@bongos/core 1.19.161 → 1.19.162

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.161",
-  "core_contract": "1.19.161",
-  "source_commit": "206359b5cf85472d7b4def6050a2766f001569ea",
+  "core_version": "1.19.162",
+  "core_contract": "1.19.162",
+  "source_commit": "1db6240e60bde4c45db842d783f1a109da3684e5",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T16:41:02.340Z",
+  "built_at": "2026-08-16T16:44:59.964Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1259,
+    "functional_verbatim": 1260,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1585,
-  "tree_sha256": "67b93c7d90a238fa234b0e809aee4545bf5190f1cd5f86513a294c4adb4244db",
+  "file_count": 1586,
+  "tree_sha256": "b21ff15e6dc8e250c96a99b03f62b79b69a99a870c2aca7d2db4bbc8a1e1f0f9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4197,12 +4197,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8bd2f7c052801d8b86e46c98ea962ecb4b23164a82ae96282e9789fb64da10c9"
+      "sha256": "0fa4ce8b1bb49791c487d1b90ac7f0ddea7577cf4c14db1b6366ccdccaed06ad"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "113553d6b43e63c5c34c77934179cb762626a81c13d63865e02de74c8c361633"
+      "sha256": "33e29cccdddaea282c452b7296e2be6ec3fd06d61b6a8d35c60a98aa86d61bf2"
     },
     {
       "path": "public-docs/index.html",
@@ -5797,7 +5797,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9c0be130573a1045b0a96d8db4b8ede624b304cdb5095c209fbec1c9c0d1248c"
+      "sha256": "6e7fcf60af8a8abcc9e1a193c5ecf49fed08c9b410c9e3a1dd031f406bf1dea3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6909,6 +6909,11 @@
       "mode": "0000644",
       "sha256": "07cacc97990f0e775342f8b30171c87128e0acb1abd38d64c683c3f257927ebd"
     },
+    {
+      "path": "tests/idea_quick_guard.mjs",
+      "mode": "0000644",
+      "sha256": "9be4414bbbbb92513a7737d4494265b24c5f5db71a67e840016cc275442df1fb"
+    },
     {
       "path": "tests/idea_templates.mjs",
       "mode": "0000644",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.161",
+  "version": "1.19.162",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.161",
+      "version": "1.19.162",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.161",
+  "version": "1.19.162",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -749,8 +749,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.159 with no explicit bump. run 31959145128. (task 1002620)
 //   1.19.161 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.160 with no explicit bump. run 31959299652. (task 1002620)
+//   1.19.162 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.161 with no explicit bump. run 31959496815. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.161'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.162'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_quick_guard.mjs

@@ -0,0 +1,142 @@
+// tests/idea_quick_guard.mjs
+//
+// task 1002926 (BV1.R150, goal 1000062) — the regression guard: THE QUICK IDEA
+// PATH IS UNTOUCHED by the grade era.
+//
+// Quick Idea exists to turn a thought into a task fast (the owner's brief), and
+// goal 1000062's C1 says it "is never silently treated as an unfinished Full
+// Idea". This file is that promise as executable assertions, pinned from FOUR
+// angles so any future grade/template work that taxes the quick path fails CI
+// here, by name, instead of quietly adding friction:
+//
+//   1. THE CAPTURE CONTRACT — captureIdea takes the same fields it always took,
+//      title is the only requirement, and its INSERT touches idea_inbox alone:
+//      ZERO statements against ideas_grades. A quick idea is quick because no
+//      grade row exists (the R140 design), not because one was written.
+//   2. THE ROUTE SCHEMA — POST /inbox's validator declares exactly the pre-grade
+//      field set. No grade / template_key / field_values key exists in it, so no
+//      client is asked for (or may smuggle) grade-era input on the quick path.
+//   3. THE READ — an idea with no grade row reads back grade='quick' with null
+//      template/score, via the LEFT JOIN + COALESCE (idea_grades.mjs owns the
+//      deep version of this; here it is asserted once as part of the contract).
+//   4. THE PROMOTE — a triage promote writes idea_inbox verdict columns only;
+//      it neither reads nor writes ideas_grades.
+//
+// DB-free, the tests/idea_grades.mjs way: inbox.js destructures `pool` off the
+// doorway at require time, so patching pool.query BEFORE requiring it
+// intercepts every statement.
+//
+// Run:  node tests/idea_quick_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const api = require('../src/module-api.js');
+
+let queries = [];
+let nextRows = [];
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  return { rows: nextRows };
+};
+
+const inbox = require('../modules/ideas/inbox.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  queries = [];
+  nextRows = [{ id: '41', title: 'an idea', status: 'open', grade: 'quick' }];
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+const grades = (q) => q.filter((x) => /ideas_grades/i.test(x.sql));
+
+// ── 1. the capture contract ─────────────────────────────────────────────────
+
+await test('capture: title alone is enough — the same minimal call as before the grade era', async () => {
+  await inbox.captureIdea({ title: 'just a thought', capturedBy: '7' });
+  assert.equal(queries.length, 1, 'one statement, the idea INSERT');
+  assert.match(queries[0].sql, /INSERT INTO idea_inbox/);
+});
+
+await test('capture: writes ZERO ideas_grades statements — quick is the absence of a row', async () => {
+  await inbox.captureIdea({
+    title: 'a fully-optioned quick idea',
+    bodyMd: 'with a body',
+    kind: 'feature',
+    suggestedVersion: 'BONGOS-V1',
+    suggestedPriority: 3,
+    capturedBy: '7',
+  });
+  assert.equal(grades(queries).length, 0, 'no grade row is written or read at capture');
+});
+
+await test('capture: accepts no grade-era argument — an unknown field is simply not a parameter', async () => {
+  // captureIdea's signature is destructured; passing grade-era keys must change
+  // nothing about what runs (they are not smuggled into SQL params).
+  await inbox.captureIdea({ title: 't', capturedBy: '7', grade: 'full', field_values: { purpose: 'x' } });
+  assert.equal(queries.length, 1);
+  const flat = JSON.stringify(queries[0].params);
+  assert.doesNotMatch(flat, /purpose/, 'grade-era keys never reach the INSERT params');
+  assert.equal(grades(queries).length, 0);
+});
+
+await test('capture: the title requirement is the SAME refusal it always was', async () => {
+  try { await inbox.captureIdea({ capturedBy: '7' }); assert.fail('should refuse'); }
+  catch (err) { assert.equal(err.code, 'TITLE_REQUIRED'); }
+  assert.equal(queries.length, 0, 'refused before any query');
+});
+
+// ── 2. the route schema ─────────────────────────────────────────────────────
+
+await test('POST /inbox declares the pre-grade field set — nothing grade-era, nothing newly required', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', 'modules', 'ideas', 'routes', 'inbox.js'), 'utf8');
+  const post = src.slice(src.indexOf("router.post('/inbox'"), src.indexOf('captureIdea('));
+  const schema = post.slice(post.indexOf('{', post.indexOf('validateOrRespond')), post.indexOf('})') + 1);
+  for (const key of ['title', 'body_md', 'kind', 'suggested_version', 'suggested_priority']) {
+    assert.ok(schema.includes(key), `the quick path still accepts ${key}`);
+  }
+  assert.doesNotMatch(schema, /grade|template|field_values|completeness/,
+    'no grade-era key in the quick capture schema');
+  const required = [...schema.matchAll(/(\w+):\s*\{[^}]*required:\s*true/g)].map((m) => m[1]);
+  assert.deepEqual(required, ['title'], 'title is the ONLY required field, as it always was');
+});
+
+// ── 3. the read ──────────────────────────────────────────────────────────────
+
+await test('read: an ungraded idea comes back grade=quick with null template/score', async () => {
+  nextRows = [{ id: '41', title: 'an idea', status: 'open', grade: 'quick', template_key: null, field_values: null, completeness_score: null }];
+  const idea = await inbox.getIdea('41');
+  assert.equal(idea.grade, 'quick');
+  assert.equal(idea.template_key, null);
+  assert.equal(idea.completeness_score, null);
+  assert.match(queries[0].sql, /LEFT JOIN ideas_grades/, 'the read is a LEFT JOIN — absence reads as quick');
+  assert.match(queries[0].sql, /COALESCE\(g\.grade/, 'the COALESCE is what defaults it');
+});
+
+// ── 4. the promote ───────────────────────────────────────────────────────────
+
+await test('promote: mutates idea_inbox only — the grade table is read (one CTE), never written', async () => {
+  nextRows = [{ id: '41', title: 'an idea', status: 'promoted', promoted_to_task_id: '900' }];
+  await inbox.updateIdea('41', { status: 'promoted', promoted_to_task_id: '900' });
+  assert.ok(queries.length >= 1);
+  for (const q of queries) {
+    // Reading the grade is CORRECT here (the CTE joins it so an already-sparked
+    // idea is not misreported as quick); what the guard forbids is any MUTATION
+    // of the grade table riding along with a triage verdict.
+    assert.doesNotMatch(q.sql, /UPDATE\s+ideas_grades|INSERT\s+INTO\s+ideas_grades|DELETE\s+FROM\s+ideas_grades/i,
+      'promote must not mutate the grade table');
+  }
+  assert.ok(queries.some((q) => /UPDATE idea_inbox/i.test(q.sql)), 'the promote is the same idea_inbox UPDATE');
+});
+
+console.log(`\nidea_quick_guard: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);