@bongos/core 1.19.1010 → 1.19.1012

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1010",
-  "core_contract": "1.19.1010",
-  "source_commit": "2e959a08be544446bcbe4a050128862f651337f6",
+  "core_version": "1.19.1012",
+  "core_contract": "1.19.1012",
+  "source_commit": "67c8c7ea6e9225abe84f04ee97d072e125b78671",
   "source_ref": "HEAD",
-  "built_at": "2026-09-24T21:57:10.279Z",
+  "built_at": "2026-09-24T22:32:49.600Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 523,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2420,
+    "functional_verbatim": 2426,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2969,
-  "tree_sha256": "1ed928f07118e31d83cb36f2f7c9e00fb8eb421f4e0c174d518a6c659944bae6",
+  "file_count": 2975,
+  "tree_sha256": "43775a7c655de35e08a0b90ecee94c1ccad0cc2e460df21d0b3b5d463e6fb7e2",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "e74f8574c95d4b2dbd2f6d41491346f39b59615ceeba00de62804cd16b4b5545"
+      "sha256": "26e3e9bd1e4dc4e7715eaabfdc155b98da64eefc2c002a18f4c5da0b5b288baa"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "8e70fb96ed9cc94ebde7fa33339a0a9a8bc9de57d0a16b2dd4b46a0fbdf0a68d"
+      "sha256": "6684688f85798c74d0c58853fa54c90e30a69c442708e191a3ef15b8f06ca0fb"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "f8b8ebe06392c748ac8874200b825a3c9ffa878c2f7d6f745bdc1ce5e51d95e7"
+      "sha256": "5b844bbe07c67c1ac42f46d8a065d59039a447ca38ca6ae9f3422c081038cd8a"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "8b4264d838e666a293e8c4179ed68b07d4f8518039f7dc8f23e35842ce664163"
+      "sha256": "c339dfc8dc3cf407b2a30a9afed1c29aab87f55f96c7bd8c7316b999bd8c6a96"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "18cef2b359d26f464839c9f692a13caa9745204fddd23e8dafd4b9ad840acbe4"
+      "sha256": "24cf3312198537eb92a5c2f247faa826f596fae91a44705905bd80a5cdc8c7b0"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2162,12 +2162,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "71a0450dc086ef7fa89d0f37a4f7b90251f246447cb0036120b5de3913d9e581"
+      "sha256": "e09fe547287b2baea31a2bf0326dbc9c123c0d85786ac3db42669b7496bfe9fe"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "8876d8fb14e716aeefeeef97c4808d90e758f8ae74c63bea53eab3b5c967386c"
+      "sha256": "a4b3d6be3fdd2b518f046c7db5849435d73cbaaf9b8f2247e08ca2243f52475c"
     },
     {
       "path": "docs/architecture.md",
@@ -2727,7 +2727,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "982c59cdf01c7f07d25fe1593a21659b31366a6b4b0b09b0350a69a23eba2407"
+      "sha256": "6a78c943439f5d8b591f285c69db81d7a468e4e18656d04330685885ed2cbbd8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5637,7 +5637,7 @@
     {
       "path": "modules/ideas/module.json",
       "mode": "0000644",
-      "sha256": "a869f9dec25e003006a495b3fbee45ac99c80b306cec7f16808693d70133e717"
+      "sha256": "96dc50c3ab602ea22329d3fff484113a7381cfe840d06f3ee51132ea09ea18f0"
     },
     {
       "path": "modules/ideas/pollers/descent-writer.js",
@@ -5674,6 +5674,11 @@
       "mode": "0000644",
       "sha256": "92c10dbffef40038dac64ea646372e3fcd1c70c5d2bda1d731ddbdcd508d9181"
     },
+    {
+      "path": "modules/ideas/routes/sky-mine.js",
+      "mode": "0000644",
+      "sha256": "a58dc499fd86af7499de613e61762e8adee88497dadad30f7f651aaafbbf10e3"
+    },
     {
       "path": "modules/ideas/routing.js",
       "mode": "0000644",
@@ -5684,6 +5689,11 @@
       "mode": "0000644",
       "sha256": "eb6a5cecb3ce54aeb0c85ffb752eb12a2400d0d4f5c7d48e4e05ff3cf7baf712"
     },
+    {
+      "path": "modules/ideas/sky-mine.js",
+      "mode": "0000644",
+      "sha256": "00ea7dcd84d31ef6f5f052ed200abcc0f3c58267af0fc7cd8cebc567d4ffeb28"
+    },
     {
       "path": "modules/ideas/templates.js",
       "mode": "0000644",
@@ -6027,7 +6037,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "36a03e5d8a4fc1129439356ba6daaf284d2cd2ca3d98d35f990e3215ff11198a"
+      "sha256": "472161627fdeb33b628eb3d9b4d4d58eba13dc74dacee1f661fc79856496cff8"
     },
     {
       "path": "modules/lifecycle/pg-constraint-fail.js",
@@ -6159,6 +6169,11 @@
       "mode": "0000644",
       "sha256": "2ab5931bd936c88a1e3a4339d927ef537e998f9756fc3260671f2bf701cd7dfa"
     },
+    {
+      "path": "modules/lifecycle/routes/sky.js",
+      "mode": "0000644",
+      "sha256": "1f058f4bd1033666daff1babf1cf64e9ea303ef87f9cd71fba9f3ad2815c4287"
+    },
     {
       "path": "modules/lifecycle/routes/task-route-helpers.js",
       "mode": "0000644",
@@ -6209,6 +6224,11 @@
       "mode": "0000644",
       "sha256": "e2d77bd858cc5aff1984ad6fd22f5441014cc92b9d610cacfca2a3d2861f0bc2"
     },
+    {
+      "path": "modules/lifecycle/sky.js",
+      "mode": "0000644",
+      "sha256": "e325fd288ff7a71c3db31d4d9756666d2a386ad25c3b9dd0a1bab3e5bec67be8"
+    },
     {
       "path": "modules/lifecycle/task-classifier.js",
       "mode": "0000644",
@@ -8222,12 +8242,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "493838f2051f8f9c9d9878add2840c5f4e18914607147bbcb4bdea1fcb5559fe"
+      "sha256": "b26e2dff351ba48f806de1851a00dc5657a52ceb0f6c2ec66bf0b407f074ca49"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "addc61bbe9d71187f833dcebcb6cfb7136557ba6782d00270395200501ef9f49"
+      "sha256": "05dadaedb82b7aac68954714ab5dba673cc5e19adc0bea7109c2951bfe8692c3"
     },
     {
       "path": "public-docs/index.html",
@@ -8877,7 +8897,7 @@
     {
       "path": "scripts/gds/gen-file-map.js",
       "mode": "0000644",
-      "sha256": "ac2308077104c2ff899f4b12ff9da7baa965a9c0d3e4ef2f92e6bdf9d3613fb6"
+      "sha256": "38505bcbacd92114abbbd06cbc41bc841e1269cb11ebaace395f3ad22104ba1a"
     },
     {
       "path": "scripts/gds/gen-freshness.js",
@@ -10272,7 +10292,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "be4a80ffea151ee7dcc548a28cf928376da1bcce570aa521478ea22657475905"
+      "sha256": "d575c9f71dfced09c23cf793d5e0d048d240621a588e65f375d47bf96cd6e006"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11542,7 +11562,7 @@
     {
       "path": "tests/file_map.mjs",
       "mode": "0000644",
-      "sha256": "c6a7da467336246652fae6db5b5d7faa147e71ac1db89a66ec143dcf03bf8013"
+      "sha256": "b4bdd09b0c11bb8d12677b48d1758603d3bc210511b090d7cc6de2f6d2b37cc0"
     },
     {
       "path": "tests/filing_abuse_matrix.mjs",
@@ -14309,6 +14329,16 @@
       "mode": "0000644",
       "sha256": "db9e246f1ce7ef6306b938d325c450e31f2e834244f64dd2f0aaea96e760d987"
     },
+    {
+      "path": "tests/sky_mine.mjs",
+      "mode": "0000644",
+      "sha256": "799fdbebfc405f42e658a5575c5291ac7932be3fc0f16f5006e8a5656c7e8661"
+    },
+    {
+      "path": "tests/sky_read.mjs",
+      "mode": "0000644",
+      "sha256": "44db7c5b3cdf12cb0f4e7dc46e6677280a4c9796664ac117f690d833c8a5ea46"
+    },
     {
       "path": "tests/smoke_preflight.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 414 operations across 61 resource groups
+- 416 operations across 62 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -884,6 +884,12 @@ function createClient(opts = {}) {
       // GET /sessions/upload-health — rank: metic+archon — GET /sessions/upload-health
       getSessionsUploadHealth: (args) => request("GET", "/sessions/upload-health", { hasBody: false }, args),
     },
+    "sky": {
+      // GET /sky — rank: any-builder — GET /sky
+      getSky: (args) => request("GET", "/sky", { hasBody: false }, args),
+      // GET /sky/mine — rank: any-builder — GET /sky/mine
+      getSkyMine: (args) => request("GET", "/sky/mine", { hasBody: false }, args),
+    },
     "specialities": {
       // GET /specialities — rank: any-builder — GET /specialities
       getSpecialities: (args) => request("GET", "/specialities", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -883,6 +883,12 @@ function createClient(opts = {}) {
       // GET /sessions/upload-health — rank: metic+archon — GET /sessions/upload-health
       getSessionsUploadHealth: (args) => request("GET", "/sessions/upload-health", { hasBody: false }, args),
     },
+    "sky": {
+      // GET /sky — rank: any-builder — GET /sky
+      getSky: (args) => request("GET", "/sky", { hasBody: false }, args),
+      // GET /sky/mine — rank: any-builder — GET /sky/mine
+      getSkyMine: (args) => request("GET", "/sky/mine", { hasBody: false }, args),
+    },
     "specialities": {
       // GET /specialities — rank: any-builder — GET /specialities
       getSpecialities: (args) => request("GET", "/specialities", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -1270,6 +1270,12 @@ export interface BongosClient {
     /** GET /sessions/upload-health — rank: metic+archon */
     getSessionsUploadHealth(args?: RequestArgs): Promise<ApiResponse>;
   };
+  "sky": {
+    /** GET /sky — rank: any-builder */
+    getSky(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /sky/mine — rank: any-builder */
+    getSkyMine(args?: RequestArgs): Promise<ApiResponse>;
+  };
   "specialities": {
     /** GET /specialities — rank: any-builder */
     getSpecialities(args?: RequestArgs): Promise<GetSpecialitiesResponse>;

package/clients/bongos-client/index.mjs

@@ -880,6 +880,12 @@ export function createClient(opts = {}) {
       // GET /sessions/upload-health — rank: metic+archon — GET /sessions/upload-health
       getSessionsUploadHealth: (args) => request("GET", "/sessions/upload-health", { hasBody: false }, args),
     },
+    "sky": {
+      // GET /sky — rank: any-builder — GET /sky
+      getSky: (args) => request("GET", "/sky", { hasBody: false }, args),
+      // GET /sky/mine — rank: any-builder — GET /sky/mine
+      getSkyMine: (args) => request("GET", "/sky/mine", { hasBody: false }, args),
+    },
     "specialities": {
       // GET /specialities — rank: any-builder — GET /specialities
       getSpecialities: (args) => request("GET", "/specialities", { hasBody: false }, args),

package/docs/api/openapi.json

@@ -237,6 +237,10 @@
       "name": "sessions",
       "description": "Endpoints under `/api/bongos/sessions`."
     },
+    {
+      "name": "sky",
+      "description": "Endpoints under `/api/bongos/sky`."
+    },
     {
       "name": "specialities",
       "description": "Endpoints under `/api/bongos/specialities`."
@@ -15855,6 +15859,68 @@
         ]
       }
     },
+    "/sky": {
+      "get": {
+        "operationId": "get_sky",
+        "tags": [
+          "sky"
+        ],
+        "summary": "GET /sky",
+        "description": "GET /sky, the whole project sky (task 1004230, ADR 0331). The same gate as GET /goals/graph, for the same reason: the viewer decides which private goals come back with their prose, and that decision is made from the authenticated request inside the read. Deliberately NOT pinned in route-rank-check: a read with no floor above sign-in has no downgrade to catch (the /inbox/sparks precedent).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/lifecycle/routes/sky.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/sky/mine": {
+      "get": {
+        "operationId": "get_sky_mine",
+        "tags": [
+          "sky"
+        ],
+        "summary": "GET /sky/mine",
+        "description": "GET /sky/mine, every thought the SIGNED-IN builder filed with its state, size and descent, capped at 1000 (task 1004230). The builder is the caller: there is no id in the path, so nobody can read a trail as somebody else through this route. The viewer's rank rides into the read so the skill-friction gate holds here as it does on the trail. Deliberately NOT pinned in route-rank-check (the /inbox/sparks precedent: a read with no floor above sign-in has no downgrade to catch).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/sky-mine.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/specialities": {
       "get": {
         "operationId": "get_specialities",
@@ -26348,7 +26414,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 414,
+  "x-endpoint-count": 416,
   "x-schema-count": 453,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 308,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 414 endpoints across 68 route files.
+> **Generated from the live route files** — the route file is authoritative. 416 endpoints across 70 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -623,6 +623,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sessions/search` | `metic+archon` | — | cross-builder corpus search (BFG-principal posture until 6C.1). |
 | GET | `/api/bongos/sessions/upload-health` | `metic+archon` | — | GET /sessions/upload-health — the answer to "has anyone's session upload silently stopped?", which before task 1003865 existed ONLY as a … |
 
+## `sky` (2)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/sky` | `any-builder` | — | GET /sky, the whole project sky (task 1004230, ADR 0331). |
+| GET | `/api/bongos/sky/mine` | `any-builder` | — | GET /sky/mine, every thought the SIGNED-IN builder filed with its state, size and descent, capped at 1000 (task 1004230). |
+
 ## `specialities` (12)
 
 | Method | Path | Rank | Body | Description |

package/docs/module-api-changelog.md

@@ -2494,5 +2494,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1008 with no explicit bump. run 36056558236. (task 1002620)
   1.19.1010 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1009 with no explicit bump. run 36064558803. (task 1002620)
+  1.19.1011 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1010 with no explicit bump. run 36066617514. (task 1002620)
+  1.19.1012 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1011 with no explicit bump. run 36067980398. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/module.json

@@ -11,6 +11,7 @@
     "routes": [
       "inbox",
       "ratify-goal",
+      "sky-mine",
       "blockers"
     ],
     "pollers": [

package/modules/ideas/routes/sky-mine.js

@@ -0,0 +1,34 @@
+'use strict';
+
+// modules/ideas/routes/sky-mine.js — GET /sky/mine, the caller's whole trail in
+// one read (task 1004230, sky part 2 of 5; ADR 0331).
+//
+// ITS OWN FILE, not more of inbox.js, for the reason ratify-goal.js gives: inbox
+// is INTAKE, and this is a read of what a person's intake became. The read and
+// its cap live in ../sky-mine.js so a test drives them with no express.
+//
+// The path is `/sky/mine` beside the lifecycle module's `/sky`: two modules, one
+// surface to the page. Express matches whole paths, so neither swallows the
+// other whichever mounts first — and no `:id` route exists under `/sky` to bind
+// the literal `mine` (the `/inbox/:id` trap this module's CLAUDE.md records).
+//
+// MODULE BOUNDARY: reaches core only through `../../../src/module-api`.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const skyMine = require('../sky-mine');
+
+module.exports = function buildSkyMineRouter() {
+  const router = express.Router();
+
+  // rank: any-builder — GET /sky/mine, every thought the SIGNED-IN builder filed
+  // with its state, size and descent, capped at 1000 (task 1004230). The builder
+  // is the caller: there is no id in the path, so nobody can read a trail as
+  // somebody else through this route. The viewer's rank rides into the read so
+  // the skill-friction gate holds here as it does on the trail. Deliberately NOT
+  // pinned in route-rank-check (the /inbox/sparks precedent: a read with no floor
+  // above sign-in has no downgrade to catch).
+  router.get('/sky/mine', api.requireBuilder, api.asyncHandler('GET /sky/mine', skyMine.skyMineHandler(), { errorCode: 'sky_mine_failed' }));
+
+  return router;
+};

package/modules/ideas/sky-mine.js

@@ -0,0 +1,75 @@
+'use strict';
+
+// modules/ideas/sky-mine.js — THE CALLER'S WHOLE TRAIL IN ONE READ (task
+// 1004230, sky part 2 of 5; goal 1000095; ADR 0331).
+//
+// WHY. The ideator's sky draws every thought a person filed at once — its state,
+// its size, its descent — and the trail route (`GET /inbox/by-builder/:id`) pages
+// that at a hundred rows. The prototype walked the pages itself; the page should
+// not. This read walks them server-side and hands back every row, the same rows
+// the room shows, so the sky and the room can never disagree about a thought.
+//
+// THE SAME ROWS, LITERALLY. Each page is `listIdeaTrailForBuilder` — the trail's
+// own projection — and the three attachers run over the whole set afterwards in
+// the trail route's order: the descent (the walk), then size (what the walk
+// paid), then state (which of the five objects — last, because it takes its
+// share off the size just left on the row). Nothing is derived here that the
+// room does not derive; ADR 0322 says the five states are derived ONCE, and this
+// file keeps that true by calling the one derivation rather than adding a second.
+//
+// THE CAP. A thousand rows. The trail's own page cap is a hundred, so this is at
+// most ten reads; a filer past a thousand thoughts gets the newest thousand and a
+// `truncated: true` the page can say out loud, never a silent slice. Ten reads
+// for the sky is still one request from the page, which is the point.
+//
+// WHOSE. The builder is the signed-in caller, from the request, never a URL
+// parameter — the room reads `/me` for the same reason: a trail is a person's,
+// and the route that lets you name a person is the other one.
+
+const inbox = require('./inbox');
+const { attachDescentToTrail } = require('./trail-descent');
+const { attachSizeToTrail } = require('./trail-size');
+const { attachStateToTrail } = require('./idea-state');
+
+const SKY_MINE_CAP = 1000;
+
+// readSkyMine — page the trail to the cap, then attach the three facts once
+// over the whole set. `deps` lets a test stand in for each read and each
+// attacher; production passes none and gets the trail's own.
+async function readSkyMine({ builderId, viewerRank = null } = {}, deps = {}) {
+  const list = deps.listIdeaTrailForBuilder || inbox.listIdeaTrailForBuilder;
+  const count = deps.countIdeaTrailForBuilder || inbox.countIdeaTrailForBuilder;
+  const descent = deps.attachDescentToTrail || attachDescentToTrail;
+  const size = deps.attachSizeToTrail || attachSizeToTrail;
+  const state = deps.attachStateToTrail || attachStateToTrail;
+  const cap = Number.isInteger(deps.cap) && deps.cap > 0 ? deps.cap : SKY_MINE_CAP;
+  const pageSize = inbox.IDEA_TRAIL_MAX_LIMIT;
+
+  const ideas = [];
+  const total = await count(builderId, { viewerRank });
+  for (let offset = 0; offset < Math.min(total, cap); offset += pageSize) {
+    const limit = Math.min(pageSize, cap - offset);
+    const page = await list(builderId, { limit, offset, viewerRank });
+    ideas.push(...page);
+    if (page.length < limit) break;
+  }
+
+  await descent(ideas);
+  await size(ideas);
+  await state(ideas);
+
+  return { builder_id: builderId, ideas, total, cap, truncated: total > ideas.length };
+}
+
+// skyMineHandler — GET /sky/mine. A factory so a test drives it with a stub
+// read and no database. Identity is the authenticated builder's, always.
+function skyMineHandler({ read = readSkyMine } = {}) {
+  return async function getSkyMine(req, res) {
+    const builderId = Number(req.builder.id);
+    const viewerRank = req.builder && req.builder.rank;
+    const out = await read({ builderId, viewerRank });
+    return res.json(out);
+  };
+}
+
+module.exports = { readSkyMine, skyMineHandler, SKY_MINE_CAP };

package/modules/lifecycle/module.json

@@ -27,7 +27,8 @@
       "rot",
       "project-settings",
       "artist-gate",
-      "removal-proposals"
+      "removal-proposals",
+      "sky"
     ],
     "pollers": [
       "publish-reconciler"

package/modules/lifecycle/routes/sky.js

@@ -0,0 +1,37 @@
+'use strict';
+
+// modules/lifecycle/routes/sky.js — GET /sky, the project sky in one read (task
+// 1004230, sky part 2 of 5; ADR 0331, ADR 0227 §11).
+//
+// WHY ITS OWN ROUTE FILE. goals.js is the goal board's surface and already
+// mounts the graph and the forest; the sky is a third view over the same rows,
+// and the one line here is the mount. The data, the cache and the handler live
+// in ../sky.js so a test drives them with no express and no database.
+//
+// The path is `/sky`, top-level, never `/goals/sky`: the ideas module contributes
+// `/sky/mine` (the caller's own trail), and the two are one surface to the page
+// even though they are two modules' reads. Express matches whole paths, so
+// `/sky` cannot swallow `/sky/mine` whichever module mounts first.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway
+// `../../../src/module-api`; `../sky` is this module's own read.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const sky = require('../sky');
+
+const log = api.logger('lifecycle');
+
+module.exports = function buildSkyRouter() {
+  const router = express.Router();
+
+  // rank: any-builder — GET /sky, the whole project sky (task 1004230, ADR 0331).
+  // The same gate as GET /goals/graph, for the same reason: the viewer decides
+  // which private goals come back with their prose, and that decision is made
+  // from the authenticated request inside the read. Deliberately NOT pinned in
+  // route-rank-check: a read with no floor above sign-in has no downgrade to
+  // catch (the /inbox/sparks precedent).
+  router.get('/sky', api.requireBuilder, sky.skyHandler({ log }));
+
+  return router;
+};