@bongos/core 1.19.237 → 1.19.239

package/modules/lifecycle/db.js

@@ -695,7 +695,7 @@ async function createGoal(
             SELECT $1, $2, $3, $4, $5, $6, next_order.n FROM next_order
        RETURNING ${GOAL_COLS}
      ), first_lead AS (
-       INSERT INTO goal_members (goal_id, builder_id, role)
+       INSERT INTO goal_members (goal_id, builder_id, membership_kind)
        SELECT g.id, $6::bigint, 'lead' FROM g WHERE $6::bigint IS NOT NULL
      )
      SELECT * FROM g`,
@@ -848,12 +848,18 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
 }
 
 // addGoalMember — join. Upserts on the (goal_id, builder_id) PK so a re-join is
-// not a duplicate-key error, and the conflict arm PRESERVES the stored role
-// (task 1002689): overwriting it let POST /goals/:id/join (always role 'member')
-// and a POST /goals/:id/members re-add silently demote a lead — including the
-// owner's row — bypassing authorizeMemberRoleChange's owner-only-demotion
-// guards. Role changes go through PATCH /goals/:id/members/:builderId only
-// (the acceptMembershipRequestAndAddMember precedent). role defaults to 'member'.
+// not a duplicate-key error, and the conflict arm PRESERVES the stored
+// membership_kind (task 1002689): overwriting it let POST /goals/:id/join (always
+// 'member') and a POST /goals/:id/members re-add silently demote a lead —
+// including the owner's row — bypassing authorizeMembershipKindChange's
+// owner-only-demotion guards. Changes go through PATCH
+// /goals/:id/members/:builderId only (the acceptMembershipRequestAndAddMember
+// precedent). membershipKind defaults to 'member'.
+
+// THE COLUMN IS `membership_kind` (task 1003013, ADR 0177 — ADR 0174 reserves the
+// other word for the three crafts). The legacy column still EXISTS for one
+// release, kept in lockstep by core_220's trigger so a rolled-back deploy still
+// reads a schema it understands: write the new name only, step 2 drops the old.
 //
 // ARRIVING AS A MEMBER CLOSES ANY PENDING ASK (task 1002888 / idea 1000688).
 // The membership write used to be a bare upsert that never looked at
@@ -880,22 +886,22 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
 // (Postgres runs a data-modifying CTE to completion whether or not the primary
 // query reads it), and both see the same snapshot.
 
-async function addGoalMember({ goalId, builderId, role = 'member', resolvedBy = null }, deps = {}) {
+async function addGoalMember({ goalId, builderId, membershipKind = 'member', resolvedBy = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `WITH added AS (
-       INSERT INTO goal_members (goal_id, builder_id, role)
+       INSERT INTO goal_members (goal_id, builder_id, membership_kind)
             VALUES ($1, $2, $3)
-       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
-       RETURNING goal_id, builder_id, role, joined_at
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET membership_kind = goal_members.membership_kind
+       RETURNING goal_id, builder_id, membership_kind, joined_at
      ), cancelled AS (
        UPDATE goal_membership_requests
           SET status = 'cancelled', resolved_by = $4, resolved_at = now(), updated_at = now()
         WHERE goal_id = $1 AND builder_id = $2 AND status = 'pending'
        RETURNING id
      )
-     SELECT goal_id, builder_id, role, joined_at FROM added`,
-    [goalId, builderId, role, resolvedBy]
+     SELECT goal_id, builder_id, membership_kind, joined_at FROM added`,
+    [goalId, builderId, membershipKind, resolvedBy]
   );
   return rows[0];
 }
@@ -917,9 +923,9 @@ async function listGoalMembers(goalId, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   // Builder identity rides along (task 1734: the hall Goals page renders member
   // names + lead badges) — additive columns, so every existing consumer that
-  // reads only {goal_id, builder_id, role} is untouched.
+  // reads only {goal_id, builder_id, membership_kind} is untouched.
   const { rows } = await activePool.query(
-    `SELECT gm.goal_id, gm.builder_id, gm.role, gm.joined_at,
+    `SELECT gm.goal_id, gm.builder_id, gm.membership_kind, gm.joined_at,
             b.github_login, b.display_name, b.avatar_url, b.rank
        FROM goal_members gm
        LEFT JOIN builders b ON b.id = gm.builder_id
@@ -993,14 +999,15 @@ async function isGoalMember({ goalId, builderId }, deps = {}) {
   return rows.length > 0;
 }
 
-// getGoalMember — one membership row incl. role, or null. The lead-authority
-// read behind PATCH /goals/:id/members/:builderId (task 1735): the route needs
-// the actor's and the target's role, not just the isGoalMember boolean.
+// getGoalMember — one membership row incl. membership_kind, or null. The
+// lead-authority read behind PATCH /goals/:id/members/:builderId (task 1735): the
+// route needs the actor's and the target's membership_kind, not just the
+// isGoalMember boolean.
 
 async function getGoalMember({ goalId, builderId }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    `SELECT goal_id, builder_id, role, joined_at
+    `SELECT goal_id, builder_id, membership_kind, joined_at
        FROM goal_members
       WHERE goal_id = $1 AND builder_id = $2`,
     [goalId, builderId]
@@ -1008,24 +1015,24 @@ async function getGoalMember({ goalId, builderId }, deps = {}) {
   return rows[0] ?? null;
 }
 
-// setGoalMemberRole — apply a role change with the owner guard IN the statement
+// setGoalMembershipKind — apply a membership change with the owner guard IN the statement
 // (task 1735): the goal OWNER (goals.created_by) is the fixed authority, so a
 // demotion never applies to the owner's row even if two requests race past the
 // route's pure gate (the attachParent "re-check atomically" posture). Returns
 // the updated row, or null when nothing changed — no such member, or the guard
 // blocked an owner demotion — which the route answers as a conflict.
 
-async function setGoalMemberRole({ goalId, builderId, role }, deps = {}) {
+async function setGoalMembershipKind({ goalId, builderId, membershipKind }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `UPDATE goal_members gm
-        SET role = $3
+        SET membership_kind = $3
       WHERE gm.goal_id = $1 AND gm.builder_id = $2
         AND ($3 = 'lead'
              OR gm.builder_id IS DISTINCT FROM
                 (SELECT g.created_by FROM goals g WHERE g.id = $1))
-     RETURNING goal_id, builder_id, role, joined_at`,
-    [goalId, builderId, role]
+     RETURNING goal_id, builder_id, membership_kind, joined_at`,
+    [goalId, builderId, membershipKind]
   );
   return rows[0] ?? null;
 }
@@ -1047,9 +1054,9 @@ async function transferGoalOwnership({ goalId, newOwnerId }, deps = {}) {
         WHERE id = $1
        RETURNING ${GOAL_COLS}
      ), new_owner_member AS (
-       INSERT INTO goal_members (goal_id, builder_id, role)
+       INSERT INTO goal_members (goal_id, builder_id, membership_kind)
        SELECT g.id, $2, 'lead' FROM g
-       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = 'lead'
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET membership_kind = 'lead'
      )
      SELECT * FROM g`,
     [goalId, newOwnerId]
@@ -1259,7 +1266,8 @@ async function resolveMembershipRequest({ id, status, resolvedBy = null }, deps
 // WHERE status='pending' keeps it idempotent — a lost race (already resolved /
 // gone) resolves nothing, adds nobody, and returns null. On the (near-impossible,
 // since the create routes reject an existing member) membership conflict the
-// existing role is PRESERVED, so an approve never silently demotes a manager.
+// existing membership_kind is PRESERVED, so an approve never silently demotes a
+// manager.
 // Returns { request, member } or null.
 async function acceptMembershipRequestAndAddMember({ id, resolvedBy = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
@@ -1270,10 +1278,10 @@ async function acceptMembershipRequestAndAddMember({ id, resolvedBy = null }, de
         WHERE id = $1 AND status = 'pending'
        RETURNING ${MEMBERSHIP_REQUEST_COLS}
      ), added AS (
-       INSERT INTO goal_members (goal_id, builder_id, role)
+       INSERT INTO goal_members (goal_id, builder_id, membership_kind)
        SELECT goal_id, builder_id, 'member' FROM resolved
-       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
-       RETURNING goal_id, builder_id, role, joined_at
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET membership_kind = goal_members.membership_kind
+       RETURNING goal_id, builder_id, membership_kind, joined_at
      )
      SELECT (SELECT to_jsonb(r) FROM resolved r) AS request,
             (SELECT to_jsonb(a) FROM added a)    AS member`,
@@ -1320,7 +1328,7 @@ async function listInboxFor(builderId, deps = {}) {
         WHERE r.kind = 'request' AND r.status = 'pending'
           AND (g.created_by = $1
                OR EXISTS (SELECT 1 FROM goal_members gm
-                           WHERE gm.goal_id = g.id AND gm.builder_id = $1 AND gm.role = 'lead'))
+                           WHERE gm.goal_id = g.id AND gm.builder_id = $1 AND gm.membership_kind = 'lead'))
         ORDER BY r.created_at, r.id`,
       [builderId]
     ),
@@ -5590,7 +5598,7 @@ module.exports = {
   listGoalMembers,
   isGoalMember,
   getGoalMember,
-  setGoalMemberRole,
+  setGoalMembershipKind,
   transferGoalOwnership,
   listActiveClaimsForTasks,
   requestClaimRelease,

package/modules/lifecycle/goal-authz.js

@@ -5,18 +5,21 @@
 // that goal's criteria, and authorization logic must have exactly one definition.
 // routes/goals.js re-exports authorizeGoalManagement (isGoalOwner it imports for
 // internal use only), so its existing DB-free unit tests (goal_conflicts,
-// goal_member_roles, goal_membership_requests) are unchanged.
+// goal_member_kinds, goal_membership_requests) are unchanged.
 //
 // A module sibling, like ../goal-conflicts — routes consume pure files here; no
 // route requires another route.
 
 // The goal AUTHORITY MODEL (task 1735). Two layers, deliberately different kinds:
-//   - OWNER — goals.created_by, the fixed authority. Not a role row: it is set at
+//   - OWNER — goals.created_by, the fixed authority. Not a membership row: set at
 //     create time (the creator) and moves only via the explicit transfer route.
 //     The owner holds every goal power.
-//   - MANAGER — the goal_members.role 'lead' value (the hall renders it
-//     "manager"). Owner-equivalent EXCEPT: a manager cannot DEMOTE a fellow
-//     manager (owner-only), and cannot transfer ownership.
+//   - MANAGER — the goal_members.membership_kind 'lead' value (the hall renders
+//     it "manager"). Owner-equivalent EXCEPT: a manager cannot DEMOTE a fellow
+//     manager (owner-only), and cannot transfer ownership. The column is
+//     `membership_kind`, never `role` — ADR 0174 reserves that word for the three
+//     crafts, and a goal membership is neither a craft nor a rank (task 1003013,
+//     ADR 0177).
 // A goal with created_by NULL (the migration-160 system defaults) has no owner;
 // Archons act as one — the archon arm of both gates below.
 function isGoalOwner(goal, builderId) {
@@ -32,12 +35,12 @@ function isGoalOwner(goal, builderId) {
 function isGoalOwnerOrManager({ goal, actorId, actorRank, actorMembership }) {
   if (actorRank === 'archon') return true;
   if (!goal) return false;
-  return isGoalOwner(goal, actorId) || (!!actorMembership && actorMembership.role === 'lead');
+  return isGoalOwner(goal, actorId) || (!!actorMembership && actorMembership.membership_kind === 'lead');
 }
 
 // authorizeGoalManagement — the shared ORDERED, FAIL-CLOSED prefix for actions
 // a goal's own authority performs (task 1736: conflict resolution; the same
-// three steps open authorizeMemberRoleChange): goal exists → goal open →
+// three steps open authorizeMembershipKindChange): goal exists → goal open →
 // actor is owner|manager|Archon. Returns { ok:true } or { ok:false, status,
 // body }. PURE + exported, same precedent as its siblings.
 function authorizeGoalManagement({ goal, actorId, actorRank, actorMembership }) {

package/modules/lifecycle/routes/done-when.js

@@ -16,7 +16,7 @@ const auth = api;
 const doneWhen = require('../done-when');
 const db = require('../db');
 // The goal authority PREDICATE (ADR 0154) — the same owner|manager test routes/goals.js
-// uses for visibility / invites / roles, so "who may manage this goal" has
+// uses for visibility / invites / memberships, so "who may manage this goal" has
 // one definition. A module sibling, like ../db.
 const { isGoalOwnerOrManager } = require('../goal-authz');
 const { validateOrRespond, parseId, asyncHandler, LIMITS } = api;
@@ -57,7 +57,7 @@ function authorizeCriterionCreate({ goal, version, actorId, actorRank, actorMemb
   if (!isGoalOwnerOrManager({ goal, actorId, actorRank, actorMembership })) {
     return { ok: false, status: 403, body: {
       error: 'goal_not_yours',
-      message: `Criteria on goal ${goal.id} can be authored only by the goal's owner or a manager (ADR 0154). Ask them to add it — or to grant you the manager role.`,
+      message: `Criteria on goal ${goal.id} can be authored only by the goal's owner or a manager (ADR 0154). Ask them to add it — or to make you a manager.`,
     } };
   }
   if (goal.status !== 'open') {
@@ -112,7 +112,7 @@ module.exports = function buildDoneWhenRouter() {
   //     which stays Archon.
   //   - So a non-Archon must name a goal_id (version-level criteria stay Archon),
   //     must be that goal's OWNER or MANAGER (isGoalOwnerOrManager — the same
-  //     predicate behind visibility/invite/role management), and the goal must be
+  //     predicate behind visibility/invite/membership management), and the goal must be
   //     open on a planning/building version. That bounds the blast radius to a
   //     workspace they already hold. An unauthorized caller gets an honest 403
   //     goal_not_yours (task 1002614 — goal reads are open to any builder, so

package/modules/lifecycle/routes/goals.js

@@ -45,7 +45,7 @@ const goalConflicts = require('../goal-conflicts');
 const { isGoalOwner, authorizeGoalManagement } = require('../goal-authz');
 
 const VALID_GOAL_STATUSES = ['open', 'achieved', 'archived'];
-const VALID_MEMBER_ROLES = ['lead', 'member'];
+const VALID_MEMBERSHIP_KINDS = ['lead', 'member'];
 const METIC_PLUS = ['metic', 'archon'];
 const RESOLVE_ACTIONS = ['sequence', 'flag_release', 'rescope'];
 // Private goals (task 1952 / ADR 0112): the visibility values, and the resolve
@@ -131,43 +131,48 @@ function authorizeGoalTaskCreate({ goal, version, isMember, builderRank, touches
 // isGoalOwner + authorizeGoalManagement are imported at the top of this file and
 // re-exported at the bottom (task 1002538 / ADR 0154).
 
-// authorizeMemberRoleChange — the ORDERED, FAIL-CLOSED authorization decision for
-// PATCH /goals/:id/members/:builderId (task 1735). Today the only role-assignment
+// authorizeMembershipKindChange — the ORDERED, FAIL-CLOSED authorization decision
+// for PATCH /goals/:id/members/:builderId (task 1735). Today the only assignment
 // path is the Archon admission route; this gate lets the goal's own authority
-// manage roles without an Archon in the loop:
+// manage memberships without an Archon in the loop:
+//
+// THE FIELD IS `membership_kind` (task 1003013, ADR 0177): ADR 0174 reserves the
+// old word for the three crafts — Artist, Ideator, Builder — and a goal membership
+// is a per-goal position, neither a craft nor a rank.
+
 //   - the owner, a manager, or an Archon may promote member→lead(manager);
 //   - ONLY the owner (or an Archon) may demote lead(manager)→member;
 //   - the OWNER's row can never be demoted — owner authority is created_by, not
-//     the role value, so a demoted owner row would just lie to the member list.
+//     the membership value, so a demoted owner row would just lie to the list.
 // PURE + exported (the authorizeGoalTaskCreate precedent above) so every
 // rejection is pinned by a DB-free unit test. The route fetches goal /
 // memberships, then calls this; it rejects on the FIRST failure (fail-closed —
 // a missing/ambiguous input denies):
 //   goal_not_found → goal_not_open → not_owner_or_manager → not_a_member
-//   (target) → no-op same-role → owner_only_demotion → owner_role_fixed.
+//   (target) → no-op same-kind → owner_only_demotion → owner_membership_fixed.
 // Authority (not_owner_or_manager) is checked BEFORE the target lookup so an
 // unauthorized actor never learns who is or isn't a member (the O1 no-leak
-// ordering precedent in the abuse matrix). The DB helper (setGoalMemberRole)
+// ordering precedent in the abuse matrix). The DB helper (setGoalMembershipKind)
 // re-asserts the owner-demotion guard atomically in the UPDATE itself — this
 // gate is the testable contract, the SQL guard is the backstop.
-// Returns { ok:true }, { ok:true, noop:true } (role already as requested), or
+// Returns { ok:true }, { ok:true, noop:true } (already as requested), or
 // { ok:false, status, body } (the exact HTTP status + JSON the route sends).
-function authorizeMemberRoleChange({ goal, actorId, actorRank, actorMembership, targetMembership, targetId, role }) {
+function authorizeMembershipKindChange({ goal, actorId, actorRank, actorMembership, targetMembership, targetId, membershipKind }) {
   if (!goal) {
     return { ok: false, status: 404, body: { error: 'goal_not_found' } };
   }
   if (goal.status !== 'open') {
     return { ok: false, status: 409, body: {
       error: 'goal_not_open', status: goal.status,
-      message: 'Member roles can only be changed on an open goal.',
+      message: 'Memberships can only be changed on an open goal.',
     } };
   }
   const actorIsOwner = isGoalOwner(goal, actorId);
-  const actorIsManager = !!actorMembership && actorMembership.role === 'lead';
+  const actorIsManager = !!actorMembership && actorMembership.membership_kind === 'lead';
   if (actorRank !== 'archon' && !actorIsOwner && !actorIsManager) {
     return { ok: false, status: 403, body: {
       error: 'not_owner_or_manager',
-      message: 'Only this goal\'s owner or a manager (or an Archon) may change member roles.',
+      message: 'Only this goal\'s owner or a manager (or an Archon) may change memberships.',
     } };
   }
   if (!targetMembership) {
@@ -176,10 +181,10 @@ function authorizeMemberRoleChange({ goal, actorId, actorRank, actorMembership,
       message: 'That builder is not a member of this goal — admit them first.',
     } };
   }
-  if (targetMembership.role === role) {
+  if (targetMembership.membership_kind === membershipKind) {
     return { ok: true, noop: true };
   }
-  if (role === 'member') {
+  if (membershipKind === 'member') {
     // A demotion. Managers promote; only the owner (or an Archon) demotes.
     if (actorRank !== 'archon' && !actorIsOwner) {
       return { ok: false, status: 403, body: {
@@ -189,7 +194,7 @@ function authorizeMemberRoleChange({ goal, actorId, actorRank, actorMembership,
     }
     if (isGoalOwner(goal, targetId)) {
       return { ok: false, status: 409, body: {
-        error: 'owner_role_fixed',
+        error: 'owner_membership_fixed',
         message: 'The goal owner cannot be demoted — transfer ownership first.',
       } };
     }
@@ -621,7 +626,7 @@ module.exports = function buildGoalsRouter() {
       // resolvedBy: the joiner — arriving as a member cancels their own still-
       // pending ask on this goal, atomically with the membership write (task
       // 1002888). Self-joining is the same intent as withdrawing the request.
-      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, role: 'member', resolvedBy: req.builder.id });
+      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, membershipKind: 'member', resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/join', err);
@@ -941,7 +946,7 @@ module.exports = function buildGoalsRouter() {
     const id = parseId(req, res, { code: 'bad_goal_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {
-      role: { type: 'string' },
+      membership_kind: { type: 'string' },
       // builder_id accepts a JSON number OR a numeric string (coerced below);
       // declared untyped so strict-mode accepts either form.
       builder_id: {},
@@ -953,9 +958,9 @@ module.exports = function buildGoalsRouter() {
     if (!Number.isInteger(builderId) || builderId <= 0) {
       return res.fail('bad_builder_id', { status: 400, message: 'builder_id must be a positive integer.' });
     }
-    const role = req.body.role || 'member';
-    if (!VALID_MEMBER_ROLES.includes(role)) {
-      return res.fail('bad_role', 400, { valid: VALID_MEMBER_ROLES });
+    const membershipKind = req.body.membership_kind || 'member';
+    if (!VALID_MEMBERSHIP_KINDS.includes(membershipKind)) {
+      return res.fail('bad_membership_kind', 400, { valid: VALID_MEMBERSHIP_KINDS });
     }
     try {
       const goal = await db.getGoal(id);
@@ -985,7 +990,7 @@ module.exports = function buildGoalsRouter() {
       // resolvedBy: the ADDER (not the target) — a direct add closes the target's
       // pending ask, and the audit trail should name whoever admitted them
       // (task 1002888).
-      const member = await db.addGoalMember({ goalId: id, builderId, role, resolvedBy: req.builder.id });
+      const member = await db.addGoalMember({ goalId: id, builderId, membershipKind, resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/members', err);
@@ -993,12 +998,14 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
-  // PATCH /goals/:id/members/:builderId — role management by the goal's own
+  // PATCH /goals/:id/members/:builderId — membership management by the goal's own
   // authority (task 1735): the owner, a manager, or an Archon promotes
   // member→lead(manager); ONLY the owner (or an Archon) demotes; the owner's
-  // row is never demotable. The decision is the pure ordered gate above
-  // (authorizeMemberRoleChange); the DB write re-asserts the owner-demotion
-  // guard atomically (setGoalMemberRole), so a race cannot demote an owner.
+  // row is never demotable. The body field is `membership_kind` (task 1003013 —
+  // ADR 0174 reserves `role` for the three crafts). The decision is the pure
+  // ordered gate above (authorizeMembershipKindChange); the DB write re-asserts
+  // the owner-demotion guard atomically (setGoalMembershipKind), so a race
+  // cannot demote an owner.
   // rank: any-builder (requireBuilder) + the in-handler (owner | manager |
   // Archon) gate — like the authoring keystone, the wall is in-handler, NOT a
   // rank middleware. Pinned in route-rank-check.MODULE_EXPECTED_RANKS['lifecycle'].
@@ -1008,11 +1015,11 @@ module.exports = function buildGoalsRouter() {
     const builderId = parseId(req, res, { param: 'builderId', code: 'bad_builder_id', positiveInt: true });
     if (builderId === null) return;
     if (validateOrRespond(req, res, {
-      role: { required: true, type: 'string' },
+      membership_kind: { required: true, type: 'string' },
     })) return;
-    const role = req.body.role;
-    if (!VALID_MEMBER_ROLES.includes(role)) {
-      return res.fail('bad_role', 400, { valid: VALID_MEMBER_ROLES });
+    const membershipKind = req.body.membership_kind;
+    if (!VALID_MEMBERSHIP_KINDS.includes(membershipKind)) {
+      return res.fail('bad_membership_kind', 400, { valid: VALID_MEMBERSHIP_KINDS });
     }
     try {
       const goal = await db.getGoal(id);
@@ -1023,14 +1030,14 @@ module.exports = function buildGoalsRouter() {
             db.getGoalMember({ goalId: id, builderId }),
           ])
         : [null, null];
-      const decision = authorizeMemberRoleChange({
+      const decision = authorizeMembershipKindChange({
         goal,
         actorId: req.builder.id,
         actorRank: req.builder.rank,
         actorMembership,
         targetMembership,
         targetId: builderId,
-        role,
+        membershipKind,
       });
       if (!decision.ok) {
         return res.status(decision.status).json(decision.body);
@@ -1038,17 +1045,17 @@ module.exports = function buildGoalsRouter() {
       if (decision.noop) {
         return res.json({ ok: true, member: targetMembership, changed: false });
       }
-      const member = await db.setGoalMemberRole({ goalId: id, builderId, role });
+      const member = await db.setGoalMembershipKind({ goalId: id, builderId, membershipKind });
       if (!member) {
         // The atomic backstop fired: the membership vanished, or ownership
         // moved onto the target between the gate's read and this write.
         // Honest conflict, not silent success.
-        return res.fail('role_change_conflict', { status: 409, message: 'The goal membership changed underneath this request — re-read the goal and retry.' });
+        return res.fail('membership_change_conflict', { status: 409, message: 'The goal membership changed underneath this request — re-read the goal and retry.' });
       }
       return res.json({ ok: true, member, changed: true });
     } catch (err) {
       console.error('[gds] PATCH /goals/:id/members/:builderId', err);
-      return res.fail('role_change_failed', { status: 500, message: 'internal error' });
+      return res.fail('membership_change_failed', { status: 500, message: 'internal error' });
     }
   });
 
@@ -1531,9 +1538,9 @@ module.exports = function buildGoalsRouter() {
 // for reuse. The shouldRefuseSessionClaim (claims.js) precedent.
 module.exports.authorizeGoalTaskCreate = authorizeGoalTaskCreate;
 // task 1735: the pure ordered gates for PATCH /goals/:id/members/:builderId and
-// POST /goals/:id/transfer — exported for tests/goal_member_roles.mjs (DB-free),
+// POST /goals/:id/transfer — exported for tests/goal_member_kinds.mjs (DB-free),
 // same precedent.
-module.exports.authorizeMemberRoleChange = authorizeMemberRoleChange;
+module.exports.authorizeMembershipKindChange = authorizeMembershipKindChange;
 module.exports.authorizeOwnershipTransfer = authorizeOwnershipTransfer;
 // task 1736: the shared management prefix gate (conflict resolution) —
 // exported for tests/goal_conflicts.mjs (DB-free), same precedent.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.237",
+  "version": "1.19.239",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.237",
+      "version": "1.19.239",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.237",
+  "version": "1.19.239",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1741,6 +1741,71 @@ function vocabFilesToScan() {
   return out;
 }
 
+// ── Check 19b — the FOURTH "role": a goal membership is not a craft either ──
+//
+// task 1003013 / ADR 0177. ADR 0174 reserved `role` for the three crafts and R07
+// (checkVocabularyWall above) enforces it on the GOVERNMENT surface — deliberately
+// only there, because `builders.system_role` is a core machine-identity column and
+// Discord's API owns its own "role" noun. Goal membership was a fourth,
+// independent use of the word (`goal_members.role` = 'lead' | 'member'), which is
+// exactly why it survived the rename: the rule was silent on it, as designed.
+//
+// So this is a SECOND narrow wall rather than a widened first one — same reason the
+// first was scoped: the honest unit is a SURFACE, not the repo. The surface here is
+// the goal-membership one: the routes and pure gate that decide it, the hall page
+// that renders it, and (line-scoped) the membership SQL in the module's db.js. The
+// noun on it is `membership_kind`.
+//
+// Naming the rule stays legal — a line that cites ADR 0174 / ADR 0177 / task
+// 1003013 is meta-commentary about the ban, the same principle as
+// VOCAB_HISTORICAL_REF above. `role="…"` is stripped first: that is HTML's ARIA
+// attribute, a different word spelled the same.
+const GOAL_VOCAB_SURFACE = [
+  'modules/lifecycle/routes/goals.js',
+  'modules/lifecycle/goal-authz.js',
+  'modules/lifecycle/routes/done-when.js',
+  'modules/hall-ui/public/goals-page.js',
+  'modules/hall-ui/public/goals.html',
+  'modules/hall-ui/public/goals.css',
+];
+// modules/lifecycle/db.js is 5k+ lines and legitimately says "role" about ranks
+// (the rank-sync port, builders.system_role). Scanning it whole would need an
+// allowlist longer than the rule; scanning the LINES THAT NAME THE TABLE catches
+// the only thing that can regress here — a membership query reaching for the old
+// column — with no false positives to excuse.
+const GOAL_VOCAB_LINE_SCOPED = [{ file: 'modules/lifecycle/db.js', mustMention: /goal_members/ }];
+const GOAL_VOCAB_CITATION = /ADR 017[47]|task 1003013/;
+
+function checkGoalMembershipVocabulary() {
+  const violations = [];
+  let scanned = 0;
+  const scanFile = (rel, lineFilter = null) => {
+    const abs = path.join(CORE_ROOT, rel);
+    let src;
+    try { src = fs.readFileSync(abs, 'utf8'); } catch { return; }
+    scanned += 1;
+    src.split('\n').forEach((line, i) => {
+      if (lineFilter && !lineFilter.test(line)) return;
+      const scanLine = line.replace(/\srole\s*=\s*("[^"]*"|'[^']*')/g, ' ');
+      if (!/\brole/i.test(scanLine)) return;
+      if (GOAL_VOCAB_CITATION.test(scanLine)) return;
+      violations.push(`${rel}:${i + 1}: "role" — a goal membership is 'membership_kind' (ADR 0174 reserves "role" for the crafts; ADR 0177).  →  ${line.trim().slice(0, 90)}`);
+    });
+  };
+  for (const rel of GOAL_VOCAB_SURFACE) scanFile(rel);
+  for (const { file, mustMention } of GOAL_VOCAB_LINE_SCOPED) scanFile(file, mustMention);
+  return {
+    name: 'a goal membership is a "membership_kind", never a role (ADR 0177)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} goal-membership-surface file(s) scanned (${GOAL_VOCAB_SURFACE.length} whole + `
+        + `${GOAL_VOCAB_LINE_SCOPED.length} line-scoped to the lines naming goal_members); no allowlist — `
+        + 'a line that CITES the rule is the only exemption.',
+  };
+}
+
 function checkVocabularyWall() {
   const violations = [];
   let scanned = 0;
@@ -1799,6 +1864,7 @@ const CHECKS = [
   checkCoreRequiresExcludedModule, // Check 16b — task 2135: core→excluded-module require guard (R89 split)
   checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
   checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
+  checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
 ];
 
@@ -1830,6 +1896,8 @@ if (require.main === module) main();
 module.exports = {
   checkVocabularyWall,
   VOCAB_ALLOW,
+  checkGoalMembershipVocabulary,
+  GOAL_VOCAB_SURFACE,
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/src/module-api.js

@@ -901,8 +901,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.235 with no explicit bump. run 32162811851. (task 1002620)
 //   1.19.237 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.236 with no explicit bump. run 32164526454. (task 1002620)
+//   1.19.238 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.237 with no explicit bump. run 32172843539. (task 1002620)
+//   1.19.239 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.238 with no explicit bump. run 32174983930. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.237'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.239'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/criterion_authoring_gate.mjs

@@ -50,8 +50,8 @@ const G_ACHIEVED = { id: 43, version_id: 'BONGOS-V1', status: 'achieved', create
 const G_ARCHIVED = { id: 44, version_id: 'BONGOS-V1', status: 'archived', created_by: OWNER };
 const G_SYSTEM = { id: 45, version_id: 'BONGOS-V1', status: 'open', created_by: null };
 
-const LEAD = { role: 'lead' };
-const PLAIN = { role: 'member' };
+const LEAD = { membership_kind: 'lead' };
+const PLAIN = { membership_kind: 'member' };
 
 const ask = (o) => authorizeCriterionCreate({ version: V_BUILDING, actorRank: 'metic', ...o });
 
@@ -62,12 +62,12 @@ await test('the goal OWNER may author their goal\'s criterion', () => {
   assert.equal(d.ok, true);
 });
 
-await test('owner authority is created_by, not the role row — an owner with no membership still passes', () => {
+await test('owner authority is created_by, not the membership row — an owner with no membership still passes', () => {
   const d = ask({ goal: G_OPEN, actorId: OWNER, actorMembership: null });
   assert.equal(d.ok, true, 'created_by is the fixed authority (goal-authz isGoalOwner)');
 });
 
-await test('a MANAGER (goal_members.role=lead) may author', () => {
+await test('a MANAGER (goal_members.membership_kind=lead) may author', () => {
   const d = ask({ goal: G_OPEN, actorId: MANAGER, actorMembership: LEAD });
   assert.equal(d.ok, true);
 });