@bongos/core 1.19.214 → 1.19.215

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.214",
-  "core_contract": "1.19.214",
-  "source_commit": "33a353b2b8d41b5d78870cf04e367ba35270db01",
+  "core_version": "1.19.215",
+  "core_contract": "1.19.215",
+  "source_commit": "697713806bfbd222ba0423c021aee84f56218f10",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T23:48:10.122Z",
+  "built_at": "2026-08-18T00:22:11.691Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1633,
-  "tree_sha256": "42e8f882bc77acfe1def79c56518e80678fb0bd4d4b635f94d013e55474b1ac1",
+  "tree_sha256": "61d4b6bf40452f45053fe94cf02b44d682b2aed0e9684b0799a0d33eda1f675d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1372,7 +1372,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "274bd57fc6c0b83aba02cedb5cc6daa2fca4a9d74ae5268e527a81ebc10b50e0"
+      "sha256": "675d873f35c886145c80d954b885692ef0608b4e5b1b843943611f59260eceed"
     },
     {
       "path": "docs/architecture.md",
@@ -3652,7 +3652,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "9e963e289039a6b1c64b17deae161895876831de20e4e06b947ea3b3f49afdf6"
+      "sha256": "8763c40223e27e9d6fc65ea76442e479301407ba70e77b9582c5ffcd09f17a11"
     },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "02845f76d2382f9e1568f039c838a34505297ae619cdb9cdbe5d8b583cd1dd40"
+      "sha256": "5a687e1b2df8e52068aaa27dfa92dd50ed65164905c74f9fe121750d023e95d9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6abe7a4d894357f207a16ab1735c642f46e2f5905d3845c436b6df438f66a3ac"
+      "sha256": "6b2203d8fa449d80e6ff225fd5f8dbe4969b4a72ca94ff61e478635fb754d445"
     },
     {
       "path": "public-docs/index.html",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "53487d418120e292c09bc2f647581d2541fbf7966052420827b8d6c49c77940d"
+      "sha256": "e2884e30e53fd3fe3c121df94ce9738bde706f3ddb414c023e6fd546ec1777ab"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6797,7 +6797,7 @@
     {
       "path": "tests/goal_membership_requests.mjs",
       "mode": "0000644",
-      "sha256": "660dd4143c21de0fe81b4507f3cb9f0731e5722e6c77806de8327156b18198f6"
+      "sha256": "59253dac0064ae1a9c7dd67ef87c1d32ff924d3c3dadf7cdb9553dbc76f88eb0"
     },
     {
       "path": "tests/goal_routes.mjs",

package/docs/api/openapi.json

@@ -4276,7 +4276,7 @@
           "goals"
         ],
         "summary": "POST /goals/:id/invitations/:reqId/respond",
-        "description": "POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the invited builder resolves their OWN pending invite (task 1952). accept → they're added as a member; decline → the row is rejected. A protected-scope goal still requires a Metic+ member, re-checked against the accepting builder's current rank (the goal could have been re-scoped after the invite). rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the invited builder resolves their OWN pending invite (task 1952). accept → they're added as a member (only while the goal is still OPEN, and a protected-scope goal still requires a Metic+ member — both re-checked against the CURRENT goal row by authorizeInvitationAccept, task 1002887); decline → the row is rejected, allowed whatever the goal's state, since that is inbox cleanup rather than admission. rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/goals.js",
         "parameters": [

package/modules/lifecycle/routes/goals.js

@@ -324,6 +324,44 @@ function authorizeInvitationResponse({ request, goalId, actorId }) {
   return { ok: true };
 }
 
+// authorizeInvitationAccept — the ORDERED, FAIL-CLOSED gate for the ACCEPT half of
+// POST /goals/:id/invitations/:reqId/respond, run against the GOAL after
+// authorizeInvitationResponse has cleared the request row (task 1002887).
+//
+// Accepting is an ADMISSION, so it needs the same goal-state floor every other
+// admission path already has: the create side requires an open goal
+// (authorizeGoalManagement) and the join-request approve side inherits that check
+// verbatim — only invitation-accept was missing it, so an invite issued while a
+// goal was open could still add a member AFTER the goal was achieved or archived.
+// DECLINE is deliberately NOT gated here: clearing a stale invitation out of your
+// inbox is cleanup, not admission (the route returns before calling this).
+// Ordering mirrors the sibling routes: goal_not_found → goal_not_open →
+// metic_required_for_protected_scope (the pre-existing protected-scope membership
+// floor, re-asserted against the ACCEPTING builder's current rank because the goal
+// may have been re-scoped since the invite; the actor-is-Archon half of
+// protectedScopeAdmissionBlock does not apply — the invitee is consenting).
+//
+// Unlike its {status, body} siblings this returns a res.fail SPEC ({ code, status,
+// message, details }) because the accept branch already answers through res.fail —
+// routing it through the envelope keeps the existing metic_required_for_protected_scope
+// response byte-identical while still being PURE + exported for DB-free tests.
+function authorizeInvitationAccept({ goal, scopeProtected, actorRank }) {
+  if (!goal) {
+    return { ok: false, code: 'goal_not_found', status: 404,
+      message: 'The goal behind this invitation no longer exists.' };
+  }
+  if (goal.status !== 'open') {
+    return { ok: false, code: 'goal_not_open', status: 409,
+      message: 'This goal is no longer open — an invitation can only be accepted while it is. You can still decline it.',
+      details: { status: goal.status } };
+  }
+  if (scopeProtected && !METIC_PLUS.includes(actorRank)) {
+    return { ok: false, code: 'metic_required_for_protected_scope', status: 403,
+      message: 'This goal is scoped to a protected module and requires a Metic+ member.' };
+  }
+  return { ok: true };
+}
+
 // authorizeJoinRequestResponse — the gate for POST /goals/:id/requests/:reqId/respond
 // (task 1952): an owner|manager|Archon approves/denies a pending join-request. The
 // authority prefix is authorizeGoalManagement VERBATIM (goal exists/open + owner|
@@ -789,9 +827,10 @@ module.exports = function buildGoalsRouter() {
 
   // POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the
   // invited builder resolves their OWN pending invite (task 1952). accept → they're
-  // added as a member; decline → the row is rejected. A protected-scope goal still
-  // requires a Metic+ member, re-checked against the accepting builder's current rank
-  // (the goal could have been re-scoped after the invite).
+  // added as a member (only while the goal is still OPEN, and a protected-scope goal
+  // still requires a Metic+ member — both re-checked against the CURRENT goal row by
+  // authorizeInvitationAccept, task 1002887); decline → the row is rejected, allowed
+  // whatever the goal's state, since that is inbox cleanup rather than admission.
   // rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.
   router.post('/goals/:id/invitations/:reqId/respond', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res, { code: 'bad_goal_id' });
@@ -814,13 +853,14 @@ module.exports = function buildGoalsRouter() {
         return res.json({ ok: true, action, request: resolved });
       }
 
-      // accept — re-assert the protected-scope Metic+ membership invariant against
-      // the accepting builder's CURRENT rank (the goal may have been re-scoped since
-      // the invite). The invitee is consenting, so the actor-is-Archon half of the
-      // admission rule does NOT apply here — only the Metic+ membership floor does.
+      // accept — the goal-state + protected-scope floor, read against the goal's
+      // CURRENT row (fail-closed if it is gone). See authorizeInvitationAccept.
       const goal = await db.getGoal(id);
-      if (goal && scopeIncludesProtected(goal.scope_modules) && !METIC_PLUS.includes(req.builder.rank)) {
-        return res.fail('metic_required_for_protected_scope', { status: 403, message: 'This goal is scoped to a protected module and requires a Metic+ member.' });
+      const admit = authorizeInvitationAccept({
+        goal, scopeProtected: !!goal && scopeIncludesProtected(goal.scope_modules), actorRank: req.builder.rank,
+      });
+      if (!admit.ok) {
+        return res.fail(admit.code, { status: admit.status, message: admit.message, details: admit.details });
       }
       // Resolve + add atomically (one statement) — never an 'accepted' invite
       // with no membership (the task-1952 review fix).
@@ -1505,6 +1545,9 @@ module.exports.RESOLVE_ACTIONS = RESOLVE_ACTIONS;
 module.exports.protectedScopeAdmissionBlock = protectedScopeAdmissionBlock;
 module.exports.authorizeCreateJoinRequest = authorizeCreateJoinRequest;
 module.exports.authorizeInvitationResponse = authorizeInvitationResponse;
+// task 1002887: the goal-state floor on the ACCEPT half of the invitation-respond
+// route — exported for tests/goal_membership_requests.mjs, same precedent.
+module.exports.authorizeInvitationAccept = authorizeInvitationAccept;
 module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
 // task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
 // same precedent as its siblings above.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.214",
+  "version": "1.19.215",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.214",
+      "version": "1.19.215",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.214",
+  "version": "1.19.215",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -855,8 +855,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.212 with no explicit bump. run 32081051255. (task 1002620)
 //   1.19.214 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.213 with no explicit bump. run 32081917908. (task 1002620)
+//   1.19.215 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.214 with no explicit bump. run 32084187695. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.214'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.215'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_membership_requests.mjs

@@ -15,6 +15,9 @@
 //   • listPendingRequestsForGoal — pending both-kinds for one goal.
 //   • addGoalMember (task 1002888) — arriving as a member by ANY route cancels
 //     that builder's still-pending ask, atomically and kind-agnostically.
+//   • authorizeInvitationAccept (task 1002887) — accepting an invite re-checks the
+//     goal is still OPEN (a stale invite can't admit to an achieved/archived goal);
+//     declining stays allowed, so the route declines before ever reading the goal.
 //   • the migration is additive + private-safe (default 'public', partial unique).
 
 import { strict as assert } from 'node:assert';
@@ -42,6 +45,7 @@ const {
   protectedScopeAdmissionBlock,
   authorizeCreateJoinRequest,
   authorizeInvitationResponse,
+  authorizeInvitationAccept,
   authorizeJoinRequestResponse,
   authorizeWithdrawJoinRequest,
   decorateGoalScope,
@@ -370,6 +374,54 @@ await test('authorizeInvitationResponse: the invitee (string vs number id) → A
   assert.deepEqual(authorizeInvitationResponse({ request: INVITE, goalId: '5', actorId: 2 }), { ok: true });
 });
 
+// authorizeInvitationAccept (task 1002887) — the goal-state floor on ACCEPT only.
+const OPEN_GOAL = { id: 5, status: 'open', scope_modules: null };
+await test('authorizeInvitationAccept: open, unprotected goal → ALLOW', () => {
+  assert.deepEqual(authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: false, actorRank: 'thetes' }), { ok: true });
+});
+await test('authorizeInvitationAccept: the goal is gone → 404 (fail-closed, never a member of nothing)', () => {
+  const d = authorizeInvitationAccept({ goal: null, scopeProtected: false, actorRank: 'archon' });
+  assert.equal(d.ok, false); assert.equal(d.status, 404); assert.equal(d.code, 'goal_not_found');
+});
+for (const status of ['achieved', 'archived']) {
+  await test(`authorizeInvitationAccept: ${status} goal → 409 goal_not_open (a stale invite can't admit)`, () => {
+    const d = authorizeInvitationAccept({ goal: { ...OPEN_GOAL, status }, scopeProtected: false, actorRank: 'archon' });
+    assert.equal(d.ok, false); assert.equal(d.status, 409); assert.equal(d.code, 'goal_not_open');
+    assert.deepEqual(d.details, { status }, 'carries the blocking status, like every sibling goal_not_open');
+  });
+}
+await test('authorizeInvitationAccept: goal-state is checked BEFORE scope (ordering, like the join route)', () => {
+  const d = authorizeInvitationAccept({ goal: { ...OPEN_GOAL, status: 'archived' }, scopeProtected: true, actorRank: 'thetes' });
+  assert.equal(d.code, 'goal_not_open', 'a closed goal refuses on state, not on the scope floor');
+});
+await test('authorizeInvitationAccept: open + protected + sub-Metic invitee → 403 metic_required (unchanged)', () => {
+  const d = authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: true, actorRank: 'thetes' });
+  assert.equal(d.status, 403); assert.equal(d.code, 'metic_required_for_protected_scope');
+  assert.equal(d.message, 'This goal is scoped to a protected module and requires a Metic+ member.');
+  assert.equal(d.details, undefined, 'no details — the res.fail envelope stays byte-identical to the pre-1002887 response');
+});
+await test('authorizeInvitationAccept: open + protected + Metic invitee → ALLOW (consent, no Archon actor needed)', () => {
+  assert.deepEqual(authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: true, actorRank: 'metic' }), { ok: true });
+});
+
+// DECLINE stays allowed on a closed goal — clearing a stale invitation out of your
+// inbox is cleanup, not admission. The route's decline branch must therefore return
+// BEFORE the goal is ever fetched; pinned at the source level (the addGoalMember
+// resolvedBy precedent above), since the live route is exercised in goal_routes.mjs.
+await test('routes: invitation-respond declines before the goal-state gate', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const handler = src.slice(src.indexOf("router.post('/goals/:id/invitations/:reqId/respond'"));
+  const body = handler.slice(0, handler.indexOf('\n  });'));
+  const declineAt = body.indexOf("if (action === 'decline')");
+  const gateAt = body.indexOf('authorizeInvitationAccept({');
+  assert.ok(declineAt > 0 && gateAt > 0, 'both branches present in the respond handler');
+  assert.ok(declineAt < gateAt, 'decline resolves and returns before the accept-only goal gate');
+  assert.ok(body.indexOf('db.getGoal(') > declineAt, 'decline never even reads the goal');
+  assert.ok(gateAt < body.indexOf('db.acceptMembershipRequestAndAddMember('),
+    'the gate runs before the membership add');
+});
+
 // authorizeJoinRequestResponse — owner|manager|Archon resolves a join-request.
 const OWNER_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
 const REQUEST = { id: 8, goal_id: '5', builder_id: '2', kind: 'request', status: 'pending' };