@bongos/core 1.19.1014 → 1.19.1016

package/modules/ideas/routes/inbox.js

@@ -35,6 +35,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const inbox = require('../inbox');
+const bornOf = require('../born-of');
 // The trail read to the FULL depth of the descent (task 1004089, BV2.R09). Its
 // own file because inbox.js is AT the size ratchet and because a task->task
 // walk is a different relation from the idea->task trail.
@@ -95,6 +96,12 @@ function registerSeams() {
   if (!api.hasProvider('ideas.capture')) {
     api.registerProvider('ideas.capture', inbox.captureIdea);
   }
+  // task 1004233 (sky part 5): which thoughts became goals or rings, for the
+  // lifecycle module's GET /sky to fold in as `born` — through the port, so
+  // lifecycle never reads an ideas_ table itself (./born-of.js).
+  if (!api.hasProvider('ideas.bornOf')) {
+    api.registerProvider('ideas.bornOf', bornOf.readBornOf);
+  }
   if (!api.hasProvider('ideas.descent')) {
     api.registerProvider('ideas.descent', {
       ancestorsOfTask: descent.ancestorsOfTask,
@@ -176,8 +183,19 @@ module.exports = function buildInboxRouter() {
       // turned out: 'goal' or 'criterion'. OPTIONAL, permanently (see the
       // refusal below and ideas_009's header).
       recommendation: { type: 'string', maxLength: 16 },
+      // task 1004233 (sky part 5): WHICH DOOR. Read off the session — never a
+      // claim — except 'planning' (capture.js --via planning); see below.
+      filed_via: { type: 'string', maxLength: 16 },
     })) return;
     const body = req.body || {};
+    // task 1004233 (sky part 5): the door is a FACT read off the session that
+    // made the request (projection.js resolveFiledVia: a web cookie is the hall,
+    // a device-flow token is the CLI, anything else the API). The body may add
+    // only 'planning' — the one door no session can tell from a CLI capture —
+    // and any other claim is refused, so a filer cannot say they came through a
+    // door they did not.
+    const door = inbox.resolveFiledVia(req.gdsSession && req.gdsSession.source, body.filed_via);
+    if (!door.ok) return res.fail('bad_filed_via', 400, door.detail);
     if (body.kind === 'criterion-proposal') {
       // FAIL CLOSED (task 1003197 (D)). This was inline and read
       // `if (rank && rank !== 'metic' && …)`, so an ABSENT rank ADMITTED. The
@@ -253,6 +271,7 @@ module.exports = function buildInboxRouter() {
         goalId: body.goal_id ?? null,
         filerRank: req.builder?.rank ?? null,
         grade,
+        filedVia: door.value,
         // task 1003691 (ADR 0262): the vector, hardcoded — NEVER read from the
         // body. This route is the authenticated API door, so a bug filed here
         // with no goal routes to the version's maintenance goal instead of
@@ -367,6 +386,7 @@ module.exports = function buildInboxRouter() {
           err.code === 'TITLE_REQUIRED' ? 400 :
           err.code === 'BAD_KIND' ? 400 :
           err.code === 'BAD_PRIORITY' ? 400 :
+          err.code === 'BAD_FILED_VIA' ? 400 :
           // task 1003065 (BV1.R01) — the routing refusals. A named goal that is
           // not a live home is the FILER'S mistake to fix (pick another goal, or
           // omit it and file to the inbox), so these are 4xx with the offending

package/modules/lifecycle/sky.js

@@ -137,12 +137,17 @@ function foldCriteria(rows = []) {
 //             satisfied, pending_review, task_ids }], tasks: [{ id, title, status,
 //             credits_reward, created_on, idea_id }] }]
 //   edges: [{ from, to, count }]           — `from` waits on `to`, the graph's own
+//   born:  { goals: { goal_id: idea_id }, criteria: { criterion_id: idea_id } }
+//                                          — which thoughts became the structure (task
+//                                            1004233): the ideas module's own read through the
+//                                            `ideas.bornOf` port, ids as strings; an absent
+//                                            port is an EMPTY map, never a guess
 //   counts: { goals, edges, criteria, tasks }
 //
 // A criterion or a task whose goal is not among the wells is DROPPED — the wells
 // are the graph's nodes (goals carrying at least one task, in the version asked
 // for), and a ring drawn around no well is a line pointing at nothing.
-function shapeSky({ goals = [], edges = [], extras = [], criteria = [], tasks = [] } = {}, categoryById = new Map()) {
+function shapeSky({ goals = [], edges = [], extras = [], criteria = [], tasks = [], born = null } = {}, categoryById = new Map()) {
   const graph = goalGraph.shapeGraph({ goals, edges }, categoryById);
   const visibleById = new Map(goals.map((g) => [String(g.goal_id), g.visible !== false]));
   const extraById = new Map(extras.map((x) => [String(x.goal_id), x]));
@@ -189,18 +194,34 @@ function shapeSky({ goals = [], edges = [], extras = [], criteria = [], tasks =
   return {
     goals: out,
     edges: graph.edges,
+    born: normalizeBorn(born),
     counts: { goals: out.length, edges: graph.edges.length, criteria: criteriaCount, tasks: taskCount },
   };
 }
 
+// normalizeBorn — the port's answer as string-keyed, string-valued maps; a null,
+// a throw or a half-shaped answer is the empty map (the page draws no mark).
+function normalizeBorn(born) {
+  const strMap = (o) => {
+    const out = {};
+    if (o && typeof o === 'object') for (const [k, v] of Object.entries(o)) if (v != null) out[String(k)] = String(v);
+    return out;
+  };
+  return { goals: strMap(born && born.goals), criteria: strMap(born && born.criteria) };
+}
+
 // sky — read + shape. `categoryIndex` is injectable so the whole path runs in a
 // test with a fake pool and no category table (the goal-graph.js precedent).
 async function sky(opts = {}, deps = {}) {
-  const [rows, byId] = await Promise.all([
+  // task 1004233: born of a thought is the IDEAS module's read, reached through
+  // its port — one of the two reads is enough to fail quietly into an empty map.
+  const readBorn = 'readBornOf' in deps ? deps.readBornOf : (api.resolveOptional ? api.resolveOptional('ideas.bornOf') : null);
+  const [rows, byId, born] = await Promise.all([
     skyRows(opts, deps),
     (deps.categoryIndex || goalCategory.categoryIndex)(deps),
+    typeof readBorn === 'function' ? readBorn().catch(() => null) : null,
   ]);
-  return shapeSky(rows, byId);
+  return shapeSky({ ...rows, born }, byId);
 }
 
 // skyCache — the 60-second memo, keyed by what decides what the viewer may see.
@@ -258,4 +279,4 @@ function skyHandler({ read = sky, log = console, cache = skyCache() } = {}) {
   };
 }
 
-module.exports = { sky, skyRows, shapeSky, foldCriteria, skyCache, skyHandler, SKY_CACHE_TTL_MS };
+module.exports = { sky, skyRows, shapeSky, foldCriteria, normalizeBorn, skyCache, skyHandler, SKY_CACHE_TTL_MS };

package/modules/platform-identity/activity-snapshots.js

@@ -0,0 +1,47 @@
+// modules/platform-identity/activity-snapshots.js — the windowed data plane's
+// append-only history (community spec D2, task 1002977): one row per rollup
+// report WHOSE TOTALS CHANGED, so a leaderboard window (7d/30d/...) can compute
+// "latest minus the last snapshot at-or-before the window start" without a core
+// change (option B) or an unbounded event feed (option C) — both rejected for V1.
+//
+// Reporting-time semantics, not earning-time: a builder who signs in fortnightly
+// lands two weeks of credits in the sign-in week. Honest, accepted V1 limitation
+// (see the spec); self-correcting on the builder's next report.
+//
+// Compaction (daily granularity after 90 days) is a later, volume-triggered task
+// — nothing here prunes. A disconnected/re-registered project's snapshots are
+// likewise not purged here — platform_identity_builder_project_activity (the
+// table this mirrors) has the identical gap today; the future leaderboard reader
+// is where consent (rollupVisibleSql) is enforced, per that table's own precedent.
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+
+// Append one snapshot row iff the totals differ from the last one on record for
+// this (client, builder) pair — ONE statement, not a read then a write: the CTE
+// and the conditional INSERT run in the same round trip, closing the two-round-
+// trip check-then-insert race the earlier design had. A DB-level race remains
+// under READ COMMITTED — two truly concurrent statements for the same pair can
+// each see no conflicting row and both insert — but the worst case is a harmless
+// duplicate snapshot with IDENTICAL totals, which reads the same either way in
+// the windowed-delta arithmetic. A first-ever report (no prior row) always
+// inserts — NOT EXISTS is true against an empty CTE regardless of the
+// comparison. `id DESC` breaks a tie on an identical `reported_at` so "the last
+// snapshot" is always one specific row.
+async function recordActivitySnapshot({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0 }, { pool = defaultPool } = {}) {
+  const { rows } = await pool.query(
+    `WITH last AS (
+       SELECT credits, tasks_shipped, karma FROM platform_identity_activity_snapshots
+        WHERE client_id = $1 AND github_id = $2
+        ORDER BY reported_at DESC, id DESC LIMIT 1
+     )
+     INSERT INTO platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at)
+     SELECT $1, $2, $3, $4, $5, now()
+      WHERE NOT EXISTS (SELECT 1 FROM last WHERE credits = $3 AND tasks_shipped = $4 AND karma = $5)
+     RETURNING id, reported_at`,
+    [clientId, githubId, credits, tasksShipped, karma],
+  );
+  return rows[0] || null;
+}
+
+module.exports = { recordActivitySnapshot };

package/modules/platform-identity/migrations/platform_identity_022_activity_snapshots.sql

@@ -0,0 +1,46 @@
+-- platform_identity_022_activity_snapshots.sql — the windowed data plane's ONE
+-- new table (community spec D2, task 1002977): an append-only history of each
+-- (project, builder)'s reported totals, one row per rollup report WHOSE TOTALS
+-- CHANGED (a no-op re-report inserts nothing — upsertActivity skips it via
+-- activity-snapshots.js:recordActivitySnapshot).
+--
+-- A window's value = latest totals (platform_identity_builder_project_activity)
+-- minus the last snapshot at-or-before the window start, summed across projects;
+-- missing baseline counts as zero (D2 option A, chosen over B/C — see the spec).
+-- Reporting-time semantics, not earning-time: the honest, accepted V1 limitation.
+--
+-- Retention: nothing pruned here. A compaction pass (daily granularity after 90
+-- days) is a later, volume-triggered task, not built now.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS platform_identity_activity_snapshots (
+  id             bigserial PRIMARY KEY,
+
+  -- The project (the sso_client that reported) + the builder (stable github id) —
+  -- the same pair platform_identity_builder_project_activity is keyed on.
+  client_id      text NOT NULL,
+  github_id      bigint NOT NULL,
+
+  -- The reported totals AT this point in time (a snapshot, not a delta).
+  credits        integer NOT NULL DEFAULT 0,
+  tasks_shipped  integer NOT NULL DEFAULT 0,
+  karma          integer NOT NULL DEFAULT 0,
+
+  reported_at    timestamptz NOT NULL DEFAULT now()
+);
+
+-- The windowed read's whole access path: "the last snapshot at-or-before a given
+-- timestamp, for this (project, builder)". DESC so the common query (the most
+-- recent snapshot <= window start) hits the front of the index; `id DESC`
+-- matches activity-snapshots.js's own tiebreak, so its top-1 probe is a pure
+-- index-order LIMIT 1 rather than relying on an incremental sort.
+CREATE INDEX IF NOT EXISTS platform_identity_activity_snapshots_builder_time
+  ON platform_identity_activity_snapshots (client_id, github_id, reported_at DESC, id DESC);
+
+COMMENT ON TABLE platform_identity_activity_snapshots IS
+  'Append-only history of reported totals per (client_id, github_id), one row per rollup report whose totals changed (community spec D2, task 1002977). A leaderboard window computes latest minus the last snapshot at-or-before the window start; missing baseline counts as zero. Reporting-time semantics, not earning-time. Nothing pruned in V1 — a later, volume-triggered compaction task handles retention.';
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -24,6 +24,9 @@ const terms = require('./terms-acceptance');
 // reads the SAME rule as a ship link instead of the "different host" check it had —
 // see origin-containment.js for why it is downward only and why it lives there.
 const { urlWithinOrigin } = require('./origin-containment');
+// The windowed data plane's append-only snapshot history (task 1002977, community
+// spec D2) — one call from upsertActivity below; the mechanism itself lives there.
+const { recordActivitySnapshot } = require('./activity-snapshots');
 
 const { pool: defaultPool } = api;
 const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible, scoutingListableSql } = visibility;
@@ -677,6 +680,16 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
     // Postgres ARRAY literal, which the jsonb column would reject.
     [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships)],
   );
+  // Windowed data plane (task 1002977): one snapshot per report whose totals
+  // changed, skipped on a no-op re-report — see activity-snapshots.js.
+  // Best-effort, the application-echo.js precedent: descriptive analytics, never
+  // authority, so a fault here (e.g. migration 022 not yet applied on this
+  // instance) must never fail the rollup report that already committed above.
+  try {
+    await recordActivitySnapshot({ clientId, githubId, credits: credits | 0, tasksShipped: tasksShipped | 0, karma: karma | 0 }, { pool });
+  } catch (err) {
+    api.logger('platform-identity').error(`activity snapshot write failed (non-fatal): ${err && err.message}`);
+  }
   return rows[0];
 }
 

package/modules/platform-identity/tests/activity-snapshots.mjs

@@ -0,0 +1,68 @@
+// modules/platform-identity/tests/activity-snapshots.mjs
+//
+// DB-free unit suite for the windowed data plane's append-only snapshot history
+// (community spec D2, task 1002977). Recording-fake-pool style, matching
+// tests/platform-identity.mjs: proves the SQL SHAPE (one statement, correct
+// table/columns, bound params, the tiebreak) — a fake pool cannot execute the
+// `WHERE NOT EXISTS` itself, so the skip-on-unchanged BEHAVIOUR is proved
+// against real Postgres in tests/activity_snapshots_db.mjs instead.
+//
+// Run standalone: node modules/platform-identity/tests/activity-snapshots.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { recordActivitySnapshot } = require('../activity-snapshots.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// A recording fake pool: returns queued responses in order and records every call.
+function mockPool(responses = []) {
+  const calls = [];
+  let i = 0;
+  return {
+    calls,
+    query: async (text, params) => {
+      calls.push({ text: String(text), params: params || [] });
+      const r = responses[i++];
+      return r || { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+console.log('recordActivitySnapshot (community spec D2, task 1002977):');
+
+await ta('one statement: a CTE for the last snapshot, guarding a conditional INSERT', async () => {
+  const pool = mockPool([{ rows: [{ id: '1', reported_at: 'T1' }] }]);
+  const out = await recordActivitySnapshot({ clientId: 'c1', githubId: 42, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  assert.equal(pool.calls.length, 1, 'one round trip, not a read then a write');
+  const c = pool.calls[0];
+  assert.match(c.text, /WITH last AS/);
+  assert.match(c.text, /FROM platform_identity_activity_snapshots/);
+  assert.match(c.text, /ORDER BY reported_at DESC, id DESC LIMIT 1/, 'a deterministic tiebreak on an identical reported_at');
+  assert.match(c.text, /INSERT INTO platform_identity_activity_snapshots/);
+  assert.match(c.text, /WHERE NOT EXISTS \(SELECT 1 FROM last WHERE credits = \$3 AND tasks_shipped = \$4 AND karma = \$5\)/);
+  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3]);
+  assert.deepEqual(out, { id: '1', reported_at: 'T1' });
+});
+
+await ta('a skipped report (the fake pool answers no rows, as a real WHERE NOT EXISTS would on a match) returns null', async () => {
+  const pool = mockPool([{ rows: [] }]);
+  const out = await recordActivitySnapshot({ clientId: 'c1', githubId: 42, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  assert.equal(pool.calls.length, 1);
+  assert.equal(out, null);
+});
+
+await ta('missing totals default to zero, like upsertActivity\'s own defaults', async () => {
+  const pool = mockPool([{ rows: [{ id: '3', reported_at: 'T3' }] }]);
+  await recordActivitySnapshot({ clientId: 'c1', githubId: 42 }, { pool });
+  assert.deepEqual(pool.calls[0].params, ['c1', 42, 0, 0, 0]);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/modules/platform-identity/tests/platform-identity.mjs

@@ -596,6 +596,27 @@ await ta('upsertActivity keeps a legitimate core rank key', async () => {
   assert.equal(pool.calls[0].params[5], 'archon');
 });
 
+await ta('upsertActivity also appends to the snapshot history (task 1002977, community spec D2) — deleting that call would leave this red', async () => {
+  const pool = mockPool([{ rows: [{ id: '1' }] }, { rows: [{ id: 's1', reported_at: 'T' }] }]);
+  await P.upsertActivity({ clientId: 'c1', githubId: 42, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  assert.equal(pool.calls.length, 2, 'the rollup upsert, then the snapshot statement');
+  assert.match(pool.calls[1].text, /INSERT INTO platform_identity_activity_snapshots/);
+  assert.deepEqual(pool.calls[1].params, ['c1', 42, 100, 5, 3]);
+});
+
+await ta('upsertActivity survives a snapshot-write failure (best-effort — the application-echo.js precedent): the rollup report still succeeds', async () => {
+  const pool = {
+    calls: [],
+    query: async (text, params) => {
+      pool.calls.push({ text: String(text), params });
+      if (/INSERT INTO platform_identity_activity_snapshots/.test(text)) throw new Error('relation "platform_identity_activity_snapshots" does not exist');
+      return { rows: [{ id: '1' }] };
+    },
+  };
+  const out = await P.upsertActivity({ clientId: 'c1', githubId: 42, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  assert.equal(out.id, '1', 'the rollup upsert result still returns despite the snapshot write throwing');
+});
+
 await ta('getMembership reads one (client, builder) row — the rollup membership requirement', async () => {
   const row = { id: '9', client_id: 'c1', github_id: '42', membership_kind: 'member', signin_verified_at: 'T' };
   const pool = mockPool([{ rows: [row] }]);

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -42,7 +42,7 @@ What changed in translation, on purpose. The method's **three persisted homes**
 Read four live signals, then print two or three recommended next commands with a one-line reason each, followed by the full list grouped by category. Signals, all read locally and none written:
 
 1. **The world files**: does `DESIGN.md` exist at the repo root; is `config/branding.json` present over the neutral pack; is `docs/project-context.template.md` filled or still the scaffold. A scaffold with no answers recommends `shape` first; a missing `DESIGN.md` alone does not make the project greenfield (the neutral pack is the world).
-2. **The last kit report** for the target, if any: `report.json` under `%TMP%/ui-design-kit/<surface>/<page>/` (or the `--out` dir the last run named). Problems listed recommend `audit` on that page; a clean report with no critique yet recommends `critique`; no report at all recommends `audit`, because the render is the read.
+2. **The last kit report** for the target, if any: `report.json` under the `--out` dir the last `render.js` run named — pass one explicitly on a shared machine, since the un-named default falls back to a world-readable OS temp dir (`os.tmpdir()`'s `ui-design-kit/<surface>/<page>/`: `%TMP%` on Windows, `$TMPDIR` on mac/linux). This is only ever read to shape the printed suggestion below, never trusted as authority. Problems listed recommend `audit` on that page; a clean report with no critique yet recommends `critique`; no report at all recommends `audit`, because the render is the read.
 3. **Dirty files in version control**: `git status --porcelain` over the surfaces (`modules/*/public/`, `src/ui/`, `public*/`). Dirty UI files recommend `polish` on that path before anything new.
 4. **A stub already listening**: `kit/serve.js` prints its port when it starts; a page already served means the live loop (the playwright plugin) is available without a second server. Never start a duplicate on an occupied port.
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1014",
+  "version": "1.19.1016",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1014",
+      "version": "1.19.1016",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1014",
+  "version": "1.19.1016",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/capture.js

@@ -269,6 +269,7 @@ async function main() {
     console.error('       ... [--spark]                       offer it up for someone else to develop');
     console.error('       ... [--full --fields-file f.json]   file a Full Idea (five fields; see spark.js --template)');
     console.error('       ... [--no-prompt]                   never ask anything (default when not a terminal)');
+    console.error('       ... [--via planning]                a planning session\'s capture — the sky records the door (task 1004233)');
     process.exit(2);
   }
 
@@ -281,6 +282,15 @@ async function main() {
   const fieldsFile = arg('--fields-file', args);
   const noPrompt = hasFlag('--no-prompt', args);
   const goalArg = arg('--goal', args);
+  // task 1004233 (sky part 5): WHICH DOOR. The server reads 'cli' off this
+  // session's token, so this CLI names nothing — except a planning session's
+  // capture, which no session can tell from any other CLI filing. Only that one
+  // value is accepted here; the server refuses every other claim the same way.
+  const viaFromArg = arg('--via', args);
+  if (viaFromArg !== null && viaFromArg !== 'planning') {
+    console.error(`--via "${viaFromArg}" is not a door this CLI may name. Where a filing came from is read off your session; the one value you may add is --via planning.`);
+    process.exit(2);
+  }
 
   // A BAD --kind used to reach the server and come back a 400 (task 1003694).
   // That is not merely late, it is invisible where it matters: a SCHEDULED routine
@@ -376,6 +386,7 @@ async function main() {
     suggested_priority: priority,
   };
   if (kindFromArg) payload.kind = kindFromArg;
+  if (viaFromArg) payload.filed_via = viaFromArg;
   if (goalResolution.goalId != null) payload.goal_id = goalResolution.goalId;
   if (wantFull) {
     // The server validates these against the R141 declaration and scores them

package/scripts/gds/run-unit-tests.js

@@ -83,6 +83,10 @@ const INTEGRATION = new Set([
   // rows is NULL rather than a free ship. Only a transaction engine settles
   // those, so this runs here and the DB-free sibling covers the renderer.
   'acclaim_feed_evidence_db',
+  // task 1002977: proves the changed-totals skip rule (a single INSERT ...
+  // WHERE NOT EXISTS statement) and the upsertActivity wiring against real SQL —
+  // a fake pool can prove the query shape but not which reports it inserts.
+  'activity_snapshots_db',
   'asset_version', 'auth_flow_slice1', 'backfill_sessions', 'bfg', 'bfg_write',
   'box_connect_e2e', 'box_onboard', 'boxes', 'cf_tunnel', 'cli_token_reissue',
   // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live

package/src/bongos/serve-internal.js

@@ -1171,6 +1171,10 @@ function mountInternalSurfaces(app) {
   // task 1003479 (goal 1000089): `goal-map` — the map of which goals wait on which,
   // reached from Goals. It reads GET /goals/graph, which is `requireBuilder`, so a
   // page gated any lower would show a signed-out visitor an empty shell.
+  // task 1004232 (sky part 4): `goal-map` is now THE PROJECT SKY — the same page
+  // as `thinking`, opened in its "the whole project" lens — and holds the nav
+  // slot under Goals the map was denied (ADR 0227 §11). Same tier: it reads GET
+  // /sky and GET /sky/mine, the sky's own reads, behind the same sign-in.
   // task 1004231 (sky part 3): `thinking` is now THE SKY itself — the prototype
   // the owner adopted (docs/design/mocks/sky/, ADR 0331) built over GET /sky +
   // GET /sky/mine, with the room inside it as the list drawer. The old ambient

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1014'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1016'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/activity_snapshots_db.mjs

@@ -0,0 +1,97 @@
+// tests/activity_snapshots_db.mjs — task 1002977 (community spec D2; real DB).
+//
+// Proves the windowed data plane's append-only history against real SQL. The
+// skip-on-unchanged rule lives entirely inside one INSERT ... WHERE NOT EXISTS
+// statement (activity-snapshots.js), so a fake pool can only prove the query
+// SHAPE (modules/platform-identity/tests/activity-snapshots.mjs); only a real
+// Postgres can prove WHICH reports it actually inserts, and that upsertActivity
+// (the existing POST /sso/activity/rollup path) really calls it end to end.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/activity_snapshots_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+const { recordActivitySnapshot } = require('../modules/platform-identity/activity-snapshots.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`activity_snapshots_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const BUILDER = 90002977, OTHER_BUILDER = 90002978;
+const IDS = [BUILDER, OTHER_BUILDER];
+const CLIENT = 't1002977-client';
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(`DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+  await q(`DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])`, [IDS]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  await q(migrationSql('platform_identity_005_builder_activity.sql'));
+  // upsertActivity's INSERT always names recent_ships (012_recent_ships adds the
+  // column); without it here, step 2 below fails 42703 on a fresh database.
+  await q(migrationSql('platform_identity_012_recent_ships.sql'));
+  await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  await cleanup();
+
+  // 1 — recordActivitySnapshot directly: the changed-totals skip rule.
+  const first = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  ok(first !== null, 'a first-ever report inserts — nothing to be unchanged from');
+
+  const unchanged = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 100, tasksShipped: 5, karma: 3 }, { pool });
+  ok(unchanged === null, 'an identical re-report inserts nothing');
+
+  const changed = await recordActivitySnapshot({ clientId: CLIENT, githubId: BUILDER, credits: 150, tasksShipped: 5, karma: 3 }, { pool });
+  ok(changed !== null, 'a changed report (credits differ) inserts a new row');
+
+  const { rows: history } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at, id`,
+    [CLIENT, BUILDER],
+  );
+  ok(history.length === 2, 'exactly two rows exist — the unchanged report left no trace');
+  assert.deepEqual(history.map((r) => r.credits), [100, 150]);
+  pass++; console.log('  ok - the history is in report order');
+
+  // 2 — upsertActivity (the real POST /sso/activity/rollup path) really calls it.
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 10, tasksShipped: 1, karma: 0 }, { pool });
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 10, tasksShipped: 1, karma: 0 }, { pool });
+  await pi.upsertActivity({ clientId: CLIENT, githubId: OTHER_BUILDER, credits: 20, tasksShipped: 1, karma: 0 }, { pool });
+  const { rows: viaRollup } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at, id`,
+    [CLIENT, OTHER_BUILDER],
+  );
+  ok(viaRollup.length === 2, 'upsertActivity appends a snapshot per changed report — two calls, one repeat, one row skipped');
+  assert.deepEqual(viaRollup.map((r) => r.credits), [10, 20]);
+  pass++; console.log('  ok - deleting the call inside upsertActivity would leave this red');
+
+  console.log(`\nactivity_snapshots_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/discord_bugs.mjs

@@ -115,6 +115,7 @@ await t('recordInboundBug: linked Metic → filed at ready, kind=bug, attributed
   assert.equal(calls.create[0].kind, 'bug', 'the channel IS the classification');
   assert.equal(calls.create[0].filerRank, 'metic', 'the LIVE rank is handed to the matrix');
   assert.equal(calls.create[0].capturedBy, 9, 'and the reporter is attached to the capture');
+  assert.equal(calls.create[0].filedVia, 'discord', 'the door is a fact on the row (task 1004233)');
   assert.equal(calls.create[0].goalId, 7, 'the suggester found it a home');
   // task 1003067: no versionId is passed AT ALL. It used to be the hardcoded
   // 'GDS-V3' — a shipped version, which is idea 1000771. The goal carries it now.

package/tests/discord_inbound.mjs

@@ -83,6 +83,7 @@ await t('recordInboundIdea: linked author → idea attributed to builder + audit
   assert.equal(r.outcome, 'filed');
   assert.equal(r.ideaId, 77);
   assert.equal(calls.capture[0].capturedBy, 9);
+  assert.equal(calls.capture[0].filedVia, 'discord', 'the door is a fact on the row (task 1004233): this path calls the port, so it names it');
   assert.match(calls.capture[0].bodyMd, /filed from Discord #ideas by mona/);
   assert.equal(calls.audit[0].surface, 'discord_bot');
   assert.equal(calls.audit[0].builderId, 9);