@bongos/core 1.19.213 → 1.19.214

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.213",
-  "core_contract": "1.19.213",
-  "source_commit": "7cd1ca35002e12c66a3937a55bf8c9e6e69fd231",
+  "core_version": "1.19.214",
+  "core_contract": "1.19.214",
+  "source_commit": "33a353b2b8d41b5d78870cf04e367ba35270db01",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T23:35:49.388Z",
+  "built_at": "2026-08-17T23:48:10.122Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1633,
-  "tree_sha256": "08e3fcc476f1d9209616049d1d79c946c56394953d7891706e2e41f8e3b28067",
+  "tree_sha256": "42e8f882bc77acfe1def79c56518e80678fb0bd4d4b635f94d013e55474b1ac1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3557,7 +3557,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "7fa58e9a9c09ba4857d57fe7cc1ed36d827d34f8cc1119ae42dc9dffdd4653b5"
+      "sha256": "3d88ff6be3d8378f0cf2826af92437dfafbeb589a677aa8928d9f325124eac5b"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3652,7 +3652,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "a291701ef3b3f8bb548d8e3475707e52562d0c9f03d334a885ff2022c90358dc"
+      "sha256": "9e963e289039a6b1c64b17deae161895876831de20e4e06b947ea3b3f49afdf6"
     },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b9113d8027c9a36b9d9923e3a850c655a0dfb57ce59633ba81042f1116127882"
+      "sha256": "02845f76d2382f9e1568f039c838a34505297ae619cdb9cdbe5d8b583cd1dd40"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "27122dc34fcd4dbe96f345a2cdf6045447a4a94a20217e43f52c803e25576e02"
+      "sha256": "6abe7a4d894357f207a16ab1735c642f46e2f5905d3845c436b6df438f66a3ac"
     },
     {
       "path": "public-docs/index.html",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c59f5553c52308967b71da155eab8249d7c8687a37184626b4c4b03ccf2d9fc7"
+      "sha256": "53487d418120e292c09bc2f647581d2541fbf7966052420827b8d6c49c77940d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6797,7 +6797,7 @@
     {
       "path": "tests/goal_membership_requests.mjs",
       "mode": "0000644",
-      "sha256": "4bc1ecb2bec4345b55e074a06009d31f97e4b5e06b214669a72e485298307ac8"
+      "sha256": "660dd4143c21de0fe81b4507f3cb9f0731e5722e6c77806de8327156b18198f6"
     },
     {
       "path": "tests/goal_routes.mjs",
@@ -6812,7 +6812,7 @@
     {
       "path": "tests/goal_tier.mjs",
       "mode": "0000644",
-      "sha256": "508b8b99afe67f64c86b5e1b382052e02a4cc916bec58e28d396ba3716998baf"
+      "sha256": "c2e37bb797c1e9af23970bfee7587b16cd13f1fac23c0e334a5ea0d362174491"
     },
     {
       "path": "tests/goal_wall_proof.mjs",

package/modules/lifecycle/db.js

@@ -854,15 +854,48 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
 // owner's row — bypassing authorizeMemberRoleChange's owner-only-demotion
 // guards. Role changes go through PATCH /goals/:id/members/:builderId only
 // (the acceptMembershipRequestAndAddMember precedent). role defaults to 'member'.
+//
+// ARRIVING AS A MEMBER CLOSES ANY PENDING ASK (task 1002888 / idea 1000688).
+// The membership write used to be a bare upsert that never looked at
+// goal_membership_requests, so a builder's pending row SURVIVED their arrival by
+// any other route — the goal flips to public and they self-join, or an Archon
+// adds them directly. The stale row lingered in the owner/manager inbox, a later
+// approve resolved a request for an existing member, and a later deny stamped
+// 'rejected' on someone who is in fact a member. Harmless to access control,
+// wrong in the audit trail.
+//
+// BOTH kinds are cancelled, not just 'request'. The partial-unique index
+// (core_188: one pending row per goal+builder, either direction) means there is
+// at most ONE pending row to close, and a stale pending INVITE is the same bug
+// mirrored — the invitee could later decline an invitation to a goal they are
+// already in, stamping 'rejected' on a member. 'cancelled' is the right terminal
+// state (core_188: "withdrawn/rescinded"); 'accepted' stays reserved for an
+// accept/approve flow that actually ran, so the inbox history never claims a
+// decision nobody made. resolvedBy is the ACTOR — the joiner themselves on
+// /join, the adding owner/manager/Archon on /members.
+//
+// One CTE, not two queries — the acceptMembershipRequestAndAddMember precedent:
+// the cancel commits with the membership write or not at all, so an error
+// between them can't leave the pair half-applied. The two arms are independent
+// (Postgres runs a data-modifying CTE to completion whether or not the primary
+// query reads it), and both see the same snapshot.
 
-async function addGoalMember({ goalId, builderId, role = 'member' }, deps = {}) {
+async function addGoalMember({ goalId, builderId, role = 'member', resolvedBy = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    `INSERT INTO goal_members (goal_id, builder_id, role)
-          VALUES ($1, $2, $3)
-     ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
-     RETURNING goal_id, builder_id, role, joined_at`,
-    [goalId, builderId, role]
+    `WITH added AS (
+       INSERT INTO goal_members (goal_id, builder_id, role)
+            VALUES ($1, $2, $3)
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
+       RETURNING goal_id, builder_id, role, joined_at
+     ), cancelled AS (
+       UPDATE goal_membership_requests
+          SET status = 'cancelled', resolved_by = $4, resolved_at = now(), updated_at = now()
+        WHERE goal_id = $1 AND builder_id = $2 AND status = 'pending'
+       RETURNING id
+     )
+     SELECT goal_id, builder_id, role, joined_at FROM added`,
+    [goalId, builderId, role, resolvedBy]
   );
   return rows[0];
 }

package/modules/lifecycle/routes/goals.js

@@ -580,7 +580,10 @@ module.exports = function buildGoalsRouter() {
           return res.fail('goal_private', { status: 409, message: 'This goal is private — request to join (POST /goals/:id/requests) or wait for an invitation.' });
         }
       }
-      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, role: 'member' });
+      // resolvedBy: the joiner — arriving as a member cancels their own still-
+      // pending ask on this goal, atomically with the membership write (task
+      // 1002888). Self-joining is the same intent as withdrawing the request.
+      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, role: 'member', resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/join', err);
@@ -939,7 +942,10 @@ module.exports = function buildGoalsRouter() {
       if (scopeIncludesProtected(goal.scope_modules) && !METIC_PLUS.includes(target.rank)) {
         return res.fail('metic_required_for_protected_scope', { status: 403, message: 'A protected-scope goal requires a Metic+ member; sub-Metic membership is deferred to the Phase-5 ADR.' });
       }
-      const member = await db.addGoalMember({ goalId: id, builderId, role });
+      // resolvedBy: the ADDER (not the target) — a direct add closes the target's
+      // pending ask, and the audit trail should name whoever admitted them
+      // (task 1002888).
+      const member = await db.addGoalMember({ goalId: id, builderId, role, resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/members', err);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.213",
+  "version": "1.19.214",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.213",
+      "version": "1.19.214",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.213",
+  "version": "1.19.214",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -853,8 +853,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.211 with no explicit bump. run 32080157462. (task 1002620)
 //   1.19.213 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.212 with no explicit bump. run 32081051255. (task 1002620)
+//   1.19.214 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.213 with no explicit bump. run 32081917908. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.213'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.214'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_membership_requests.mjs

@@ -13,6 +13,8 @@
 //   • listInboxFor — the three buckets, and that joinRequests gates on
 //     owner (goals.created_by) OR manager (goal_members 'lead').
 //   • listPendingRequestsForGoal — pending both-kinds for one goal.
+//   • addGoalMember (task 1002888) — arriving as a member by ANY route cancels
+//     that builder's still-pending ask, atomically and kind-agnostically.
 //   • the migration is additive + private-safe (default 'public', partial unique).
 
 import { strict as assert } from 'node:assert';
@@ -31,6 +33,7 @@ const {
   getMembershipRequest,
   resolveMembershipRequest,
   acceptMembershipRequestAndAddMember,
+  addGoalMember,
   listInboxFor,
   listPendingRequestsForGoal,
 } = require('../modules/lifecycle/db.js');
@@ -190,6 +193,92 @@ await test('listPendingRequestsForGoal: pending both-kinds for one goal', async
   assert.deepEqual(find(pool.queries, /goal_membership_requests/).params, [5]);
 });
 
+// =========================================================================
+// addGoalMember — arriving as a member CLOSES any pending ask (task 1002888 /
+// idea 1000688). The bug: the membership write was a bare upsert that never
+// read goal_membership_requests, so a pending row survived the builder's
+// arrival by any OTHER route (visibility flips to public and they self-join;
+// an Archon adds them directly). The stale row sat in the owner/manager inbox,
+// a later approve resolved a request for an existing member, and a later deny
+// stamped 'rejected' on someone who is in fact a member.
+// =========================================================================
+
+const ADD_MEMBER_ROW = { goal_id: 7, builder_id: 42, role: 'member', joined_at: 'T0' };
+const addMemberPool = () => fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [ADD_MEMBER_ROW] } : null));
+
+// join-cancels-request: the joiner arrives under their own steam.
+await test('addGoalMember: a join cancels the joiner\'s pending ask in ONE statement', async () => {
+  const pool = addMemberPool();
+  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member', resolvedBy: 42 }, { pool });
+  assert.deepEqual(out, ADD_MEMBER_ROW, 'still returns the member row — the route response shape is unchanged');
+  assert.equal(pool.queries.length, 1, 'ONE statement: the cancel commits with the membership write or not at all');
+  const q = find(pool.queries, /^WITH added AS/);
+  assert.ok(/INSERT INTO goal_members[\s\S]*ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/.test(norm(q.sql)),
+    'the membership upsert is the first arm, role still preserved (task 1002689)');
+  assert.ok(/UPDATE goal_membership_requests[\s\S]*SET status = 'cancelled', resolved_by = \$4/.test(norm(q.sql)),
+    'the second arm closes the ask as cancelled, attributed to the actor');
+  assert.ok(/WHERE goal_id = \$1 AND builder_id = \$2 AND status = 'pending'/.test(norm(q.sql)),
+    'scoped to THIS goal+builder, and only a pending row');
+  assert.deepEqual(q.params, [7, 42, 'member', 42], 'goal, builder, role, resolvedBy — in that order');
+});
+
+// add-cancels-request: an owner/manager/Archon admits them directly. Same
+// statement; resolvedBy is the ADDER, so the audit trail names who admitted them.
+await test('addGoalMember: a direct member-add cancels the target\'s pending ask, attributed to the adder', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, role: 'lead', resolvedBy: 99 }, { pool });
+  const q = find(pool.queries, /^WITH added AS/);
+  assert.deepEqual(q.params, [7, 42, 'lead', 99],
+    'resolved_by is the ADDER (99), not the target (42) — who admitted them is the audit fact');
+});
+
+// The mirror-case decision (task 1002888): a stale pending INVITE is the same
+// bug reflected — the invitee could later decline an invitation to a goal they
+// are already in, stamping 'rejected' on a member. core_188's partial-unique
+// index allows at most ONE pending row per (goal, builder) in EITHER direction,
+// so "any pending row" is unambiguous and the cancel is deliberately kind-blind.
+await test('addGoalMember: the cancel is kind-AGNOSTIC — a stale pending invite closes too', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, resolvedBy: 42 }, { pool });
+  const cancelArm = norm(find(pool.queries, /^WITH added AS/).sql).match(/UPDATE goal_membership_requests.*?RETURNING id/)[0];
+  assert.ok(!/kind\s*=/.test(cancelArm),
+    'no kind filter: both a pending request and a pending invite are closed by arrival');
+});
+
+// 'accepted' stays reserved for an accept/approve flow that actually ran, so the
+// inbox history never claims a decision nobody made; resolved rows are the audit
+// trail and must survive untouched.
+await test('addGoalMember: closes as \'cancelled\' (never \'accepted\'), and only pending rows', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42, resolvedBy: 42 }, { pool });
+  const sql = norm(find(pool.queries, /^WITH added AS/).sql);
+  assert.ok(!/status = 'accepted'/.test(sql), "arrival never fabricates an 'accepted' decision");
+  assert.ok(/status = 'pending'/.test(sql), 'already-resolved rows stay as the audit trail');
+});
+
+await test('addGoalMember: resolvedBy defaults to null for a non-route caller', async () => {
+  const pool = addMemberPool();
+  await addGoalMember({ goalId: 7, builderId: 42 }, { pool });
+  assert.equal(find(pool.queries, /^WITH added AS/).params[3], null);
+});
+
+// Both route call sites must actually SUPPLY the actor — the db helper defaults
+// resolvedBy to null, so a missed wire-up would silently drop the attribution
+// while still cancelling. The routes are verified against live Postgres (see
+// goal_routes.mjs header), so this pins the wiring at the source level.
+await test('routes: both /join and /members pass resolvedBy to addGoalMember', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const calls = src.match(/db\.addGoalMember\(\{[^}]*\}\)/g) || [];
+  assert.equal(calls.length, 2, 'exactly two membership-add call sites: POST /join and POST /members');
+  for (const c of calls) {
+    assert.ok(/resolvedBy:\s*req\.builder\.id/.test(c),
+      `every membership add attributes the cancel to the acting builder — got: ${c}`);
+  }
+  assert.ok(calls.some((c) => /builderId:\s*req\.builder\.id/.test(c)), '/join adds the caller themselves');
+  assert.ok(calls.some((c) => /builderId,/.test(c)), '/members adds the named target builder');
+});
+
 // =========================================================================
 // The migration is additive + private-safe
 // =========================================================================

package/tests/goal_tier.mjs

@@ -154,20 +154,25 @@ await test('setGoalStatus: unknown goal returns null', async () => {
 // =========================================================================
 // addGoalMember
 // =========================================================================
+// task 1002888 wrapped the bare upsert in a CTE that also cancels any pending
+// membership request, so the statement now STARTS with `WITH added AS (` — the
+// INSERT is the first arm. The pending-ask cancellation itself is pinned in
+// tests/goal_membership_requests.mjs; here we only re-anchor the role contract.
 await test('addGoalMember: upsert PRESERVES the existing role (re-join cannot demote a lead)', async () => {
-  const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
+  const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
   const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member' }, { pool });
   assert.equal(out.role, 'lead', 'an existing lead row survives a role:member re-add');
-  const ins = find(pool.queries, /^INSERT INTO goal_members/);
-  assert.deepEqual(ins.params, [7, 42, 'member']);
+  const ins = find(pool.queries, /^WITH added AS/);
+  assert.deepEqual(ins.params, [7, 42, 'member', null], 'resolvedBy defaults to null when no actor is supplied');
+  assert.match(ins.sql, /INSERT INTO goal_members/, 'the membership write is the first CTE arm');
   assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/,
     'conflict keeps the stored role — role changes go through PATCH /goals/:id/members/:builderId only (task 1002689)');
 });
 
 await test('addGoalMember: role defaults to member', async () => {
-  const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [MEMBER_ROW] } : null));
+  const pool = fakePool((s) => (/^WITH added AS/.test(s) ? { rows: [MEMBER_ROW] } : null));
   await addGoalMember({ goalId: 7, builderId: 42 }, { pool });
-  assert.equal(find(pool.queries, /^INSERT INTO goal_members/).params[2], 'member');
+  assert.equal(find(pool.queries, /^WITH added AS/).params[2], 'member');
 });
 
 // =========================================================================