@bongos/core 1.18.19 → 1.19.3

package/modules/lifecycle/routes/tasks.js

@@ -309,7 +309,7 @@ module.exports = function buildTasksRouter() {
   // BACKSTOP for the on-claim restock (the live mechanism is the post-claim hook
   // in routes/claims.js). Archon-gated like all task creation (ADR 0016). Must
   // be registered BEFORE GET /tasks/:id so ':id' doesn't swallow the literal.
-  router.post('/tasks/newcomer-restock', auth.requireBuilder, auth.requireRank('archon'), async (_req, res) => {
+  router.post('/tasks/newcomer-restock', auth.requireBuilder, auth.requirePermission('task.newcomer_restock'), async (_req, res) => {
     try {
       // The newcomer-chore restock carved into modules/onboarding/ (BV1.R81 / ADR
       // 0093 §1): resolve the `onboarding` kernel port — never a direct require.
@@ -368,7 +368,7 @@ module.exports = function buildTasksRouter() {
   //                                       { depends_on_task_ids: [N, ...] }
   // Returns 409 with code='cycle' if accepting would create a cycle.
   // rank: metic+archon — task-shaping; Metic may wire deps of a task it can author (ADR 0090).
-  router.post('/tasks/:id/dependencies', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/tasks/:id/dependencies', auth.requireBuilder, auth.requirePermission('task.dependency.manage'), async (req, res) => {
     if (validateOrRespond(req, res, {
       depends_on_task_ids: { type: 'array', maxItems: 200 },
       // depends_on_task_id can be a number or a string-coerced number — leave
@@ -412,7 +412,7 @@ module.exports = function buildTasksRouter() {
 
   // DELETE /tasks/:id/dependencies/:depId — removes the edge.
   // rank: metic+archon — removes a dep edge; task-shaping, Metic+ (ADR 0090).
-  router.delete('/tasks/:id/dependencies/:depId', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.delete('/tasks/:id/dependencies/:depId', auth.requireBuilder, auth.requirePermission('task.dependency.manage'), async (req, res) => {
     const id = Number(req.params.id);
     const depId = Number(req.params.depId);
     if (!Number.isFinite(id) || !Number.isFinite(depId)) {
@@ -425,7 +425,7 @@ module.exports = function buildTasksRouter() {
   // PUT /tasks/:id/dependencies — replace the full dep set.
   //   body: { depends_on_task_ids: [N, ...] }
   // rank: metic+archon — replaces the full dep set; task-shaping, Metic+ (ADR 0090).
-  router.put('/tasks/:id/dependencies', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.put('/tasks/:id/dependencies', auth.requireBuilder, auth.requirePermission('task.dependency.manage'), async (req, res) => {
     if (validateOrRespond(req, res, {
       depends_on_task_ids: { required: true, type: 'array', maxItems: 200 },
     })) return;
@@ -467,7 +467,7 @@ module.exports = function buildTasksRouter() {
   // POST /tasks/:id/criteria — body: { criterion_ids: [ref, ...] } OR
   //                                  { criterion_id: ref }. Metic+.
   // rank: metic+archon — links a task it can author to a criterion; mirrors POST deps (ADR 0090).
-  router.post('/tasks/:id/criteria', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/tasks/:id/criteria', auth.requireBuilder, auth.requirePermission('task.criterion.manage'), async (req, res) => {
     if (validateOrRespond(req, res, {
       criterion_ids: { type: 'array', maxItems: 100 },
       // criterion_id is the singular alt-form (a numeric id, "Cn" token, or slug)
@@ -509,7 +509,7 @@ module.exports = function buildTasksRouter() {
   // DELETE /tasks/:id/criteria/:criterionId — removes one link (criterionId is
   // the numeric done_when_criteria.id, mirroring DELETE deps/:depId).
   // rank: metic+archon — removes a criterion↔task edge; task-shaping, Metic+ (ADR 0090).
-  router.delete('/tasks/:id/criteria/:criterionId', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.delete('/tasks/:id/criteria/:criterionId', auth.requireBuilder, auth.requirePermission('task.criterion.manage'), async (req, res) => {
     const id = Number(req.params.id);
     const criterionId = Number(req.params.criterionId);
     if (!Number.isFinite(id) || !Number.isFinite(criterionId)) {
@@ -525,7 +525,7 @@ module.exports = function buildTasksRouter() {
   // ADR 0018). A Xenos/Thetes still cannot author — they file ideas. Setting rank
   // and closing versions stay Archon. The every-route audit is task #231 (V3.R06).
   // rank: metic+archon — create work (plan/scope mutation); ADR 0090 (was ADR 0016/0018 archon).
-  router.post('/tasks', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/tasks', auth.requireBuilder, auth.requirePermission('task.create'), async (req, res) => {
     if (validateOrRespond(req, res, {
       version_id: { required: true, type: 'string', maxLength: 64 },
       title: { required: true, type: 'string', maxLength: LIMITS.TITLE, minLength: 1 },
@@ -747,7 +747,7 @@ module.exports = function buildTasksRouter() {
   // accepts true|false|null; newcomer_friendly is a boolean. Validation lives
   // in hierarchy.js for parent; the rest are validated inline.
   // rank: metic+archon — edit work (incl. newcomer_friendly flag); ADR 0090 (was ADR 0016 archon).
-  router.patch('/tasks/:id', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.patch('/tasks/:id', auth.requireBuilder, auth.requirePermission('task.edit'), async (req, res) => {
     if (validateOrRespond(req, res, {
       kind: { type: 'string', maxLength: 64 },
       discipline: { type: 'string', maxLength: 64 },
@@ -797,18 +797,20 @@ module.exports = function buildTasksRouter() {
     if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasRequiresRank && !hasModuleKey && !hasGoalId) {
       return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, parallel_safe, security_sensitive, automation_tag, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
-    let updated = null;
-    if (hasParallelSafe) {
-      if (body.parallel_safe !== null && typeof body.parallel_safe !== 'boolean') {
-        return res.fail('bad_parallel_safe', { status: 400, message: 'parallel_safe must be true, false, or null' });
-      }
-      try {
-        updated = await db.updateTaskParallelSafe(id, body.parallel_safe);
-        if (!updated) return res.fail('task_not_found', 404);
-      } catch (err) {
-        console.error('[gds] PATCH /tasks/:id parallel_safe', err);
-        return res.fail('patch_failed', { status: 500, message: 'internal error' });
-      }
+    // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
+    // ---- FIRST write. The previous shape validated-and-wrote per field in ----
+    // sequence, so a body mixing a valid early field with a refused later one
+    // committed the early write and then 403/400'd — state changed on a request
+    // the caller was told was refused (a Metic sending { parallel_safe,
+    // security_sensitive } had parallel_safe committed before rank_forbidden).
+    // Authorization, type/enum checks, and the goal existence/version reads all
+    // run here; writes begin only after the last validation `return`.
+    // (Documented residual: parent_task_id validates inside hierarchy.attachParent
+    // at the end — its checks are atomic with its OWN write, but a refusal there
+    // still lands after the field writes below. No authorization gate is
+    // involved in that path; the handler's only rank gate is hoisted here.)
+    if (hasParallelSafe && body.parallel_safe !== null && typeof body.parallel_safe !== 'boolean') {
+      return res.fail('bad_parallel_safe', { status: 400, message: 'parallel_safe must be true, false, or null' });
     }
     if (hasSecuritySensitive) {
       // task 990: explicit Archon-only-broadcast flag. Boolean only (no null) —
@@ -826,41 +828,19 @@ module.exports = function buildTasksRouter() {
       if (typeof body.security_sensitive !== 'boolean') {
         return res.fail('bad_security_sensitive', { status: 400, message: 'security_sensitive must be a boolean' });
       }
-      try {
-        updated = await db.updateTaskSecuritySensitive(id, body.security_sensitive);
-        if (!updated) return res.fail('task_not_found', 404);
-      } catch (err) {
-        console.error('[gds] PATCH /tasks/:id security_sensitive', err);
-        return res.fail('patch_failed', { status: 500, message: 'internal error' });
-      }
     }
+    const VALID_AUTOMATION_TAGS = new Set(['overnight-safe', 'live-only', 'needs-input']);
     if (hasAutomationTag) {
       const tag = body.automation_tag;
-      const VALID_AUTOMATION_TAGS = new Set(['overnight-safe', 'live-only', 'needs-input']);
       if (tag !== null && (typeof tag !== 'string' || !VALID_AUTOMATION_TAGS.has(tag))) {
         return res.fail('bad_automation_tag', { status: 400, message: 'automation_tag must be one of overnight-safe | live-only | needs-input, or null to clear', details: { valid: Array.from(VALID_AUTOMATION_TAGS) } });
       }
-      try {
-        updated = await db.updateTaskAutomationTag(id, tag);
-        if (!updated) return res.fail('task_not_found', 404);
-      } catch (err) {
-        console.error('[gds] PATCH /tasks/:id automation_tag', err);
-        return res.fail('patch_failed', { status: 500, message: 'internal error' });
-      }
     }
     if (hasModuleKey) {
       // BV1.R53 (task 1422): assign or clear the module affinity label. null clears.
-      const key = body.module_key;
-      if (key !== null && !isModuleKey(key)) {
+      if (body.module_key !== null && !isModuleKey(body.module_key)) {
         return res.fail('bad_module_key', { status: 400, message: `module_key must be one of the known module keys, or null to clear. Valid keys: ${moduleKeys().join(', ')}.`, details: { valid: moduleKeys() } });
       }
-      try {
-        updated = await db.updateTaskModuleKey(id, key ?? null);
-        if (!updated) return res.fail('task_not_found', 404);
-      } catch (err) {
-        console.error('[gds] PATCH /tasks/:id module_key', err);
-        return res.fail('patch_failed', { status: 500, message: 'internal error' });
-      }
     }
     if (hasGoalId) {
       // task 1763: (re)assign the task's goal — the documented "Archon/Metic
@@ -882,8 +862,6 @@ module.exports = function buildTasksRouter() {
         if (String(goal.version_id) !== String(task.version_id)) {
           return res.fail('goal_version_mismatch', { status: 409, message: `Goal #${goalId} is in version '${goal.version_id}' but task #${id} is in '${task.version_id}'. A task can only join a goal in its own version.` });
         }
-        updated = await db.updateTaskGoal(id, goalId);
-        if (!updated) return res.fail('task_not_found', 404);
       } catch (err) {
         console.error('[gds] PATCH /tasks/:id goal_id', err);
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
@@ -893,13 +871,77 @@ module.exports = function buildTasksRouter() {
       // task 1498 / ADR 0084: the Archon override of the per-task rank floor.
       // Validate the enum here; db.updateTaskRequiresRank clamps the value UP to
       // the auto-derived floor (touches + security_sensitive), so a PATCH can
-      // only RAISE the gate — never open a sensitive task to a lower rank. Runs
-      // AFTER the security_sensitive block above, so a same-request flag flip is
-      // already reflected in the derived floor.
+      // only RAISE the gate — never open a sensitive task to a lower rank.
       const LIVE_RANKS = new Set(db.LIVE_RANK_LADDER);
       if (typeof body.requires_rank !== 'string' || !LIVE_RANKS.has(body.requires_rank)) {
         return res.fail('bad_requires_rank', { status: 400, message: `requires_rank must be one of ${db.LIVE_RANK_LADDER.join(' | ')}. An override can only raise the floor; it is clamped up to the auto-derived minimum.`, details: { valid: db.LIVE_RANK_LADDER } });
       }
+    }
+    if (hasKind && !VALID_KINDS.has(body.kind)) {
+      return badKind(res);
+    }
+    if (hasDiscipline && !VALID_DISCIPLINES.has(body.discipline)) {
+      return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
+    }
+    if (hasNewcomerOrXenos) {
+      // V3.R15 #239: prefer newcomer_friendly (canonical); fall back to
+      // xenos_claimable (pre-rename alias). Both map to the same DB column.
+      const incoming = hasNewcomerFriendly ? body.newcomer_friendly : body.xenos_claimable;
+      if (typeof incoming !== 'boolean') {
+        const field = hasNewcomerFriendly ? 'newcomer_friendly' : 'xenos_claimable';
+        return res.fail(`bad_${field}`, { status: 400, message: `${field} must be a boolean` });
+      }
+    }
+    // ---- all gates passed: apply the writes. Order preserved from the old ----
+    // shape — requires_rank still runs AFTER security_sensitive so a
+    // same-request flag flip is already reflected in the derived floor.
+    let updated = null;
+    if (hasParallelSafe) {
+      try {
+        updated = await db.updateTaskParallelSafe(id, body.parallel_safe);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id parallel_safe', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasSecuritySensitive) {
+      try {
+        updated = await db.updateTaskSecuritySensitive(id, body.security_sensitive);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id security_sensitive', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasAutomationTag) {
+      try {
+        updated = await db.updateTaskAutomationTag(id, body.automation_tag);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id automation_tag', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasModuleKey) {
+      try {
+        updated = await db.updateTaskModuleKey(id, body.module_key ?? null);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id module_key', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasGoalId) {
+      try {
+        updated = await db.updateTaskGoal(id, body.goal_id);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id goal_id', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
+    if (hasRequiresRank) {
       try {
         updated = await db.updateTaskRequiresRank(id, body.requires_rank);
         if (!updated) return res.fail('task_not_found', 404);
@@ -909,9 +951,6 @@ module.exports = function buildTasksRouter() {
       }
     }
     if (hasKind) {
-      if (!VALID_KINDS.has(body.kind)) {
-        return badKind(res);
-      }
       try {
         updated = await db.updateTaskKind(id, body.kind);
         if (!updated) return res.fail('task_not_found', 404);
@@ -921,9 +960,6 @@ module.exports = function buildTasksRouter() {
       }
     }
     if (hasDiscipline) {
-      if (!VALID_DISCIPLINES.has(body.discipline)) {
-        return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
-      }
       try {
         updated = await db.updateTaskDiscipline(id, body.discipline);
         if (!updated) return res.fail('task_not_found', 404);
@@ -933,13 +969,7 @@ module.exports = function buildTasksRouter() {
       }
     }
     if (hasNewcomerOrXenos) {
-      // V3.R15 #239: prefer newcomer_friendly (canonical); fall back to
-      // xenos_claimable (pre-rename alias). Both map to the same DB column.
       const incoming = hasNewcomerFriendly ? body.newcomer_friendly : body.xenos_claimable;
-      if (typeof incoming !== 'boolean') {
-        const field = hasNewcomerFriendly ? 'newcomer_friendly' : 'xenos_claimable';
-        return res.fail(`bad_${field}`, { status: 400, message: `${field} must be a boolean` });
-      }
       try {
         updated = await db.updateTaskNewcomerFriendly(id, incoming);
         if (!updated) return res.fail('task_not_found', 404);
@@ -977,7 +1007,7 @@ module.exports = function buildTasksRouter() {
   // PATCH refuses `status` outright). A restore lands in **backlog**, never straight
   // to ready: the task was retired for a reason, so it re-enters as un-workable and
   // takes a second, deliberate promote to become claimable again.
-  router.post('/tasks/:id/promote', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/tasks/:id/promote', auth.requireBuilder, auth.requirePermission('task.promote'), async (req, res) => {
     const id = Number(req.params.id);
     const task = await db.getTask(id);
     if (!task) return res.fail('task_not_found', 404);
@@ -1020,7 +1050,7 @@ module.exports = function buildTasksRouter() {
   // task out from under its claim holder. No reward side-effects (the reward gate
   // is a promote-only concern; backlog is the pre-workable state).
   // rank: metic+archon — ready→backlog demotion; scope mutation; mirrors /promote (ADR 0090).
-  router.post('/tasks/:id/demote', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/tasks/:id/demote', auth.requireBuilder, auth.requirePermission('task.demote'), async (req, res) => {
     const id = Number(req.params.id);
     const task = await db.getTask(id);
     if (!task) return res.fail('task_not_found', 404);
@@ -1091,7 +1121,7 @@ module.exports = function buildTasksRouter() {
   // GRADER_BYPASS_ENABLED==='1'; archon-only otherwise).
   const confirmRankGate = (req, res, next) => {
     if (graderBypassEnabled()) return next();
-    return auth.requireRank('archon')(req, res, next);
+    return auth.requirePermission('task.confirm.grade_bypass')(req, res, next);
   };
   router.post('/tasks/:id/confirm', auth.requireBuilder, confirmRankGate, async (req, res) => {
     if (validateOrRespond(req, res, {
@@ -1148,7 +1178,7 @@ module.exports = function buildTasksRouter() {
   // triage they already delegated. Not one-way any more — /promote restores an
   // abandoned task to backlog at the same rank — and the guards below (shipped
   // refused, active claim refused) plus the audit_log entry are unchanged.
-  router.post('/tasks/:id/abandon', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/tasks/:id/abandon', auth.requireBuilder, auth.requirePermission('task.abandon'), async (req, res) => {
     if (validateOrRespond(req, res, {
       reason: { type: 'string' },  // free-text retire reason (sliced to 2000 below)
     })) return;
@@ -1228,7 +1258,7 @@ module.exports = function buildTasksRouter() {
   // reaches it via the doorway api.tallyPeerVotes — BV1.R83) share one code path
   // and can never diverge. This route keeps the Archon gate (the HTTP surface
   // stays Archon-only); the in-process timer has no requester to authorize.
-  router.post('/tasks/peer-votes/tally', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.post('/tasks/peer-votes/tally', auth.requireBuilder, auth.requirePermission('task.peer_votes.tally'), async (req, res) => {
     try {
       const result = await db.tallyPeerVotes();
       res.json(result);
@@ -1244,7 +1274,7 @@ module.exports = function buildTasksRouter() {
   //   - 409 if the task isn't votable, or the vote was already folded into karma
   //   - vote: 0 clears (deletes the row, only while still untallied)
   // rank: metic+archon — a trusted-builder reputation action.
-  router.post('/tasks/:id/vote', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+  router.post('/tasks/:id/vote', auth.requireBuilder, auth.requirePermission('task.vote'), async (req, res) => {
     if (validateOrRespond(req, res, {
       vote: { required: true, type: 'integer', enum: [-1, 0, 1] },
     })) return;
@@ -1685,7 +1715,7 @@ module.exports = function buildTasksRouter() {
   // GET /override-requests?status=open — Archon queue. Status defaults to open;
   // pass ?status=approved or ?status=denied for the resolved history.
   // rank: archon — same gate as the audit log + Archon view.
-  router.get('/override-requests', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/override-requests', auth.requireBuilder, auth.requirePermission('override_request.decide'), async (req, res) => {
     const status = req.query.status || 'open';
     if (!['open', 'approved', 'denied'].includes(status)) {
       return res.fail('bad_status', 400);
@@ -1705,7 +1735,7 @@ module.exports = function buildTasksRouter() {
   // updates; the task stays at completed and the builder must release or
   // re-ship after fixing whatever the grader caught.
   // rank: archon — grader-bypass authority; same gate as POST /tasks/:id/confirm.
-  router.post('/override-requests/:id/decide', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.post('/override-requests/:id/decide', auth.requireBuilder, auth.requirePermission('override_request.decide'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {

package/modules/lifecycle/routes/versions.js

@@ -11,6 +11,11 @@ const { asyncHandler, validateOrRespond } = api;
 // 'building'; 'shipped'/'frozen' are end states reached via the close flow.
 const VALID_VERSION_STATUSES = new Set(['planning', 'building', 'shipped', 'frozen']);
 
+// versions.track CHECK (migration 003) — NOT NULL with no DB default, so the
+// create path must always supply one. 'product' is the caller-facing default:
+// an instance seeding its first version is seeding its product track.
+const VALID_VERSION_TRACKS = new Set(['product', 'internal']);
+
 module.exports = function buildVersionsRouter() {
   const router = express.Router();
 
@@ -62,11 +67,12 @@ module.exports = function buildVersionsRouter() {
   // no hand-written seed-*.js script. Archon-only: creating a version is a
   // plan/scope mutation, same gate as POST /tasks (ADR 0016).
   // rank: archon — creates a version + its done-when criteria.
-  router.post('/versions', auth.requireBuilder, auth.requireRank('archon'), asyncHandler('POST /versions', async (req, res) => {
+  router.post('/versions', auth.requireBuilder, auth.requirePermission('version.create'), asyncHandler('POST /versions', async (req, res) => {
     if (validateOrRespond(req, res, {
       id: { required: true, type: 'string', maxLength: 64, minLength: 1 },
       name: { required: true, type: 'string', maxLength: 200, minLength: 1 },
       status: { type: 'string', maxLength: 32 },
+      track: { type: 'string', maxLength: 16 },
       done_when: { type: 'string', maxLength: 8000 },
       scope_doc_path: { type: 'string', maxLength: 256 },
       criteria: { type: 'array', maxItems: 100 },
@@ -81,6 +87,11 @@ module.exports = function buildVersionsRouter() {
       return res.fail('bad_status', 400, { valid: Array.from(VALID_VERSION_STATUSES) });
     }
 
+    const track = body.track || 'product';
+    if (!VALID_VERSION_TRACKS.has(track)) {
+      return res.fail('bad_track', 400, { valid: Array.from(VALID_VERSION_TRACKS) });
+    }
+
     if (await db.getVersion(id)) {
       return res.fail('version_exists', { status: 409, message: `Version '${id}' already exists.` });
     }
@@ -104,7 +115,7 @@ module.exports = function buildVersionsRouter() {
     let version, created;
     try {
       ({ version, criteria: created } = await db.createVersion({
-        id, name, status,
+        id, name, status, track,
         doneWhen: body.done_when ?? null,
         scopeDocPath: body.scope_doc_path ?? null,
         criteria,

package/modules/lifecycle/ship-card.js

@@ -195,7 +195,21 @@ function safeBrand() {
 // Stage-specific field selection lives HERE; the renderers are generic.
 function buildCardModel(input = {}) {
   const stage = input.stage || stageFor(input.postGradeStatus);
-  const cfg = STAGES[stage] || STAGES.failed;
+  const baseCfg = STAGES[stage] || STAGES.failed;
+  // task 1002541: did the land actually bail? `input.land` is the ship chain's
+  // outcome ({ ok, pending, reason, nextStep }). A task sits at 'confirmed' both
+  // when it IS landing on its own (pending — CI/the reconciler will finish it)
+  // and when the merge gave up. Only the second is a lie worth shouting about,
+  // so this needs an explicit reason — never a bare "not ok".
+  // ABSENT `land` (every pre-existing caller, and breadcrumbs written by older
+  // versions) ⇒ false ⇒ the card renders exactly as it did before.
+  const land = input.land || null;
+  const landBailed = !!(stage === 'confirmed' && land && land.ok === false && !land.pending && land.reason);
+  // A bailed land is not "confirmed — landing". Recolor the banner to match the
+  // truth; the underlying STAGES entry is left untouched (it's frozen + shared).
+  const cfg = landBailed
+    ? { ...baseCfg, tone: 'warning', icon: 'ti-alert-triangle', statusWord: 'Not landed', headline: (id) => `Task #${id} confirmed — NOT landed` }
+    : baseCfg;
   const brand = input.brand || safeBrand();
   const taskId = input.taskId;
   const grade = input.grade || {};
@@ -285,11 +299,20 @@ function buildCardModel(input = {}) {
       deployCommit = input.deploy && input.deploy.commit ? String(input.deploy.commit) : null;
       deployText = deployCommit ? `live · ${deployCommit}` : 'live';
     } else if (stage === 'confirmed') {
-      // The server lands confirmed tasks automatically (publish-reconciler +
-      // merge driver + ADR 0082 resolver); /merge-mode is a rare manual
-      // fallback, kept as the card's optional 'Land it' override — so the fact
-      // states the automatic reality rather than implying a required command.
-      deployText = 'landing automatically';
+      // task 1002541: this line used to be unconditional, driven by the STATUS
+      // alone — so a merge that bailed still reported "landing automatically".
+      // Nothing was landing, no PR existed, and under ADR 0120 (pay on land) the
+      // builder was unpaid: the failure announced itself as success, which is
+      // why these strands survived for days. Say what actually happened.
+      if (landBailed) {
+        deployText = `NOT landed — ${land.reason}`;
+      } else {
+        // The server lands confirmed tasks automatically (publish-reconciler +
+        // merge driver + ADR 0082 resolver); /merge-mode is a rare manual
+        // fallback, kept as the card's optional 'Land it' override — so the fact
+        // states the automatic reality rather than implying a required command.
+        deployText = 'landing automatically';
+      }
     } else {
       deployText = 'not deployed';
     }
@@ -300,12 +323,20 @@ function buildCardModel(input = {}) {
     addFact('', changed);
     if (gradeText) addFact('grade', gradeText, { cls: gradeCls });
     if (stage === 'shipped') addFact('live', deployCommit, { mono: true });
+    // The reason can be a full sentence — too long for a fact chip, so the chip
+    // carries the alarm and the reason rides in its tooltip (the Deploy row above
+    // always shows it in full).
+    else if (landBailed) addFact('', 'NOT landed', { cls: 'cc-bad', title: land.reason });
     else addFact('', deployText);
     addFact('', usageText, usageTitle ? { title: usageTitle } : {});
     if (creditsText) addFact('', creditsText);
   }
 
-  const action = nextActionFor(stage, { taskId, discipline: input.discipline, sandboxUrl: input.sandboxUrl });
+  // task 1002541: a bail knows the precise recovery command (re-run the ship,
+  // re-auth, pass --db-only…), which beats the stage's generic '/merge-mode'.
+  const action = (landBailed && land.nextStep)
+    ? { kind: 'prompt', label: 'Land it', cmd: land.nextStep }
+    : nextActionFor(stage, { taskId, discipline: input.discipline, sandboxUrl: input.sandboxUrl });
 
   return {
     stage, cfg, brand, taskId,

package/modules/memory/routes/memory.js

@@ -556,7 +556,7 @@ module.exports = function buildMemoryRouter() {
   router.get(
     '/memory/builders/:builderId/files',
     auth.requireBuilder,
-    auth.requireRank('archon'),
+    auth.requirePermission('memory.read.any'),
     readRateLimit,
     async (req, res) => {
       const targetId = Number(req.params.builderId);
@@ -607,7 +607,7 @@ module.exports = function buildMemoryRouter() {
   router.get(
     '/memory/builders/:builderId/file',
     auth.requireBuilder,
-    auth.requireRank('archon'),
+    auth.requirePermission('memory.read.any'),
     readRateLimit,
     async (req, res) => {
       const targetId = Number(req.params.builderId);

package/modules/onboarding/routes/access-requests.js

@@ -26,7 +26,7 @@ const express = require('express');
 // core file a module may require, ADR 0083); approval-broadcast travels WITH this
 // admission route (its sole consumer) and is an intra-module require.
 const api = require('../../../src/module-api');
-const auth = { requireBuilder: api.requireBuilder, requireRank: api.requireRank };
+const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requirePermission };
 const { pool } = api;
 const { validateOrRespond, parseId } = api;
 const approvalBroadcast = require('../approval-broadcast');
@@ -145,7 +145,7 @@ module.exports = function buildAccessRequestsRouter() {
   // GET /access-requests?status=pending — Archon queue. Defaults to pending;
   // pass ?status=invited|dismissed for the resolved history.
   // rank: archon — the queue exposes would-be builders' usernames.
-  router.get('/access-requests', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/access-requests', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     const status = req.query.status || 'pending';
     if (!['pending', 'invited', 'dismissed'].includes(status)) {
       return res.fail('bad_status', 400);
@@ -174,7 +174,7 @@ module.exports = function buildAccessRequestsRouter() {
   // (the only sign-in gate — no repo access needed); 'dismissed' = declined /
   // spam / dup. The row stays as the audit trail either way.
   // rank: archon — same gate as the rest of the roster management surface.
-  router.patch('/access-requests/:id', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.patch('/access-requests/:id', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {

package/modules/platform-identity/routes/projects.js

@@ -14,13 +14,17 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 
-const { pool, requireBuilder, requireRank, validateOrRespond, parseId, corsPublicGet } = api;
+const { pool, requireBuilder, requirePermission, validateOrRespond, parseId, corsPublicGet } = api;
 
 module.exports = function projectsRoutes() {
   const router = express.Router();
 
-  // rank: archon — the full curation list (includes unfeatured + owner attribution).
-  router.get('/projects', requireBuilder, requireRank('archon'), async (_req, res) => {
+  // rank: metic+archon — the full curation list (includes unfeatured + owner attribution).
+  // BV1.R105 left this on requireRank because `project.curate` was declared over the
+  // writes + GET /scouting, not over this read. ADR 0157 extends that atom's guards to
+  // name GET /projects and lowers its floor archon→metic, so the mapping now exists and
+  // the audience is the working rank.
+  router.get('/projects', requireBuilder, requirePermission('project.curate'), async (_req, res) => {
     try {
       res.json({ projects: await pi.listAllProjects({ pool }) });
     } catch (err) {
@@ -31,7 +35,7 @@ module.exports = function projectsRoutes() {
 
   // rank: archon — create / update a catalog entry (manual seed for hand-wired
   // instances; federated projects auto-catalogue at registration).
-  router.post('/projects', requireBuilder, requireRank('archon'), async (req, res) => {
+  router.post('/projects', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     if (validateOrRespond(req, res, {
       origin: { required: true, type: 'string', maxLength: 512 },
       name: { required: true, type: 'string', maxLength: 200 },
@@ -57,7 +61,7 @@ module.exports = function projectsRoutes() {
   // by github_login and requires the invitee to already have a platform account (they
   // build on some project); inviting someone entirely new to the platform (GitHub-id
   // resolution) is a follow-up.
-  router.post('/projects/invite', requireBuilder, requireRank('archon'), async (req, res) => {
+  router.post('/projects/invite', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     if (validateOrRespond(req, res, {
       client_id: { required: true, type: 'string', maxLength: 200 },
       github_login: { required: true, type: 'string', maxLength: 200 },
@@ -76,7 +80,7 @@ module.exports = function projectsRoutes() {
   });
 
   // rank: archon — the feature / unfeature control (the ADR 0141 §5 curation gate).
-  router.patch('/projects/:id/featured', requireBuilder, requireRank('archon'), async (req, res) => {
+  router.patch('/projects/:id/featured', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_project_id', positiveInt: true });
     if (id === null) return;
     if (validateOrRespond(req, res, { featured: { required: true, type: 'boolean' } })) return;

package/modules/platform-identity/routes/scouting.js

@@ -12,7 +12,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 
-const { pool, requireBuilder, requireRank, parsePagination } = api;
+const { pool, requireBuilder, requirePermission, parsePagination } = api;
 
 module.exports = function scoutingRoutes() {
   const router = express.Router();
@@ -20,7 +20,7 @@ module.exports = function scoutingRoutes() {
   // rank: archon — the internal talent directory across every project. The Archon
   // gate here is the load-bearing protection ("NOT shown to builders"): a non-Archon
   // is 403'd before any cross-builder data is read.
-  router.get('/scouting', requireBuilder, requireRank('archon'), async (req, res) => {
+  router.get('/scouting', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
     try {
       const builders = await pi.listScoutingRollup({ limit, pool });

package/modules/provisioning/migrations/provisioning_004_onboard_mode.sql

@@ -0,0 +1,30 @@
+-- provisioning_004_onboard_mode.sql — record HOW an instance was onboarded:
+-- greenfield (a fresh empty repo) vs adopt (layer onto a repo the owner already has).
+-- ADR 0121 / task 1002562, BONGOS-V1 goal 32.
+--
+-- WHY THIS COLUMN EXISTS. `bongos init --adopt` (ADR 0121, tasks 2042-2046) built the
+-- LOCAL half of brownfield onboarding, and `GET /provisioning/onboard-plan?mode=…`
+-- branches the checklist TEXT the user is shown — but the mode was never PERSISTED, so
+-- the control-plane runner had no way to know. scripts/gds/provision.js therefore ran
+-- the greenfield scaffold unconditionally: `git init` a fresh tree, commit, and push
+-- `HEAD:main`. Against a repo that already has history that is an unrelated-history
+-- non-fast-forward and git rejects it, so adopting an existing repo could never
+-- succeed. This column is what lets the runner take the layering path instead.
+--
+-- DEFAULT 'greenfield' is the correct backfill: every instance provisioned before this
+-- migration went through the greenfield scaffold by construction (there was no other
+-- path), so no existing row is mislabelled.
+--
+-- Widening/adding is ADDITIVE — a new nullable-with-default column plus a CHECK that
+-- only constrains the new column. No existing row changes and no data is lost, so this
+-- is safe under the module-owned-migration rule (ADR 0083 §Decision #5). Idempotent:
+-- safe to re-run.
+ALTER TABLE provisioning_instances
+  ADD COLUMN IF NOT EXISTS onboard_mode text NOT NULL DEFAULT 'greenfield';
+
+ALTER TABLE provisioning_instances DROP CONSTRAINT IF EXISTS provisioning_instances_onboard_mode_check;
+ALTER TABLE provisioning_instances ADD CONSTRAINT provisioning_instances_onboard_mode_check
+  CHECK (onboard_mode IN ('greenfield', 'adopt'));
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_004_onboard_mode')
+  ON CONFLICT (version) DO NOTHING;