@bongos/core 1.19.258 → 1.19.259

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.258",
-  "core_contract": "1.19.258",
-  "source_commit": "66f71503310987ea2c91b4e930f3d5c81b3fb018",
+  "core_version": "1.19.259",
+  "core_contract": "1.19.259",
+  "source_commit": "c8780bb9be3f75bfac1c6c697c5d8e1d081d8dae",
   "source_ref": "HEAD",
-  "built_at": "2026-08-19T18:01:56.705Z",
+  "built_at": "2026-08-19T18:22:02.664Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 317,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1358,
+    "functional_verbatim": 1360,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1697,
-  "tree_sha256": "66ae54f6968edbafb532b3e566ec10fad20a45ca1c48af7951a8bc3fe1a06cd7",
+  "file_count": 1699,
+  "tree_sha256": "3cbb76304d7e5e19aa97c2b90a211e4b35bf3e08d882a9684184df0720855449",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1402,7 +1402,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "497b1fbf18ec1cf6d7e0f3620669cfba9008bc6a40e1f70e4b5f53d3406bc12e"
+      "sha256": "193c04262908677d4cdee4c9ba20031ed19220c3886cce8f25f54ea3e615079f"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2414,6 +2414,11 @@
       "mode": "0000644",
       "sha256": "51d7fc76fdc59a5ab145839aa4943fe7753324022f82e4b4a76c2fe3cab9b98d"
     },
+    {
+      "path": "migrations/core_222_idea_inbox_suggested_goal.sql",
+      "mode": "0000644",
+      "sha256": "9939ee2c641caa8ae4f5055c60e3208a6ed4e379b1bfd1aaa67247a8ed4a4fd8"
+    },
     {
       "path": "modules/autonomy/CLAUDE.md",
       "mode": "0000644",
@@ -3674,6 +3679,11 @@
       "mode": "0000644",
       "sha256": "3c30ba66b8426d6f304c8135764108f25c4c9aeb8a571347dd7c22ff7a68fad2"
     },
+    {
+      "path": "modules/ideas/migrations/ideas_003_lineage_origin_route.sql",
+      "mode": "0000644",
+      "sha256": "8edeeb0bbf5bac57111008357fc287f8dc14e6907d7bc218264c40633778b9c3"
+    },
     {
       "path": "modules/ideas/module.json",
       "mode": "0000644",
@@ -4447,12 +4457,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "815b7d1a58cdf1a0d9c7e30a97f70faa146ee6f826501f0c42f1b38529851575"
+      "sha256": "df6bf392719f8ba6a0aa64db49a0c29fc65dbc623f6efe0cf0b33e984469803b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "dcc8774d55d45595b6e3f3229a278b4bf5e263438bb730a8bdd620edf9c47bbd"
+      "sha256": "8afa3a02911351bbae1709a66e204a73ff07c65132c50fad0536246708143aac"
     },
     {
       "path": "public-docs/index.html",
@@ -6097,7 +6107,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a34bf521314a258ef3c444962bac548fa9aa2e0853dc45531f79586ef52bdeec"
+      "sha256": "c00527049537e4f63e7c3d70446ebb20ba7e760fa77bb200aa26f3e2de6b22f2"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/architecture.md

@@ -154,7 +154,13 @@ learnings(id, title, body_md, tags text[], related_files text[], captured_by, so
           source_ref, task_id?, created_at)
   indexes: GIN(tags), GIN(related_files), UNIQUE(source, source_ref) WHERE non-null
 idea_inbox(id, title, body_md, kind, suggested_version, suggested_priority, captured_at,
-           captured_by, status 'open'|'promoted'|'discarded'|'merged', promoted_to_task_id, reviewed_at)
+           captured_by, status 'open'|'promoted'|'discarded'|'merged', promoted_to_task_id, reviewed_at,
+           merged_into_idea_id? FK idea_inbox, triage_note?,   -- mig core_195 (task 1002447): what a
+           -- triage VERDICT decided -- which idea a merge folded into, and why a discard happened.
+           -- CHECK (merged_into_idea_id IS NULL OR status = 'merged') -- no merge chains.
+           suggested_goal_id? FK goals ON DELETE SET NULL)  -- mig core_222 (task 1003060, goal 1000071):
+           -- an ADVISORY routing hint for rows that did NOT convert (homeless/soft-landed/Discord).
+           -- The binding home for routed work is tasks.goal_id; nothing may gate on this column.
 done_when_criteria(id, version_id, criterion_id, criterion_md, satisfied bool, satisfied_by_task_id,
                    checked_at, sort_order, UNIQUE(version_id, criterion_id))  -- 13 seeded (V1 + PMS-V2)
 task_criteria(task_id FK tasks, criterion_id FK done_when_criteria, source 'backfill'|'manual'|'planning',

package/migrations/core_222_idea_inbox_suggested_goal.sql

@@ -0,0 +1,57 @@
+-- core_222_idea_inbox_suggested_goal.sql — a routing HINT on an inbox row
+-- (task 1003060, BV1.R02, goal 1000071 "Idea routing").
+--
+-- WHAT THIS IS NOT. This is not where a routed idea's goal lives. When routing
+-- fires, the idea is converted in the same transaction (R01): the idea row goes
+-- status='promoted' with promoted_to_task_id set, and the TASK carries the real
+-- goal_id. The binding home for "which goal does this work belong to" is
+-- tasks.goal_id — always. This column is strictly the ADVISORY leftover for rows
+-- that did NOT convert:
+--   * soft-landed / homeless ideas that stayed in the inbox (no goal at filing),
+--   * Discord #ideas inbound carrying a classifier's guess (R12),
+--   * Full Ideas and criterion-proposals, which never auto-route by design,
+-- so /idea-triage can show "this probably belongs to goal N" instead of making
+-- every triage pass re-derive it. A hint is nullable, overwritable, and load-
+-- bearing for NOTHING — no rank check, no scope wall, and no payout may read it.
+--
+-- WHY CORE, NOT modules/ideas/migrations/. `idea_inbox` is a CORE table. A module
+-- migration may only touch its own <key>_-prefixed objects — fitness.js
+-- checkModuleMigrationsAdditive hard-fails an `ALTER TABLE idea_inbox` from a
+-- module (ADR 0083 §Decision #5). Same reasoning core_195 recorded when it added
+-- merged_into_idea_id: the ideas module owns every QUERY against this table and
+-- none of its schema. The lineage half of R02 — which touches an ideas-OWNED
+-- table — is correctly a module migration (ideas_003).
+--
+-- WHY ON DELETE SET NULL. A hint must never keep a goal alive nor block its
+-- deletion, and a dangling hint is worse than no hint: an archived-then-deleted
+-- goal would otherwise leave triage pointing at a tombstone. RESTRICT would let
+-- an advisory column veto a goal deletion, which inverts the whole point.
+--
+-- Additive, nullable, idempotent (safe to re-run). Forward-safe by construction:
+-- every existing reader SELECTs an explicit column list, so old code on the new
+-- schema neither sees nor needs this (tests/migrations_forward_safe.mjs).
+
+BEGIN;
+
+ALTER TABLE idea_inbox
+  ADD COLUMN IF NOT EXISTS suggested_goal_id bigint REFERENCES goals(id) ON DELETE SET NULL;
+
+-- Triage's homeless-only walk (R13) filters "open ideas that have a hint" and
+-- the reverse "what is pointed at this goal". Partial: the overwhelming majority
+-- of rows are NULL (no hint), so a partial index stays small and still serves
+-- both directions.
+--
+-- NOT CONCURRENTLY, and it cannot be: CREATE INDEX CONCURRENTLY is forbidden
+-- inside a transaction block, and this migration is wrapped BEGIN/COMMIT so the
+-- column and its index land atomically (a half-applied migration is the worse
+-- failure). The plain form takes a brief ACCESS EXCLUSIVE lock on idea_inbox for
+-- the duration of the build. That is acceptable HERE specifically because
+-- idea_inbox is a low-volume human-filing queue — ideas arrive at human pace, not
+-- per-request — so the build is milliseconds against a small table and no write
+-- path of consequence blocks. This reasoning does NOT generalise: a future index
+-- on a write-hot table wants CONCURRENTLY in its OWN transaction-less migration.
+CREATE INDEX IF NOT EXISTS idx_idea_inbox_suggested_goal
+  ON idea_inbox (suggested_goal_id)
+  WHERE suggested_goal_id IS NOT NULL;
+
+COMMIT;

package/modules/ideas/migrations/ideas_003_lineage_origin_route.sql

@@ -0,0 +1,62 @@
+-- ideas_003_lineage_origin_route.sql — 'route' becomes a legal lineage origin
+-- (task 1003060, BV1.R02, goal 1000071 "Idea routing").
+--
+-- WHY. ideas_002 created ideas_task_lineage with origin IN ('promote','develop')
+-- — the two ways a task could descend from an idea when it was written. Routing
+-- adds a THIRD: capture-time promotion, where the idea row and its task are
+-- written in one transaction at filing time (R01) rather than by a later triage
+-- promote. That is genuinely a different provenance and must be distinguishable
+-- in the ledger: 'promote' means a human triaged it, 'route' means the filer
+-- named a goal and the system converted it on the spot. Collapsing the two would
+-- destroy the only signal that tells us how much triage routing actually saved
+-- (C6 triage-shrinks-to-judgment) — and IC4 may want to weigh them differently.
+--
+-- WHY THE WHOLE POINT IS ATTRIBUTION. Discord #bugs is the cautionary tale this
+-- goal exists to fix: it creates tasks DIRECTLY, skipping idea_inbox, so there is
+-- no captured_by and no lineage row — the ideator-credit lane (goal 1000067) has
+-- nothing to ever pay against. Routing must never become a second such bypass, so
+-- every routed task gets a lineage row like any other. This CHECK is what lets it.
+--
+-- WHY THIS IS ADDITIVE DESPITE THE `DROP CONSTRAINT`. Postgres has no "extend a
+-- CHECK" verb; widening an enum-style CHECK is necessarily drop-then-re-add of
+-- the SAME-named constraint. That is additive in EFFECT — the new predicate
+-- permits a strict superset of the old one, so no existing row can be
+-- invalidated and no data is touched. fitness.js recognises exactly this shape
+-- (isConstraintWidening, task 1978): a DROP whose constraint name is re-ADDed in
+-- the same file is exempt from the destructive-DDL rule. The name must therefore
+-- match Postgres's auto-generated name from the ideas_002 inline column CHECK —
+-- ideas_task_lineage_origin_check — or the exemption does not apply and the
+-- constraint silently does not come back. provisioning_003 is the precedent.
+--
+-- Module migrations are ADDITIVE and NAMESPACED: every object here is
+-- ideas_-prefixed, no down-migration, idempotent (safe to re-run).
+
+BEGIN;
+
+ALTER TABLE ideas_task_lineage DROP CONSTRAINT IF EXISTS ideas_task_lineage_origin_check;
+ALTER TABLE ideas_task_lineage ADD CONSTRAINT ideas_task_lineage_origin_check
+  CHECK (origin IN ('promote', 'develop', 'route'));
+
+-- SAFETY NET — did the widening actually take? If ideas_002's inline CHECK ever
+-- carried a name other than Postgres's auto-generated ideas_task_lineage_origin_check,
+-- the DROP above silently no-ops and the ADD installs a SECOND constraint while the
+-- original keeps rejecting 'route' — routing would then fail at runtime, in the one
+-- transaction whose whole job is preserving attribution, with nothing pointing here.
+-- A migration that cannot prove its own effect must not report success. Read-only,
+-- no DDL: it asserts that no surviving CHECK on this table still excludes 'route'.
+DO $$
+DECLARE stale text;
+BEGIN
+  SELECT string_agg(conname, ', ') INTO stale
+    FROM pg_constraint
+   WHERE conrelid = 'ideas_task_lineage'::regclass
+     AND contype  = 'c'
+     AND pg_get_constraintdef(oid) ILIKE '%origin%'
+     AND pg_get_constraintdef(oid) NOT ILIKE '%route%';
+  IF stale IS NOT NULL THEN
+    RAISE EXCEPTION
+      'ideas_003: CHECK constraint(s) % still reject origin=''route'' — the widening did not take (name mismatch with ideas_002). Rename the DROP target to match and re-run.', stale;
+  END IF;
+END $$;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.258",
+  "version": "1.19.259",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.258",
+      "version": "1.19.259",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.258",
+  "version": "1.19.259",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -943,8 +943,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.256 with no explicit bump. run 32209295358. (task 1002620)
 //   1.19.258 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.257 with no explicit bump. run 32284962866. (task 1002620)
+//   1.19.259 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.258 with no explicit bump. run 32286866098. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.258'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.259'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');