@bongos/core 1.19.208 → 1.19.209

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.208",
-  "core_contract": "1.19.208",
-  "source_commit": "6dabd2e84af8785ac779f8a6801b951d80ecad3b",
+  "core_version": "1.19.209",
+  "core_contract": "1.19.209",
+  "source_commit": "7163dda884c4ff7ab746790988dd3612e1271681",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T20:55:34.065Z",
+  "built_at": "2026-08-17T21:40:11.933Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1299,
+    "functional_verbatim": 1300,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1630,
-  "tree_sha256": "63df68d9f034ba54b42011a4bfc310a811d2c53cb550a586bf40d5d35228a258",
+  "file_count": 1631,
+  "tree_sha256": "f933ba33ff7212d28d0d1b4447b760177e211576e00658e3050a7a72528c3bc5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "df481ba4f5057938d85fadf4e5551602cb50c68f78358dc110d03ebfb99ff278"
+      "sha256": "9a096a5f5cadd3f8dab6e2c958402e36c857ff560a14364c756161c41d573ed3"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5b6943de459044d4545437bd4941abadbdefcedc0063e291f72205e46956beb3"
+      "sha256": "9b699cde73691611630459b846d40b8a887cb51099b8d4193d775fd76f1b9749"
     },
     {
       "path": "public-docs/index.html",
@@ -5339,6 +5339,11 @@
       "mode": "0000644",
       "sha256": "c5393ea0633f1fd60b1f6a1e86f7f86be489b74c56d2a0e947f8b262eaeab2cb"
     },
+    {
+      "path": "scripts/gds/seed-bongos-v1-idea-routing-tasks.js",
+      "mode": "0000644",
+      "sha256": "1756751e8c32d9667c82173ac7ba78f98b8416aa946c747036502c5853cbf77f"
+    },
     {
       "path": "scripts/gds/seed-bongos-v1-seo-tasks.js",
       "mode": "0000644",
@@ -5897,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d20ec520ccfe8d1ac72910455f97f728feaf179b265f79ebf6f9a2ca21f1e424"
+      "sha256": "efbf7edd3c80dbce81da9aa7473ae1903674c9018da9803e6ab0e807bcb616f0"
     },
     {
       "path": "src/module-loader/catalog.js",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.208",
+  "version": "1.19.209",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.208",
+      "version": "1.19.209",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.208",
+  "version": "1.19.209",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/seed-bongos-v1-idea-routing-tasks.js

@@ -0,0 +1,121 @@
+// Seed the tasks for goal 1000071 "Idea routing — work that has a home lands in it" (BONGOS-V1).
+// Source of truth: docs/specs/bongos-v1-idea-routing.md (status: final).
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+//
+// Run: node scripts/gds/seed-bongos-v1-idea-routing-tasks.js
+const os = require('os');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = sess.api_base.replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V1';
+const GOAL = 1000071;
+const SRC = 'planning-session';
+const META_TASK = 1003059;      // this planning session's meta task — moved into the goal
+const DISCORD_BUGS_IDEA = 1000771; // subsumed by R11; marked promoted against it
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(400); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/gds${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// Landing matrix (interview-decided): bugs hard-land (Metic+ filer → ready; sub-Metic → backlog);
+// every other goal-bound kind soft-lands (backlog, one Metic+ promote away); homeless → inbox.
+//
+// crit uses the goal's criterion SLUGS via CRIT — positional "Cn" tokens resolve against the
+// whole VERSION's criterion order (and even matched an old criterion literally slugged "C1"),
+// which mislinked the first seed run; slugs are position-independent.
+const CRIT = {
+  C1: 'bug-lands-in-its-goal', C2: 'inbox-holds-only-homeless', C3: 'no-route-loses-the-author',
+  C4: 'filing-cannot-outrun-rank', C5: 'system-offers-the-home', C6: 'triage-shrinks-to-judgment',
+};
+const TASKS = [
+  // T1 — zero-dep layer — P5
+  { ref:'R02', kind:'infra',    disc:'engineer', prio:5, est:90,  crit:['C1','C3'], deps:[],                title:'R02 · Schema: idea_inbox.suggested_goal_id + lineage origin \'route\'', desc:'Core migration: nullable suggested_goal_id FK on idea_inbox (routing hint for soft-landed/Discord/homeless ideas). Module migration (ideas_*): extend ideas_task_lineage.origin CHECK with \'route\'. See docs/specs/bongos-v1-idea-routing.md.' },
+  { ref:'R03', kind:'bug',      disc:'engineer', prio:5, est:90,  crit:['C1'],      deps:[],                title:'R03 · Catch-all fallback never resolves to a non-building version', desc:'generalGoalIdForVersion (modules/lifecycle/db.js:1343) + the null-goal fallback (:1414): a task create must never land in a shipped/frozen version\'s catch-all goal (the 1000771 failure shape). Routed creates with no goal go to the inbox instead. Done-when: test proves a create against a shipped version cannot resolve a catch-all.' },
+  { ref:'R07', kind:'feature',  disc:'engineer', prio:5, est:120, crit:['C5'],      deps:[],                title:'R07 · Capture-time goal suggester (advisory consulted BEFORE creation)', desc:'Expose candidate goals for a draft capture — reuse buildGoalAdvisory\'s candidate logic (modules/lifecycle/goal-advisory.js:89) as a pre-creation read (e.g. GET /inbox/goal-suggestions?title=&kind=&version=). Feeds the hall picker (R08), CLI (R09), and Discord suggestion (R11). Done-when: candidates returned for a draft title/kind without creating anything.' },
+  { ref:'R10', kind:'feature',  disc:'ui',       prio:5, est:120, crit:['C5'],      deps:[],                title:'R10 · Hall move-a-task-to-goal affordance', desc:'PATCH /tasks/:id {goal_id} (task 1763) exists but has no hall UI. Add move-to-goal on the task overlay (Metic+, task.edit) so a wrong routing pick is one reassignment, never a re-file. Done-when: a Metic+ moves a task between same-version goals from the hall.' },
+  { ref:'R14', kind:'decision', disc:'engineer', prio:5, est:60,  crit:['C2'],      deps:[],                title:'R14 · ADR: idea routing — capture-time promotion, the landing matrix, the homeless-only inbox', desc:'Write the ADR recording: routing mechanism is capture-time promotion (never inbox bypass — the Discord #bugs lesson), the landing matrix (bugs hard-land by rank; other kinds soft-land; Full Ideas/criterion-proposals/decisions never auto-route), and the inbox\'s new identity (holds only work without a home). Source: docs/specs/bongos-v1-idea-routing.md interview decisions.' },
+
+  // T2 — the core mechanism — P5
+  { ref:'R01', kind:'feature',  disc:'engineer', prio:5, est:240, crit:['C1','C3'], deps:['R02'],           title:'R01 · Capture-time routing core: POST /inbox accepts goal_id and converts in one transaction', desc:'Extend inbox.captureIdea/route: when goal_id present and the landing matrix says route, one transaction writes the idea row (status=promoted, promoted_to_task_id), the task (in the goal, matrix-decided status), and ideas_task_lineage (origin=route). Validations: goal open + belongs to a building version; Full-grade and criterion-proposal/decision kinds never auto-route; goal-less capture behaves exactly as today. Deps R02.' },
+
+  // T3 — enforcement + surfaces — P4
+  { ref:'R05', kind:'feature',  disc:'engineer', prio:4, est:150, crit:['C4'],      deps:['R01'],           title:'R05 · Rank-aware landing: matrix enforcement server-side', desc:'Metic+ filer\'s bug → status=ready; sub-Metic filer / any non-bug kind → backlog (awaiting any Metic+ promote via the existing task.promote, surfaced in the Needs-your-attention slice). Auto-derived requires_rank floors (ADR 0084) and the goal scope wall run on routed tasks exactly as on authored ones. Deps R01.' },
+  { ref:'R11', kind:'feature',  disc:'engineer', prio:4, est:180, crit:['C1','C3'], deps:['R01'],           title:'R11 · Discord #bugs retired onto the routing path', desc:'Replace discord-bugs.js\'s direct createTask bypass (hardcoded GDS-V3 → goal 1000002 catch-all; destroys attribution) with capture-time routing: idea row + classifier-suggested goal (suggested_goal_id), soft-landing into the pending queue for a one-click Metic+ route. Unlinked authors still yield an attributable idea row (captured_by null). Closes inbox idea 1000771. Deps R01.' },
+  { ref:'R12', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C5'],      deps:['R02'],           title:'R12 · Discord #ideas carries routing hints', desc:'The #ideas inbound (discord-inbound.js) files with no suggested_version at all today. Add: default suggested_version (most-recent building), classifier-suggested suggested_goal_id. Deps R02.' },
+  { ref:'R08', kind:'feature',  disc:'ui',       prio:4, est:240, crit:['C1','C5'], deps:['R01','R07'],     title:'R08 · Hall filing surface: file a bug/idea with a goal picker', desc:'The hall has NO capture surface today (triage only). Add file-a-bug/idea: title, body, kind, goal picker fed by the suggester (R07); submits to POST /inbox with goal_id so goal-bound work routes at filing time. Grade capture untouched. Deps R01,R07.' },
+  { ref:'R09', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C1','C5'], deps:['R01','R07'],     title:'R09 · CLI capture routing: --goal, suggester prompt, active-claim default', desc:'capture.js gains --goal; when the builder holds a claim the suggested goal defaults to the claim\'s goal (interview decision 4); suggester candidates offered otherwise. Deps R01,R07.' },
+  { ref:'R13', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C2','C6'], deps:['R07'],           title:'R13 · Promote path passes goal_id; /idea-triage goes homeless-only', desc:'task-detail.js (:320) and triage.js (:160) finally send goal_id (suggester-fed default) so even triaged promotions land in a real goal; the /idea-triage skill doc is updated to the homeless-only contract. Deps R07.' },
+
+  // T4 — proofs — P3
+  { ref:'R04', kind:'verify',   disc:'engineer', prio:3, est:90,  crit:['C3'],      deps:['R01'],           title:'R04 · PROOF: attribution survives the route end-to-end', desc:'A routed bug\'s task ships; sourceIdeaForTask returns the filer; ideas_task_lineage (origin=route) + captured_by intact — the trail goal 1000067\'s ideator credit will pay against (test). Deps R01.' },
+  { ref:'R06', kind:'verify',   disc:'engineer', prio:3, est:120, crit:['C4'],      deps:['R05'],           title:'R06 · PROOF: abuse matrix — filing cannot escalate', desc:'A Xenos mass-filing bugs never lands claimable work, never reaches protected scope, rate limits hold; a sub-Metic cannot reach ready via any capture vector (test suite). Deps R05.' },
+
+  // T5 — the measured close — P2
+  { ref:'R15', kind:'verify',   disc:'engineer', prio:2, est:120, crit:['C2','C6'], deps:['R01','R05','R13'], title:'R15 · PROOF: reclassification sweep of the open inbox', desc:'Walk the open idea_inbox (~50 rows at planning time; 14 bugs) under the new rules: every goal-bound bug homed in a real goal; residual inbox is homeless-only; before/after counts recorded in this task\'s notes as the goal\'s measured evidence. Deps R01,R05,R13.' },
+];
+
+const ROOTS = ['R02', 'R03', 'R07', 'R10', 'R14']; // zero-dep, non-spike → open for claiming
+
+(async () => {
+  const idByRef = {};
+  let created = 0, existing = 0;
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc,
+      kind: t.kind, discipline: t.disc, priority: t.prio, est_minutes: t.est,
+      criterion_ids: t.crit.map((c) => CRIT[c]), source: SRC, source_ref: `bongos-v1-idea-routing-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    const task = r.json.task || r.json;
+    idByRef[t.ref] = task.id;
+    if (r.json.idempotent || r.json.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    const depIds = t.deps.map((d) => idByRef[d]).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) { console.log(`  ${t.ref}: dep resolve gap, skipping`); continue; }
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) { console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    edges += (r.json.added || depIds.length);
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting the zero-dep layer to ready…');
+  for (const ref of ROOTS) {
+    const id = idByRef[ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.json).slice(0, 120)}`);
+  }
+
+  console.log('Linking provenance…');
+  if (idByRef.R11) {
+    const r = await api('PATCH', `/inbox/${DISCORD_BUGS_IDEA}`, { status: 'promoted', promoted_to_task_id: Number(idByRef.R11) });
+    console.log(`  idea ${DISCORD_BUGS_IDEA} → ${r.ok ? `promoted against R11 (task ${idByRef.R11})` : 'PATCH note ' + JSON.stringify(r.json).slice(0, 160)}`);
+  }
+  const meta = await api('PATCH', `/tasks/${META_TASK}`, { goal_id: GOAL });
+  console.log(`  meta task ${META_TASK} → ${meta.ok ? `goal ${GOAL}` : 'PATCH note ' + JSON.stringify(meta.json).slice(0, 160)}`);
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}. Roots opened: ${ROOTS.join(', ')}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();

package/src/module-api.js

@@ -843,8 +843,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.206 with no explicit bump. run 32065995444. (task 1002620)
 //   1.19.208 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.207 with no explicit bump. run 32068332007. (task 1002620)
+//   1.19.209 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.208 with no explicit bump. run 32072227661. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.208'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.209'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');