@bongos/core 1.18.3 → 1.18.19

package/modules/ideas/routes/inbox.js

@@ -7,6 +7,8 @@ const inbox = require('../inbox');
 const { validateOrRespond, LIMITS, parseId } = api;
 
 const INBOX_STATUS_VALUES = ['open', 'promoted', 'discarded', 'merged'];
+// One cap, declared where the domain declares it (task 1002447).
+const { TRIAGE_NOTE_MAX } = inbox;
 
 // The `ideas.capture` kernel PORT (ADR 0093 §5) — captureIdea's permanent home,
 // which retired the temporary `module-api.captureIdea` doorway leak (ADR 0091
@@ -139,6 +141,14 @@ module.exports = function buildInboxRouter() {
       // check stays open (declared untyped so strict-mode accepts it); the
       // inline `new Date()` parse handles the rest.
       reviewed_at: {},
+      // task 1002447 (migration core_195): the merge TARGET and the verdict's
+      // reason. status='merged' never said what it merged into, and a discard
+      // never said why. An explicit null still passes — validateField returns
+      // early for a null non-required field — so it doubles as the un-merge.
+      // inbox.updateIdea enforces the rest: the target exists, isn't this idea,
+      // isn't itself merged, and travels with status='merged'.
+      merged_into_idea_id: { type: 'integer', min: 1 },
+      triage_note: { type: 'string', maxLength: TRIAGE_NOTE_MAX },
     })) return;
     const id = parseId(req, res, { code: 'bad_id' });
     if (id === null) return;
@@ -147,6 +157,8 @@ module.exports = function buildInboxRouter() {
     if (body.status !== undefined) patch.status = body.status;
     if (body.kind !== undefined) patch.kind = body.kind;
     if (body.promoted_to_task_id !== undefined) patch.promoted_to_task_id = body.promoted_to_task_id;
+    if (body.triage_note !== undefined) patch.triage_note = body.triage_note;
+    if (body.merged_into_idea_id !== undefined) patch.merged_into_idea_id = body.merged_into_idea_id;
     if (body.reviewed_at !== undefined) {
       const d = body.reviewed_at ? new Date(body.reviewed_at) : null;
       if (d && Number.isNaN(d.getTime())) {
@@ -165,6 +177,11 @@ module.exports = function buildInboxRouter() {
       if (err && err.code) {
         const status =
           err.code === 'IDEA_NOT_FOUND' ? 404 :
+          err.code === 'MERGE_TARGET_NOT_FOUND' ? 404 :
+          err.code === 'MERGE_TARGET_MERGED' ? 409 :
+          err.code === 'MERGE_SELF' ? 400 :
+          err.code === 'MERGE_STATUS_REQUIRED' ? 400 :
+          err.code === 'TRIAGE_NOTE_TOO_LONG' ? 400 :
           err.code === 'BAD_STATUS' ? 400 :
           err.code === 'BAD_KIND' ? 400 :
           500;
@@ -196,6 +213,12 @@ module.exports = function buildInboxRouter() {
     api.requireBuilder,
     api.requireRank('archon'),
     async (req, res) => {
+      // notes_md is OPTIONAL and free text. The schema keeps the accepted shape
+      // exactly as it was (absent → ''), and adds what the typeof guard could not:
+      // a length bound and rejection of unknown fields (BV1.R109c).
+      if (validateOrRespond(req, res, {
+        notes_md: { type: 'string', maxLength: LIMITS.NOTES },
+      })) return;
       const id = parseId(req, res, { code: 'bad_id' });
       if (id === null) return;
       const notes = (req.body && typeof req.body.notes_md === 'string') ? req.body.notes_md : '';

package/modules/lifecycle/claim-eligibility.js

@@ -0,0 +1,72 @@
+'use strict';
+
+// modules/lifecycle/claim-eligibility.js — the QUEUE axis of claim eligibility,
+// expressed in PERMISSIONS (ADR 0151, BV1.R106).
+//
+// Claim-time authority has TWO independent axes, and keeping them independent is
+// the whole point of this file:
+//
+//   1. WHICH QUEUE may this builder claim from?   ← THIS FILE
+//      Permission atoms: `task.claim.any` (the whole ready queue) and
+//      `task.claim.newcomer` (newcomer_friendly rows only). A property of the
+//      BUILDER's roles.
+//   2. Does this particular task raise its own floor?   ← db.rankAllowsTask
+//      The per-task `requires_rank` column (V3.R82 #301 / ADR 0084-0085). A
+//      property of the TASK, not of the claimer's roles.
+//
+// BOTH must pass, and neither substitutes for the other: a builder holding
+// `task.claim.any` still cannot claim a task whose `requires_rank` is above their
+// rank. Collapsing the two into one check is the most likely way to silently
+// widen access, so db.js calls this predicate and `rankAllowsTask` as two
+// separate, consecutive gates — see claimTask / claimTasksBatch /
+// validateClaimBatch.
+//
+// Pure + DB-free so tests/governance_claim_eligibility.mjs can exercise every
+// rank × permission × requires_rank combination without Postgres.
+
+// The two catalog keys this axis reads (modules/governance/catalog.js). Exported
+// so a test can anchor them against the catalog: a rename or a floor change over
+// there must red a test here rather than silently detach the gate from the seed.
+const CLAIM_ANY = 'task.claim.any';
+const CLAIM_NEWCOMER = 'task.claim.newcomer';
+
+// permissionAllowsClaim — the permission-only decision.
+//
+// `task.claim.any` covers the whole ready queue, newcomer_friendly rows included
+// (the compat seed makes it a strict superset — every rank-role granted it also
+// holds `task.claim.newcomer`). `task.claim.newcomer` alone reaches ONLY rows
+// explicitly opened to newcomers. Everything else — no claim permission, an empty
+// set, an unrelated grant — is refused (fail-closed, matching the posture
+// xenosClaimAllowed took for unknown ranks in #510).
+//
+// `newcomerFriendly` is compared with === true: the column is nullable, and a
+// NULL/undefined must read as "not opened to newcomers", never as truthy.
+function permissionAllowsClaim(heldPermissions, newcomerFriendly) {
+  const held = heldPermissions instanceof Set ? heldPermissions : new Set(heldPermissions || []);
+  if (held.has(CLAIM_ANY)) return true;
+  return newcomerFriendly === true && held.has(CLAIM_NEWCOMER);
+}
+
+// claimEligibilityAllows — the gate the claim paths actually call.
+//
+// `heldPermissions` is the builder's effective permission set resolved through
+// the `governance` kernel port, or NULL when authority could not be ESTABLISHED:
+// the module is off, the resolver threw, or the builder holds no role rows at all.
+// That last case is LIVE today — governance_002's backfill is run-once and nothing
+// yet assigns a rank-role to a builder created (or re-ranked) after it ran — so
+// NULL falls back to `rankRuleAllows`, the INCUMBENT rank gate
+// (db.xenosClaimAllowed).
+//
+// The fallback is to today's gate, never to "allow". It cannot admit anyone rank
+// did not already admit, which is what makes this swap behaviour-identical; and it
+// becomes dead code the moment role assignment is kept in sync with rank. It is
+// deliberately NOT requirePermission's "deny on a missing port" posture: that gate
+// guards ADDED authority, where denying is free, whereas denying here would refuse
+// every claim on the instance — a much worse failure than continuing to enforce
+// exactly the rule that is in force today.
+function claimEligibilityAllows({ heldPermissions, newcomerFriendly, rankRuleAllows }) {
+  if (heldPermissions === null || heldPermissions === undefined) return rankRuleAllows === true;
+  return permissionAllowsClaim(heldPermissions, newcomerFriendly);
+}
+
+module.exports = { CLAIM_ANY, CLAIM_NEWCOMER, permissionAllowsClaim, claimEligibilityAllows };