@bongos/core 1.19.163 → 1.19.164

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.163",
-  "core_contract": "1.19.163",
-  "source_commit": "cf29eabb9874ecd380580fa762e09cf7ab412a1e",
+  "core_version": "1.19.164",
+  "core_contract": "1.19.164",
+  "source_commit": "779753af3493b89014e91088a53931afe771ec00",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T16:52:34.284Z",
+  "built_at": "2026-08-16T17:05:29.044Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1262,
+    "functional_verbatim": 1263,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1588,
-  "tree_sha256": "5c874eb035676d192575fc9366d0ddb5dac5a4af849f8c7034694ddb591d421c",
+  "file_count": 1589,
+  "tree_sha256": "ea5a8e73501fb69d4e1d6e808d63a241df8b2ccf76728a49282a328b14b63337",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "bca3cfecb85aa504c645ef360eb2370e72c417e34d171b40936b6e01d0d94e95"
+      "sha256": "4245c4fb82c1c4f5c87788030dc4640987fe22e0d588072d4549e9982cea7ecc"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1347,12 +1347,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "600c7a58bb59803bea046d379bf1f9c42a03a1c5f05514f4b2edac3b71956b12"
+      "sha256": "879ef6fd06bde11c040c5ef67ccf495f0be6eb95e11be6f8979c9d560a33da64"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0b2a7a1534b1bc4b92b3a2e939e5d5e6a7b8907fa0cd7513e5a3a6311d4318e1"
+      "sha256": "9382373e7be837c0ce4e26f23c3cd32bf20ab09858650bdee318dd90a06dedbe"
     },
     {
       "path": "docs/architecture.md",
@@ -3482,12 +3482,12 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "6c57608d1eae4159e967f9b471b20cb4c518c2b4acdf9d5ab88cad2afaf7c197"
+      "sha256": "8604c627617cc90fa3197dcf3776ce708546d754b9acc2d45c16dfea97a478cb"
     },
     {
       "path": "modules/ideas/templates.js",
       "mode": "0000644",
-      "sha256": "d2816db988207f9f2c9305971ebca9bcd87d62e594facaea115d9f6db4b5d9f0"
+      "sha256": "eade9a2d07da0a39af17c086d188a195be00c544889d61454ed3c6368d39ea04"
     },
     {
       "path": "modules/lifecycle/CLAUDE.md",
@@ -4202,12 +4202,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "572ae700360b73fdbc62135f01397fd335bcb5a735d113962a8343377672268c"
+      "sha256": "098af85c69e5a9f9aa4dcfd69292d9bbdecfa6bb4294a344740568344fd36673"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1460066c89ad9a7db9dc62ae0b6766c5e11cc18d8268fb95a4ae8767325569c5"
+      "sha256": "6efe95b7773147ac8801e5d03fe75b7143f1eda728d123dfa6a19dd41deb5f27"
     },
     {
       "path": "public-docs/index.html",
@@ -5802,7 +5802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4e7edb74be33ea3e2b126dadb6a51dce083c4df6eb8c0521c0c7f484997edbe4"
+      "sha256": "575799bb117e5a9166aabc3abbba42f9b737fda008bc08e1461147a57831683a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6914,6 +6914,11 @@
       "mode": "0000644",
       "sha256": "e7b6af463185ea77f40d62408026c55c7fb077f18999b972564b3b5bc7656ca5"
     },
+    {
+      "path": "tests/idea_full_capture.mjs",
+      "mode": "0000644",
+      "sha256": "95b53f1acfa61f723741b4d33b5e882525903ccc549ae01f3094a788251a60ec"
+    },
     {
       "path": "tests/idea_grades.mjs",
       "mode": "0000644",
@@ -6922,12 +6927,12 @@
     {
       "path": "tests/idea_quick_guard.mjs",
       "mode": "0000644",
-      "sha256": "9be4414bbbbb92513a7737d4494265b24c5f5db71a67e840016cc275442df1fb"
+      "sha256": "729c511f9bb3d4a9b7fb76c7b3843e1900c8d4c9cfa30fe08e482d1e41113839"
     },
     {
       "path": "tests/idea_templates.mjs",
       "mode": "0000644",
-      "sha256": "3360dcfcccd6ada6375124108a2570d84172977046aa47e1704d4be303ad41f3"
+      "sha256": "943afa2366f92c4d6188ce9f8d68f499aac8d67930f91d6860a2cb83020642ab"
     },
     {
       "path": "tests/idea_triage.mjs",

package/clients/bongos-client/index.d.ts

@@ -222,8 +222,7 @@ export interface PostGovernanceRolesRequest { role_key: string; label: string; d
 export interface PostGovernanceRolesResponse { role: unknown }
 export interface PostGovernanceRolesRoleKeyResetResponse { ok: boolean; role_key: unknown; seeded_rank: unknown; permission_count: unknown }
 export interface PostInboxIdRatifyRequest { notes_md?: string }
-export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number }
-export interface PostInboxResponse { idea: unknown; open_count: unknown; kind_auto: unknown }
+export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number; grade?: string; template_key?: string; field_values?: Record<string, unknown> }
 export interface PostLearningsRequest { title: string; body_md: string; tags?: string[]; related_files?: string[]; source?: string; source_ref?: string; task_id?: number }
 export interface PostLearningsResponse { skipped?: boolean; reason?: unknown; learning?: unknown }
 export interface PostLlmCacheLookupRequest { cache_key?: unknown; tokens_saved_est?: unknown }
@@ -607,7 +606,7 @@ export interface BongosClient {
     /** GET /inbox — rank: any-builder */
     getInbox(args?: RequestArgs): Promise<GetInboxResponse>;
     /** POST /inbox — rank: any-builder */
-    postInbox(args: RequestArgs & { body: PostInboxRequest }): Promise<PostInboxResponse>;
+    postInbox(args: RequestArgs & { body: PostInboxRequest }): Promise<ApiResponse>;
     /** GET /inbox/{id} — rank: any-builder */
     getInboxId(args?: RequestArgs): Promise<GetInboxIdResponse>;
     /** PATCH /inbox/{id} — rank: metic+archon */

package/docs/api/openapi.json

@@ -5686,14 +5686,7 @@
         },
         "responses": {
           "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostInboxResponse"
-                }
-              }
-            }
+            "description": "Success."
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -15422,6 +15415,16 @@
             "type": "integer",
             "minimum": 0,
             "maximum": 100
+          },
+          "grade": {
+            "type": "string",
+            "maxLength": 16
+          },
+          "template_key": {
+            "type": "string"
+          },
+          "field_values": {
+            "type": "object"
           }
         },
         "required": [
@@ -15429,19 +15432,6 @@
         ],
         "additionalProperties": false
       },
-      "PostInboxResponse": {
-        "type": "object",
-        "properties": {
-          "idea": {},
-          "open_count": {},
-          "kind_auto": {}
-        },
-        "required": [
-          "idea",
-          "open_count",
-          "kind_auto"
-        ]
-      },
       "PostLearningsRequest": {
         "type": "object",
         "properties": {
@@ -17109,8 +17099,8 @@
     }
   },
   "x-endpoint-count": 271,
-  "x-schema-count": 304,
+  "x-schema-count": 303,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 206,
+  "x-response-schemas": 205,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -245,7 +245,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/inbox` | `any-builder` | — | read open ideas; skill-friction rows filtered by viewer rank. |
-| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
+| POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `grade`, `template_key`, `field_values` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
 | GET | `/api/bongos/inbox/:id` | `any-builder` | — | single idea read for the "#NNN" deep-link resolver (task 1047). |
 | PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
 | POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |

package/modules/ideas/routes/inbox.js

@@ -4,6 +4,10 @@ const express = require('express');
 // sibling — a module never requires a core internal.
 const api = require('../../../src/module-api');
 const inbox = require('../inbox');
+// Full Idea capture (task 1002919 / BV1.R143): the template validator (R141)
+// and the deterministic scorer (R142) — both pure, both walk the declaration.
+const { validateFieldValues } = require('../templates');
+const { completenessScore } = require('../completeness');
 const { validateOrRespond, LIMITS, parseId } = api;
 
 const INBOX_STATUS_VALUES = ['open', 'promoted', 'discarded', 'merged'];
@@ -42,6 +46,12 @@ module.exports = function buildInboxRouter() {
       kind: { type: 'string', maxLength: 64 },
       suggested_version: { type: 'string', maxLength: 64 },
       suggested_priority: { type: 'integer', min: 0, max: 100 },
+      // Full Idea capture (R143) — ALL OPTIONAL: omitting every one of these is
+      // exactly the pre-grade quick capture (tests/idea_quick_guard.mjs pins
+      // that title stays the only required field).
+      grade: { type: 'string', maxLength: 16 },
+      template_key: { type: 'string', maxLength: inbox.TEMPLATE_KEY_MAX },
+      field_values: { type: 'object' },
     })) return;
     const body = req.body || {};
     if (body.kind === 'criterion-proposal') {
@@ -50,6 +60,40 @@ module.exports = function buildInboxRouter() {
         return res.fail('rank_forbidden', 403, { required: ['metic', 'archon'], actual: rank, reason: "kind='criterion-proposal' is a planning-session write; Metic+ only." });
       }
     }
+    // Full Idea capture (task 1002919 / BV1.R143). Only 'full' means anything
+    // at capture: 'quick' is the default (explicit or omitted — no grade row
+    // either way, the R140 absence-is-quick design), and 'spark' is REFUSED
+    // here because sparking is the author's later, deliberate act on an
+    // EXISTING quick idea (R144's surface) — an idea does not arrive pre-marked.
+    const grade = body.grade ?? null;
+    if (grade !== null && grade !== 'quick' && grade !== 'full') {
+      return res.fail('bad_grade_at_capture', 400, {
+        grade, allowed: ['quick', 'full'],
+        reason: "capture accepts grade 'quick' (the default) or 'full'; a spark is made from an existing idea, not captured as one.",
+      });
+    }
+    const templateKey = body.template_key ?? undefined;
+    if (grade === 'full') {
+      // Validate BEFORE any write, so a bad payload is a named 400 and no
+      // orphan idea lands. Each error carries { field, reason } — the
+      // "clear error naming the missing field" the task's done-when demands.
+      //
+      // WRAPPED IN try/catch as defence in depth. templateFor's own-property
+      // guard already keeps validateFieldValues from throwing on a hostile
+      // template_key (the R143 grader's blocker), but this validation runs
+      // OUTSIDE the capture try/catch below, so a future consumer that
+      // reintroduces a throw would again escape as an unhandled rejection and
+      // crash the process. Catching here means the boundary holds regardless:
+      // a validator that throws is a 400, never a downed server.
+      let v;
+      try {
+        v = validateFieldValues(body.field_values ?? {}, templateKey ? { templateKey } : undefined);
+      } catch (validationErr) {
+        console.error('[gds] POST /inbox field-values validation threw:', validationErr);
+        return res.fail('invalid_field_values', 400, { errors: [{ field: null, reason: 'unvalidatable' }], template_key: templateKey ?? null });
+      }
+      if (!v.ok) return res.fail('invalid_field_values', 400, { errors: v.errors, template_key: templateKey ?? null });
+    }
     try {
       const idea = await inbox.captureIdea({
         title: body.title,
@@ -59,8 +103,30 @@ module.exports = function buildInboxRouter() {
         suggestedPriority: body.suggested_priority ?? null,
         capturedBy: req.builder.id,
       });
+      let grade_warning;
+      if (grade === 'full') {
+        // The idea is captured; from here every failure is FAIL-OPEN (the
+        // task's contract: a scoring/grading hiccup never blocks capture —
+        // the idea still lands, as quick, with a named warning).
+        try {
+          // completenessScore never throws (R142's contract) — null = unscorable.
+          const row = await inbox.setIdeaGrade(idea.id, {
+            grade: 'full',
+            ...(templateKey ? { templateKey } : {}),
+            fieldValues: body.field_values,
+            completenessScore: completenessScore(body.field_values, templateKey ? { templateKey } : undefined),
+          });
+          idea.grade = row.grade;
+          idea.template_key = row.template_key;
+          idea.field_values = row.field_values;
+          idea.completeness_score = row.completeness_score;
+        } catch (gradeErr) {
+          console.error('[gds] POST /inbox full-grade write failed (idea captured, landing as quick):', gradeErr);
+          grade_warning = 'captured_but_ungraded';
+        }
+      }
       const open_count = await inbox.countOpenIdeas({ viewerRank: req.builder?.rank ?? null });
-      res.status(201).json({ idea, open_count, kind_auto: !body.kind });
+      res.status(201).json({ idea, open_count, kind_auto: !body.kind, ...(grade_warning ? { grade_warning } : {}) });
     } catch (err) {
       if (err && err.code) {
         const status =

package/modules/ideas/templates.js

@@ -74,7 +74,21 @@ if (BASE_TEMPLATE.key !== DEFAULT_TEMPLATE_KEY) {
 // whether that is a 400 (capture) or a render-as-raw fallback (display).
 function templateFor(key, registry = BUILTIN_TEMPLATES) {
   if (typeof key !== 'string' || !key) return null;
-  return registry[key] || null;
+  // OWN-PROPERTY LOOKUP, never a bare `registry[key]`. `template_key` is
+  // attacker-controlled at capture (POST /inbox, R143) and only length-checked,
+  // so a key like 'constructor' / '__proto__' / 'toString' would otherwise
+  // resolve up the prototype chain to an Object.prototype member — a truthy
+  // non-template whose `.fields` is undefined, and fieldOrder(template) then
+  // throws a synchronous TypeError from inside the pure validator, OUTSIDE the
+  // route's try/catch → an unhandled rejection that crashes the process. One
+  // authenticated request, any rank. Object.hasOwn confines resolution to keys
+  // the registry actually declares. (Found by the R143 grader.)
+  if (!Object.hasOwn(registry, key)) return null;
+  const t = registry[key];
+  // Defence in depth: even an own key must resolve to a real template shape
+  // before any consumer reads `.fields`. A malformed entry is a null, never a
+  // throw.
+  return t && Array.isArray(t.fields) ? t : null;
 }
 
 // The one legal source of field display order (see header). Returns key order

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.163",
+  "version": "1.19.164",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.163",
+      "version": "1.19.164",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.163",
+  "version": "1.19.164",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -753,8 +753,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.161 with no explicit bump. run 31959496815. (task 1002620)
 //   1.19.163 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.162 with no explicit bump. run 31959864781. (task 1002620)
+//   1.19.164 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.163 with no explicit bump. run 31960518012. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.163'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.164'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_full_capture.mjs

@@ -0,0 +1,146 @@
+// tests/idea_full_capture.mjs
+//
+// task 1002919 (BV1.R143, goal 1000062) — POST /inbox accepts a Full Idea.
+//
+// The done-when, as assertions: a Full Idea round-trips with its fields and
+// score intact; an invalid field set is a 400 NAMING the field, refused BEFORE
+// any write; a grade-write failure never blocks capture (fail-open: the idea
+// lands as quick with a named warning); 'spark' is refused at capture (sparking
+// is R144's act on an EXISTING idea); and the quick path stays byte-identical
+// (the deep version of that lives in tests/idea_quick_guard.mjs).
+//
+// DB-free the idea_grades.mjs way (pool.query patched on the doorway before the
+// modules load), driving the REAL route handler through a stub req/res — the
+// same validator, the same error map a client sees.
+//
+// Run:  node tests/idea_full_capture.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+let queries = [];
+let failNextGradeWrite = false;
+api.pool.query = async (sql, params = []) => {
+  queries.push({ sql, params });
+  if (/INSERT INTO ideas_grades/i.test(sql)) {
+    if (failNextGradeWrite) { failNextGradeWrite = false; throw new Error('synthetic grade-write outage'); }
+    return { rows: [{ idea_id: params[0], grade: params[1], template_key: params[2], field_values: JSON.parse(params[3]), completeness_score: params[4] }] };
+  }
+  if (/INSERT INTO idea_inbox/i.test(sql)) {
+    return { rows: [{ id: '77', title: params[0], status: 'open' }] };
+  }
+  if (/SELECT COUNT/i.test(sql) || /count/i.test(sql)) return { rows: [{ n: '3', count: '3' }] };
+  return { rows: [] };
+};
+
+const { BASE_TEMPLATE } = require('../modules/ideas/templates.js');
+const routesFactory = require('../modules/ideas/routes/inbox.js');
+
+// Pull the real POST /inbox handler off the mounted router.
+const router = routesFactory({});
+const layer = router.stack.find((l) => l.route && l.route.path === '/inbox' && l.route.methods.post);
+const handlers = layer.route.stack.map((s) => s.handle);
+const postInbox = handlers[handlers.length - 1]; // after requireBuilder
+
+function call(bodyIn) {
+  return new Promise((resolve) => {
+    const req = { body: bodyIn, builder: { id: '9', rank: 'metic' }, query: {} };
+    const res = {
+      statusCode: 200,
+      status(c) { this.statusCode = c; return this; },
+      json(payload) { resolve({ status: this.statusCode, payload }); },
+      fail(code, status, extra) {
+        const s = typeof status === 'number' ? status : (status && status.status) || 500;
+        resolve({ status: s, payload: { error: code, ...(extra || {}) } });
+      },
+    };
+    postInbox(req, res);
+  });
+}
+
+const FULL = Object.fromEntries(
+  BASE_TEMPLATE.fields.map((f) => [f.key, `A substantive answer for ${f.key}, long enough to clear the floor.`]),
+);
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  queries = [];
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+await test('a Full Idea round-trips: 201 with grade, fields and score intact', async () => {
+  const r = await call({ title: 'a full idea', grade: 'full', field_values: FULL });
+  assert.equal(r.status, 201);
+  assert.equal(r.payload.idea.grade, 'full');
+  assert.deepEqual(r.payload.idea.field_values, FULL);
+  assert.equal(r.payload.idea.completeness_score, 100, 'scored via R142 at capture');
+  assert.ok(queries.some((q) => /INSERT INTO idea_inbox/i.test(q.sql)));
+  assert.ok(queries.some((q) => /INSERT INTO ideas_grades/i.test(q.sql)));
+});
+
+await test('an invalid field set is a 400 naming the field — and NOTHING is written', async () => {
+  const r = await call({ title: 'bad full', grade: 'full', field_values: { ...FULL, rogue: 'x' } });
+  assert.equal(r.status, 400);
+  assert.equal(r.payload.error, 'invalid_field_values');
+  assert.deepEqual(r.payload.errors, [{ field: 'rogue', reason: 'unknown_field' }]);
+  assert.equal(queries.length, 0, 'refused before any write — no orphan idea');
+});
+
+await test('a missing required field is named the same way', async () => {
+  const { fit, ...four } = FULL;
+  const r = await call({ title: 'incomplete full', grade: 'full', field_values: four });
+  assert.equal(r.status, 400);
+  assert.ok(r.payload.errors.some((e) => e.field === 'fit' && e.reason === 'missing_required'));
+});
+
+await test("'spark' is refused at capture — sparking is an act on an existing idea (R144)", async () => {
+  const r = await call({ title: 'pre-marked?', grade: 'spark' });
+  assert.equal(r.status, 400);
+  assert.equal(r.payload.error, 'bad_grade_at_capture');
+  assert.deepEqual(r.payload.allowed, ['quick', 'full']);
+  assert.equal(queries.length, 0);
+});
+
+await test('a grade-write failure never blocks capture: idea lands, named warning returned', async () => {
+  failNextGradeWrite = true;
+  const r = await call({ title: 'resilient full', grade: 'full', field_values: FULL });
+  assert.equal(r.status, 201, 'the capture still succeeds');
+  assert.equal(r.payload.grade_warning, 'captured_but_ungraded');
+  assert.ok(queries.some((q) => /INSERT INTO idea_inbox/i.test(q.sql)), 'the idea landed');
+});
+
+await test('the quick path is untouched: a bare capture writes idea_inbox only', async () => {
+  const r = await call({ title: 'just a thought' });
+  assert.equal(r.status, 201);
+  // since R140 every new idea reads grade='quick' BY DEFINITION (the absence
+  // design) — what the guard forbids is a grade-table statement, not the label
+  assert.equal(r.payload.idea.grade, 'quick');
+  assert.ok(!queries.some((q) => /ideas_grades/i.test(q.sql)), 'zero grade statements');
+});
+
+await test("an explicit grade:'quick' is the same no-op quick capture", async () => {
+  const r = await call({ title: 'explicitly quick', grade: 'quick' });
+  assert.equal(r.status, 201);
+  assert.ok(!queries.some((q) => /ideas_grades/i.test(q.sql)));
+});
+
+await test('SECURITY (R143 grader blocker): a hostile template_key is a 400, the process survives', async () => {
+  // The exact crash the grader found: template_key:'constructor' with grade:full.
+  // Pre-fix this threw a synchronous TypeError out of the async handler (an
+  // unhandled rejection → process down). Now it is a clean 400 and NOTHING is
+  // written. Proven at the route layer, over the real handler.
+  for (const hostile of ['constructor', '__proto__', 'toString']) {
+    const r = await call({ title: 'attack', grade: 'full', field_values: FULL, template_key: hostile });
+    assert.equal(r.status, 400, `template_key='${hostile}' must be a 400, not a crash`);
+    assert.equal(r.payload.error, 'invalid_field_values');
+    assert.equal(queries.length, 0, 'refused before any write');
+  }
+});
+
+console.log(`\nidea_full_capture: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/idea_quick_guard.mjs

@@ -13,9 +13,10 @@
 //      title is the only requirement, and its INSERT touches idea_inbox alone:
 //      ZERO statements against ideas_grades. A quick idea is quick because no
 //      grade row exists (the R140 design), not because one was written.
-//   2. THE ROUTE SCHEMA — POST /inbox's validator declares exactly the pre-grade
-//      field set. No grade / template_key / field_values key exists in it, so no
-//      client is asked for (or may smuggle) grade-era input on the quick path.
+//   2. THE ROUTE SCHEMA — the five pre-grade keys survive and title stays the
+//      ONLY required field. (R143 later added grade-era keys as OPTIONALS —
+//      the promise was never "the schema can't grow", it is "no new REQUIRED
+//      field appears on the quick path".)
 //   3. THE READ — an idea with no grade row reads back grade='quick' with null
 //      template/score, via the LEFT JOIN + COALESCE (idea_grades.mjs owns the
 //      deep version of this; here it is asserted once as part of the contract).
@@ -97,15 +98,18 @@ await test('capture: the title requirement is the SAME refusal it always was', a
 
 // ── 2. the route schema ─────────────────────────────────────────────────────
 
-await test('POST /inbox declares the pre-grade field set — nothing grade-era, nothing newly required', () => {
+await test('POST /inbox: the pre-grade fields survive and title stays the ONLY requirement', () => {
+  // R143 legitimately added grade / template_key / field_values as OPTIONAL
+  // keys — the promise this guard protects (R150's done-when) was never "the
+  // schema can't grow", it is "no new REQUIRED field appears on the quick
+  // path". So the pin is: the five original keys remain, and required is
+  // exactly ['title'] — a grade-era key turning required fails here by name.
   const src = fs.readFileSync(path.join(__dirname, '..', 'modules', 'ideas', 'routes', 'inbox.js'), 'utf8');
   const post = src.slice(src.indexOf("router.post('/inbox'"), src.indexOf('captureIdea('));
   const schema = post.slice(post.indexOf('{', post.indexOf('validateOrRespond')), post.indexOf('})') + 1);
   for (const key of ['title', 'body_md', 'kind', 'suggested_version', 'suggested_priority']) {
     assert.ok(schema.includes(key), `the quick path still accepts ${key}`);
   }
-  assert.doesNotMatch(schema, /grade|template|field_values|completeness/,
-    'no grade-era key in the quick capture schema');
   const required = [...schema.matchAll(/(\w+):\s*\{[^}]*required:\s*true/g)].map((m) => m[1]);
   assert.deepEqual(required, ['title'], 'title is the ONLY required field, as it always was');
 });

package/tests/idea_templates.mjs

@@ -62,6 +62,22 @@ test('templateFor: base key resolves, unknown/blank/non-string do not', () => {
   assert.equal(T.templateFor(null), null);
 });
 
+test('SECURITY (R143 grader blocker): a prototype-chain key resolves to null, never a crash', () => {
+  // template_key is attacker-controlled at capture and only length-checked, so
+  // a bare registry[key] would resolve 'constructor' / '__proto__' / 'toString'
+  // up the prototype chain to a truthy Object.prototype member — a non-template
+  // whose .fields is undefined — and validateFieldValues would then throw a
+  // synchronous TypeError, crashing the process. Own-property lookup returns
+  // null for every one of these, and the validator path stays a clean refusal.
+  for (const hostile of ['constructor', '__proto__', 'toString', 'valueOf', 'hasOwnProperty', 'isPrototypeOf']) {
+    assert.equal(T.templateFor(hostile), null, `templateFor('${hostile}') must be null`);
+    assert.doesNotThrow(() => T.validateFieldValues({}, { templateKey: hostile }),
+      `validateFieldValues must not throw on template_key='${hostile}'`);
+    assert.deepEqual(T.validateFieldValues({}, { templateKey: hostile }).errors,
+      [{ field: null, reason: 'unknown_template' }]);
+  }
+});
+
 // ── validation follows the declaration ──────────────────────────────────────
 
 test('a complete five-field payload validates', () => {