ')})`
+      : '';
+    const modOwnedSkipNote = moduleTestsSkipped.length
+      ? ` + ${moduleTestsSkipped.length} module-owned test(s) skipped (module disabled: ${[...new Set(moduleTestsSkipped.map((t) => t.key))].sort().join(', ')})`
+      : '';
+    console.log(`run-unit-tests: ${files.length + moduleTests.length} DB-free unit test file(s) (${files.length} core + ${moduleTests.length} module-owned; excluded ${INTEGRATION.size} integration + ${KNOWN_FAILING.size} known-failing${moduleNote}${modOwnedSkipNote})`);
+  }
   const total = files.length + moduleTests.length;
-  console.log(`run-unit-tests: ${total} DB-free unit test file(s) (${files.length} core + ${moduleTests.length} module-owned; excluded ${INTEGRATION.size} integration + ${KNOWN_FAILING.size} known-failing${moduleNote}${modOwnedSkipNote})`);
 
   const failures = [];
   const runOne = (displayName, filePath) => {
     try {
       execFileSync(process.execPath, [filePath], {
         stdio: ['ignore', 'ignore', 'pipe'],
-        timeout: PER_TEST_TIMEOUT_MS,
+        timeout: perTestTimeout,
         env: { ...process.env, NODE_ENV: 'test' },
       });
       console.log(`  ok    ${displayName}`);
@@ -168,12 +193,13 @@ function main() {
   for (const name of files) runOne(name, path.join(TESTS_DIR, `${name}.mjs`));
   for (const { key, name, file } of moduleTests) runOne(`${key}/${name}`, file);
 
+  const label = integrationMode ? 'run-unit-tests --integration' : 'run-unit-tests';
   console.log('');
   if (failures.length === 0) {
-    console.log(`run-unit-tests: all ${total} passed.`);
+    console.log(`${label}: all ${total} passed.`);
     process.exit(0);
   }
-  console.log(`run-unit-tests: ${failures.length} FAILED — ${failures.join(', ')}`);
+  console.log(`${label}: ${failures.length} FAILED — ${failures.join(', ')}`);
   process.exit(1);
 }
 

package/scripts/gds/seed-bongos-v1-seo-tasks.js

@@ -0,0 +1,104 @@
+// Seed the tasks for goal 1000048 "SEO & public discoverability — rankable per-project
+// profiles" (BONGOS-V1, internal). Source of truth:
+// docs/specs/bongos-v1-seo-public-discoverability.md (status: final).
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+//
+// Run: node scripts/gds/seed-bongos-v1-seo-tasks.js
+const os = require('os');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = (sess.api_base || 'https://cloudbongos.com').replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V1';
+const GOAL = 1000048;
+const SRC = 'planning-session';
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(400); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/gds${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// criterion slugs (position-independent — the goal's done_when_criteria.criterion_id)
+const PP = 'seo-project-profile-page', NS = 'seo-toplevel-namespace', PC = 'seo-project-content',
+  PM = 'seo-page-metadata', CC = 'seo-canonical-consolidation', SR = 'seo-sitemap-robots',
+  VG = 'seo-visibility-gated', SB = 'seo-site-baseline';
+
+// disc: engineer (backend/API/spike) | ui (page/markup/meta). kind: spike | feature | refactor | infra | verify (proofs).
+// deps: 'R##' resolve to the just-created id; a NUMBER is a real cross-goal task id, passed through.
+const TASKS = [
+  { ref:'R01', kind:'spike',   disc:'engineer', prio:5, est:180, crit:[PP,NS,PM,CC], deps:[],           title:'R01 · SEO + namespace architecture ADR', desc:'Needs-exploration: profile-page rendering (server-rendered HTML from the Node/Express hub), routing precedence (/<slug> vs /bongos/* vs /api/*), the owner-picked slug model + reserved-word list, the cross-instance canonical mechanism, and how the profile reads goal-1000046 setup content. Output an ADR + confirmed sub-tasks. See docs/specs/bongos-v1-seo-public-discoverability.md.' },
+  { ref:'R02', kind:'feature', disc:'engineer', prio:5, est:240, crit:[PP,NS],       deps:['R01'],      title:'R02 · Owner-picked slug at creation + reserved-name validation + backfill', desc:'Projects get a unique owner-chosen vanity slug at creation (username-style), validated vs a reserved list (bongos, api, sso, gate, create, explore, builders, status, assets, sitemap.xml, robots.txt, ...). Auto-derive + backfill a default slug for existing projects (owner can change). Adds a step to the creation flow — coordinate with goals 1000035/1000046. Deps R01.' },
+  { ref:'R03', kind:'refactor',disc:'engineer', prio:5, est:240, crit:[NS],          deps:['R01'],      title:'R03 · Move platform pages under /bongos/… ; top-level /<slug> resolves to a project', desc:'Serve hall/status/create/explore/gate under /bongos/… with 301 redirects from old paths; never move /api, /sso, /auth, /.well-known. Top-level /<slug> resolves to a project profile after the reserved-word check. Deps R01.' },
+  { ref:'R04', kind:'feature', disc:'ui',       prio:5, est:240, crit:[PP,PM],       deps:['R02','R03'],title:'R04 · Server-rendered project profile page at /<slug>', desc:'Crawlable server-rendered HTML: project name, description, cover art, builders, tech/modules, and a prominent "Open the live app" CTA. This page is the primary shareable destination. Deps R02,R03.' },
+  { ref:'R05', kind:'feature', disc:'ui',       prio:4, est:180, crit:[PC],          deps:['R04'],      title:'R05 · Render goal-1000046 setup content on the profile + auto-derive SEO copy', desc:'Read the project\'s setup content (goal 1000046) and render it on the profile; auto-derive SEO title/description from it. No separate editor (per interview). Coordinate with 1000046 — needs a real description + tags; render current fields (name/tagline) meanwhile and enrich as 1000046 lands. Deps R04.' },
+  { ref:'R06', kind:'feature', disc:'ui',       prio:4, est:150, crit:[PM,CC],       deps:['R04'],      title:'R06 · Per-page SEO metadata (title/description/OG/Twitter/self-canonical)', desc:'Dynamic <title>, meta description, Open Graph + Twitter card tags, and a self-referencing canonical on each profile. Deps R04.' },
+  { ref:'R07', kind:'feature', disc:'ui',       prio:4, est:120, crit:[PM],          deps:['R04'],      title:'R07 · JSON-LD structured data on profiles', desc:'Emit SoftwareApplication/CreativeWork JSON-LD on each profile page. Deps R04.' },
+  { ref:'R08', kind:'feature', disc:'ui',       prio:4, est:150, crit:[PP],          deps:['R04'],      title:'R08 · Route discovery through profiles (orbs + links → /<slug>)', desc:'Make /<slug> the shareable destination: orbs cards and "view project" links point to the profile, which carries the "Open the live app" CTA — maximizing internal links to the ranking page. Deps R04. NOTE: the orbs front door is a separate static site — the orbs-side link change likely lands instance-side.' },
+  { ref:'R09', kind:'feature', disc:'ui',       prio:4, est:180, crit:[PP,SR],       deps:['R04'],      title:'R09 · Crawlable projects directory via the orbs table-view', desc:'Make the orbs page\'s table view a server-rendered, crawlable, indexable HTML index of all Public projects (a plain-link list to each /<slug>), linked from the landing. This IS the directory (no separate directory page, per interview). Deps R04.' },
+  { ref:'R10', kind:'feature', disc:'engineer', prio:4, est:180, crit:[SR],          deps:['R04','R11'],title:'R10 · sitemap.xml (public projects + core pages)', desc:'Auto-generated sitemap.xml at /sitemap.xml listing all Public project profiles + core pages; regenerates on project create/update/visibility-change (cached). Deps R04,R11.' },
+  { ref:'R11', kind:'feature', disc:'engineer', prio:4, est:210, crit:[VG],          deps:['R04'],      title:'R11 · Visibility-gated indexing (visibility metaphor)', desc:'Public→full indexable profile; Private (star)→minimal page + join/request CTA, noindex; Stealth (black hole)→404; Unlisted (dark matter)→no public page until published. HARD conceptual dependency on goal 1000046\'s visibility states (not yet seeded) — coordinate; gate on the state field once it exists. Deps R04.' },
+  { ref:'R12', kind:'feature', disc:'engineer', prio:3, est:120, crit:[SR],          deps:['R10'],      title:'R12 · robots.txt', desc:'Serve robots.txt: allow public pages, disallow /api + internal, reference /sitemap.xml. Deps R10.' },
+  { ref:'R13', kind:'feature', disc:'engineer', prio:3, est:240, crit:[CC],          deps:['R04'],      title:'R13 · Cross-instance canonical (full scope)', desc:'rel=canonical from each live instance back to its hub profile: federated/co-tenant instances emit it; hub-hosted subdomains when that tier lands; publish a documented canonical snippet for self-hosted owners. Touches instance-side core rendering → Metic+ auto-floor. Coordinate with provisioning/federation (goals 1000032/1000041). Deps R04.' },
+  { ref:'R14', kind:'feature', disc:'ui',       prio:3, est:210, crit:[PP,PM],       deps:['R04',1002278], title:'R14 · Public builder-profile SEO page (handle-based path)', desc:'Server-rendered, SEO-optimized public builder profile at a handle path (e.g. /u/<handle>): metadata + Person/ProfilePage JSON-LD, crawlable HTML. Extends goal 1000045\'s builder profiles with a public, rankable rendering. Deps R04 + goal-1000045 profile API (task 1002278).' },
+  { ref:'R15', kind:'feature', disc:'engineer', prio:3, est:150, crit:[SR,VG],       deps:['R14','R10'],title:'R15 · Builder profiles in sitemap, consent-gated', desc:'Add consented/public builder profiles to sitemap.xml; honor goal-1000045\'s hide/opt-out flag (coordinate with 1000045 R03). Non-consented builders excluded/noindex. Deps R14,R10.' },
+  { ref:'R16', kind:'feature', disc:'ui',       prio:2, est:120, crit:[PC],          deps:['R05'],      title:'R16 · SEO content nudges in the setup/edit flow', desc:'Rule-based nudges where owners author content (goal 1000046 setup/edit): description length, tags, cover image — so profiles have enough real text to rank. Coordinate with 1000046. Deps R05.' },
+  { ref:'R17', kind:'feature', disc:'ui',       prio:3, est:150, crit:[SB],          deps:['R01'],      title:'R17 · Landing + Explore SEO metadata', desc:'Give the landing page (goal 1000031) and the Explore page proper title/description/Open Graph/structured data and ensure they are indexable. Coordinate with 1000031. Deps R01.' },
+  { ref:'R18', kind:'infra',   disc:'engineer', prio:2, est:180, crit:[SB],          deps:['R04'],      title:'R18 · Technical-SEO + Core Web Vitals pass', desc:'Audit + fix technical SEO across public pages: mobile-friendly, load speed / Core Web Vitals, indexability. Deps R04.' },
+  { ref:'R19', kind:'verify',  disc:'engineer', prio:2, est:120, crit:[PP,PM,CC,SR,VG,PC], deps:['R04','R06','R07','R10','R11','R14','R15'], title:'R19 · PROOF: a public project + builder profile rank-ready; non-public hidden', desc:'End-to-end proof: a real Public project profile is live at cloudbongos.com/<slug> with correct metadata + JSON-LD, appears in sitemap.xml, passes Google Rich Results + mobile-friendly tests; a public builder profile is likewise rank-ready; and a Private project is noindex + absent from the sitemap (Stealth 404s). Deps R04,R06,R07,R10,R11,R14,R15.' },
+];
+
+const ROOTS = ['R01']; // zero-dep entry task to open for claiming
+
+(async () => {
+  const idByRef = {};
+  let created = 0, existing = 0;
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc,
+      kind: t.kind, discipline: t.disc, priority: t.prio, est_minutes: t.est,
+      criterion_ids: t.crit, source: SRC, source_ref: `bv1-seo-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    const task = r.json.task || r.json;
+    idByRef[t.ref] = task.id;
+    if (r.json.idempotent || r.json.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    const depIds = t.deps.map((d) => (typeof d === 'number' ? d : idByRef[d])).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) { console.log(`  ${t.ref}: dep resolve gap, skipping`); continue; }
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) { console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    edges += (r.json.added || depIds.length);
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting root(s) to ready…');
+  for (const ref of ROOTS) {
+    const id = idByRef[ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.json).slice(0, 120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}. Roots opened: ${ROOTS.join(', ')}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();

package/scripts/gds/seed-bv1-profiles-tasks.js

@@ -0,0 +1,126 @@
+// Seed the tasks for goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
+// Source of truth: docs/specs/bongos-v1-public-builder-profiles.md (status: final).
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+//
+// Run: node scripts/gds/seed-bv1-profiles-tasks.js
+const os = require('os');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = sess.api_base.replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V1';
+const GOAL = 1000045;
+const SRC = 'planning-session';
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(400); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/gds${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// disc: engineer (backend/API/spike) | ui (frontend). kind: spike | feature | verify (proofs).
+const TASKS = [
+  // Phase 1 — profile shows cross-project record + hide (C1,C2) — P5
+  { ref:'R01', kind:'spike',   disc:'engineer', prio:5, est:180, crit:['C1','C2'], deps:[],            title:'R01 · Design profile↔cross-project rollup join + consent model', desc:'Needs-exploration: how the public profile reads the platform-identity rollup (listScoutingRollup / platform_identity_builder_project_activity), public-by-default, and where the hide flag (C2) lives. Output an ADR + sub-tasks. See docs/specs/bongos-v1-public-builder-profiles.md.' },
+  { ref:'R02', kind:'feature', disc:'engineer', prio:5, est:240, crit:['C1'],      deps:['R01'],        title:'R02 · Profile API returns cross-project record + project names', desc:'Extend GET /builders/:id/profile to include aggregated cross-project credits/ships/karma/disciplines + the list of projects by name, from the platform-identity rollup; public by default; respects the whitelist + leak test (tests/profile_route.mjs). Done-when: another account sees the aggregate + project names, no private columns. Deps R01.' },
+  { ref:'R03', kind:'feature', disc:'engineer', prio:5, est:180, crit:['C2'],      deps:['R01'],        title:'R03 · Hide flag: builder hides cross-project stats (opt-out, live)', desc:'Self-serve opt-out that hides the cross-project record from the profile + applications, honored live everywhere. Default is shown. Deps R01.' },
+  { ref:'R04', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C1','C2'], deps:['R02','R03'],  title:'R04 · Profile UI: cross-project section + self hide-toggle', desc:'Render the cross-project section (totals + project names) on the profile; show the hide toggle to the profile owner. Deps R02,R03.' },
+  { ref:'R05', kind:'feature', disc:'ui',       prio:4, est:120, crit:['C1'],      deps:['R02'],        title:'R05 · Shareable-by-login profile URL (?builder=<login>)', desc:'Add a login-addressable profile URL alongside ?id=. Promotes idea #1000522. Deps R02.' },
+  { ref:'R06', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C1','C2'], deps:['R04','R03'],  title:'R06 · PROOF: cross-project record shows to a viewer; hide removes it live', desc:'Verify a 2-project builder\'s combined record shows to another account, and hiding removes it within one load. Extends tests/profile_route.mjs. Deps R04,R03.' },
+
+  // Phase 2 — apply from orbs + application carries profile (C3,C4) — P5
+  { ref:'R07', kind:'spike',   disc:'engineer', prio:5, est:180, crit:['C3','C4'], deps:[],             title:'R07 · Design application model + "project owner (registrant+delegates)" authz', desc:'Needs-exploration: extend access_requests vs a new cross-project applications record; how the profile snapshot travels hub→target; the owner (registrant + delegates) authz; pending queue + approve/decline. Output an ADR + sub-tasks. Deps none.' },
+  { ref:'R08', kind:'feature', disc:'engineer', prio:5, est:240, crit:['C3','C4'], deps:['R07'],        title:'R08 · Application API: apply / list-pending / approve / decline', desc:'Cross-project application flow reusing the join relay (/my-projects/join → target /access-requests). Deps R07.' },
+  { ref:'R09', kind:'feature', disc:'engineer', prio:5, est:150, crit:['C4'],      deps:['R08','R02'],  title:'R09 · Application carries the applicant\'s cross-project record (+note)', desc:'Attach the applicant\'s cross-project record (subject to the C2 hide, live) + optional note to the application the owner sees. Deps R08,R02.' },
+  { ref:'R10', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C3'],      deps:['R08'],        title:'R10 · "Apply" affordance on the in-core browse surface', desc:'Apply action + state (applied/pending/member) on the project cards / My Projects. Deps R08.' },
+  { ref:'R11', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C4'],      deps:['R08'],        title:'R11 · Owner pending-applications view (approve/decline)', desc:'A project owner sees pending applications for their project and approves/declines. Deps R08.' },
+  { ref:'R12', kind:'feature', disc:'ui',       prio:4, est:150, crit:['C3'],      deps:['R10'],        title:'R12 · Surface "Apply" on the orbs front door', desc:'Wire the Apply affordance onto the orbs page. NOTE: the orbs front door is a separate static site — this likely lands instance-side. Deps R10.' },
+  { ref:'R13', kind:'verify',  disc:'engineer', prio:5, est:90,  crit:['C3','C4'], deps:['R10','R11','R09'], title:'R13 · PROOF: apply → owner sees record → approves → applicant joins', desc:'End-to-end verify of the apply→approve flow carrying the profile. Deps R10,R11,R09.' },
+
+  // Phase 3 — owners browse builder profiles (C5) — P4
+  { ref:'R14', kind:'feature', disc:'engineer', prio:4, est:210, crit:['C5'],      deps:['R02'],        title:'R14 · Graduate /scouting to project-owner-facing + opt-out-of-recruiting flag', desc:'Widen the Archon-only /scouting to a project owner (registrant+delegates); add a builder opt-out-of-recruiting flag. Touches authz → Metic+ floor. Deps R02.' },
+  { ref:'R15', kind:'feature', disc:'ui',       prio:4, est:210, crit:['C5'],      deps:['R14'],        title:'R15 · Owner recruiting UI (search/filter/sort; honors hide + opt-out)', desc:'Owner-facing recruiting surface: search/filter by discipline, sort by track record; honors C2 hide + recruiting opt-out. Deps R14.' },
+  { ref:'R16', kind:'feature', disc:'ui',       prio:4, est:150, crit:['C5'],      deps:['R15','R08'],  title:'R16 · Browse → invite/recruit a builder to your project', desc:'Invite/recruit a builder from the browse surface, tying into the application/invite flow. Deps R15,R08.' },
+  { ref:'R17', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C5'],      deps:['R15','R16'],  title:'R17 · PROOF: non-Archon owner browses, filters, invites', desc:'Verify a non-Archon project owner browses builder profiles, filters by discipline, invites one. Deps R15,R16.' },
+
+  // Phase 4 — builder-to-builder connections + degrees (C6) — P4
+  { ref:'R18', kind:'spike',   disc:'engineer', prio:4, est:180, crit:['C6'],      deps:[],             title:'R18 · Design connections model incl. 1st/2nd/3rd-degree traversal', desc:'Needs-exploration: platform-level connections (account↔account) with request/accept/decline/remove; degree-of-separation traversal (1st/2nd/3rd); "people you may know" from native signals. Output an ADR + sub-tasks. Deps none.' },
+  { ref:'R19', kind:'feature', disc:'engineer', prio:4, est:240, crit:['C6'],      deps:['R18'],        title:'R19 · Connections API: request/accept/decline/remove/list + degree queries', desc:'The connection graph API incl. degree-of-separation queries. Deps R18.' },
+  { ref:'R20', kind:'feature', disc:'ui',       prio:4, est:180, crit:['C6'],      deps:['R19','R04'],  title:'R20 · Connections on the profile (with degree labels) + connect button', desc:'Show a builder\'s connections (public) with 1st/2nd/3rd-degree labels; connect/pending/accept from the profile. Deps R19,R04.' },
+  { ref:'R21', kind:'feature', disc:'engineer', prio:4, est:150, crit:['C6'],      deps:['R19'],        title:'R21 · "Builders you may know" from mutuals + shared projects/guilds', desc:'Suggest connections from mutual connections + shared projects/guilds (2nd/3rd degree). Deps R19.' },
+  { ref:'R22', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C6'],      deps:['R20','R21'],  title:'R22 · PROOF: two builders connect; each sees the other + a 2nd-degree suggestion', desc:'Verify request→accept, mutual visibility, and a 2nd-degree suggestion appears. Deps R20,R21.' },
+
+  // Phase 5 — guilds + apply/invite + guild map (C7,C8,C9) — P3
+  { ref:'R23', kind:'spike',   disc:'engineer', prio:3, est:210, crit:['C7','C8','C9'], deps:['R18','R07'], title:'R23 · Design guild model (tables, roles, public/unlisted, rollup, map ranking)', desc:'Needs-exploration: platform-level guilds + guild_members (multi-guild, distinct from goal_members); roles; public/unlisted visibility; collective rollup (excludes hidden members); guild↔project application reuse; map ranking. Output an ADR + sub-tasks. Deps R18,R07.' },
+  { ref:'R24', kind:'feature', disc:'engineer', prio:3, est:240, crit:['C7'],      deps:['R23'],        title:'R24 · Guild CRUD + membership API + public/unlisted visibility', desc:'Create guild, invite/accept/join-request, roster, leave; owner sets public/unlisted. Deps R23.' },
+  { ref:'R25', kind:'feature', disc:'ui',       prio:3, est:210, crit:['C7'],      deps:['R24'],        title:'R25 · Guild page UI (identity, roster, collective record)', desc:'Guild page: identity, roster, collective track record (N of M counted). Deps R24.' },
+  { ref:'R26', kind:'feature', disc:'engineer', prio:3, est:180, crit:['C7'],      deps:['R24','R02'],  title:'R26 · Guild collective track-record rollup (excludes hidden members)', desc:'Aggregate members\' cross-project stats into the guild total; exclude C2-hidden members ("N of M counted"). Deps R24,R02.' },
+  { ref:'R27', kind:'feature', disc:'engineer', prio:3, est:210, crit:['C8'],      deps:['R24','R08'],  title:'R27 · Guild → project applications + owner invites a guild (each-member-opt-in)', desc:'Guild applies to / is invited to a project (guild-level mirror of R08); each member opts in before being attached. Deps R24,R08.' },
+  { ref:'R28', kind:'feature', disc:'ui',       prio:3, est:150, crit:['C8'],      deps:['R27','R11'],  title:'R28 · Owner view: pending guild applications', desc:'Extends the owner application view (R11) to guild applications. Deps R27,R11.' },
+  { ref:'R29', kind:'spike',   disc:'engineer', prio:3, est:150, crit:['C9'],      deps:['R26'],        title:'R29 · Design guild map ranking + orb-sky viz approach', desc:'Needs-exploration: rank guilds by size/success; render on the orb-sky visual language (goal 1000044). Output design + sub-tasks. Deps R26.' },
+  { ref:'R30', kind:'feature', disc:'engineer', prio:3, est:150, crit:['C9'],      deps:['R26'],        title:'R30 · Guild map API (ranked; public guilds only; honors hide)', desc:'Ranked guilds by size/success; only public (not unlisted) guilds; honors member hide. Deps R26.' },
+  { ref:'R31', kind:'feature', disc:'ui',       prio:3, est:210, crit:['C9'],      deps:['R30','R29','R15'], title:'R31 · Guild map UI on the recruiting surface (orb-sky visual)', desc:'Visual guild map on the owner recruiting surface. Deps R30,R29,R15.' },
+  { ref:'R32', kind:'verify',  disc:'engineer', prio:3, est:120, crit:['C7','C8','C9'], deps:['R25','R27','R31'], title:'R32 · PROOF: form guild → applies (members opt in) → owner approves → ranked on map', desc:'End-to-end verify of the guild lifecycle incl. the map. Deps R25,R27,R31.' },
+
+  // Phase 6 — connection proximity via orb-sky physics (C10) — P3
+  { ref:'R33', kind:'spike',   disc:'engineer', prio:3, est:210, crit:['C10'],     deps:['R19','R23'],  title:'R33 · Design connection→orb-physics proximity + degree model', desc:'Needs-exploration: connection strength (direct + mutuals + shared projects/guilds + co-shipped; no time-decay) feeding orb-world physics (goals 1000044/1000049); cluster detection. NOTE cross-goal dependency on orb-physics infra. Output an ADR + sub-tasks. Deps R19,R23.' },
+  { ref:'R34', kind:'feature', disc:'engineer', prio:3, est:210, crit:['C10'],     deps:['R33'],        title:'R34 · Connection-strength + degree + cluster compute API', desc:'Compute connection strength + degrees + close-knit clusters; feeds orb physics + recruiting. Deps R33.' },
+  { ref:'R35', kind:'feature', disc:'ui',       prio:3, est:180, crit:['C10'],     deps:['R34','R25'],  title:'R35 · Builder-side: clusters in the orb sky → invite a close cluster to a guild', desc:'Close connections cluster in the orb sky; invite a cluster to form a guild from it. Deps R34,R25.' },
+  { ref:'R36', kind:'feature', disc:'ui',       prio:3, est:180, crit:['C10'],     deps:['R34','R16'],  title:'R36 · Project-side: recruit a close-knit cluster together', desc:'Surface close-knit clusters on the recruiting surface; recruit them together. Deps R34,R16.' },
+  { ref:'R37', kind:'verify',  disc:'engineer', prio:3, est:120, crit:['C10'],     deps:['R35','R36'],  title:'R37 · PROOF: cluster forms a guild from the sky; owner recruits a cluster', desc:'End-to-end verify of the proximity-driven guild-forming + cluster-recruiting. Deps R35,R36.' },
+];
+
+const ROOTS = ['R01', 'R07', 'R18']; // zero-dep entry spikes to open for claiming
+
+(async () => {
+  const idByRef = {};
+  let created = 0, existing = 0;
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc,
+      kind: t.kind, discipline: t.disc, priority: t.prio, est_minutes: t.est,
+      criterion_ids: t.crit, source: SRC, source_ref: `bv1-profiles-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    const task = r.json.task || r.json;
+    idByRef[t.ref] = task.id;
+    if (r.json.idempotent || r.json.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    const depIds = t.deps.map((d) => idByRef[d]).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) { console.log(`  ${t.ref}: dep resolve gap, skipping`); continue; }
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) { console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    edges += (r.json.added || depIds.length);
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting root spikes to ready…');
+  for (const ref of ROOTS) {
+    const id = idByRef[ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.json).slice(0,120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}. Roots opened: ${ROOTS.join(', ')}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();