@bongos/core 1.19.162 → 1.19.164

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.162",
-  "core_contract": "1.19.162",
-  "source_commit": "1db6240e60bde4c45db842d783f1a109da3684e5",
+  "core_version": "1.19.164",
+  "core_contract": "1.19.164",
+  "source_commit": "779753af3493b89014e91088a53931afe771ec00",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T16:44:59.964Z",
+  "built_at": "2026-08-16T17:05:29.044Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1260,
+    "functional_verbatim": 1263,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1586,
-  "tree_sha256": "b21ff15e6dc8e250c96a99b03f62b79b69a99a870c2aca7d2db4bbc8a1e1f0f9",
+  "file_count": 1589,
+  "tree_sha256": "ea5a8e73501fb69d4e1d6e808d63a241df8b2ccf76728a49282a328b14b63337",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "bca3cfecb85aa504c645ef360eb2370e72c417e34d171b40936b6e01d0d94e95"
+      "sha256": "4245c4fb82c1c4f5c87788030dc4640987fe22e0d588072d4549e9982cea7ecc"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1347,12 +1347,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "600c7a58bb59803bea046d379bf1f9c42a03a1c5f05514f4b2edac3b71956b12"
+      "sha256": "879ef6fd06bde11c040c5ef67ccf495f0be6eb95e11be6f8979c9d560a33da64"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0b2a7a1534b1bc4b92b3a2e939e5d5e6a7b8907fa0cd7513e5a3a6311d4318e1"
+      "sha256": "9382373e7be837c0ce4e26f23c3cd32bf20ab09858650bdee318dd90a06dedbe"
     },
     {
       "path": "docs/architecture.md",
@@ -2662,7 +2662,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "2c199a1ad61c8ca8a015b0918368da4c3bf4a8e6196edfd46b93048dda8e9eb5"
+      "sha256": "257ac54c66f7969090065a34c29e2874fa6f9d111b6e75f0510ab1a2fcb3ef17"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3454,6 +3454,11 @@
       "mode": "0000644",
       "sha256": "73349f0209190305a61e2f4d771fa466c12be4f9034b4134b60a9e4a560e1c5a"
     },
+    {
+      "path": "modules/ideas/completeness.js",
+      "mode": "0000644",
+      "sha256": "84d977372c79a46f8481176b7cdc740cbaca9480af3464b7b66183aad6d6e180"
+    },
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
@@ -3477,12 +3482,12 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "6c57608d1eae4159e967f9b471b20cb4c518c2b4acdf9d5ab88cad2afaf7c197"
+      "sha256": "8604c627617cc90fa3197dcf3776ce708546d754b9acc2d45c16dfea97a478cb"
     },
     {
       "path": "modules/ideas/templates.js",
       "mode": "0000644",
-      "sha256": "d2816db988207f9f2c9305971ebca9bcd87d62e594facaea115d9f6db4b5d9f0"
+      "sha256": "eade9a2d07da0a39af17c086d188a195be00c544889d61454ed3c6368d39ea04"
     },
     {
       "path": "modules/lifecycle/CLAUDE.md",
@@ -4197,12 +4202,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0fa4ce8b1bb49791c487d1b90ac7f0ddea7577cf4c14db1b6366ccdccaed06ad"
+      "sha256": "098af85c69e5a9f9aa4dcfd69292d9bbdecfa6bb4294a344740568344fd36673"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "33e29cccdddaea282c452b7296e2be6ec3fd06d61b6a8d35c60a98aa86d61bf2"
+      "sha256": "6efe95b7773147ac8801e5d03fe75b7143f1eda728d123dfa6a19dd41deb5f27"
     },
     {
       "path": "public-docs/index.html",
@@ -5797,7 +5802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6e7fcf60af8a8abcc9e1a193c5ecf49fed08c9b410c9e3a1dd031f406bf1dea3"
+      "sha256": "575799bb117e5a9166aabc3abbba42f9b737fda008bc08e1461147a57831683a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6904,6 +6909,16 @@
       "mode": "0000644",
       "sha256": "7d384cd84cdc93b8e7b57df291a4600a40f43346fd2a52168324ecde219f1388"
     },
+    {
+      "path": "tests/idea_completeness.mjs",
+      "mode": "0000644",
+      "sha256": "e7b6af463185ea77f40d62408026c55c7fb077f18999b972564b3b5bc7656ca5"
+    },
+    {
+      "path": "tests/idea_full_capture.mjs",
+      "mode": "0000644",
+      "sha256": "95b53f1acfa61f723741b4d33b5e882525903ccc549ae01f3094a788251a60ec"
+    },
     {
       "path": "tests/idea_grades.mjs",
       "mode": "0000644",
@@ -6912,12 +6927,12 @@
     {
       "path": "tests/idea_quick_guard.mjs",
       "mode": "0000644",
-      "sha256": "9be4414bbbbb92513a7737d4494265b24c5f5db71a67e840016cc275442df1fb"
+      "sha256": "729c511f9bb3d4a9b7fb76c7b3843e1900c8d4c9cfa30fe08e482d1e41113839"
     },
     {
       "path": "tests/idea_templates.mjs",
       "mode": "0000644",
-      "sha256": "3360dcfcccd6ada6375124108a2570d84172977046aa47e1704d4be303ad41f3"
+      "sha256": "943afa2366f92c4d6188ce9f8d68f499aac8d67930f91d6860a2cb83020642ab"
     },
     {
       "path": "tests/idea_triage.mjs",

package/clients/bongos-client/index.d.ts

@@ -222,8 +222,7 @@ export interface PostGovernanceRolesRequest { role_key: string; label: string; d
 export interface PostGovernanceRolesResponse { role: unknown }
 export interface PostGovernanceRolesRoleKeyResetResponse { ok: boolean; role_key: unknown; seeded_rank: unknown; permission_count: unknown }
 export interface PostInboxIdRatifyRequest { notes_md?: string }
-export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number }
-export interface PostInboxResponse { idea: unknown; open_count: unknown; kind_auto: unknown }
+export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number; grade?: string; template_key?: string; field_values?: Record<string, unknown> }
 export interface PostLearningsRequest { title: string; body_md: string; tags?: string[]; related_files?: string[]; source?: string; source_ref?: string; task_id?: number }
 export interface PostLearningsResponse { skipped?: boolean; reason?: unknown; learning?: unknown }
 export interface PostLlmCacheLookupRequest { cache_key?: unknown; tokens_saved_est?: unknown }
@@ -607,7 +606,7 @@ export interface BongosClient {
     /** GET /inbox — rank: any-builder */
     getInbox(args?: RequestArgs): Promise<GetInboxResponse>;
     /** POST /inbox — rank: any-builder */
-    postInbox(args: RequestArgs & { body: PostInboxRequest }): Promise<PostInboxResponse>;
+    postInbox(args: RequestArgs & { body: PostInboxRequest }): Promise<ApiResponse>;
     /** GET /inbox/{id} — rank: any-builder */
     getInboxId(args?: RequestArgs): Promise<GetInboxIdResponse>;
     /** PATCH /inbox/{id} — rank: metic+archon */

package/docs/api/openapi.json

@@ -5686,14 +5686,7 @@
         },
         "responses": {
           "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostInboxResponse"
-                }
-              }
-            }
+            "description": "Success."
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -15422,6 +15415,16 @@
             "type": "integer",
             "minimum": 0,
             "maximum": 100
+          },
+          "grade": {
+            "type": "string",
+            "maxLength": 16
+          },
+          "template_key": {
+            "type": "string"
+          },
+          "field_values": {
+            "type": "object"
           }
         },
         "required": [
@@ -15429,19 +15432,6 @@
         ],
         "additionalProperties": false
       },
-      "PostInboxResponse": {
-        "type": "object",
-        "properties": {
-          "idea": {},
-          "open_count": {},
-          "kind_auto": {}
-        },
-        "required": [
-          "idea",
-          "open_count",
-          "kind_auto"
-        ]
-      },
       "PostLearningsRequest": {
         "type": "object",
         "properties": {
@@ -17109,8 +17099,8 @@
     }
   },
   "x-endpoint-count": 271,
-  "x-schema-count": 304,
+  "x-schema-count": 303,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 206,
+  "x-response-schemas": 205,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -245,7 +245,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/inbox` | `any-builder` | — | read open ideas; skill-friction rows filtered by viewer rank. |
-| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
+| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `grade`, `template_key`, `field_values` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
 | GET | `/api/bongos/inbox/:id` | `any-builder` | — | single idea read for the "#NNN" deep-link resolver (task 1047). |
 | PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
 | POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -354,6 +354,8 @@ function createClient(opts = {}) {
       deleteGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("DELETE", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: false }, args),
       // PUT /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — PUT /governance/roles/:roleKey/permissions/:permissionKey
       putGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("PUT", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: true }, args),
+      // POST /governance/roles/{roleKey}/reset — rank: archon — POST /governance/roles/:roleKey/reset
+      postGovernanceRolesRoleKeyReset: (args) => request("POST", "/governance/roles/{roleKey}/reset", { hasBody: true }, args),
     },
     "grades": {
       // GET /grades/by-builder — rank: metic+archon — GET /grades/by-builder

package/modules/ideas/completeness.js

@@ -0,0 +1,72 @@
+// modules/ideas/completeness.js — the deterministic Full Idea completeness
+// scorer (task 1002918, BV1.R142, goal 1000062).
+//
+// WHY DETERMINISTIC (the owner's call, recorded on the goal): the score feeds
+// karma (R147), so it must be predictable, free and reproducible — the same
+// input scores the same number on every machine, every day, with no model
+// having a good day. An AI depth-judge is a deliberately LATER seam; nothing
+// here calls a network or reads a clock.
+//
+// WHAT IT MEASURES — PRESENCE + SUBSTANCE, NOTHING SMARTER. It walks the R141
+// template declaration (never five hard-coded names): each declared field
+// contributes equally; a field earns its share in proportion to how much
+// actual text it carries against the template's `substanceMin` floor, capped
+// at 1. "Actual text" is the trimmed, whitespace-collapsed length, so a page
+// of blank lines scores as the nothing it is. That is the whole algorithm —
+// honest about its limit: a determined padder can beat a character counter,
+// and catching THAT is the future AI seam (goal notes), not a cleverness this
+// number should pretend to.
+//
+// NEVER THROWS INTO THE CAPTURE PATH (the task's hard requirement): malformed
+// input — unknown template, non-object values, non-string fields — returns a
+// null score, not an exception. A null completeness_score is a legal stored
+// state (ideas_001_grades.sql: scoring never blocks capture), so "could not
+// score" and "not scored yet" deliberately look the same downstream.
+//
+// The write side already exists (inbox.js setIdeaCompleteness, 0–100 int);
+// capture (R143) computes-and-stores via this module, and the triage ordering
+// (R148) reads the stored number — neither re-implements the arithmetic.
+
+'use strict';
+
+const { templateFor, BUILTIN_TEMPLATES } = require('./templates');
+const { DEFAULT_TEMPLATE_KEY } = require('./inbox');
+
+// The substance of a value: the length of its trimmed, whitespace-collapsed
+// text. Non-strings carry no substance (validation refuses them upstream; the
+// scorer just declines to credit them).
+function substanceOf(value) {
+  if (typeof value !== 'string') return 0;
+  return value.trim().replace(/\s+/g, ' ').length;
+}
+
+// Score field_values against a template. Returns
+//   { score, fields: [{ key, substance, floor, ratio }] }
+// where score is an integer 0–100 (ready for setIdeaCompleteness) or NULL when
+// the input cannot be scored. `fields` is the per-field breakdown in TEMPLATE
+// ORDER (fieldOrder's contract) — the hall's live meter (R152) and the triage
+// view (R148) render it without redoing the arithmetic.
+function scoreFieldValues(fieldValues, { templateKey = DEFAULT_TEMPLATE_KEY, registry = BUILTIN_TEMPLATES } = {}) {
+  const template = templateFor(templateKey, registry);
+  if (!template || !template.fields.length) return { score: null, fields: [] };
+  if (!fieldValues || typeof fieldValues !== 'object' || Array.isArray(fieldValues)) {
+    return { score: null, fields: [] };
+  }
+  const fields = template.fields.map((f) => {
+    const substance = substanceOf(fieldValues[f.key]);
+    const floor = f.substanceMin > 0 ? f.substanceMin : 1;
+    return { key: f.key, substance, floor, ratio: Math.min(1, substance / floor) };
+  });
+  const mean = fields.reduce((sum, f) => sum + f.ratio, 0) / fields.length;
+  return { score: Math.round(mean * 100), fields };
+}
+
+// The one-number convenience for callers that only store: integer 0–100, or
+// null when unscorable. This is what R143's capture writes through
+// setIdeaCompleteness — and because it never throws, the capture path needs no
+// guard around it.
+function completenessScore(fieldValues, opts) {
+  return scoreFieldValues(fieldValues, opts).score;
+}
+
+module.exports = { completenessScore, scoreFieldValues, substanceOf };

package/modules/ideas/routes/inbox.js

@@ -4,6 +4,10 @@ const express = require('express');
 // sibling — a module never requires a core internal.
 const api = require('../../../src/module-api');
 const inbox = require('../inbox');
+// Full Idea capture (task 1002919 / BV1.R143): the template validator (R141)
+// and the deterministic scorer (R142) — both pure, both walk the declaration.
+const { validateFieldValues } = require('../templates');
+const { completenessScore } = require('../completeness');
 const { validateOrRespond, LIMITS, parseId } = api;
 
 const INBOX_STATUS_VALUES = ['open', 'promoted', 'discarded', 'merged'];
@@ -42,6 +46,12 @@ module.exports = function buildInboxRouter() {
       kind: { type: 'string', maxLength: 64 },
       suggested_version: { type: 'string', maxLength: 64 },
       suggested_priority: { type: 'integer', min: 0, max: 100 },
+      // Full Idea capture (R143) — ALL OPTIONAL: omitting every one of these is
+      // exactly the pre-grade quick capture (tests/idea_quick_guard.mjs pins
+      // that title stays the only required field).
+      grade: { type: 'string', maxLength: 16 },
+      template_key: { type: 'string', maxLength: inbox.TEMPLATE_KEY_MAX },
+      field_values: { type: 'object' },
     })) return;
     const body = req.body || {};
     if (body.kind === 'criterion-proposal') {
@@ -50,6 +60,40 @@ module.exports = function buildInboxRouter() {
         return res.fail('rank_forbidden', 403, { required: ['metic', 'archon'], actual: rank, reason: "kind='criterion-proposal' is a planning-session write; Metic+ only." });
       }
     }
+    // Full Idea capture (task 1002919 / BV1.R143). Only 'full' means anything
+    // at capture: 'quick' is the default (explicit or omitted — no grade row
+    // either way, the R140 absence-is-quick design), and 'spark' is REFUSED
+    // here because sparking is the author's later, deliberate act on an
+    // EXISTING quick idea (R144's surface) — an idea does not arrive pre-marked.
+    const grade = body.grade ?? null;
+    if (grade !== null && grade !== 'quick' && grade !== 'full') {
+      return res.fail('bad_grade_at_capture', 400, {
+        grade, allowed: ['quick', 'full'],
+        reason: "capture accepts grade 'quick' (the default) or 'full'; a spark is made from an existing idea, not captured as one.",
+      });
+    }
+    const templateKey = body.template_key ?? undefined;
+    if (grade === 'full') {
+      // Validate BEFORE any write, so a bad payload is a named 400 and no
+      // orphan idea lands. Each error carries { field, reason } — the
+      // "clear error naming the missing field" the task's done-when demands.
+      //
+      // WRAPPED IN try/catch as defence in depth. templateFor's own-property
+      // guard already keeps validateFieldValues from throwing on a hostile
+      // template_key (the R143 grader's blocker), but this validation runs
+      // OUTSIDE the capture try/catch below, so a future consumer that
+      // reintroduces a throw would again escape as an unhandled rejection and
+      // crash the process. Catching here means the boundary holds regardless:
+      // a validator that throws is a 400, never a downed server.
+      let v;
+      try {
+        v = validateFieldValues(body.field_values ?? {}, templateKey ? { templateKey } : undefined);
+      } catch (validationErr) {
+        console.error('[gds] POST /inbox field-values validation threw:', validationErr);
+        return res.fail('invalid_field_values', 400, { errors: [{ field: null, reason: 'unvalidatable' }], template_key: templateKey ?? null });
+      }
+      if (!v.ok) return res.fail('invalid_field_values', 400, { errors: v.errors, template_key: templateKey ?? null });
+    }
     try {
       const idea = await inbox.captureIdea({
         title: body.title,
@@ -59,8 +103,30 @@ module.exports = function buildInboxRouter() {
         suggestedPriority: body.suggested_priority ?? null,
         capturedBy: req.builder.id,
       });
+      let grade_warning;
+      if (grade === 'full') {
+        // The idea is captured; from here every failure is FAIL-OPEN (the
+        // task's contract: a scoring/grading hiccup never blocks capture —
+        // the idea still lands, as quick, with a named warning).
+        try {
+          // completenessScore never throws (R142's contract) — null = unscorable.
+          const row = await inbox.setIdeaGrade(idea.id, {
+            grade: 'full',
+            ...(templateKey ? { templateKey } : {}),
+            fieldValues: body.field_values,
+            completenessScore: completenessScore(body.field_values, templateKey ? { templateKey } : undefined),
+          });
+          idea.grade = row.grade;
+          idea.template_key = row.template_key;
+          idea.field_values = row.field_values;
+          idea.completeness_score = row.completeness_score;
+        } catch (gradeErr) {
+          console.error('[gds] POST /inbox full-grade write failed (idea captured, landing as quick):', gradeErr);
+          grade_warning = 'captured_but_ungraded';
+        }
+      }
       const open_count = await inbox.countOpenIdeas({ viewerRank: req.builder?.rank ?? null });
-      res.status(201).json({ idea, open_count, kind_auto: !body.kind });
+      res.status(201).json({ idea, open_count, kind_auto: !body.kind, ...(grade_warning ? { grade_warning } : {}) });
     } catch (err) {
       if (err && err.code) {
         const status =

package/modules/ideas/templates.js

@@ -74,7 +74,21 @@ if (BASE_TEMPLATE.key !== DEFAULT_TEMPLATE_KEY) {
 // whether that is a 400 (capture) or a render-as-raw fallback (display).
 function templateFor(key, registry = BUILTIN_TEMPLATES) {
   if (typeof key !== 'string' || !key) return null;
-  return registry[key] || null;
+  // OWN-PROPERTY LOOKUP, never a bare `registry[key]`. `template_key` is
+  // attacker-controlled at capture (POST /inbox, R143) and only length-checked,
+  // so a key like 'constructor' / '__proto__' / 'toString' would otherwise
+  // resolve up the prototype chain to an Object.prototype member — a truthy
+  // non-template whose `.fields` is undefined, and fieldOrder(template) then
+  // throws a synchronous TypeError from inside the pure validator, OUTSIDE the
+  // route's try/catch → an unhandled rejection that crashes the process. One
+  // authenticated request, any rank. Object.hasOwn confines resolution to keys
+  // the registry actually declares. (Found by the R143 grader.)
+  if (!Object.hasOwn(registry, key)) return null;
+  const t = registry[key];
+  // Defence in depth: even an own key must resolve to a real template shape
+  // before any consumer reads `.fields`. A malformed entry is a null, never a
+  // throw.
+  return t && Array.isArray(t.fields) ? t : null;
 }
 
 // The one legal source of field display order (see header). Returns key order

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.162",
+  "version": "1.19.164",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.162",
+      "version": "1.19.164",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.162",
+  "version": "1.19.164",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -751,8 +751,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.160 with no explicit bump. run 31959299652. (task 1002620)
 //   1.19.162 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.161 with no explicit bump. run 31959496815. (task 1002620)
+//   1.19.163 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.162 with no explicit bump. run 31959864781. (task 1002620)
+//   1.19.164 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.163 with no explicit bump. run 31960518012. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.162'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.164'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_completeness.mjs

@@ -0,0 +1,98 @@
+// tests/idea_completeness.mjs
+//
+// task 1002918 (BV1.R142, goal 1000062) — the deterministic completeness scorer.
+//
+// The three claims under guard, straight from the task's done-when:
+//   1. SAME INPUT, SAME SCORE — determinism is what lets the number feed karma.
+//   2. The empty / thin / padded / complete shapes score sensibly, with padding
+//      (whitespace, blank lines) earning exactly nothing.
+//   3. IT NEVER THROWS — malformed input is a null score, because scoring must
+//      never block capture (the R140 schema's contract).
+//
+// Pure module, pure tests — no DB, no harness.
+//
+// Run:  node tests/idea_completeness.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const C = require('../modules/ideas/completeness.js');
+const { BASE_TEMPLATE } = require('../modules/ideas/templates.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// Five answers comfortably past every substanceMin (40 chars).
+const COMPLETE = Object.fromEntries(
+  BASE_TEMPLATE.fields.map((f) => [f.key, `A real, substantive answer for ${f.key} that clears the declared floor easily.`]),
+);
+
+test('a complete idea scores 100, an empty one 0', () => {
+  assert.equal(C.completenessScore(COMPLETE), 100);
+  assert.equal(C.completenessScore({}), 0);
+});
+
+test('same input, same score — byte-for-byte determinism', () => {
+  const a = C.completenessScore(COMPLETE);
+  for (let i = 0; i < 5; i++) assert.equal(C.completenessScore({ ...COMPLETE }), a);
+  assert.deepEqual(C.scoreFieldValues(COMPLETE), C.scoreFieldValues(COMPLETE));
+});
+
+test('a thin answer earns its proportion, not the full share', () => {
+  const oneThin = { ...COMPLETE, purpose: 'ten chars.' }; // 10 of the 40-char floor
+  const s = C.completenessScore(oneThin);
+  assert.ok(s > 80 && s < 100, `four full + one quarter-credit field ≈ 85, got ${s}`);
+  const breakdown = C.scoreFieldValues(oneThin).fields.find((f) => f.key === 'purpose');
+  assert.equal(breakdown.substance, 10);
+  assert.equal(breakdown.ratio, 0.25);
+});
+
+test('padding earns exactly nothing: whitespace and blank lines are not substance', () => {
+  const padded = { ...COMPLETE, purpose: '   \n\n\t   \n     \n\n        ' };
+  const b = C.scoreFieldValues(padded).fields.find((f) => f.key === 'purpose');
+  assert.equal(b.substance, 0, 'a page of blank lines is the nothing it is');
+  const spaced = { ...COMPLETE, purpose: 'a    b\n\n\nc         d e' }; // collapses to 9
+  const b2 = C.scoreFieldValues(spaced).fields.find((f) => f.key === 'purpose');
+  assert.equal(b2.substance, 9, 'runs of whitespace collapse to one');
+});
+
+test('one missing field costs exactly its equal share', () => {
+  const { fit, ...four } = COMPLETE;
+  assert.equal(C.completenessScore(four), 80, 'five equal fields: one absent = -20');
+});
+
+test('the breakdown comes back in TEMPLATE order, ready to render', () => {
+  const keys = C.scoreFieldValues(COMPLETE).fields.map((f) => f.key);
+  assert.deepEqual(keys, ['purpose', 'big_picture', 'why_had', 'why_matters', 'fit']);
+});
+
+test('it never throws: malformed input is a null score, not an exception', () => {
+  for (const bad of [null, undefined, [], 'a string', 42]) {
+    assert.equal(C.completenessScore(bad), null, `completenessScore(${JSON.stringify(bad)})`);
+  }
+  assert.equal(C.completenessScore(COMPLETE, { templateKey: 'no-such-template' }), null);
+  // a non-string FIELD does not throw either — it just earns nothing
+  assert.equal(typeof C.completenessScore({ ...COMPLETE, purpose: 42 }), 'number');
+});
+
+test('the scorer walks the declaration — a different template scores by ITS fields', () => {
+  const registry = {
+    'two-v1': { key: 'two-v1', label: 'Two', fields: [
+      { key: 'a', label: 'A', required: true, substanceMin: 10 },
+      { key: 'b', label: 'B', required: true, substanceMin: 10 },
+    ] },
+  };
+  const opts = { templateKey: 'two-v1', registry };
+  assert.equal(C.completenessScore({ a: 'ten chars!', b: 'ten chars!' }, opts), 100);
+  assert.equal(C.completenessScore({ a: 'ten chars!' }, opts), 50);
+  // base fields mean nothing to it
+  assert.equal(C.completenessScore(COMPLETE, opts), 0);
+});
+
+console.log(`\nidea_completeness: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/idea_full_capture.mjs

@@ -0,0 +1,146 @@
+// tests/idea_full_capture.mjs
+//
+// task 1002919 (BV1.R143, goal 1000062) — POST /inbox accepts a Full Idea.
+//
+// The done-when, as assertions: a Full Idea round-trips with its fields and
+// score intact; an invalid field set is a 400 NAMING the field, refused BEFORE
+// any write; a grade-write failure never blocks capture (fail-open: the idea
+// lands as quick with a named warning); 'spark' is refused at capture (sparking
+// is R144's act on an EXISTING idea); and the quick path stays byte-identical
+// (the deep version of that lives in tests/idea_quick_guard.mjs).
+//
+// DB-free the idea_grades.mjs way (pool.query patched on the doorway before the
+// modules load), driving the REAL route handler through a stub req/res — the
+// same validator, the same error map a client sees.
+//
+// Run:  node tests/idea_full_capture.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+let queries = [];
+let failNextGradeWrite = false;
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  if (/INSERT INTO ideas_grades/i.test(sql)) {
+    if (failNextGradeWrite) { failNextGradeWrite = false; throw new Error('synthetic grade-write outage'); }
+    return { rows: [{ idea_id: params[0], grade: params[1], template_key: params[2], field_values: JSON.parse(params[3]), completeness_score: params[4] }] };
+  }
+  if (/INSERT INTO idea_inbox/i.test(sql)) {
+    return { rows: [{ id: '77', title: params[0], status: 'open' }] };
+  }
+  if (/SELECT COUNT/i.test(sql) || /count/i.test(sql)) return { rows: [{ n: '3', count: '3' }] };
+  return { rows: [] };
+};
+
+const { BASE_TEMPLATE } = require('../modules/ideas/templates.js');
+const routesFactory = require('../modules/ideas/routes/inbox.js');
+
+// Pull the real POST /inbox handler off the mounted router.
+const router = routesFactory({});
+const layer = router.stack.find((l) => l.route && l.route.path === '/inbox' && l.route.methods.post);
+const handlers = layer.route.stack.map((s) => s.handle);
+const postInbox = handlers[handlers.length - 1]; // after requireBuilder
+
+function call(bodyIn) {
+  return new Promise((resolve) => {
+    const req = { body: bodyIn, builder: { id: '9', rank: 'metic' }, query: {} };
+    const res = {
+      statusCode: 200,
+      status(c) { this.statusCode = c; return this; },
+      json(payload) { resolve({ status: this.statusCode, payload }); },
+      fail(code, status, extra) {
+        const s = typeof status === 'number' ? status : (status && status.status) || 500;
+        resolve({ status: s, payload: { error: code, ...(extra || {}) } });
+      },
+    };
+    postInbox(req, res);
+  });
+}
+
+const FULL = Object.fromEntries(
+  BASE_TEMPLATE.fields.map((f) => [f.key, `A substantive answer for ${f.key}, long enough to clear the floor.`]),
+);
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  queries = [];
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+await test('a Full Idea round-trips: 201 with grade, fields and score intact', async () => {
+  const r = await call({ title: 'a full idea', grade: 'full', field_values: FULL });
+  assert.equal(r.status, 201);
+  assert.equal(r.payload.idea.grade, 'full');
+  assert.deepEqual(r.payload.idea.field_values, FULL);
+  assert.equal(r.payload.idea.completeness_score, 100, 'scored via R142 at capture');
+  assert.ok(queries.some((q) => /INSERT INTO idea_inbox/i.test(q.sql)));
+  assert.ok(queries.some((q) => /INSERT INTO ideas_grades/i.test(q.sql)));
+});
+
+await test('an invalid field set is a 400 naming the field — and NOTHING is written', async () => {
+  const r = await call({ title: 'bad full', grade: 'full', field_values: { ...FULL, rogue: 'x' } });
+  assert.equal(r.status, 400);
+  assert.equal(r.payload.error, 'invalid_field_values');
+  assert.deepEqual(r.payload.errors, [{ field: 'rogue', reason: 'unknown_field' }]);
+  assert.equal(queries.length, 0, 'refused before any write — no orphan idea');
+});
+
+await test('a missing required field is named the same way', async () => {
+  const { fit, ...four } = FULL;
+  const r = await call({ title: 'incomplete full', grade: 'full', field_values: four });
+  assert.equal(r.status, 400);
+  assert.ok(r.payload.errors.some((e) => e.field === 'fit' && e.reason === 'missing_required'));
+});
+
+await test("'spark' is refused at capture — sparking is an act on an existing idea (R144)", async () => {
+  const r = await call({ title: 'pre-marked?', grade: 'spark' });
+  assert.equal(r.status, 400);
+  assert.equal(r.payload.error, 'bad_grade_at_capture');
+  assert.deepEqual(r.payload.allowed, ['quick', 'full']);
+  assert.equal(queries.length, 0);
+});
+
+await test('a grade-write failure never blocks capture: idea lands, named warning returned', async () => {
+  failNextGradeWrite = true;
+  const r = await call({ title: 'resilient full', grade: 'full', field_values: FULL });
+  assert.equal(r.status, 201, 'the capture still succeeds');
+  assert.equal(r.payload.grade_warning, 'captured_but_ungraded');
+  assert.ok(queries.some((q) => /INSERT INTO idea_inbox/i.test(q.sql)), 'the idea landed');
+});
+
+await test('the quick path is untouched: a bare capture writes idea_inbox only', async () => {
+  const r = await call({ title: 'just a thought' });
+  assert.equal(r.status, 201);
+  // since R140 every new idea reads grade='quick' BY DEFINITION (the absence
+  // design) — what the guard forbids is a grade-table statement, not the label
+  assert.equal(r.payload.idea.grade, 'quick');
+  assert.ok(!queries.some((q) => /ideas_grades/i.test(q.sql)), 'zero grade statements');
+});
+
+await test("an explicit grade:'quick' is the same no-op quick capture", async () => {
+  const r = await call({ title: 'explicitly quick', grade: 'quick' });
+  assert.equal(r.status, 201);
+  assert.ok(!queries.some((q) => /ideas_grades/i.test(q.sql)));
+});
+
+await test('SECURITY (R143 grader blocker): a hostile template_key is a 400, the process survives', async () => {
+  // The exact crash the grader found: template_key:'constructor' with grade:full.
+  // Pre-fix this threw a synchronous TypeError out of the async handler (an
+  // unhandled rejection → process down). Now it is a clean 400 and NOTHING is
+  // written. Proven at the route layer, over the real handler.
+  for (const hostile of ['constructor', '__proto__', 'toString']) {
+    const r = await call({ title: 'attack', grade: 'full', field_values: FULL, template_key: hostile });
+    assert.equal(r.status, 400, `template_key='${hostile}' must be a 400, not a crash`);
+    assert.equal(r.payload.error, 'invalid_field_values');
+    assert.equal(queries.length, 0, 'refused before any write');
+  }
+});
+
+console.log(`\nidea_full_capture: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/idea_quick_guard.mjs

@@ -13,9 +13,10 @@
 //      title is the only requirement, and its INSERT touches idea_inbox alone:
 //      ZERO statements against ideas_grades. A quick idea is quick because no
 //      grade row exists (the R140 design), not because one was written.
-//   2. THE ROUTE SCHEMA — POST /inbox's validator declares exactly the pre-grade
-//      field set. No grade / template_key / field_values key exists in it, so no
-//      client is asked for (or may smuggle) grade-era input on the quick path.
+//   2. THE ROUTE SCHEMA — the five pre-grade keys survive and title stays the
+//      ONLY required field. (R143 later added grade-era keys as OPTIONALS —
+//      the promise was never "the schema can't grow", it is "no new REQUIRED
+//      field appears on the quick path".)
 //   3. THE READ — an idea with no grade row reads back grade='quick' with null
 //      template/score, via the LEFT JOIN + COALESCE (idea_grades.mjs owns the
 //      deep version of this; here it is asserted once as part of the contract).
@@ -97,15 +98,18 @@ await test('capture: the title requirement is the SAME refusal it always was', a
 
 // ── 2. the route schema ─────────────────────────────────────────────────────
 
-await test('POST /inbox declares the pre-grade field set — nothing grade-era, nothing newly required', () => {
+await test('POST /inbox: the pre-grade fields survive and title stays the ONLY requirement', () => {
+  // R143 legitimately added grade / template_key / field_values as OPTIONAL
+  // keys — the promise this guard protects (R150's done-when) was never "the
+  // schema can't grow", it is "no new REQUIRED field appears on the quick
+  // path". So the pin is: the five original keys remain, and required is
+  // exactly ['title'] — a grade-era key turning required fails here by name.
   const src = fs.readFileSync(path.join(__dirname, '..', 'modules', 'ideas', 'routes', 'inbox.js'), 'utf8');
   const post = src.slice(src.indexOf("router.post('/inbox'"), src.indexOf('captureIdea('));
   const schema = post.slice(post.indexOf('{', post.indexOf('validateOrRespond')), post.indexOf('})') + 1);
   for (const key of ['title', 'body_md', 'kind', 'suggested_version', 'suggested_priority']) {
     assert.ok(schema.includes(key), `the quick path still accepts ${key}`);
   }
-  assert.doesNotMatch(schema, /grade|template|field_values|completeness/,
-    'no grade-era key in the quick capture schema');
   const required = [...schema.matchAll(/(\w+):\s*\{[^}]*required:\s*true/g)].map((m) => m[1]);
   assert.deepEqual(required, ['title'], 'title is the ONLY required field, as it always was');
 });

package/tests/idea_templates.mjs

@@ -62,6 +62,22 @@ test('templateFor: base key resolves, unknown/blank/non-string do not', () => {
   assert.equal(T.templateFor(null), null);
 });
 
+test('SECURITY (R143 grader blocker): a prototype-chain key resolves to null, never a crash', () => {
+  // template_key is attacker-controlled at capture and only length-checked, so
+  // a bare registry[key] would resolve 'constructor' / '__proto__' / 'toString'
+  // up the prototype chain to a truthy Object.prototype member — a non-template
+  // whose .fields is undefined — and validateFieldValues would then throw a
+  // synchronous TypeError, crashing the process. Own-property lookup returns
+  // null for every one of these, and the validator path stays a clean refusal.
+  for (const hostile of ['constructor', '__proto__', 'toString', 'valueOf', 'hasOwnProperty', 'isPrototypeOf']) {
+    assert.equal(T.templateFor(hostile), null, `templateFor('${hostile}') must be null`);
+    assert.doesNotThrow(() => T.validateFieldValues({}, { templateKey: hostile }),
+      `validateFieldValues must not throw on template_key='${hostile}'`);
+    assert.deepEqual(T.validateFieldValues({}, { templateKey: hostile }).errors,
+      [{ field: null, reason: 'unknown_template' }]);
+  }
+});
+
 // ── validation follows the declaration ──────────────────────────────────────
 
 test('a complete five-field payload validates', () => {