@bongos/core 1.19.277 → 1.19.279

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.277",
-  "core_contract": "1.19.277",
-  "source_commit": "35b30c3a1c2a68136a144277b48bb750148995a4",
+  "core_version": "1.19.279",
+  "core_contract": "1.19.279",
+  "source_commit": "20fdd2b00fa489173ea330aeec453d56dcb6999a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-21T16:28:45.099Z",
+  "built_at": "2026-08-21T20:04:41.616Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 318,
+    "docs_redacted": 319,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1376,
+    "functional_verbatim": 1377,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1716,
-  "tree_sha256": "42012dded2c6108d84ebdea4781e6cf78523e2f6c93cf2eebbc16e032b8a33b2",
+  "file_count": 1718,
+  "tree_sha256": "98ca3398579326bf1dc3356202895e6911341413dbf4e0238347e3357888565f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1389,10 +1389,15 @@
       "mode": "0000644",
       "sha256": "26f39ae01ea1768dfbd61789752356ae30364b465117b1e7ddee94fabc7d6bbf"
     },
+    {
+      "path": "docs/adr/0182-project-visibility-two-axes.md",
+      "mode": "0000644",
+      "sha256": "119637165d2d6b89f8c00afccd07d9f073629f1502f4b2f2cdc673001b2f8d2a"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "01396708c202d9c266bc2a3cf3ab4052fd2f3823e6957e7669370fdad2fdb7a9"
+      "sha256": "56d478e1b5285c1c133225240c65ec23c6b3b4f280cdda853c50b33564cc2910"
     },
     {
       "path": "docs/api-reference.md",
@@ -3739,6 +3744,11 @@
       "mode": "0000644",
       "sha256": "0c52ae165d304f0f08ca04c9a288ef7d8ffb07288282dcd7b2d503fced7cd744"
     },
+    {
+      "path": "modules/lifecycle/claim-feed.js",
+      "mode": "0000644",
+      "sha256": "3586cc2aa07913870ad99073c534e70ef2e2c5ff6a5ef2ddeb141cfd397269cd"
+    },
     {
       "path": "modules/lifecycle/conflict-resolve.js",
       "mode": "0000644",
@@ -3752,7 +3762,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "64cdde411e3fb8d1263eebf9093a353dde6ee684be2977057c8800e608b52a63"
+      "sha256": "74eedb9ee1c423c9ecdea6f09d8555fa3200ac9e3a86a194182774cb72f0cd0b"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3777,7 +3787,7 @@
     {
       "path": "modules/lifecycle/goal-authz.js",
       "mode": "0000644",
-      "sha256": "6280028c33fd0770514e753962e3a83ee2e3d47d6c9efdb67b9905b868c6db72"
+      "sha256": "3eb9d818e0e0d45a896a5c0a515842b5f5a01e102d02f8a9a605c271088c8e5d"
     },
     {
       "path": "modules/lifecycle/goal-conflicts.js",
@@ -3832,7 +3842,7 @@
     {
       "path": "modules/lifecycle/routes/claims.js",
       "mode": "0000644",
-      "sha256": "4f40c6e74c40c1ff29f8f487e2a6b574e7998aca4366a6372101d17412917eea"
+      "sha256": "e02abac52a82fb02603dd92074d4ebd060ec03195803d704b021614806ef00fe"
     },
     {
       "path": "modules/lifecycle/routes/dependencies.js",
@@ -4487,12 +4497,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "296343fcb5f99b8dc4fb410e8b7c983d8c27da94bb23a64ffae6e246b87634d1"
+      "sha256": "66c790ddb5f66b9c7e5961f8402a508bdb36d5dddf35215401eda673a115c003"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0fa3267232afe7bfab282670e735d0cdd313d21614128c7666a10368f302ae2e"
+      "sha256": "ea43d45c4c7ef30f10935c5ec6e967e9a1c707a6f9a69ed7f5f6b2e5771fef8e"
     },
     {
       "path": "public-docs/index.html",
@@ -6137,7 +6147,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3068c942e43140df9169a36c39acb9b3daffb182d2a7f33e89180b3926abfd37"
+      "sha256": "e58b6609edc9a144ab403e149a715aebdc324b598244833d1ef3a6aa3713f88a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7037,7 +7047,7 @@
     {
       "path": "tests/goal_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "e5b32e9c4a38e405cfd3185b49f4a1d9a6b39a0f39c12053c01ba3680c550120"
+      "sha256": "daf3a5942ce3f154d29618e4242557758db50d8c70046562995fc2c10d5ee954"
     },
     {
       "path": "tests/goal_achievement.mjs",
@@ -8057,7 +8067,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "7ae4d9af4d389c34f0d16f921858cbbf5d0d57f3219f830d10552ebcdc43908f"
+      "sha256": "a21d9f4d3ff937d59b9361b330a2e5e93ded9c9a12d73434eb843cae9d1a3c74"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/docs/adr/0182-project-visibility-two-axes.md

@@ -0,0 +1,168 @@
+# ADR 0182 — Project visibility is TWO axes: a derived publish gate and a stored join door
+
+- **Status:** Accepted
+- **Date:** 2026-08-21
+- **Task:** [task 1002320](https://cloudbongos.com/builders#/task/1002320) (BONGOS-V1, goal 1000046 — *Project creation — visibility & customization*)
+- **Deciders:** IAMMASTERQUA (Archon), Claude
+- **Confirms R04–R18** — the full accounting is in *Scope* below, including the two that this ADR deliberately does **not** govern.
+- **Bounds — deliberately NOT decided here:** the self-hosted→hub *reporting and trust* mechanics ([task 1002321](https://cloudbongos.com/builders#/task/1002321), R02) · the applications/invite *model* (`docs/specs/<redacted>.md` D2, already decided) · project *authority* (same spec, D1)
+- **Related:** [ADR 0141](<redacted>.md) (hub = identity + relay, authority stays local) · [ADR 0112](<redacted>.md) (`goals.visibility`, the precedent this copies) · [ADR 0108](<redacted>.md) (the instance IS the project) · [ADR 0174](<redacted>.md) (one word, one meaning)
+
+---
+
+## Scope — what "confirms R04–R18" means, task by task
+
+The task description says this ADR *"confirms R04–R18"*. That is 15 tasks and they do not
+all relate to it the same way, so they are enumerated rather than gestured at. **Its
+criteria** are `proj-visibility-states`, `proj-join-policy` and `proj-detail-interview`
+(the goal's C1–C3); task 1002320 is linked to all three.
+
+**Shape set by this ADR** — these build what it decides, and each should be read against it:
+
+| | Task | Gets from this ADR |
+|---|---|---|
+| R04 | [1002323](https://cloudbongos.com/builders#/task/1002323) | the 3-value enum + the derived gate + the missing `description` column (D1, D4) |
+| R05 | [1002324](https://cloudbongos.com/builders#/task/1002324) | **moves host** — an instance surface, not a hub one (D5) |
+| R06 | [1002325](https://cloudbongos.com/builders#/task/1002325) | the feed predicate change + **server-side** stealth redaction (D2a, D3) |
+| R07 | [1002326](https://cloudbongos.com/builders#/task/1002326) | which three states render, and that `featured` no longer gates presence (D3) |
+| R08 | [1002327](https://cloudbongos.com/builders#/task/1002327) | the hub row is a cache; **unreported ⇒ fail-closed** (D5) |
+| R09 | [1002328](https://cloudbongos.com/builders#/task/1002328) | the render mapping, and that it may not be trusted to redact (D2a) |
+| R11 | [1002330](https://cloudbongos.com/builders#/task/1002330) | per-state application rules on the already-decided model (D6) |
+| R12 | [1002331](https://cloudbongos.com/builders#/task/1002331) | **visibility is the ceiling; join policy may only narrow** (D6) |
+| R15 | [1002334](https://cloudbongos.com/builders#/task/1002334) | why skipping the interview is a supported default, not a dead end (D4) |
+| R16 | [1002335](https://cloudbongos.com/builders#/task/1002335) | the bar is identity only, and it must name what is missing (D4) |
+
+**Proofs of those shapes** — no new decisions, but their assertions are set here:
+R10 ([1002329](https://cloudbongos.com/builders#/task/1002329)) must assert stealth's
+**absent fields, not absent pixels** (D2a);
+R14 ([1002333](https://cloudbongos.com/builders#/task/1002333)) must cover the
+ceiling-vs-narrowing rule (D6);
+R18 ([1002337](https://cloudbongos.com/builders#/task/1002337)) must cover
+skip ⇒ dark-matter-until-published (D4).
+
+**NOT governed by this ADR**, stated so the omission is a decision rather than a gap:
+
+- **R13** ([1002332](https://cloudbongos.com/builders#/task/1002332)), the owner
+  applications review queue — belongs to `docs/specs/<redacted>.md`
+  (D1/D2), which already decided the queue, its authority and its storage. This ADR sets
+  only which states *accept* an application (D6), never what happens to it afterwards.
+- **R17** ([1002336](https://cloudbongos.com/builders#/task/1002336)), rule-based
+  recommendations from the project detail — orthogonal. Recommendations concern module and
+  governance presets; nothing about them depends on visibility or publishability.
+
+## Context
+
+Goal 1000046 seeded 31 tasks, and R04–R18 each say *"per R01"* — this ADR. Nothing in the goal could start until it landed: at claim time it gated **29 open tasks**, the largest single chokepoint in the repo, and it was itself parked at `backlog` with no dependencies of its own.
+
+The spec its planning task cites — `docs/specs/<redacted>.md` — **was never written**. This ADR is therefore the design of record, not a summary of one.
+
+**What exists today.** `platform_identity_projects` (hub-side, keyed by `origin`) carries `status ('active'|'hidden')`, an Archon-curated `featured` boolean, and `owner_github_id` — explicitly commented *"advisory attribution (not an authority)"*. The public feed reads `featured = true AND status = 'active'`. So today a project's presence on the map is **Archon editorial curation**, and the owner has no control at all. The goal's premise is the inverse: the owner shapes it.
+
+**The apparent contradiction that motivated this ADR.** The goal's own criterion `proj-visibility-states` says *"one of **four** states"* (Public/Private/Stealth/Unlisted). R04's description says *"3-state visibility enum … dark-matter is derived … not a stored 4th state"*. Read as one enum these disagree. They do not disagree; they describe different layers, and conflating those layers is the trap this ADR exists to prevent.
+
+## Decision 1 — Two independent axes, not one four-valued enum
+
+| Axis | Stored? | Set by | Governs |
+|---|---|---|---|
+| **Publishability** | **Derived** | the identity gate (R16) | whether the project is on the map *at all* |
+| **The join door** | Stored: `visibility ∈ (public, private, stealth)` | the project's owner | how it renders, and who may get in |
+
+The four user-facing states are **3 × publishable, plus one derived state that collapses all three**:
+
+```
+publishable = false  →  DARK MATTER   (off the map, un-joinable) — whatever the enum says
+publishable = true   →  public   → planet      (identified,  anyone may join)
+                        private  → star        (identified,  no self-join, applications accepted)
+                        stealth  → black hole  (ANONYMOUS,   no self-join, applications refused)
+```
+
+**The name `visibility` is kept, and it is a mild lie.** The column does not decide visibility — publishability does. We keep the name because `goals.visibility` (ADR 0112) already established it and one word across both planes beats an accurate name used in one place. This paragraph is the mitigation: **anyone reading `visibility = 'public'` and expecting the orb on the map is reading it wrong**, and the publish gate is the thing to check. R04 must carry that sentence to the column comment.
+
+## Decision 2 — All three stored states are VISIBLE; only the derived state is invisible
+
+This is what makes the 3+1 split honest rather than a workaround: the enum is a *door* policy, and every value of it is on the map. Consequences worth stating because R06/R07/R09 all depend on them:
+
+- **`private` means visible-but-closed, exactly as it already does for goals.** ADR 0112: *"a private goal stays VISIBLE in the goal list but non-members can't self-join."* The project plane inherits that meaning unchanged. A private project is a star you can see and ask to join.
+- **`stealth` exposes EXISTENCE but not IDENTITY.** The black hole is the metaphor and it is precise: you see the gravitational effect, not the object. R06/R09 say "stealth is anonymous", and that is a real privacy primitive, not a rendering note.
+- **Dark matter is not a state an owner picks.** It is the absence of a met bar. There is deliberately no way to *choose* it, because "unlisted" as a selectable option would compete with `private` and nobody could say which to pick.
+
+### Decision 2a — stealth redaction is SERVER-SIDE, in the feed
+
+A stealth project's `name`, `tagline`, `art_url`, and `origin` **must not leave the server** in the public feed. The feed emits the orb (existence, render type, and whatever aggregate the map needs) and nothing identifying.
+
+This is called out because the naive implementation is to send the row and let the orbs page hide it — which leaks the whole thing to anyone who opens the network tab, and the orbs page is a **static site outside this repo** (R09), so we cannot enforce it there even in principle. Redaction at the boundary is the only version of this that is true. R06 owns it; R10's proof must assert the absence of the fields, not the absence of pixels.
+
+## Decision 3 — Three mechanisms, three owners, one composition rule
+
+`status`, `visibility` and `featured` all touch "does this appear", and they are not the same thing:
+
+| Field | Owner | Meaning |
+|---|---|---|
+| `status` | system / Archon | operational lifecycle — a deprovisioned project is `hidden` |
+| `visibility` | the **project owner** | the join door (Decision 1) |
+| `featured` | Archon | editorial promotion |
+
+**Composition:** a project is on the map iff `status = 'active' AND publishable`. `featured` may only **rank or promote among projects already on the map** — it can never put an unpublishable or `hidden` project there.
+
+That is a behaviour change: today's feed predicate is `featured = true AND status = 'active'`, so **featuring is currently load-bearing for visibility at all**, and an owner setting `public` on an unfeatured project would see nothing happen. R06 replaces the predicate; R07 dogfoods it. Without this decision the owner-control premise of the whole goal silently does not work.
+
+## Decision 4 — The publish gate is identity only: `name` + `description`
+
+Per the owner interview (recorded on R16): the bar is a name and a description. **Not** tagline, art, modules, governance, or a completed interview.
+
+The bar exists to keep empty husks off the map — not to enforce completeness. A higher bar would make "skip the optional detail step" a dead end rather than the supported default the goal explicitly wants (`proj-detail-interview`: *"skipping it produces sensible defaults"*).
+
+**The gate must name what is missing, never merely refuse.** A project that cannot be published and is not told why is indistinguishable from a broken one.
+
+*Note for R04:* `platform_identity_projects` has `name NOT NULL` but **no `description` column** (only `tagline`). R04 adds it. Do not repurpose `tagline` — it is the card one-liner and a description is the publish bar; collapsing them means editing your card can unpublish your project.
+
+## Decision 5 — Visibility is owned by the INSTANCE and mirrored to the hub
+
+The hub's `platform_identity_projects` row is a **cache, never the source of truth.**
+
+This follows from ADR 0141 §3 and the admin-console spike's D1 (*the instance IS the project; authority lives on the project instance*), and it resolves what otherwise looks like a gap: `owner_github_id` being "advisory, not an authority" is **correct**, not a hole to be filled. The hub never authorizes a visibility change; it accepts a report from the authenticated `sso_client` and stores it.
+
+Two consequences that redirect seeded work:
+
+1. **R05 (owner set/change visibility) is an INSTANCE surface**, not a hub one. The setting lives in the project's own hall settings, gated by the project's own ranks.
+2. **R08 is the sync, not an afterthought.** A hub row whose visibility was never reported is stale, and stale here means *wrong on the public map*. R08's absent-report default must be **fail-closed: unreported ⇒ treated as not publishable (dark matter)**, so a project that has never spoken is off the map rather than exposed by omission.
+
+The *trust* mechanics of that report — how the hub authenticates it, replay, rate — are **R02's** ([task 1002321](https://cloudbongos.com/builders#/task/1002321)), not this ADR's.
+
+## Decision 6 — Per-state join rules, and how they compose with the join-policy setting
+
+The applications *model* is already decided (`docs/specs/<redacted>.md` D2: extend `access_requests` with `kind ∈ ('application','invite')`, no new table). This ADR adds only the per-state rules on top:
+
+| State | Self-join | Applications |
+|---|---|---|
+| public / planet | permitted | not needed |
+| private / star | refused | accepted, owner reviews |
+| stealth / black hole | refused | **refused at the door** (the public POST 403s) |
+| dark matter | refused | refused — there is no door to knock on |
+
+Stealth's distinction from private is **at the door, not in the queue**: a refused application is never stored, so a stealth project accumulates no queue to leak.
+
+**Two knobs could contradict.** [task 1002817](https://cloudbongos.com/builders#/task/1002817) adds a per-project join policy (`open|closed`) at the same door. Rule: **visibility sets the ceiling; join policy may only narrow it.** A `closed` public project accepts no self-joins; an `open` stealth project still refuses everything. The stricter of the two always wins, and neither can widen the other. Without this, the two settings are a coin-flip decided by evaluation order.
+
+## Decision 7 — The word `stealth` already means something else; product surfaces win, and the collision is tracked
+
+`src/bongos/stealth-gate.js` + `STEALTH_PASSWORD` already mean *an instance-wide pre-launch password wall* — an entire instance made **unreadable**. Project `visibility = 'stealth'` means a project that is **on the public map, anonymously, refusing applications**. These are close to opposites, and ADR 0174 is the standing lesson that one word carrying two meanings costs more than a rename.
+
+**Decision:** the *product* meaning (the owner-facing state, whose orb metaphor is locked by the criterion) keeps the word. The infra gate is the one that should be renamed — to `prelaunch` — but that touches a protected path, an env var, and a live instance's configuration, so it is **not** decided here by an ADR about visibility. It is filed as its own task with the owner's call attached.
+
+Until then: `stealth` unqualified in product code and copy means the project state. The infra gate is referred to as the **pre-launch gate** in prose even while its identifier still says stealth.
+
+## Consequences
+
+- R04 lands `visibility` (3-value CHECK, default `public`, precedent `goals.visibility`) **and** the missing `description` column, plus the backfill. Existing rows keep today's behaviour: `visibility='public'`, publishable iff they already have a name and description.
+- R06's feed predicate changes from `featured`-gated to `publishable + active`, with stealth rows redacted server-side. This is the single riskiest change in the goal — it is what actually moves control from Archon curation to the owner — and R10 is its proof.
+- R05 moves host: instance-side settings, not a hub page.
+- R08 defaults fail-closed on an unreported project.
+- Anything reading `featured = true AND status = 'active'` as "is this public" is now wrong and must be found. `modules/platform-identity/routes/projects.js` is the known site.
+
+## Alternatives rejected
+
+- **A stored four-valued enum including `unlisted`.** Rejected: it makes "unlisted" a choice competing with `private`, and it lets a project be simultaneously "publishable" and "unlisted" — two sources of truth for one question, which is the bug the derived gate prevents by construction.
+- **A separate `published` boolean.** Rejected for the same reason: a boolean can disagree with the identity it is supposed to summarise. Derived cannot drift.
+- **Letting `featured` keep gating visibility, with owner visibility layered on top.** Rejected: an owner who sets `public` and appears nowhere until an Archon blesses them has not been given control, and the goal's premise is that they have.
+- **Client-side stealth redaction.** Rejected: the orbs page is a static site outside this repo, so the guarantee would be unenforceable by construction.

package/docs/adr/README.md

@@ -255,5 +255,6 @@ This keeps the decision history honest and traceable.
 | 0179 | [**`rank:metic+` means metic and above; a bare `rank:metic` still means exactly metic** ([task 1003094](https://cloudbongos.com/builders#/task/1003094), goal 1000069). [ADR 0175](<redacted>.md) gave the constitution ONE membership form, `rank:<key>`, resolved by an EXACT SQL match — so `rank:metic` seated metics ONLY (excluding Archons), `rank:xenos` seated NEWCOMERS ONLY rather than "everyone", and "Metic and above" was inexpressible. Everywhere else a rank is a LADDER and authority is cumulative (ADR 0034 inheritance, requireRank('metic','archon'), the floor-derived seed); board membership was the one place it meant "exactly", and nothing said so. Rehearsing R25 on a real Postgres, an Archon ratified `rank:metic` under monarchy — the apply worked perfectly — and the next vote came back 403 not_board_member: **the owner flipped the switch and fell off their own board**, with the board deadlocked at one member because an Archon can still PROPOSE but no longer VOTE. Owner decision: EXPLICIT GRAMMAR. `rank:metic+` (that rank and above), `rank:metic,archon` (union), and **a bare key still means EXACTLY that key** — rejecting the smaller diff (silently redefining the bare form) precisely because it would have changed the meaning of every already-ratified constitution, the monarchy default included, on upgrade: nothing in a government should change meaning without a vote. `+` is defined only on the STANDARD ladder — "and above" about a custom rank with no ladder position is a parse REFUSAL, not a guess, and a refusal seats nobody. The grammar had been written TWICE (a shape regex in the config sanitizer, a parse regex in the resolver, pinned by a property test) — sound for one literal form, unsound the moment a rule needs a LOOKUP, which is the same class of drift that produced the bug; both now call one pure `membership-predicate.js`. Adds the DISENFRANCHISEMENT GUARD: a proposal that would unseat its own proposer is refused before any write, naming the one-character fix, overridable with an explicit `acknowledge_self_removal` (a separate parameter, never a proposal field) because stepping back is a legitimate act. The two DB reads take a set via `= ANY($1)` + DISTINCT (a double-counted member silently raises the consent bar), the structural filters are re-proven against real Postgres (a deactivated builder and a machine principal still never govern), and the hall panel now describes every form in plain language — rendering `rank:metic+` as "the metic+ rank" would be the same bug one layer up. Unblocks task 1003095, which can now write each charter's TRUE predicate rather than wording around a limitation.](<redacted>.md) | government / the board |
 | 0180 | [**Dependency intake & drift policy: baseline-ratchet audit gate, install scripts off, cooldown via patrol, OIDC publish** ([task 1003127](https://cloudbongos.com/builders#/task/1003127), goal 1000076). The red-team baseline audit found 18 advisories (2 high) sitting unwatched in 9 production deps, the `undici ^6.27.0` override pinned INSIDE a vulnerable range while also breaking Node 26 CLIs, and nothing gated what an agent may install — against a 2025 npm threat wave (chalk/debug, Shai-Hulud, Nx) that ran on postinstall scripts and long-lived publish tokens. Four decisions. (1) `scripts/gds/audit-gate.js` runs in the required `unit` check: a high/critical advisory NOT in the committed `config/audit-baseline.json` fails the merge gate; the baseline is **shrink-only pre-gate debt** (10 findings at adoption) — adding an entry to silence a NEW advisory is out of policy. Fail-OPEN on registry/infra errors, fail-CLOSED on findings: the gate catches new advisories, it does not prove registry uptime. Notably a blanket `npm audit fix` cannot even run here (`workspace:` protocol, EUNSUPPORTEDPROTOCOL) — fixes are explicit tasks. (2) `.npmrc ignore-scripts=true`: the tree needs no install-lifecycle scripts — sharp installs prebuilds via optionalDependencies, proven by a script-less `npm ci` + full 430-test suite; a future dep needing one is an ADR-level exception. (3) Update cooldown is PATROL-enforced (task 1003128 flags versions younger than 7 days + stale overrides + action-pin drift) rather than `.npmrc`-enforced, because CI's npm 10 warns on the npm-11 `minimum-release-age` key for every builder; move it into `.npmrc` when the toolchain floor reaches npm ≥ 11.10. (4) Publish auth moves to npm **trusted publishing (OIDC)** — needs a one-time owner registration on npmjs.com (blocker filed); until then the granular 90-day `NPM_TOKEN` is a documented exception.](<redacted>.md) | devsecops / supply chain |
 | 0181 | [**Teardown accepts every state but `torn_down`, and deliberately keeps the address** ([task 1003042](https://cloudbongos.com/builders#/task/1003042), goal 1000058). Walk finding N5: an instance at `status='error'` could never be removed — the owner's teardown answered 409 `not_teardownable` and the archon `force-teardown`, which exists as the escape hatch, answered the SAME refusal, because both read one hand-kept whitelist `['provisioning','active','tearing_down']` that omitted `requested` and `error`. No role had a path out, so errored rows accumulated permanently (instance 15 `swag` from 2026-08-07). The whitelist justified itself as "nothing running to tear down", which is FALSE for `error`: a provision failing mid-run lands there AFTER it may have created the database, taken a port, and written the systemd unit, Caddy block and DNS record — a partial standup is the thing most in need of reclaiming. `TEARDOWN_FROM` is now DERIVED from `INSTANCE_STATES` minus `torn_down`, so a future state is teardownable by DEFAULT — the bug was an allow-list that silently omitted states, and for a failure mode whose signature is "a row with no exit", the safe default is that an exit exists. The runner needed no change (its steps are each `allowFail`); only the web guard refused. The one surviving refusal is now ONE shared helper: the copies had drifted, and force-teardown's positional `res.fail` form put the bare code `not_teardownable` on the wire as the human text. **The `port` and `domain` are deliberately NOT released** — releasing the port alone would be WORSE than the status quo, because the `<slug>.caddy` block survives teardown and proxies the hostname to a PORT NUMBER, so a later instance given that port would answer at the torn-down project's still-live address (verified live: two projects torn down 2026-08-13 still resolved on 2026-08-19). Holding the port is what keeps the address inert at a harmless 502; releasing both is [task 1002897](https://cloudbongos.com/builders#/task/1002897). Retention is also correct for revive, which re-uses the same hostname. Copy was corrected to match: it had promised "the address stops answering", which was never true.](0181-teardown-state-gate-and-address-retention.md) | provisioning / lifecycle |
+| 0182 | [**Project visibility is TWO axes: a derived publish gate and a stored join door** ([task 1002320](https://cloudbongos.com/builders#/task/1002320), goal 1000046). Goal 1000046 seeded 31 tasks each citing "per R01" — this ADR — so nothing in the goal could start until it landed: it gated **29 open tasks**, the largest single chokepoint in the repo, while itself parked at `backlog` with no dependencies. The spec its planning task cites was never written, so this is the design of record. The goal's criterion says **four** states (Public/Private/Stealth/Unlisted) and R04 says **three** stored plus a derived dark-matter; both are right and conflating them is the trap. There are two INDEPENDENT axes: **publishability** (DERIVED from the identity gate — name + description, per the owner interview) decides whether a project is on the map at all, and **the join door** (STORED `visibility ∈ public|private|stealth`, owner-set) decides how it renders and who gets in. Four user-facing states = 3 × publishable + one derived state that collapses all three. The column name `visibility` is a mild lie kept for consistency with `goals.visibility` (ADR 0112) — it does NOT decide visibility, publishability does — and the ADR is the mitigation. All three stored states are VISIBLE; only the derived state is invisible, which is what makes the 3+1 split honest rather than a workaround. `private` inherits ADR 0112's exact meaning (visible-but-closed); `stealth` exposes EXISTENCE but not IDENTITY, and its redaction is **server-side in the feed** — the naive client-side version leaks to anyone opening the network tab, and the orbs page is a static site OUTSIDE this repo (R09) so it could never be enforced there. Three mechanisms touch "does this appear" and are separated: `status` (operational), `visibility` (owner), `featured` (Archon editorial) — on the map iff `status='active' AND publishable`, with `featured` only ranking among those. That is a real behaviour change: today's predicate is `featured=true AND status='active'`, so **featuring is currently load-bearing for visibility at all** and the goal's owner-control premise silently does not work without it. Visibility is owned by the INSTANCE and the hub row is a CACHE (ADR 0141 §3 + the admin-console spike's D1) — so `owner_github_id` being "advisory, not an authority" is CORRECT rather than a gap, R05 moves to an instance surface, and R08's absent-report default is fail-closed (unreported ⇒ dark matter, off the map rather than exposed by omission). Per-state join rules compose with the separate `open|closed` join policy ([task 1002817](https://cloudbongos.com/builders#/task/1002817)) by one rule: **visibility sets the ceiling, join policy may only narrow** — otherwise the two settings are a coin-flip decided by evaluation order. Finally, `stealth` COLLIDES with the existing instance-wide pre-launch password gate (`STEALTH_PASSWORD`, `src/bongos/stealth-gate.js`), which means nearly the opposite (a whole instance made unreadable vs a project publicly on the map, anonymously); per ADR 0174 the product meaning keeps the word and the infra rename is filed separately rather than decided by an ADR about visibility. Rejected: a stored 4-valued enum (makes `unlisted` compete with `private`, and lets publishable+unlisted disagree), a separate `published` boolean (can drift from the identity it summarises; derived cannot), and keeping `featured` as the visibility gate (an owner who sets public and appears nowhere has not been given control).](<redacted>.md) | platform-identity / project visibility |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/modules/lifecycle/claim-feed.js

@@ -0,0 +1,142 @@
+'use strict';
+
+// modules/lifecycle/claim-feed.js — shaping + gating helpers for the claimable
+// feed and the two claim paths, carved out of the oversized db.js (task 1003137;
+// the fitness excess-lines ratchet is why these live here and not inline).
+//
+// Three residents, two halves of one rule plus a feed cap:
+//
+//   - goalMembershipFailures — the CLAIM-time goal-membership gate (task
+//     1003137, owner ruling 2026-08-19: a task that lives in a goal is
+//     claimable only by that goal's members — every goal, catch-alls included).
+//     EXTRACTED so BOTH `INSERT INTO claims` sites (db.claimTask and
+//     db.claimTasksBatch — the batch path duplicates claimTask's gates one by
+//     one, so an inline-only gate would be trivially bypassable via
+//     /claims/batch) run the identical check. The DECISION itself is the pure
+//     goal-authz.goalMembershipClaimRefusal; this wrapper only fetches the
+//     goal + membership facts on the caller's open txn client.
+//   - decorateGoalMembership — the FEED half of the same rule (owner chose
+//     filter-plus-show-as-joinable): a ready task whose goal the builder has
+//     not joined is never silently advertised as claimable — the exact trap
+//     task 1002650 closed for open blockers. The row stays in the feed but
+//     carries goal_membership { required, goal_id, visibility, action } so the
+//     caller renders it joinable. Reuses the SAME pure refusal fn, so feed and
+//     gate cannot disagree on join-vs-apply or on the leak rule (a private
+//     goal's title/scope never leave the server).
+//   - capNewcomerTasks — the newcomer-chore display cap (task 1266), moved
+//     verbatim from db.js.
+//
+// db.js re-exports all three, so callers and tests keep their import site.
+
+// Pure kernel-adjacent matcher via the doorway (never the core file); the pure
+// membership decision from the authority-model sibling.
+const api = require('../../src/module-api');
+const { scopeIncludesProtected } = api.moduleScopeMap;
+const { goalMembershipClaimRefusal } = require('./goal-authz.js');
+
+// The claim-txn half. `tasks` rows need { id, goal_id }; goal_id NULL rows are
+// skipped (nullable by migration 160 — a NULL goal has no membership to check;
+// a dangling goal_id can't occur, tasks.goal_id is FK'd). An Archon passes as
+// the implicit member (the isMemberOrArchon convention). Runs on the caller's
+// open txn `client` so the read shares the claim transaction's snapshot.
+// Returns [{ task_id, refusal }] — empty when every task is claimable.
+async function goalMembershipFailures({ client, tasks, builderId, builderRank }) {
+  const gated = tasks.filter((t) => t.goal_id != null);
+  if (gated.length === 0 || builderRank === 'archon') return [];
+  const goalIds = Array.from(new Set(gated.map((t) => Number(t.goal_id))));
+  const { rows: goalRows } = await client.query(
+    `SELECT g.id, g.title, g.visibility, g.scope_modules,
+            EXISTS (SELECT 1 FROM goal_members gm
+                     WHERE gm.goal_id = g.id AND gm.builder_id = $2) AS is_member
+       FROM goals g
+      WHERE g.id = ANY($1::bigint[])`,
+    [goalIds, builderId]
+  );
+  const byId = new Map(goalRows.map((r) => [Number(r.id), r]));
+  const failures = [];
+  for (const t of gated) {
+    const goal = byId.get(Number(t.goal_id)) ?? null;
+    const refusal = goalMembershipClaimRefusal({
+      goal,
+      isMember: goal ? goal.is_member === true : false,
+      actorRank: builderRank,
+      scopeProtected: goal ? scopeIncludesProtected(goal.scope_modules) : false,
+    });
+    if (refusal) failures.push({ task_id: Number(t.id), refusal });
+  }
+  return failures;
+}
+
+// The feed half. Consumes (and strips) the g_* scratch columns db.js's
+// LEFT JOIN rides along; member / Archon / goal-less rows pass through shaped
+// exactly as before task 1003137. The SQL folds "Archon" into g_is_member, so
+// actorRank is passed null here — membership is the only remaining question.
+function decorateGoalMembership(row) {
+  const { g_visibility, g_scope_modules, g_title, g_is_member, ...task } = row;
+  if (task.goal_id == null || g_visibility == null) return task; // no goal → not gated
+  const refusal = goalMembershipClaimRefusal({
+    goal: { id: task.goal_id, title: g_title, visibility: g_visibility },
+    isMember: g_is_member === true,
+    actorRank: null,
+    scopeProtected: scopeIncludesProtected(g_scope_modules),
+  });
+  if (!refusal) return task; // member/Archon → as today
+  return {
+    ...task,
+    goal_membership: {
+      required: true,
+      goal_id: refusal.goal_id,
+      visibility: refusal.visibility,
+      action: refusal.action,
+      ...('goal_title' in refusal ? { goal_title: refusal.goal_title } : {}),
+    },
+  };
+}
+
+// Cap the number of newcomer_friendly rows in a claimable feed to `cap`
+// (task 1266). Pure + exported for unit testing. Non-newcomer (real version)
+// rows pass through untouched and unbounded. When newcomer rows exceed the cap
+// they're selected round-robin across the disciplines PRESENT among them — so
+// each of the builder's lanes is represented before a slot goes to a duplicate
+// of an already-shown discipline. Input ordering (priority, est, created) is
+// preserved: we compute a keep-set of ids and then filter the original array.
+function capNewcomerTasks(rows, cap = 3) {
+  const all = Array.isArray(rows) ? rows : [];
+  const newcomer = all.filter((t) => t && t.newcomer_friendly === true);
+  if (newcomer.length <= cap) return all;
+
+  // Group newcomer rows by discipline, preserving (a) input order within each
+  // group and (b) first-appearance order of the groups themselves — so the
+  // highest-priority discipline's chore is picked first.
+  const groups = new Map(); // discipline -> [rows], insertion-ordered
+  for (const t of newcomer) {
+    const disc = t.discipline || 'unclassified';
+    if (!groups.has(disc)) groups.set(disc, []);
+    groups.get(disc).push(t);
+  }
+  const lists = Array.from(groups.values());
+
+  // Round-robin: take index 0 from each group, then index 1, etc., until we've
+  // kept `cap` rows. Duplicate disciplines fill later passes once each lane has
+  // been represented.
+  const keep = new Set();
+  let depth = 0;
+  let progressed = true;
+  while (keep.size < cap && progressed) {
+    progressed = false;
+    for (const list of lists) {
+      if (depth < list.length) {
+        keep.add(list[depth].id);
+        progressed = true;
+        if (keep.size >= cap) break;
+      }
+    }
+    depth += 1;
+  }
+
+  // Filter the original (ordered) array: every non-newcomer row, plus the kept
+  // newcomer rows. Preserves the original feed ordering.
+  return all.filter((t) => t.newcomer_friendly !== true || keep.has(t.id));
+}
+
+module.exports = { goalMembershipFailures, decorateGoalMembership, capNewcomerTasks };

package/modules/lifecycle/db.js

@@ -46,6 +46,9 @@ const { claimEligibilityAllows, CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-e
 // Pure kernel-adjacent matchers via the doorway (never the core file).
 const { matchProtected } = api.permissionPathCheck;
 const { touchesOverlap } = api.pathMatch;
+// Claimable-feed shaping + the goal-membership claim gate (task 1003137; the
+// newcomer cap of task 1266 moved there too) — see claim-feed.js.
+const { goalMembershipFailures, decorateGoalMembership, capNewcomerTasks } = require('./claim-feed.js');
 
 
 // ---------------------------------------------------------------------------
@@ -1923,6 +1926,8 @@ const SESSION_FIT_SQL = `
 async function listClaimableTasks({ versionId = null, builderId = null, discipline = null, fit = null } = {}) {
   const params = [];
   const where = [];
+  let goalJoin = '';
+  let selectCols = 'v.*';
   if (versionId) {
     params.push(versionId);
     where.push(`v.version_id = $${params.length}`);
@@ -1971,6 +1976,16 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
         WHEN 'archon' THEN 4 WHEN 'metic' THEN 3 WHEN 'thetes' THEN 2 WHEN 'xenos' THEN 1 ELSE 0
       END
     )`);
+    // task 1003137: ride the goal + own-membership facts along so
+    // decorateGoalMembership (claim-feed.js) can flag non-member rows joinable.
+    // Same parameter index — all three reads are the same builderId. The
+    // goal_members PK (goal_id, builder_id) means the LEFT JOIN never
+    // multiplies rows; an Archon reads as member (isMemberOrArchon convention).
+    goalJoin = ` LEFT JOIN goals g ON g.id = v.goal_id
+                 LEFT JOIN goal_members gm ON gm.goal_id = g.id AND gm.builder_id = $${params.length}`;
+    selectCols = `v.*, g.visibility AS g_visibility, g.scope_modules AS g_scope_modules, g.title AS g_title,
+      (gm.builder_id IS NOT NULL
+        OR (SELECT rank FROM builders WHERE id = $${params.length}) = 'archon') AS g_is_member`;
   }
   // Autonomy / parallel-eligibility filter. Joining the session-fit relation
   // (also a SELECT t.* shape) makes bare column names like priority/created_at
@@ -1988,12 +2003,14 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   // recent actuals; ordering on the raw estimate puts oversized tasks at the
   // bottom even when their actual time-to-ship is short. See migration 015.
   const sql =
-    `SELECT v.* FROM (${CLAIMABLE_SQL}) v` + fitJoin +
+    `SELECT ${selectCols} FROM (${CLAIMABLE_SQL}) v` + goalJoin + fitJoin +
     (where.length ? ` WHERE ${where.join(' AND ')}` : '') +
     ` ORDER BY v.priority NULLS LAST,
               COALESCE(v.est_minutes_calibrated, v.est_minutes) NULLS LAST,
               v.created_at`;
-  const { rows } = await pool.query(sql, params);
+  const { rows: rawRows } = await pool.query(sql, params);
+  // task 1003137: strip g_* scratch columns, flag non-member rows joinable.
+  const rows = rawRows.map(decorateGoalMembership);
   // SR-12 / G2 (task 994): when the autonomous/parallel runner is asking, drop
   // any task whose declared touches[] reach the permission/methodology/deploy
   // core. The runner ships as Archon straight to main, so these must never be
@@ -2002,7 +2019,12 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   // with the grader pre-pass, pre-push hook, and main-audit — no second source
   // of truth to drift.
   if (fit === 'autonomous' || fit === 'parallel') {
-    return rows.filter((t) => !taskTouchesProtectedPath(t));
+    // task 1003137: membership-required rows are DROPPED, not flagged — the
+    // claim gate will refuse them and an autonomous runner can't answer a join
+    // prompt. (No builderId → no membership facts; the claim gate stays the
+    // hard control.)
+    return rows.filter((t) => !taskTouchesProtectedPath(t)
+      && !(t.goal_membership && t.goal_membership.required === true));
   }
   // Newcomer-chore display cap (task 1266, owner decision 2026-06-19). The
   // newcomer-floor keeps a deep supply pool (floor: 3 artist + 2 ideator) so
@@ -2017,53 +2039,6 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   return capNewcomerTasks(rows);
 }
 
-// Cap the number of newcomer_friendly rows in a claimable feed to `cap`
-// (task 1266). Pure + exported for unit testing. Non-newcomer (real version)
-// rows pass through untouched and unbounded. When newcomer rows exceed the cap
-// they're selected round-robin across the disciplines PRESENT among them — so
-// each of the builder's lanes is represented before a slot goes to a duplicate
-// of an already-shown discipline. Input ordering (priority, est, created) is
-// preserved: we compute a keep-set of ids and then filter the original array.
-
-function capNewcomerTasks(rows, cap = 3) {
-  const all = Array.isArray(rows) ? rows : [];
-  const newcomer = all.filter((t) => t && t.newcomer_friendly === true);
-  if (newcomer.length <= cap) return all;
-
-  // Group newcomer rows by discipline, preserving (a) input order within each
-  // group and (b) first-appearance order of the groups themselves — so the
-  // highest-priority discipline's chore is picked first.
-  const groups = new Map(); // discipline -> [rows], insertion-ordered
-  for (const t of newcomer) {
-    const disc = t.discipline || 'unclassified';
-    if (!groups.has(disc)) groups.set(disc, []);
-    groups.get(disc).push(t);
-  }
-  const lists = Array.from(groups.values());
-
-  // Round-robin: take index 0 from each group, then index 1, etc., until we've
-  // kept `cap` rows. Duplicate disciplines fill later passes once each lane has
-  // been represented.
-  const keep = new Set();
-  let depth = 0;
-  let progressed = true;
-  while (keep.size < cap && progressed) {
-    progressed = false;
-    for (const list of lists) {
-      if (depth < list.length) {
-        keep.add(list[depth].id);
-        progressed = true;
-        if (keep.size >= cap) break;
-      }
-    }
-    depth += 1;
-  }
-
-  // Filter the original (ordered) array: every non-newcomer row, plus the kept
-  // newcomer rows. Preserves the original feed ordering.
-  return all.filter((t) => t.newcomer_friendly !== true || keep.has(t.id));
-}
-
 // SR-12 / G2 (task 994): does this task's declared touches[] overlap any
 // permission-sensitive (ADR 0043) path? Pure + exported for unit testing.
 // Returns true if ANY declared touch matches a protected glob — such a task is
@@ -2659,7 +2634,7 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     }
 
     const { rows: taskRows } = await client.query(
-      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind FROM tasks WHERE id = $1 FOR UPDATE`,
+      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind, goal_id FROM tasks WHERE id = $1 FOR UPDATE`,
       [taskId]
     );
     if (taskRows.length === 0) {
@@ -2730,6 +2705,15 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
       };
     }
 
+    // task 1003137 (owner ruling 2026-08-19): a task's goal requires MEMBERSHIP —
+    // every goal, catch-alls included; goal_id NULL is NOT gated. After the rank
+    // gates (membership only narrows — it must never mask a rank refusal),
+    // before deps. Decision + leak rule: goal-authz.goalMembershipClaimRefusal;
+    // the SAME extracted check runs in claimTasksBatch (the only other INSERT
+    // INTO claims site) — see claim-feed.js.
+    const goalRefusals = await goalMembershipFailures({ client, tasks: [task], builderId, builderRank });
+    if (goalRefusals.length > 0) throw goalRefusals[0].refusal;
+
     // The claim gate (ADR 0015, generalized in task 1516 / ADR 0086 §5): a task
     // can't be claimed while any dependency is un-done — its OWN edges plus those
     // inherited from its goal/criteria, where "done" = task shipped | criterion
@@ -2986,7 +2970,7 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
 
     // Lock every requested task row up front (sorted to avoid deadlocks).
     const { rows: taskRows } = await client.query(
-      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key FROM tasks WHERE id = ANY($1::bigint[]) ORDER BY id FOR UPDATE`,
+      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, goal_id FROM tasks WHERE id = ANY($1::bigint[]) ORDER BY id FOR UPDATE`,
       [uniqIds]
     );
 
@@ -3069,6 +3053,14 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
       }
     }
 
+    // task 1003137: the SAME extracted goal-membership gate as claimTask — this
+    // path owns the repo's only other INSERT INTO claims, so an inline-only gate
+    // would be bypassable via batch. Same ladder position: after rank, before deps.
+    for (const f of await goalMembershipFailures({ client, tasks: taskRows, builderId, builderRank })) {
+      const { code, ...rest } = f.refusal;
+      failures.push({ task_id: f.task_id, reason: code, ...rest });
+    }
+
     // Per-task dependency check (ADR 0015, generalized task 1516). An EXTERNAL dep
     // (not in this batch) must already be done; a batch-internal dep isn't done yet
     // at claim time but doesn't block — the batch is worked serially. "Internal"
@@ -3351,7 +3343,7 @@ async function validateClaimBatch({ taskIds, builderId }) {
   const builderRank = builderRows[0] ? builderRows[0].rank : null;
 
   const { rows: taskRows } = await pool.query(
-    `SELECT id, status, touches, newcomer_friendly, requires_rank, module_key
+    `SELECT id, status, touches, newcomer_friendly, requires_rank, module_key, goal_id
        FROM tasks WHERE id = ANY($1::bigint[])`,
     [uniqIds]
   );
@@ -3393,6 +3385,12 @@ async function validateClaimBatch({ taskIds, builderId }) {
     }
   }
 
+  // task 1003137: goal-membership, kept in sync with claimTasksBatch (see claim-feed.js).
+  for (const f of await goalMembershipFailures({ client: pool, tasks: taskRows, builderId, builderRank })) {
+    const { code, ...rest } = f.refusal;
+    push(f.task_id, { reason: code, ...rest });
+  }
+
   // Dependencies — external to the batch only (a batch-internal dep is fine;
   // the batch is worked serially, same rule as claimTasksBatch).
   const batchIdSet = new Set(uniqIds);
@@ -5688,6 +5686,7 @@ module.exports = {
   listClaimableTasks,
   capNewcomerTasks,
   taskTouchesProtectedPath, // SR-12 / G2 (task 994): autonomous-fit protected-path exclusion (pure, testable)
+  decorateGoalMembership, // task 1003137: feed-side joinable flag (pure, testable)
   rankCrossDisciplineRecommendations,
   listActiveClaims,
   updateTaskStatus,

package/modules/lifecycle/goal-authz.js

@@ -62,4 +62,59 @@ function authorizeGoalManagement({ goal, actorId, actorRank, actorMembership })
   return { ok: true };
 }
 
-module.exports = { isGoalOwner, isGoalOwnerOrManager, authorizeGoalManagement };
+// goalMembershipClaimRefusal — the CLAIM-time membership gate (task 1003137).
+// Owner ruling 2026-08-19: a task that lives in a goal is claimable only by that
+// goal's members — EVERY goal, the '<version> — general' catch-alls included.
+// Safe precisely because the refusal is actionable in-session: joining a public
+// goal costs one 'yes' (POST /goals/:id/join), a private/protected one an
+// application (POST /goals/:id/requests).
+//
+// Returns null when the claim may proceed, else the refusal payload the claim
+// paths throw (code GOAL_MEMBERSHIP_REQUIRED, HTTP 403 at the route). PURE —
+// both INSERT INTO claims sites (claimTask + claimTasksBatch, db.js) feed it
+// through db.goalMembershipFailures so the batch path cannot drift from the
+// single-claim path.
+//
+// The decision, in order (fail-closed on the membership question itself):
+//   - no goal → not gated. tasks.goal_id is NULLABLE (migration 160) and every
+//     version created after it gets no catch-all, so goal_id IS NULL is COMMON —
+//     a NULL goal has no membership to check. (A dangling goal_id can't occur:
+//     tasks.goal_id is FK'd to goals(id).)
+//   - Archon → pass. An Archon is an implicit member everywhere in the goal
+//     surface (isMemberOrArchon, POST /goals/:id/join, isGoalOwnerOrManager);
+//     the claim gate follows that single convention rather than minting a
+//     second membership model. Membership only NARROWS what the rank gates
+//     (which run before this in claimTask's ladder) already allow — it never
+//     widens what a Xenos reaches.
+//   - member → pass.
+//   - else refuse, naming the action: 'join' for a public unprotected goal,
+//     'apply' for a private one OR a protected-scope one (self-join on
+//     protected scope is Archon-mediated — routes/goals.js POST /:id/join).
+//
+// LEAK RULE (the goal_abuse_matrix ordering discipline, gotcha d): a PRIVATE
+// goal's refusal carries goal_id, visibility and the action ONLY — never the
+// title, never scope. A public goal's title is public; it rides along so the
+// CLI can name what to join.
+function goalMembershipClaimRefusal({ goal, isMember, actorRank, scopeProtected }) {
+  if (!goal) return null; // goal_id NULL — no membership to check, NOT gated
+  if (actorRank === 'archon') return null;
+  if (isMember) return null;
+  const isPrivate = goal.visibility === 'private';
+  const action = (isPrivate || scopeProtected === true) ? 'apply' : 'join';
+  const goalId = Number(goal.id);
+  return {
+    code: 'GOAL_MEMBERSHIP_REQUIRED',
+    goal_id: goalId,
+    visibility: goal.visibility,
+    action,
+    ...(isPrivate ? {} : { goal_title: goal.title }),
+    what_to_do: action === 'join'
+      ? `Join the goal (POST /api/bongos/goals/${goalId}/join), then retry the claim.`
+      : `Apply to join (POST /api/bongos/goals/${goalId}/requests); nothing can be claimed until an owner approves.`,
+    message: isPrivate
+      ? `This task lives in goal ${goalId}, which is private — you are not a member.`
+      : `This task lives in goal ${goalId} ("${goal.title}") — you are not a member.`,
+  };
+}
+
+module.exports = { isGoalOwner, isGoalOwnerOrManager, authorizeGoalManagement, goalMembershipClaimRefusal };

package/modules/lifecycle/routes/claims.js

@@ -301,6 +301,12 @@ module.exports = function buildClaimsRouter() {
           // builder's. Same 403 semantics as the Xenos gate; the body carries
           // { required, actual } so the CLI can render a clean message.
           err.code === 'INSUFFICIENT_RANK' ? 403 :
+          // task 1003137: the task's goal requires membership. The body carries
+          // goal_id, visibility, and the action (join|apply) + what_to_do —
+          // enough for the CLI to offer the join inline (task 1003138). A
+          // private goal's body deliberately omits its title/scope (leak rule
+          // in goal-authz.goalMembershipClaimRefusal).
+          err.code === 'GOAL_MEMBERSHIP_REQUIRED' ? 403 :
           500;
         // V4.R14 (#952): a TASK_NOT_READY 409 names the way forward instead of
         // leaving the caller to discover the promote route by spelunking (#506).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.277",
+  "version": "1.19.279",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.277",
+      "version": "1.19.279",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.277",
+  "version": "1.19.279",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -981,8 +981,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.275 with no explicit bump. run 32499257959. (task 1002620)
 //   1.19.277 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.276 with no explicit bump. run 32503053532. (task 1002620)
+//   1.19.278 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.277 with no explicit bump. run 32508270995. (task 1002620)
+//   1.19.279 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.278 with no explicit bump. run 32521664476. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.277'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.279'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_abuse_matrix.mjs

@@ -29,6 +29,10 @@
 //   O1  ordering: non-member + out-of-scope                  → not_a_member (no scope hint leaks)
 //   O2  ordering: a closed goal short-circuits first         → goal_not_open
 //   P   Metic+ on an in-scope protected path                 → ALLOW (rank clears the floor)
+//   Q*  CLAIM a task in a goal you never joined (task 1003137)→ 403 GOAL_MEMBERSHIP_REQUIRED
+//       (join for public, apply for private/protected; a private goal's refusal
+//       leaks no title and no scope; goal_id NULL is not gated; both INSERT
+//       INTO claims sites run the same extracted gate)
 //
 // Ordering is fail-closed (a missing/ambiguous input denies), and membership is
 // checked BEFORE scope so a non-member never learns the scope (O1 vs B). Per-branch
@@ -155,6 +159,74 @@ await test('[K] a protected-scope goal is recognized as protected; a normal goal
   assert.equal(scopeIncludesProtected(G_IDEAS.scope_modules), false, 'ideas is a normal, open-join module');
 });
 
+// ---- [Q] the CLAIM-time membership wall (task 1003137) ----
+// A task that lives in a goal is claimable only by that goal's members — every
+// goal, the '<version> — general' catch-alls included (owner ruling 2026-08-19).
+// The decision is the pure goalMembershipClaimRefusal (goal-authz.js); db.js
+// feeds BOTH claim paths through the one extracted db.goalMembershipFailures.
+const { goalMembershipClaimRefusal } = require('../modules/lifecycle/goal-authz.js');
+const G_PUBLIC = { id: 21, title: 'Public builder profiles', visibility: 'public' };
+const G_PRIVATE = { id: 22, title: 'SECRET-TITLE-MUST-NOT-LEAK', visibility: 'private', scope_modules: ['lifecycle'] };
+
+await test('[Q1] goal_id NULL is NOT gated — a NULL goal has no membership to check (migration 160 nullable)', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: null, isMember: false, actorRank: 'xenos', scopeProtected: false }), null);
+});
+await test('[Q2] a member claims freely', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: true, actorRank: 'xenos', scopeProtected: false }), null);
+});
+await test('[Q3] an Archon is an implicit member (the isMemberOrArchon convention)', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: G_PRIVATE, isMember: false, actorRank: 'archon', scopeProtected: true }), null);
+});
+await test('[Q4] non-member on a public unprotected goal → GOAL_MEMBERSHIP_REQUIRED, action=join, title rides along', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: false, actorRank: 'metic', scopeProtected: false });
+  assert.equal(r.code, 'GOAL_MEMBERSHIP_REQUIRED');
+  assert.equal(r.action, 'join');
+  assert.equal(r.goal_id, 21);
+  assert.equal(r.visibility, 'public');
+  assert.equal(r.goal_title, 'Public builder profiles');
+  assert.ok(/join/i.test(r.what_to_do), 'the way forward names the join route');
+});
+await test('[Q5] non-member on a PRIVATE goal → action=apply, and the refusal leaks NO title and NO scope', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PRIVATE, isMember: false, actorRank: 'metic', scopeProtected: true });
+  assert.equal(r.code, 'GOAL_MEMBERSHIP_REQUIRED');
+  assert.equal(r.action, 'apply');
+  assert.equal(r.visibility, 'private');
+  assert.ok(!('goal_title' in r), 'a private goal\'s title must not leak to a non-member');
+  const flat = JSON.stringify(r);
+  assert.ok(!flat.includes('SECRET-TITLE-MUST-NOT-LEAK'), 'no field may carry the private title');
+  assert.ok(!flat.includes('scope_modules') && !flat.includes('lifecycle'), 'no field may carry the private scope');
+});
+await test('[Q6] non-member on a public PROTECTED-scope goal → action=apply (self-join is Archon-mediated)', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: false, actorRank: 'metic', scopeProtected: true });
+  assert.equal(r.action, 'apply', 'a protected-scope goal is never offered as open-join');
+});
+await test('[Q7] source contract: BOTH INSERT INTO claims sites run the extracted gate (batch cannot bypass)', () => {
+  const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  const insertSites = dbSrc.match(/INSERT INTO claims \(/g) || [];
+  assert.equal(insertSites.length, 2, 'exactly two claim-insert sites (claimTask + claimTasksBatch) — a third needs the gate too');
+  const gateCalls = dbSrc.match(/await goalMembershipFailures\(/g) || [];
+  assert.equal(gateCalls.length, 3, 'the membership gate must run on both claim paths + validateClaimBatch (the dry-run twin that must stay in sync)');
+});
+await test('[Q8] feed contract: a non-member row is flagged joinable, never silently claimable (leak rule holds)', () => {
+  const { decorateGoalMembership } = require('../modules/lifecycle/db.js');
+  // member / goal-less rows pass through shaped as today
+  assert.deepEqual(decorateGoalMembership({ id: 1, goal_id: null }), { id: 1, goal_id: null });
+  assert.deepEqual(
+    decorateGoalMembership({ id: 2, goal_id: 21, g_visibility: 'public', g_scope_modules: ['ideas'], g_title: 'T', g_is_member: true }),
+    { id: 2, goal_id: 21 }
+  );
+  // non-member public → flagged join, title carried, scope stripped
+  const pub = decorateGoalMembership({ id: 3, goal_id: 21, g_visibility: 'public', g_scope_modules: ['ideas'], g_title: 'T', g_is_member: false });
+  assert.deepEqual(pub.goal_membership, { required: true, goal_id: 21, visibility: 'public', action: 'join', goal_title: 'T' });
+  assert.ok(!('g_scope_modules' in pub) && !('g_title' in pub), 'scratch columns must not leave the feed');
+  // non-member private → flagged apply, NO title
+  const priv = decorateGoalMembership({ id: 4, goal_id: 22, g_visibility: 'private', g_scope_modules: ['ideas'], g_title: 'SECRET', g_is_member: false });
+  assert.deepEqual(priv.goal_membership, { required: true, goal_id: 22, visibility: 'private', action: 'apply' });
+  // non-member public but protected-scope → apply (matches the join route's Archon-mediation)
+  const prot = decorateGoalMembership({ id: 5, goal_id: 23, g_visibility: 'public', g_scope_modules: ['lifecycle'], g_title: 'L', g_is_member: false });
+  assert.equal(prot.goal_membership.action, 'apply');
+});
+
 // ---- the pins that make a rank drift on a goal route a red build (BV1.R61) ----
 // The wall is only drift-proof if the goal routes are PINNED and the LIVE routes
 // classify to those pins. The catch-violation (a downgrade → blocker) is proven in

package/tests/reward_gate.mjs

@@ -163,9 +163,10 @@ t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', (
   // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
   // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
   // past the old edge; 6000 -> 7000 in task 1002613, when the enriched
-  // rank_too_low_for_task denial did the same. Keep it comfortably below the
-  // claimTasksBatch boundary (~15.5k chars in).
-  const body = dbSrc.slice(start, start + 7000);
+  // rank_too_low_for_task denial did the same; 7000 -> 8500 in task 1003137, when
+  // the goal-membership gate landed between the rank gates and deps. Keep it
+  // comfortably below the claimTasksBatch boundary (~16.5k chars in).
+  const body = dbSrc.slice(start, start + 8500);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.