@bongos/core 1.19.166 → 1.19.167

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.166",
-  "core_contract": "1.19.166",
-  "source_commit": "f0915c151ca43c0539146b5538ab7e5232c0340d",
+  "core_version": "1.19.167",
+  "core_contract": "1.19.167",
+  "source_commit": "35e223942ac5cbbccc7300e2db6175343b2f300a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T17:20:37.651Z",
+  "built_at": "2026-08-16T17:31:19.570Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 305,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1264,
+    "functional_verbatim": 1265,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1590,
-  "tree_sha256": "66c7fea0b4a3bc4ad100fbc357028f28c0445c73227a53a90f842938c6e059f8",
+  "file_count": 1591,
+  "tree_sha256": "b033aa8ae702d08b637604677eefba0fb49124560898516f90f6fbbe751ce09a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4202,12 +4202,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "99da59c846c54ee93a5cc36d2dd760afd344905469a9a6368388de10ee02c506"
+      "sha256": "91c78ba67f8cece0ac27f0dd7ae8cd927e3d4e041eeb41d7de1ddb9897331554"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0f77d032953f120415ec207ecc3827fb00156aec357f542614445ed644c4b4a8"
+      "sha256": "c1fd91411d3a575ba33f6632a8820320389a490c4678e9a238c288008f8d03b5"
     },
     {
       "path": "public-docs/index.html",
@@ -5259,6 +5259,11 @@
       "mode": "0000644",
       "sha256": "5de4203d6a764c8aec374c7802f69f659816d2c0d75bbe70144f7dfb56df2e39"
     },
+    {
+      "path": "scripts/gds/seed-bv1-community-tasks.js",
+      "mode": "0000644",
+      "sha256": "081a90e2b6b6ed78c5230b38ad95a8c620a504c307e227480214aa08590db881"
+    },
     {
       "path": "scripts/gds/seed-bv1-privacy-invites-tasks.js",
       "mode": "0000644",
@@ -5807,7 +5812,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b83c5398b0e936e23705d50233c269ede9f36ea85f3c7b98111fbc501fd6d39a"
+      "sha256": "4bd1d6d5c41a01b6338a148203a8a289864cee0dd7e3d2a4f5de15dd90c0443e"
     },
     {
       "path": "src/module-loader/catalog.js",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.166",
+  "version": "1.19.167",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.166",
+      "version": "1.19.167",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.166",
+  "version": "1.19.167",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/seed-bv1-community-tasks.js

@@ -0,0 +1,131 @@
+// Seed the community-tab build tasks the 1002782 spike scoped, into the
+// community-surface goal (created by the spike; pass --goal <id>).
+//
+// Source of truth: docs/specs/bongos-v1-community-tab.md (owner-signed
+// 2026-08-16: own goal; builder-of-week auto-computed). Idempotent on
+// source_ref bv1-community-CTn; safe to re-run (tasks re-home if --goal moves).
+//
+// Run: node scripts/gds/seed-bv1-community-tasks.js --goal 1000065
+
+const { apiCall, arg } = require('./cli-lib');
+
+const VER = 'BONGOS-V1';
+const SRC = 'planning-session';
+const SPEC = 'docs/specs/bongos-v1-community-tab.md';
+
+// Cross-goal dependency: the shared privacy predicate (privacy spike PV2).
+const PV2 = 1002967;
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function api(method, path, body, _tries = 0) {
+  await sleep(1500);
+  const r = await apiCall(method, `/api/gds${path}`, body);
+  if (r.status === 429 && _tries < 8) {
+    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return r;
+}
+
+const NEW_TASKS = [
+  {
+    ref: 'CT1', kind: 'feature', prio: 3, est: 120, crit: ['CS5'], deps: [], ready: true,
+    title: 'Windowed data plane: activity snapshots appended on changed-totals rollup reports',
+    desc: `New table platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at) — additive platform_identity_* migration — plus one INSERT on the existing rollup-report path, skipped when totals are unchanged. Window value per builder = latest totals minus last snapshot at-or-before window start, summed across projects; missing baseline counts from zero. Reporting-time (not earning-time) semantics — document honestly, options B/C recorded in ${SPEC} D2. Compaction (daily granularity after 90 days) is a later, volume-triggered task: note it in this task's handoff, do not build it.`,
+  },
+  {
+    ref: 'CT2', kind: 'feature', prio: 3, est: 180, crit: ['CS1', 'CS5'], deps: ['CT1', PV2],
+    title: 'Windowed leaderboard API: GET /community/leaderboard',
+    desc: `Public endpoint: ?window=7d|30d|365d|all&discipline=. All-time reads the existing rollup; windowed reads CT1 deltas. Eligibility via the SHARED privacy predicate (task ${PV2} / privacy spike PV2) — active + public + stats shown; no surface-local variant. Columns: credits (rank), tasks_shipped, karma; response identical for every viewer. ${SPEC} D3.`,
+  },
+  {
+    ref: 'CT3', kind: 'feature', prio: 3, est: 120, crit: ['CS2'], deps: [PV2],
+    title: 'Builder search API: name + discipline under public-profile rules',
+    desc: `Public search over active+public accounts: handle/display-name prefix + trigram, discipline filter. Matrix consequences: hide_stats accounts findable by NAME but excluded from discipline-FILTERED results (disciplines are rollup-derived); private + provisional absent. This is not the recruiting search — the discoverable sliver population never appears here. ${SPEC} D4.`,
+  },
+  {
+    ref: 'CT4', kind: 'feature', prio: 3, est: 180, crit: ['CS1', 'CS2'], deps: ['CT2', 'CT3'],
+    title: 'The /community page: leaderboards + search + feature cards',
+    desc: `The public tab on the hub apex (status-ui, beside Explore): leaderboard windows + discipline tabs, search, builder-of-week + rising-builder card slots, server-render-friendly markup (goal 1000048 indexes later; their specifics). 'community' is already in the reserved slug list (edited by spike 1002782). ${SPEC} D1/D3/D4.`,
+  },
+  {
+    ref: 'CT5', kind: 'feature', prio: 3, est: 120, crit: ['CS3'], deps: ['CT2'],
+    title: 'Builder of the Week: crown-at-render + weekly_features table + archive',
+    desc: `Owner-signed formula: top 7d credit delta among leaderboard-eligible builders, floor one shipped work in window, ties by ships then karma. Crowned at first render after Monday 00:00 UTC and recorded to platform_identity_weekly_features (github_id, week_start, credits_delta, ships_delta) so the crown is pinned and the archive section renders from real rows. No cron. Formula shown on the page. ${SPEC} D5.`,
+  },
+  {
+    ref: 'CT6', kind: 'feature', prio: 4, est: 90, crit: ['CS4'], deps: ['CT4'],
+    title: 'Recruit affordance for project.recruit holders',
+    desc: `Leaderboard rows + search results grow a Recruit button rendered only for holders of project.recruit (the console wave's atom — coordinate spike 1002786 R2/R4), linking into the console invite flow. A door to a gated surface, never a data reveal. ${SPEC} D6.`,
+  },
+  {
+    ref: 'CT7', kind: 'feature', prio: 4, est: 90, crit: ['CS1'], deps: ['CT2'],
+    title: 'Rising builder + most-active-projects cards',
+    desc: `Rising builder: biggest relative 30d delta on a small all-time base (same CT1 snapshots). Most-active projects: the snapshots aggregated on the project axis, a strip on the community tab (orb-sizing reuse is goal 1000044 territory — feed it, don't build it here). ${SPEC} D7 items 1-2.`,
+  },
+  {
+    ref: 'CT8', kind: 'infra', prio: 4, est: 90, crit: ['CS3'], deps: ['CT2', 'CT5'],
+    title: 'Weekly Discord community digest',
+    desc: `A scheduled routine posting top movers + builder of the week via the existing postWebhook plumbing (scripts/discord/lib.js channels). Owner-audience copy, no jargon. ${SPEC} D7 item 4.`,
+  },
+  {
+    ref: 'CT9', kind: 'verify', prio: 3, est: 90, crit: ['CS1', 'CS2', 'CS3'], deps: ['CT2', 'CT3', 'CT4', 'CT5'],
+    title: 'PROOF: matrix enforcement + window math on the community surfaces',
+    desc: `Seed fixture accounts in every privacy state and snapshot rows across window boundaries; assert: private/provisional/hidden absent from every board, search result, feature card; name-vs-discipline search asymmetry for hide_stats; window deltas exact against the seeded snapshots; anonymous and signed-in responses identical. ${SPEC} D8.`,
+  },
+];
+
+(async () => {
+  const goalId = Number(arg('--goal'));
+  if (!goalId) {
+    console.error('usage: node scripts/gds/seed-bv1-community-tasks.js --goal <id>');
+    process.exit(2);
+  }
+  console.log(`Seeding community-tab tasks under goal ${goalId} (${VER})…`);
+  const idByRef = {};
+  let created = 0, existing = 0;
+
+  for (const t of NEW_TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER,
+      goal_id: goalId,
+      title: t.title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: 'engineer',
+      priority: t.prio,
+      est_minutes: t.est,
+      criterion_ids: t.crit,
+      source: SRC,
+      source_ref: `bv1-community-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`); continue; }
+    const task = r.data.task || r.data;
+    idByRef[t.ref] = Number(task.id);
+    if (r.data.idempotent || r.data.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}, P${t.prio})`);
+  }
+
+  console.log('Wiring dependencies…');
+  for (const t of NEW_TASKS.filter((x) => x.deps.length)) {
+    const id = idByRef[t.ref];
+    const deps = t.deps.map((d) => (typeof d === 'number' ? d : idByRef[d])).filter(Boolean);
+    if (!id || !deps.length) continue;
+    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: deps });
+    console.log(`  ${t.ref} (task ${id}) depends on [${deps.join(', ')}]: ${r.ok ? 'ok' : 'FAILED ' + r.status + ' ' + JSON.stringify(r.data).slice(0, 160)}`);
+  }
+
+  console.log('Promoting the zero-dep root…');
+  for (const t of NEW_TASKS.filter((x) => x.ready)) {
+    const id = idByRef[t.ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();

package/src/module-api.js

@@ -759,8 +759,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.164 with no explicit bump. run 31960929146. (task 1002620)
 //   1.19.166 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.165 with no explicit bump. run 31961272140. (task 1002620)
+//   1.19.167 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.166 with no explicit bump. run 31961815831. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.166'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.167'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');