@bongos/core 1.19.278 → 1.19.279

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.278",
-  "core_contract": "1.19.278",
-  "source_commit": "d2c8b889323c64a1734fa1e622fe168b46b1116f",
+  "core_version": "1.19.279",
+  "core_contract": "1.19.279",
+  "source_commit": "20fdd2b00fa489173ea330aeec453d56dcb6999a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-21T17:28:18.709Z",
+  "built_at": "2026-08-21T20:04:41.616Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 319,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1376,
+    "functional_verbatim": 1377,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1717,
-  "tree_sha256": "f8955f572f4ca37464ee436a7b53e1b27efcc4d7f142af25ea001a4f42ca390b",
+  "file_count": 1718,
+  "tree_sha256": "98ca3398579326bf1dc3356202895e6911341413dbf4e0238347e3357888565f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3744,6 +3744,11 @@
       "mode": "0000644",
       "sha256": "0c52ae165d304f0f08ca04c9a288ef7d8ffb07288282dcd7b2d503fced7cd744"
     },
+    {
+      "path": "modules/lifecycle/claim-feed.js",
+      "mode": "0000644",
+      "sha256": "3586cc2aa07913870ad99073c534e70ef2e2c5ff6a5ef2ddeb141cfd397269cd"
+    },
     {
       "path": "modules/lifecycle/conflict-resolve.js",
       "mode": "0000644",
@@ -3757,7 +3762,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "64cdde411e3fb8d1263eebf9093a353dde6ee684be2977057c8800e608b52a63"
+      "sha256": "74eedb9ee1c423c9ecdea6f09d8555fa3200ac9e3a86a194182774cb72f0cd0b"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3782,7 +3787,7 @@
     {
       "path": "modules/lifecycle/goal-authz.js",
       "mode": "0000644",
-      "sha256": "6280028c33fd0770514e753962e3a83ee2e3d47d6c9efdb67b9905b868c6db72"
+      "sha256": "3eb9d818e0e0d45a896a5c0a515842b5f5a01e102d02f8a9a605c271088c8e5d"
     },
     {
       "path": "modules/lifecycle/goal-conflicts.js",
@@ -3837,7 +3842,7 @@
     {
       "path": "modules/lifecycle/routes/claims.js",
       "mode": "0000644",
-      "sha256": "4f40c6e74c40c1ff29f8f487e2a6b574e7998aca4366a6372101d17412917eea"
+      "sha256": "e02abac52a82fb02603dd92074d4ebd060ec03195803d704b021614806ef00fe"
     },
     {
       "path": "modules/lifecycle/routes/dependencies.js",
@@ -4492,12 +4497,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6c3c704f2de78db933bd38831feaae364a1d1d608a01b7c14d147854950a6cef"
+      "sha256": "66c790ddb5f66b9c7e5961f8402a508bdb36d5dddf35215401eda673a115c003"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "61504099e0e7e063f76862dfb805405f2743eaa0a3cb389a6b80fad771f35775"
+      "sha256": "ea43d45c4c7ef30f10935c5ec6e967e9a1c707a6f9a69ed7f5f6b2e5771fef8e"
     },
     {
       "path": "public-docs/index.html",
@@ -6142,7 +6147,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e0b73ea48b0a4c19e931162761dc58e0f97859e35bd92d93335cf610fc2036b0"
+      "sha256": "e58b6609edc9a144ab403e149a715aebdc324b598244833d1ef3a6aa3713f88a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7042,7 +7047,7 @@
     {
       "path": "tests/goal_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "e5b32e9c4a38e405cfd3185b49f4a1d9a6b39a0f39c12053c01ba3680c550120"
+      "sha256": "daf3a5942ce3f154d29618e4242557758db50d8c70046562995fc2c10d5ee954"
     },
     {
       "path": "tests/goal_achievement.mjs",
@@ -8062,7 +8067,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "7ae4d9af4d389c34f0d16f921858cbbf5d0d57f3219f830d10552ebcdc43908f"
+      "sha256": "a21d9f4d3ff937d59b9361b330a2e5e93ded9c9a12d73434eb843cae9d1a3c74"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/modules/lifecycle/claim-feed.js

@@ -0,0 +1,142 @@
+'use strict';
+
+// modules/lifecycle/claim-feed.js — shaping + gating helpers for the claimable
+// feed and the two claim paths, carved out of the oversized db.js (task 1003137;
+// the fitness excess-lines ratchet is why these live here and not inline).
+//
+// Three residents, two halves of one rule plus a feed cap:
+//
+//   - goalMembershipFailures — the CLAIM-time goal-membership gate (task
+//     1003137, owner ruling 2026-08-19: a task that lives in a goal is
+//     claimable only by that goal's members — every goal, catch-alls included).
+//     EXTRACTED so BOTH `INSERT INTO claims` sites (db.claimTask and
+//     db.claimTasksBatch — the batch path duplicates claimTask's gates one by
+//     one, so an inline-only gate would be trivially bypassable via
+//     /claims/batch) run the identical check. The DECISION itself is the pure
+//     goal-authz.goalMembershipClaimRefusal; this wrapper only fetches the
+//     goal + membership facts on the caller's open txn client.
+//   - decorateGoalMembership — the FEED half of the same rule (owner chose
+//     filter-plus-show-as-joinable): a ready task whose goal the builder has
+//     not joined is never silently advertised as claimable — the exact trap
+//     task 1002650 closed for open blockers. The row stays in the feed but
+//     carries goal_membership { required, goal_id, visibility, action } so the
+//     caller renders it joinable. Reuses the SAME pure refusal fn, so feed and
+//     gate cannot disagree on join-vs-apply or on the leak rule (a private
+//     goal's title/scope never leave the server).
+//   - capNewcomerTasks — the newcomer-chore display cap (task 1266), moved
+//     verbatim from db.js.
+//
+// db.js re-exports all three, so callers and tests keep their import site.
+
+// Pure kernel-adjacent matcher via the doorway (never the core file); the pure
+// membership decision from the authority-model sibling.
+const api = require('../../src/module-api');
+const { scopeIncludesProtected } = api.moduleScopeMap;
+const { goalMembershipClaimRefusal } = require('./goal-authz.js');
+
+// The claim-txn half. `tasks` rows need { id, goal_id }; goal_id NULL rows are
+// skipped (nullable by migration 160 — a NULL goal has no membership to check;
+// a dangling goal_id can't occur, tasks.goal_id is FK'd). An Archon passes as
+// the implicit member (the isMemberOrArchon convention). Runs on the caller's
+// open txn `client` so the read shares the claim transaction's snapshot.
+// Returns [{ task_id, refusal }] — empty when every task is claimable.
+async function goalMembershipFailures({ client, tasks, builderId, builderRank }) {
+  const gated = tasks.filter((t) => t.goal_id != null);
+  if (gated.length === 0 || builderRank === 'archon') return [];
+  const goalIds = Array.from(new Set(gated.map((t) => Number(t.goal_id))));
+  const { rows: goalRows } = await client.query(
+    `SELECT g.id, g.title, g.visibility, g.scope_modules,
+            EXISTS (SELECT 1 FROM goal_members gm
+                     WHERE gm.goal_id = g.id AND gm.builder_id = $2) AS is_member
+       FROM goals g
+      WHERE g.id = ANY($1::bigint[])`,
+    [goalIds, builderId]
+  );
+  const byId = new Map(goalRows.map((r) => [Number(r.id), r]));
+  const failures = [];
+  for (const t of gated) {
+    const goal = byId.get(Number(t.goal_id)) ?? null;
+    const refusal = goalMembershipClaimRefusal({
+      goal,
+      isMember: goal ? goal.is_member === true : false,
+      actorRank: builderRank,
+      scopeProtected: goal ? scopeIncludesProtected(goal.scope_modules) : false,
+    });
+    if (refusal) failures.push({ task_id: Number(t.id), refusal });
+  }
+  return failures;
+}
+
+// The feed half. Consumes (and strips) the g_* scratch columns db.js's
+// LEFT JOIN rides along; member / Archon / goal-less rows pass through shaped
+// exactly as before task 1003137. The SQL folds "Archon" into g_is_member, so
+// actorRank is passed null here — membership is the only remaining question.
+function decorateGoalMembership(row) {
+  const { g_visibility, g_scope_modules, g_title, g_is_member, ...task } = row;
+  if (task.goal_id == null || g_visibility == null) return task; // no goal → not gated
+  const refusal = goalMembershipClaimRefusal({
+    goal: { id: task.goal_id, title: g_title, visibility: g_visibility },
+    isMember: g_is_member === true,
+    actorRank: null,
+    scopeProtected: scopeIncludesProtected(g_scope_modules),
+  });
+  if (!refusal) return task; // member/Archon → as today
+  return {
+    ...task,
+    goal_membership: {
+      required: true,
+      goal_id: refusal.goal_id,
+      visibility: refusal.visibility,
+      action: refusal.action,
+      ...('goal_title' in refusal ? { goal_title: refusal.goal_title } : {}),
+    },
+  };
+}
+
+// Cap the number of newcomer_friendly rows in a claimable feed to `cap`
+// (task 1266). Pure + exported for unit testing. Non-newcomer (real version)
+// rows pass through untouched and unbounded. When newcomer rows exceed the cap
+// they're selected round-robin across the disciplines PRESENT among them — so
+// each of the builder's lanes is represented before a slot goes to a duplicate
+// of an already-shown discipline. Input ordering (priority, est, created) is
+// preserved: we compute a keep-set of ids and then filter the original array.
+function capNewcomerTasks(rows, cap = 3) {
+  const all = Array.isArray(rows) ? rows : [];
+  const newcomer = all.filter((t) => t && t.newcomer_friendly === true);
+  if (newcomer.length <= cap) return all;
+
+  // Group newcomer rows by discipline, preserving (a) input order within each
+  // group and (b) first-appearance order of the groups themselves — so the
+  // highest-priority discipline's chore is picked first.
+  const groups = new Map(); // discipline -> [rows], insertion-ordered
+  for (const t of newcomer) {
+    const disc = t.discipline || 'unclassified';
+    if (!groups.has(disc)) groups.set(disc, []);
+    groups.get(disc).push(t);
+  }
+  const lists = Array.from(groups.values());
+
+  // Round-robin: take index 0 from each group, then index 1, etc., until we've
+  // kept `cap` rows. Duplicate disciplines fill later passes once each lane has
+  // been represented.
+  const keep = new Set();
+  let depth = 0;
+  let progressed = true;
+  while (keep.size < cap && progressed) {
+    progressed = false;
+    for (const list of lists) {
+      if (depth < list.length) {
+        keep.add(list[depth].id);
+        progressed = true;
+        if (keep.size >= cap) break;
+      }
+    }
+    depth += 1;
+  }
+
+  // Filter the original (ordered) array: every non-newcomer row, plus the kept
+  // newcomer rows. Preserves the original feed ordering.
+  return all.filter((t) => t.newcomer_friendly !== true || keep.has(t.id));
+}
+
+module.exports = { goalMembershipFailures, decorateGoalMembership, capNewcomerTasks };

package/modules/lifecycle/db.js

@@ -46,6 +46,9 @@ const { claimEligibilityAllows, CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-e
 // Pure kernel-adjacent matchers via the doorway (never the core file).
 const { matchProtected } = api.permissionPathCheck;
 const { touchesOverlap } = api.pathMatch;
+// Claimable-feed shaping + the goal-membership claim gate (task 1003137; the
+// newcomer cap of task 1266 moved there too) — see claim-feed.js.
+const { goalMembershipFailures, decorateGoalMembership, capNewcomerTasks } = require('./claim-feed.js');
 
 
 // ---------------------------------------------------------------------------
@@ -1923,6 +1926,8 @@ const SESSION_FIT_SQL = `
 async function listClaimableTasks({ versionId = null, builderId = null, discipline = null, fit = null } = {}) {
   const params = [];
   const where = [];
+  let goalJoin = '';
+  let selectCols = 'v.*';
   if (versionId) {
     params.push(versionId);
     where.push(`v.version_id = $${params.length}`);
@@ -1971,6 +1976,16 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
         WHEN 'archon' THEN 4 WHEN 'metic' THEN 3 WHEN 'thetes' THEN 2 WHEN 'xenos' THEN 1 ELSE 0
       END
     )`);
+    // task 1003137: ride the goal + own-membership facts along so
+    // decorateGoalMembership (claim-feed.js) can flag non-member rows joinable.
+    // Same parameter index — all three reads are the same builderId. The
+    // goal_members PK (goal_id, builder_id) means the LEFT JOIN never
+    // multiplies rows; an Archon reads as member (isMemberOrArchon convention).
+    goalJoin = ` LEFT JOIN goals g ON g.id = v.goal_id
+                 LEFT JOIN goal_members gm ON gm.goal_id = g.id AND gm.builder_id = $${params.length}`;
+    selectCols = `v.*, g.visibility AS g_visibility, g.scope_modules AS g_scope_modules, g.title AS g_title,
+      (gm.builder_id IS NOT NULL
+        OR (SELECT rank FROM builders WHERE id = $${params.length}) = 'archon') AS g_is_member`;
   }
   // Autonomy / parallel-eligibility filter. Joining the session-fit relation
   // (also a SELECT t.* shape) makes bare column names like priority/created_at
@@ -1988,12 +2003,14 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   // recent actuals; ordering on the raw estimate puts oversized tasks at the
   // bottom even when their actual time-to-ship is short. See migration 015.
   const sql =
-    `SELECT v.* FROM (${CLAIMABLE_SQL}) v` + fitJoin +
+    `SELECT ${selectCols} FROM (${CLAIMABLE_SQL}) v` + goalJoin + fitJoin +
     (where.length ? ` WHERE ${where.join(' AND ')}` : '') +
     ` ORDER BY v.priority NULLS LAST,
               COALESCE(v.est_minutes_calibrated, v.est_minutes) NULLS LAST,
               v.created_at`;
-  const { rows } = await pool.query(sql, params);
+  const { rows: rawRows } = await pool.query(sql, params);
+  // task 1003137: strip g_* scratch columns, flag non-member rows joinable.
+  const rows = rawRows.map(decorateGoalMembership);
   // SR-12 / G2 (task 994): when the autonomous/parallel runner is asking, drop
   // any task whose declared touches[] reach the permission/methodology/deploy
   // core. The runner ships as Archon straight to main, so these must never be
@@ -2002,7 +2019,12 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   // with the grader pre-pass, pre-push hook, and main-audit — no second source
   // of truth to drift.
   if (fit === 'autonomous' || fit === 'parallel') {
-    return rows.filter((t) => !taskTouchesProtectedPath(t));
+    // task 1003137: membership-required rows are DROPPED, not flagged — the
+    // claim gate will refuse them and an autonomous runner can't answer a join
+    // prompt. (No builderId → no membership facts; the claim gate stays the
+    // hard control.)
+    return rows.filter((t) => !taskTouchesProtectedPath(t)
+      && !(t.goal_membership && t.goal_membership.required === true));
   }
   // Newcomer-chore display cap (task 1266, owner decision 2026-06-19). The
   // newcomer-floor keeps a deep supply pool (floor: 3 artist + 2 ideator) so
@@ -2017,53 +2039,6 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   return capNewcomerTasks(rows);
 }
 
-// Cap the number of newcomer_friendly rows in a claimable feed to `cap`
-// (task 1266). Pure + exported for unit testing. Non-newcomer (real version)
-// rows pass through untouched and unbounded. When newcomer rows exceed the cap
-// they're selected round-robin across the disciplines PRESENT among them — so
-// each of the builder's lanes is represented before a slot goes to a duplicate
-// of an already-shown discipline. Input ordering (priority, est, created) is
-// preserved: we compute a keep-set of ids and then filter the original array.
-
-function capNewcomerTasks(rows, cap = 3) {
-  const all = Array.isArray(rows) ? rows : [];
-  const newcomer = all.filter((t) => t && t.newcomer_friendly === true);
-  if (newcomer.length <= cap) return all;
-
-  // Group newcomer rows by discipline, preserving (a) input order within each
-  // group and (b) first-appearance order of the groups themselves — so the
-  // highest-priority discipline's chore is picked first.
-  const groups = new Map(); // discipline -> [rows], insertion-ordered
-  for (const t of newcomer) {
-    const disc = t.discipline || 'unclassified';
-    if (!groups.has(disc)) groups.set(disc, []);
-    groups.get(disc).push(t);
-  }
-  const lists = Array.from(groups.values());
-
-  // Round-robin: take index 0 from each group, then index 1, etc., until we've
-  // kept `cap` rows. Duplicate disciplines fill later passes once each lane has
-  // been represented.
-  const keep = new Set();
-  let depth = 0;
-  let progressed = true;
-  while (keep.size < cap && progressed) {
-    progressed = false;
-    for (const list of lists) {
-      if (depth < list.length) {
-        keep.add(list[depth].id);
-        progressed = true;
-        if (keep.size >= cap) break;
-      }
-    }
-    depth += 1;
-  }
-
-  // Filter the original (ordered) array: every non-newcomer row, plus the kept
-  // newcomer rows. Preserves the original feed ordering.
-  return all.filter((t) => t.newcomer_friendly !== true || keep.has(t.id));
-}
-
 // SR-12 / G2 (task 994): does this task's declared touches[] overlap any
 // permission-sensitive (ADR 0043) path? Pure + exported for unit testing.
 // Returns true if ANY declared touch matches a protected glob — such a task is
@@ -2659,7 +2634,7 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     }
 
     const { rows: taskRows } = await client.query(
-      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind FROM tasks WHERE id = $1 FOR UPDATE`,
+      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind, goal_id FROM tasks WHERE id = $1 FOR UPDATE`,
       [taskId]
     );
     if (taskRows.length === 0) {
@@ -2730,6 +2705,15 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
       };
     }
 
+    // task 1003137 (owner ruling 2026-08-19): a task's goal requires MEMBERSHIP —
+    // every goal, catch-alls included; goal_id NULL is NOT gated. After the rank
+    // gates (membership only narrows — it must never mask a rank refusal),
+    // before deps. Decision + leak rule: goal-authz.goalMembershipClaimRefusal;
+    // the SAME extracted check runs in claimTasksBatch (the only other INSERT
+    // INTO claims site) — see claim-feed.js.
+    const goalRefusals = await goalMembershipFailures({ client, tasks: [task], builderId, builderRank });
+    if (goalRefusals.length > 0) throw goalRefusals[0].refusal;
+
     // The claim gate (ADR 0015, generalized in task 1516 / ADR 0086 §5): a task
     // can't be claimed while any dependency is un-done — its OWN edges plus those
     // inherited from its goal/criteria, where "done" = task shipped | criterion
@@ -2986,7 +2970,7 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
 
     // Lock every requested task row up front (sorted to avoid deadlocks).
     const { rows: taskRows } = await client.query(
-      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key FROM tasks WHERE id = ANY($1::bigint[]) ORDER BY id FOR UPDATE`,
+      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, goal_id FROM tasks WHERE id = ANY($1::bigint[]) ORDER BY id FOR UPDATE`,
       [uniqIds]
     );
 
@@ -3069,6 +3053,14 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
       }
     }
 
+    // task 1003137: the SAME extracted goal-membership gate as claimTask — this
+    // path owns the repo's only other INSERT INTO claims, so an inline-only gate
+    // would be bypassable via batch. Same ladder position: after rank, before deps.
+    for (const f of await goalMembershipFailures({ client, tasks: taskRows, builderId, builderRank })) {
+      const { code, ...rest } = f.refusal;
+      failures.push({ task_id: f.task_id, reason: code, ...rest });
+    }
+
     // Per-task dependency check (ADR 0015, generalized task 1516). An EXTERNAL dep
     // (not in this batch) must already be done; a batch-internal dep isn't done yet
     // at claim time but doesn't block — the batch is worked serially. "Internal"
@@ -3351,7 +3343,7 @@ async function validateClaimBatch({ taskIds, builderId }) {
   const builderRank = builderRows[0] ? builderRows[0].rank : null;
 
   const { rows: taskRows } = await pool.query(
-    `SELECT id, status, touches, newcomer_friendly, requires_rank, module_key
+    `SELECT id, status, touches, newcomer_friendly, requires_rank, module_key, goal_id
        FROM tasks WHERE id = ANY($1::bigint[])`,
     [uniqIds]
   );
@@ -3393,6 +3385,12 @@ async function validateClaimBatch({ taskIds, builderId }) {
     }
   }
 
+  // task 1003137: goal-membership, kept in sync with claimTasksBatch (see claim-feed.js).
+  for (const f of await goalMembershipFailures({ client: pool, tasks: taskRows, builderId, builderRank })) {
+    const { code, ...rest } = f.refusal;
+    push(f.task_id, { reason: code, ...rest });
+  }
+
   // Dependencies — external to the batch only (a batch-internal dep is fine;
   // the batch is worked serially, same rule as claimTasksBatch).
   const batchIdSet = new Set(uniqIds);
@@ -5688,6 +5686,7 @@ module.exports = {
   listClaimableTasks,
   capNewcomerTasks,
   taskTouchesProtectedPath, // SR-12 / G2 (task 994): autonomous-fit protected-path exclusion (pure, testable)
+  decorateGoalMembership, // task 1003137: feed-side joinable flag (pure, testable)
   rankCrossDisciplineRecommendations,
   listActiveClaims,
   updateTaskStatus,

package/modules/lifecycle/goal-authz.js

@@ -62,4 +62,59 @@ function authorizeGoalManagement({ goal, actorId, actorRank, actorMembership })
   return { ok: true };
 }
 
-module.exports = { isGoalOwner, isGoalOwnerOrManager, authorizeGoalManagement };
+// goalMembershipClaimRefusal — the CLAIM-time membership gate (task 1003137).
+// Owner ruling 2026-08-19: a task that lives in a goal is claimable only by that
+// goal's members — EVERY goal, the '<version> — general' catch-alls included.
+// Safe precisely because the refusal is actionable in-session: joining a public
+// goal costs one 'yes' (POST /goals/:id/join), a private/protected one an
+// application (POST /goals/:id/requests).
+//
+// Returns null when the claim may proceed, else the refusal payload the claim
+// paths throw (code GOAL_MEMBERSHIP_REQUIRED, HTTP 403 at the route). PURE —
+// both INSERT INTO claims sites (claimTask + claimTasksBatch, db.js) feed it
+// through db.goalMembershipFailures so the batch path cannot drift from the
+// single-claim path.
+//
+// The decision, in order (fail-closed on the membership question itself):
+//   - no goal → not gated. tasks.goal_id is NULLABLE (migration 160) and every
+//     version created after it gets no catch-all, so goal_id IS NULL is COMMON —
+//     a NULL goal has no membership to check. (A dangling goal_id can't occur:
+//     tasks.goal_id is FK'd to goals(id).)
+//   - Archon → pass. An Archon is an implicit member everywhere in the goal
+//     surface (isMemberOrArchon, POST /goals/:id/join, isGoalOwnerOrManager);
+//     the claim gate follows that single convention rather than minting a
+//     second membership model. Membership only NARROWS what the rank gates
+//     (which run before this in claimTask's ladder) already allow — it never
+//     widens what a Xenos reaches.
+//   - member → pass.
+//   - else refuse, naming the action: 'join' for a public unprotected goal,
+//     'apply' for a private one OR a protected-scope one (self-join on
+//     protected scope is Archon-mediated — routes/goals.js POST /:id/join).
+//
+// LEAK RULE (the goal_abuse_matrix ordering discipline, gotcha d): a PRIVATE
+// goal's refusal carries goal_id, visibility and the action ONLY — never the
+// title, never scope. A public goal's title is public; it rides along so the
+// CLI can name what to join.
+function goalMembershipClaimRefusal({ goal, isMember, actorRank, scopeProtected }) {
+  if (!goal) return null; // goal_id NULL — no membership to check, NOT gated
+  if (actorRank === 'archon') return null;
+  if (isMember) return null;
+  const isPrivate = goal.visibility === 'private';
+  const action = (isPrivate || scopeProtected === true) ? 'apply' : 'join';
+  const goalId = Number(goal.id);
+  return {
+    code: 'GOAL_MEMBERSHIP_REQUIRED',
+    goal_id: goalId,
+    visibility: goal.visibility,
+    action,
+    ...(isPrivate ? {} : { goal_title: goal.title }),
+    what_to_do: action === 'join'
+      ? `Join the goal (POST /api/bongos/goals/${goalId}/join), then retry the claim.`
+      : `Apply to join (POST /api/bongos/goals/${goalId}/requests); nothing can be claimed until an owner approves.`,
+    message: isPrivate
+      ? `This task lives in goal ${goalId}, which is private — you are not a member.`
+      : `This task lives in goal ${goalId} ("${goal.title}") — you are not a member.`,
+  };
+}
+
+module.exports = { isGoalOwner, isGoalOwnerOrManager, authorizeGoalManagement, goalMembershipClaimRefusal };

package/modules/lifecycle/routes/claims.js

@@ -301,6 +301,12 @@ module.exports = function buildClaimsRouter() {
           // builder's. Same 403 semantics as the Xenos gate; the body carries
           // { required, actual } so the CLI can render a clean message.
           err.code === 'INSUFFICIENT_RANK' ? 403 :
+          // task 1003137: the task's goal requires membership. The body carries
+          // goal_id, visibility, and the action (join|apply) + what_to_do —
+          // enough for the CLI to offer the join inline (task 1003138). A
+          // private goal's body deliberately omits its title/scope (leak rule
+          // in goal-authz.goalMembershipClaimRefusal).
+          err.code === 'GOAL_MEMBERSHIP_REQUIRED' ? 403 :
           500;
         // V4.R14 (#952): a TASK_NOT_READY 409 names the way forward instead of
         // leaving the caller to discover the promote route by spelunking (#506).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.278",
+  "version": "1.19.279",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.278",
+      "version": "1.19.279",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.278",
+  "version": "1.19.279",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -983,8 +983,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.276 with no explicit bump. run 32503053532. (task 1002620)
 //   1.19.278 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.277 with no explicit bump. run 32508270995. (task 1002620)
+//   1.19.279 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.278 with no explicit bump. run 32521664476. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.278'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.279'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_abuse_matrix.mjs

@@ -29,6 +29,10 @@
 //   O1  ordering: non-member + out-of-scope                  → not_a_member (no scope hint leaks)
 //   O2  ordering: a closed goal short-circuits first         → goal_not_open
 //   P   Metic+ on an in-scope protected path                 → ALLOW (rank clears the floor)
+//   Q*  CLAIM a task in a goal you never joined (task 1003137)→ 403 GOAL_MEMBERSHIP_REQUIRED
+//       (join for public, apply for private/protected; a private goal's refusal
+//       leaks no title and no scope; goal_id NULL is not gated; both INSERT
+//       INTO claims sites run the same extracted gate)
 //
 // Ordering is fail-closed (a missing/ambiguous input denies), and membership is
 // checked BEFORE scope so a non-member never learns the scope (O1 vs B). Per-branch
@@ -155,6 +159,74 @@ await test('[K] a protected-scope goal is recognized as protected; a normal goal
   assert.equal(scopeIncludesProtected(G_IDEAS.scope_modules), false, 'ideas is a normal, open-join module');
 });
 
+// ---- [Q] the CLAIM-time membership wall (task 1003137) ----
+// A task that lives in a goal is claimable only by that goal's members — every
+// goal, the '<version> — general' catch-alls included (owner ruling 2026-08-19).
+// The decision is the pure goalMembershipClaimRefusal (goal-authz.js); db.js
+// feeds BOTH claim paths through the one extracted db.goalMembershipFailures.
+const { goalMembershipClaimRefusal } = require('../modules/lifecycle/goal-authz.js');
+const G_PUBLIC = { id: 21, title: 'Public builder profiles', visibility: 'public' };
+const G_PRIVATE = { id: 22, title: 'SECRET-TITLE-MUST-NOT-LEAK', visibility: 'private', scope_modules: ['lifecycle'] };
+
+await test('[Q1] goal_id NULL is NOT gated — a NULL goal has no membership to check (migration 160 nullable)', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: null, isMember: false, actorRank: 'xenos', scopeProtected: false }), null);
+});
+await test('[Q2] a member claims freely', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: true, actorRank: 'xenos', scopeProtected: false }), null);
+});
+await test('[Q3] an Archon is an implicit member (the isMemberOrArchon convention)', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: G_PRIVATE, isMember: false, actorRank: 'archon', scopeProtected: true }), null);
+});
+await test('[Q4] non-member on a public unprotected goal → GOAL_MEMBERSHIP_REQUIRED, action=join, title rides along', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: false, actorRank: 'metic', scopeProtected: false });
+  assert.equal(r.code, 'GOAL_MEMBERSHIP_REQUIRED');
+  assert.equal(r.action, 'join');
+  assert.equal(r.goal_id, 21);
+  assert.equal(r.visibility, 'public');
+  assert.equal(r.goal_title, 'Public builder profiles');
+  assert.ok(/join/i.test(r.what_to_do), 'the way forward names the join route');
+});
+await test('[Q5] non-member on a PRIVATE goal → action=apply, and the refusal leaks NO title and NO scope', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PRIVATE, isMember: false, actorRank: 'metic', scopeProtected: true });
+  assert.equal(r.code, 'GOAL_MEMBERSHIP_REQUIRED');
+  assert.equal(r.action, 'apply');
+  assert.equal(r.visibility, 'private');
+  assert.ok(!('goal_title' in r), 'a private goal\'s title must not leak to a non-member');
+  const flat = JSON.stringify(r);
+  assert.ok(!flat.includes('SECRET-TITLE-MUST-NOT-LEAK'), 'no field may carry the private title');
+  assert.ok(!flat.includes('scope_modules') && !flat.includes('lifecycle'), 'no field may carry the private scope');
+});
+await test('[Q6] non-member on a public PROTECTED-scope goal → action=apply (self-join is Archon-mediated)', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: false, actorRank: 'metic', scopeProtected: true });
+  assert.equal(r.action, 'apply', 'a protected-scope goal is never offered as open-join');
+});
+await test('[Q7] source contract: BOTH INSERT INTO claims sites run the extracted gate (batch cannot bypass)', () => {
+  const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  const insertSites = dbSrc.match(/INSERT INTO claims \(/g) || [];
+  assert.equal(insertSites.length, 2, 'exactly two claim-insert sites (claimTask + claimTasksBatch) — a third needs the gate too');
+  const gateCalls = dbSrc.match(/await goalMembershipFailures\(/g) || [];
+  assert.equal(gateCalls.length, 3, 'the membership gate must run on both claim paths + validateClaimBatch (the dry-run twin that must stay in sync)');
+});
+await test('[Q8] feed contract: a non-member row is flagged joinable, never silently claimable (leak rule holds)', () => {
+  const { decorateGoalMembership } = require('../modules/lifecycle/db.js');
+  // member / goal-less rows pass through shaped as today
+  assert.deepEqual(decorateGoalMembership({ id: 1, goal_id: null }), { id: 1, goal_id: null });
+  assert.deepEqual(
+    decorateGoalMembership({ id: 2, goal_id: 21, g_visibility: 'public', g_scope_modules: ['ideas'], g_title: 'T', g_is_member: true }),
+    { id: 2, goal_id: 21 }
+  );
+  // non-member public → flagged join, title carried, scope stripped
+  const pub = decorateGoalMembership({ id: 3, goal_id: 21, g_visibility: 'public', g_scope_modules: ['ideas'], g_title: 'T', g_is_member: false });
+  assert.deepEqual(pub.goal_membership, { required: true, goal_id: 21, visibility: 'public', action: 'join', goal_title: 'T' });
+  assert.ok(!('g_scope_modules' in pub) && !('g_title' in pub), 'scratch columns must not leave the feed');
+  // non-member private → flagged apply, NO title
+  const priv = decorateGoalMembership({ id: 4, goal_id: 22, g_visibility: 'private', g_scope_modules: ['ideas'], g_title: 'SECRET', g_is_member: false });
+  assert.deepEqual(priv.goal_membership, { required: true, goal_id: 22, visibility: 'private', action: 'apply' });
+  // non-member public but protected-scope → apply (matches the join route's Archon-mediation)
+  const prot = decorateGoalMembership({ id: 5, goal_id: 23, g_visibility: 'public', g_scope_modules: ['lifecycle'], g_title: 'L', g_is_member: false });
+  assert.equal(prot.goal_membership.action, 'apply');
+});
+
 // ---- the pins that make a rank drift on a goal route a red build (BV1.R61) ----
 // The wall is only drift-proof if the goal routes are PINNED and the LIVE routes
 // classify to those pins. The catch-violation (a downgrade → blocker) is proven in

package/tests/reward_gate.mjs

@@ -163,9 +163,10 @@ t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', (
   // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
   // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
   // past the old edge; 6000 -> 7000 in task 1002613, when the enriched
-  // rank_too_low_for_task denial did the same. Keep it comfortably below the
-  // claimTasksBatch boundary (~15.5k chars in).
-  const body = dbSrc.slice(start, start + 7000);
+  // rank_too_low_for_task denial did the same; 7000 -> 8500 in task 1003137, when
+  // the goal-membership gate landed between the rank gates and deps. Keep it
+  // comfortably below the claimTasksBatch boundary (~16.5k chars in).
+  const body = dbSrc.slice(start, start + 8500);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.