@bongos/core 1.19.278 → 1.19.280

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.278",
-  "core_contract": "1.19.278",
-  "source_commit": "d2c8b889323c64a1734fa1e622fe168b46b1116f",
+  "core_version": "1.19.280",
+  "core_contract": "1.19.280",
+  "source_commit": "60f4ffc6a9e2ee27fd0325d8f332658692b5d954",
   "source_ref": "HEAD",
-  "built_at": "2026-08-21T17:28:18.709Z",
+  "built_at": "2026-08-21T20:22:42.788Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 319,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1376,
+    "functional_verbatim": 1377,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1717,
-  "tree_sha256": "f8955f572f4ca37464ee436a7b53e1b27efcc4d7f142af25ea001a4f42ca390b",
+  "file_count": 1718,
+  "tree_sha256": "81c6c6bebc79cb9374d40181db1cb84c1bd035f0bd2c1062f261078df64042e8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -42,7 +42,7 @@
     {
       "path": ".claude/skills/builder-claim/SKILL.md",
       "mode": "0000644",
-      "sha256": "076e3143a87c2257389a710de69e7b5b2c14cd353e0eff4d53b7b01444fc5ae0"
+      "sha256": "057a5bac75084ea29e5dc3da1cf457089d77c882bfb34936f3c0b37889edc1c3"
     },
     {
       "path": ".claude/skills/builder-connect/SKILL.md",
@@ -3744,6 +3744,11 @@
       "mode": "0000644",
       "sha256": "0c52ae165d304f0f08ca04c9a288ef7d8ffb07288282dcd7b2d503fced7cd744"
     },
+    {
+      "path": "modules/lifecycle/claim-feed.js",
+      "mode": "0000644",
+      "sha256": "3586cc2aa07913870ad99073c534e70ef2e2c5ff6a5ef2ddeb141cfd397269cd"
+    },
     {
       "path": "modules/lifecycle/conflict-resolve.js",
       "mode": "0000644",
@@ -3757,7 +3762,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "64cdde411e3fb8d1263eebf9093a353dde6ee684be2977057c8800e608b52a63"
+      "sha256": "74eedb9ee1c423c9ecdea6f09d8555fa3200ac9e3a86a194182774cb72f0cd0b"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3782,7 +3787,7 @@
     {
       "path": "modules/lifecycle/goal-authz.js",
       "mode": "0000644",
-      "sha256": "6280028c33fd0770514e753962e3a83ee2e3d47d6c9efdb67b9905b868c6db72"
+      "sha256": "3eb9d818e0e0d45a896a5c0a515842b5f5a01e102d02f8a9a605c271088c8e5d"
     },
     {
       "path": "modules/lifecycle/goal-conflicts.js",
@@ -3837,7 +3842,7 @@
     {
       "path": "modules/lifecycle/routes/claims.js",
       "mode": "0000644",
-      "sha256": "4f40c6e74c40c1ff29f8f487e2a6b574e7998aca4366a6372101d17412917eea"
+      "sha256": "e02abac52a82fb02603dd92074d4ebd060ec03195803d704b021614806ef00fe"
     },
     {
       "path": "modules/lifecycle/routes/dependencies.js",
@@ -4492,12 +4497,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6c3c704f2de78db933bd38831feaae364a1d1d608a01b7c14d147854950a6cef"
+      "sha256": "db9e4dfef2e02b0e40fa3535f1af51d53071128b960698cf48b04fd6995eb54c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "61504099e0e7e063f76862dfb805405f2743eaa0a3cb389a6b80fad771f35775"
+      "sha256": "99c8deb7b7edff1c7a5560a59dd9887aefa080786d3f2c9acd6c87c5b495c114"
     },
     {
       "path": "public-docs/index.html",
@@ -4972,7 +4977,7 @@
     {
       "path": "scripts/gds/claim.js",
       "mode": "0000644",
-      "sha256": "6f09d9344f57039c07d2de943dabb48dbf717226aa2667f4163dab47fb74428a"
+      "sha256": "3e830a3e319c4b67d87547ae4ad2d647ee3ce74725c84d7f64788c094f0974c7"
     },
     {
       "path": "scripts/gds/classify-discipline.js",
@@ -6142,7 +6147,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e0b73ea48b0a4c19e931162761dc58e0f97859e35bd92d93335cf610fc2036b0"
+      "sha256": "afc9e2e6432d8a8f2e6a9812e92d1673f637c18b93555313c4881c9c44839914"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6577,7 +6582,7 @@
     {
       "path": "tests/claim_error_surface.mjs",
       "mode": "0000644",
-      "sha256": "365f498d290298e0cd74888aff080cfbf3439e5e0cf2dd883291f39dface27e7"
+      "sha256": "33b0bbbb4c1a1f8b44a71c692a40b8a7e9cdde2e32483226484427ccf24238b5"
     },
     {
       "path": "tests/claim_gate_open_blocker.mjs",
@@ -7042,7 +7047,7 @@
     {
       "path": "tests/goal_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "e5b32e9c4a38e405cfd3185b49f4a1d9a6b39a0f39c12053c01ba3680c550120"
+      "sha256": "daf3a5942ce3f154d29618e4242557758db50d8c70046562995fc2c10d5ee954"
     },
     {
       "path": "tests/goal_achievement.mjs",
@@ -8062,7 +8067,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "7ae4d9af4d389c34f0d16f921858cbbf5d0d57f3219f830d10552ebcdc43908f"
+      "sha256": "a21d9f4d3ff937d59b9361b330a2e5e93ded9c9a12d73434eb843cae9d1a3c74"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/.claude/skills/builder-claim/SKILL.md

@@ -66,6 +66,11 @@ The server now **enforces** the one-claim half (task 1642): `POST /api/gds/claim
 
 11. **On `session_already_has_active_claim`** (task 1642 — applies to **all ranks**): this *session* already holds an active claim, and a session may hold only one (one worktree → one branch → no commingled ships). The body names `active_task_id` + `active_task_title`. Surface them with `what_to_do`: either `/builder-ship N` (or `/builder-release N`) the in-flight task first, **or** open a fresh worktree/session for this new task and claim there. Do not retry in the same worktree — the refusal is the guard working. (`session_claim_check_failed` is the rare fail-closed variant when the server couldn't verify the session state; same remedy — retry, or use a fresh session/worktree.)
 
+12. **On `GOAL_MEMBERSHIP_REQUIRED`** (task 1003137/1003138): the task lives in a goal the builder hasn't joined. The refusal is resolvable **in-session — never send the builder to the hall UI**. The body carries `goal_id`, `visibility`, and the `action` (`join` | `apply`); the CLI already renders the offer and, on a TTY, prompts `[Y/n]` itself. In an agent session (no TTY) the CLI prints the one-command path instead — narrate the same offer to the user:
+    - **`action: join`** (public goal): offer *"Task N lives in goal G ("title", public) — you're not a member. Join and claim?"* On yes, run `node scripts/gds/claim.js <task-id> --join` — it joins the goal and lands the claim in one command. On no, stop: declining leaves no membership row.
+    - **`action: apply`** (private goal, or a public goal with Archon-mediated protected scope): offer to file the application. On yes, run the same `--join` command — it files exactly one pending request and states plainly that **nothing can be claimed until an owner approves** (do not retry the claim; check the goal inbox later). Re-running reports "already pending", not an error. A private goal's refusal deliberately carries no title or scope — don't guess at them.
+    - **Never pass `--join` without the user's yes.** The owner chose the explicit-join model: the offer is a prompt, not a silent side effect.
+
 ## Constraints
 
 - **Don't retry on conflict.** Failures here are intentional — they protect us from race conditions.

package/modules/lifecycle/claim-feed.js

@@ -0,0 +1,142 @@
+'use strict';
+
+// modules/lifecycle/claim-feed.js — shaping + gating helpers for the claimable
+// feed and the two claim paths, carved out of the oversized db.js (task 1003137;
+// the fitness excess-lines ratchet is why these live here and not inline).
+//
+// Three residents, two halves of one rule plus a feed cap:
+//
+//   - goalMembershipFailures — the CLAIM-time goal-membership gate (task
+//     1003137, owner ruling 2026-08-19: a task that lives in a goal is
+//     claimable only by that goal's members — every goal, catch-alls included).
+//     EXTRACTED so BOTH `INSERT INTO claims` sites (db.claimTask and
+//     db.claimTasksBatch — the batch path duplicates claimTask's gates one by
+//     one, so an inline-only gate would be trivially bypassable via
+//     /claims/batch) run the identical check. The DECISION itself is the pure
+//     goal-authz.goalMembershipClaimRefusal; this wrapper only fetches the
+//     goal + membership facts on the caller's open txn client.
+//   - decorateGoalMembership — the FEED half of the same rule (owner chose
+//     filter-plus-show-as-joinable): a ready task whose goal the builder has
+//     not joined is never silently advertised as claimable — the exact trap
+//     task 1002650 closed for open blockers. The row stays in the feed but
+//     carries goal_membership { required, goal_id, visibility, action } so the
+//     caller renders it joinable. Reuses the SAME pure refusal fn, so feed and
+//     gate cannot disagree on join-vs-apply or on the leak rule (a private
+//     goal's title/scope never leave the server).
+//   - capNewcomerTasks — the newcomer-chore display cap (task 1266), moved
+//     verbatim from db.js.
+//
+// db.js re-exports all three, so callers and tests keep their import site.
+
+// Pure kernel-adjacent matcher via the doorway (never the core file); the pure
+// membership decision from the authority-model sibling.
+const api = require('../../src/module-api');
+const { scopeIncludesProtected } = api.moduleScopeMap;
+const { goalMembershipClaimRefusal } = require('./goal-authz.js');
+
+// The claim-txn half. `tasks` rows need { id, goal_id }; goal_id NULL rows are
+// skipped (nullable by migration 160 — a NULL goal has no membership to check;
+// a dangling goal_id can't occur, tasks.goal_id is FK'd). An Archon passes as
+// the implicit member (the isMemberOrArchon convention). Runs on the caller's
+// open txn `client` so the read shares the claim transaction's snapshot.
+// Returns [{ task_id, refusal }] — empty when every task is claimable.
+async function goalMembershipFailures({ client, tasks, builderId, builderRank }) {
+  const gated = tasks.filter((t) => t.goal_id != null);
+  if (gated.length === 0 || builderRank === 'archon') return [];
+  const goalIds = Array.from(new Set(gated.map((t) => Number(t.goal_id))));
+  const { rows: goalRows } = await client.query(
+    `SELECT g.id, g.title, g.visibility, g.scope_modules,
+            EXISTS (SELECT 1 FROM goal_members gm
+                     WHERE gm.goal_id = g.id AND gm.builder_id = $2) AS is_member
+       FROM goals g
+      WHERE g.id = ANY($1::bigint[])`,
+    [goalIds, builderId]
+  );
+  const byId = new Map(goalRows.map((r) => [Number(r.id), r]));
+  const failures = [];
+  for (const t of gated) {
+    const goal = byId.get(Number(t.goal_id)) ?? null;
+    const refusal = goalMembershipClaimRefusal({
+      goal,
+      isMember: goal ? goal.is_member === true : false,
+      actorRank: builderRank,
+      scopeProtected: goal ? scopeIncludesProtected(goal.scope_modules) : false,
+    });
+    if (refusal) failures.push({ task_id: Number(t.id), refusal });
+  }
+  return failures;
+}
+
+// The feed half. Consumes (and strips) the g_* scratch columns db.js's
+// LEFT JOIN rides along; member / Archon / goal-less rows pass through shaped
+// exactly as before task 1003137. The SQL folds "Archon" into g_is_member, so
+// actorRank is passed null here — membership is the only remaining question.
+function decorateGoalMembership(row) {
+  const { g_visibility, g_scope_modules, g_title, g_is_member, ...task } = row;
+  if (task.goal_id == null || g_visibility == null) return task; // no goal → not gated
+  const refusal = goalMembershipClaimRefusal({
+    goal: { id: task.goal_id, title: g_title, visibility: g_visibility },
+    isMember: g_is_member === true,
+    actorRank: null,
+    scopeProtected: scopeIncludesProtected(g_scope_modules),
+  });
+  if (!refusal) return task; // member/Archon → as today
+  return {
+    ...task,
+    goal_membership: {
+      required: true,
+      goal_id: refusal.goal_id,
+      visibility: refusal.visibility,
+      action: refusal.action,
+      ...('goal_title' in refusal ? { goal_title: refusal.goal_title } : {}),
+    },
+  };
+}
+
+// Cap the number of newcomer_friendly rows in a claimable feed to `cap`
+// (task 1266). Pure + exported for unit testing. Non-newcomer (real version)
+// rows pass through untouched and unbounded. When newcomer rows exceed the cap
+// they're selected round-robin across the disciplines PRESENT among them — so
+// each of the builder's lanes is represented before a slot goes to a duplicate
+// of an already-shown discipline. Input ordering (priority, est, created) is
+// preserved: we compute a keep-set of ids and then filter the original array.
+function capNewcomerTasks(rows, cap = 3) {
+  const all = Array.isArray(rows) ? rows : [];
+  const newcomer = all.filter((t) => t && t.newcomer_friendly === true);
+  if (newcomer.length <= cap) return all;
+
+  // Group newcomer rows by discipline, preserving (a) input order within each
+  // group and (b) first-appearance order of the groups themselves — so the
+  // highest-priority discipline's chore is picked first.
+  const groups = new Map(); // discipline -> [rows], insertion-ordered
+  for (const t of newcomer) {
+    const disc = t.discipline || 'unclassified';
+    if (!groups.has(disc)) groups.set(disc, []);
+    groups.get(disc).push(t);
+  }
+  const lists = Array.from(groups.values());
+
+  // Round-robin: take index 0 from each group, then index 1, etc., until we've
+  // kept `cap` rows. Duplicate disciplines fill later passes once each lane has
+  // been represented.
+  const keep = new Set();
+  let depth = 0;
+  let progressed = true;
+  while (keep.size < cap && progressed) {
+    progressed = false;
+    for (const list of lists) {
+      if (depth < list.length) {
+        keep.add(list[depth].id);
+        progressed = true;
+        if (keep.size >= cap) break;
+      }
+    }
+    depth += 1;
+  }
+
+  // Filter the original (ordered) array: every non-newcomer row, plus the kept
+  // newcomer rows. Preserves the original feed ordering.
+  return all.filter((t) => t.newcomer_friendly !== true || keep.has(t.id));
+}
+
+module.exports = { goalMembershipFailures, decorateGoalMembership, capNewcomerTasks };

package/modules/lifecycle/db.js

@@ -46,6 +46,9 @@ const { claimEligibilityAllows, CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-e
 // Pure kernel-adjacent matchers via the doorway (never the core file).
 const { matchProtected } = api.permissionPathCheck;
 const { touchesOverlap } = api.pathMatch;
+// Claimable-feed shaping + the goal-membership claim gate (task 1003137; the
+// newcomer cap of task 1266 moved there too) — see claim-feed.js.
+const { goalMembershipFailures, decorateGoalMembership, capNewcomerTasks } = require('./claim-feed.js');
 
 
 // ---------------------------------------------------------------------------
@@ -1923,6 +1926,8 @@ const SESSION_FIT_SQL = `
 async function listClaimableTasks({ versionId = null, builderId = null, discipline = null, fit = null } = {}) {
   const params = [];
   const where = [];
+  let goalJoin = '';
+  let selectCols = 'v.*';
   if (versionId) {
     params.push(versionId);
     where.push(`v.version_id = $${params.length}`);
@@ -1971,6 +1976,16 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
         WHEN 'archon' THEN 4 WHEN 'metic' THEN 3 WHEN 'thetes' THEN 2 WHEN 'xenos' THEN 1 ELSE 0
       END
     )`);
+    // task 1003137: ride the goal + own-membership facts along so
+    // decorateGoalMembership (claim-feed.js) can flag non-member rows joinable.
+    // Same parameter index — all three reads are the same builderId. The
+    // goal_members PK (goal_id, builder_id) means the LEFT JOIN never
+    // multiplies rows; an Archon reads as member (isMemberOrArchon convention).
+    goalJoin = ` LEFT JOIN goals g ON g.id = v.goal_id
+                 LEFT JOIN goal_members gm ON gm.goal_id = g.id AND gm.builder_id = $${params.length}`;
+    selectCols = `v.*, g.visibility AS g_visibility, g.scope_modules AS g_scope_modules, g.title AS g_title,
+      (gm.builder_id IS NOT NULL
+        OR (SELECT rank FROM builders WHERE id = $${params.length}) = 'archon') AS g_is_member`;
   }
   // Autonomy / parallel-eligibility filter. Joining the session-fit relation
   // (also a SELECT t.* shape) makes bare column names like priority/created_at
@@ -1988,12 +2003,14 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   // recent actuals; ordering on the raw estimate puts oversized tasks at the
   // bottom even when their actual time-to-ship is short. See migration 015.
   const sql =
-    `SELECT v.* FROM (${CLAIMABLE_SQL}) v` + fitJoin +
+    `SELECT ${selectCols} FROM (${CLAIMABLE_SQL}) v` + goalJoin + fitJoin +
     (where.length ? ` WHERE ${where.join(' AND ')}` : '') +
     ` ORDER BY v.priority NULLS LAST,
               COALESCE(v.est_minutes_calibrated, v.est_minutes) NULLS LAST,
               v.created_at`;
-  const { rows } = await pool.query(sql, params);
+  const { rows: rawRows } = await pool.query(sql, params);
+  // task 1003137: strip g_* scratch columns, flag non-member rows joinable.
+  const rows = rawRows.map(decorateGoalMembership);
   // SR-12 / G2 (task 994): when the autonomous/parallel runner is asking, drop
   // any task whose declared touches[] reach the permission/methodology/deploy
   // core. The runner ships as Archon straight to main, so these must never be
@@ -2002,7 +2019,12 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   // with the grader pre-pass, pre-push hook, and main-audit — no second source
   // of truth to drift.
   if (fit === 'autonomous' || fit === 'parallel') {
-    return rows.filter((t) => !taskTouchesProtectedPath(t));
+    // task 1003137: membership-required rows are DROPPED, not flagged — the
+    // claim gate will refuse them and an autonomous runner can't answer a join
+    // prompt. (No builderId → no membership facts; the claim gate stays the
+    // hard control.)
+    return rows.filter((t) => !taskTouchesProtectedPath(t)
+      && !(t.goal_membership && t.goal_membership.required === true));
   }
   // Newcomer-chore display cap (task 1266, owner decision 2026-06-19). The
   // newcomer-floor keeps a deep supply pool (floor: 3 artist + 2 ideator) so
@@ -2017,53 +2039,6 @@ async function listClaimableTasks({ versionId = null, builderId = null, discipli
   return capNewcomerTasks(rows);
 }
 
-// Cap the number of newcomer_friendly rows in a claimable feed to `cap`
-// (task 1266). Pure + exported for unit testing. Non-newcomer (real version)
-// rows pass through untouched and unbounded. When newcomer rows exceed the cap
-// they're selected round-robin across the disciplines PRESENT among them — so
-// each of the builder's lanes is represented before a slot goes to a duplicate
-// of an already-shown discipline. Input ordering (priority, est, created) is
-// preserved: we compute a keep-set of ids and then filter the original array.
-
-function capNewcomerTasks(rows, cap = 3) {
-  const all = Array.isArray(rows) ? rows : [];
-  const newcomer = all.filter((t) => t && t.newcomer_friendly === true);
-  if (newcomer.length <= cap) return all;
-
-  // Group newcomer rows by discipline, preserving (a) input order within each
-  // group and (b) first-appearance order of the groups themselves — so the
-  // highest-priority discipline's chore is picked first.
-  const groups = new Map(); // discipline -> [rows], insertion-ordered
-  for (const t of newcomer) {
-    const disc = t.discipline || 'unclassified';
-    if (!groups.has(disc)) groups.set(disc, []);
-    groups.get(disc).push(t);
-  }
-  const lists = Array.from(groups.values());
-
-  // Round-robin: take index 0 from each group, then index 1, etc., until we've
-  // kept `cap` rows. Duplicate disciplines fill later passes once each lane has
-  // been represented.
-  const keep = new Set();
-  let depth = 0;
-  let progressed = true;
-  while (keep.size < cap && progressed) {
-    progressed = false;
-    for (const list of lists) {
-      if (depth < list.length) {
-        keep.add(list[depth].id);
-        progressed = true;
-        if (keep.size >= cap) break;
-      }
-    }
-    depth += 1;
-  }
-
-  // Filter the original (ordered) array: every non-newcomer row, plus the kept
-  // newcomer rows. Preserves the original feed ordering.
-  return all.filter((t) => t.newcomer_friendly !== true || keep.has(t.id));
-}
-
 // SR-12 / G2 (task 994): does this task's declared touches[] overlap any
 // permission-sensitive (ADR 0043) path? Pure + exported for unit testing.
 // Returns true if ANY declared touch matches a protected glob — such a task is
@@ -2659,7 +2634,7 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     }
 
     const { rows: taskRows } = await client.query(
-      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind FROM tasks WHERE id = $1 FOR UPDATE`,
+      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind, goal_id FROM tasks WHERE id = $1 FOR UPDATE`,
       [taskId]
     );
     if (taskRows.length === 0) {
@@ -2730,6 +2705,15 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
       };
     }
 
+    // task 1003137 (owner ruling 2026-08-19): a task's goal requires MEMBERSHIP —
+    // every goal, catch-alls included; goal_id NULL is NOT gated. After the rank
+    // gates (membership only narrows — it must never mask a rank refusal),
+    // before deps. Decision + leak rule: goal-authz.goalMembershipClaimRefusal;
+    // the SAME extracted check runs in claimTasksBatch (the only other INSERT
+    // INTO claims site) — see claim-feed.js.
+    const goalRefusals = await goalMembershipFailures({ client, tasks: [task], builderId, builderRank });
+    if (goalRefusals.length > 0) throw goalRefusals[0].refusal;
+
     // The claim gate (ADR 0015, generalized in task 1516 / ADR 0086 §5): a task
     // can't be claimed while any dependency is un-done — its OWN edges plus those
     // inherited from its goal/criteria, where "done" = task shipped | criterion
@@ -2986,7 +2970,7 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
 
     // Lock every requested task row up front (sorted to avoid deadlocks).
     const { rows: taskRows } = await client.query(
-      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key FROM tasks WHERE id = ANY($1::bigint[]) ORDER BY id FOR UPDATE`,
+      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, goal_id FROM tasks WHERE id = ANY($1::bigint[]) ORDER BY id FOR UPDATE`,
       [uniqIds]
     );
 
@@ -3069,6 +3053,14 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
       }
     }
 
+    // task 1003137: the SAME extracted goal-membership gate as claimTask — this
+    // path owns the repo's only other INSERT INTO claims, so an inline-only gate
+    // would be bypassable via batch. Same ladder position: after rank, before deps.
+    for (const f of await goalMembershipFailures({ client, tasks: taskRows, builderId, builderRank })) {
+      const { code, ...rest } = f.refusal;
+      failures.push({ task_id: f.task_id, reason: code, ...rest });
+    }
+
     // Per-task dependency check (ADR 0015, generalized task 1516). An EXTERNAL dep
     // (not in this batch) must already be done; a batch-internal dep isn't done yet
     // at claim time but doesn't block — the batch is worked serially. "Internal"
@@ -3351,7 +3343,7 @@ async function validateClaimBatch({ taskIds, builderId }) {
   const builderRank = builderRows[0] ? builderRows[0].rank : null;
 
   const { rows: taskRows } = await pool.query(
-    `SELECT id, status, touches, newcomer_friendly, requires_rank, module_key
+    `SELECT id, status, touches, newcomer_friendly, requires_rank, module_key, goal_id
        FROM tasks WHERE id = ANY($1::bigint[])`,
     [uniqIds]
   );
@@ -3393,6 +3385,12 @@ async function validateClaimBatch({ taskIds, builderId }) {
     }
   }
 
+  // task 1003137: goal-membership, kept in sync with claimTasksBatch (see claim-feed.js).
+  for (const f of await goalMembershipFailures({ client: pool, tasks: taskRows, builderId, builderRank })) {
+    const { code, ...rest } = f.refusal;
+    push(f.task_id, { reason: code, ...rest });
+  }
+
   // Dependencies — external to the batch only (a batch-internal dep is fine;
   // the batch is worked serially, same rule as claimTasksBatch).
   const batchIdSet = new Set(uniqIds);
@@ -5688,6 +5686,7 @@ module.exports = {
   listClaimableTasks,
   capNewcomerTasks,
   taskTouchesProtectedPath, // SR-12 / G2 (task 994): autonomous-fit protected-path exclusion (pure, testable)
+  decorateGoalMembership, // task 1003137: feed-side joinable flag (pure, testable)
   rankCrossDisciplineRecommendations,
   listActiveClaims,
   updateTaskStatus,

package/modules/lifecycle/goal-authz.js

@@ -62,4 +62,59 @@ function authorizeGoalManagement({ goal, actorId, actorRank, actorMembership })
   return { ok: true };
 }
 
-module.exports = { isGoalOwner, isGoalOwnerOrManager, authorizeGoalManagement };
+// goalMembershipClaimRefusal — the CLAIM-time membership gate (task 1003137).
+// Owner ruling 2026-08-19: a task that lives in a goal is claimable only by that
+// goal's members — EVERY goal, the '<version> — general' catch-alls included.
+// Safe precisely because the refusal is actionable in-session: joining a public
+// goal costs one 'yes' (POST /goals/:id/join), a private/protected one an
+// application (POST /goals/:id/requests).
+//
+// Returns null when the claim may proceed, else the refusal payload the claim
+// paths throw (code GOAL_MEMBERSHIP_REQUIRED, HTTP 403 at the route). PURE —
+// both INSERT INTO claims sites (claimTask + claimTasksBatch, db.js) feed it
+// through db.goalMembershipFailures so the batch path cannot drift from the
+// single-claim path.
+//
+// The decision, in order (fail-closed on the membership question itself):
+//   - no goal → not gated. tasks.goal_id is NULLABLE (migration 160) and every
+//     version created after it gets no catch-all, so goal_id IS NULL is COMMON —
+//     a NULL goal has no membership to check. (A dangling goal_id can't occur:
+//     tasks.goal_id is FK'd to goals(id).)
+//   - Archon → pass. An Archon is an implicit member everywhere in the goal
+//     surface (isMemberOrArchon, POST /goals/:id/join, isGoalOwnerOrManager);
+//     the claim gate follows that single convention rather than minting a
+//     second membership model. Membership only NARROWS what the rank gates
+//     (which run before this in claimTask's ladder) already allow — it never
+//     widens what a Xenos reaches.
+//   - member → pass.
+//   - else refuse, naming the action: 'join' for a public unprotected goal,
+//     'apply' for a private one OR a protected-scope one (self-join on
+//     protected scope is Archon-mediated — routes/goals.js POST /:id/join).
+//
+// LEAK RULE (the goal_abuse_matrix ordering discipline, gotcha d): a PRIVATE
+// goal's refusal carries goal_id, visibility and the action ONLY — never the
+// title, never scope. A public goal's title is public; it rides along so the
+// CLI can name what to join.
+function goalMembershipClaimRefusal({ goal, isMember, actorRank, scopeProtected }) {
+  if (!goal) return null; // goal_id NULL — no membership to check, NOT gated
+  if (actorRank === 'archon') return null;
+  if (isMember) return null;
+  const isPrivate = goal.visibility === 'private';
+  const action = (isPrivate || scopeProtected === true) ? 'apply' : 'join';
+  const goalId = Number(goal.id);
+  return {
+    code: 'GOAL_MEMBERSHIP_REQUIRED',
+    goal_id: goalId,
+    visibility: goal.visibility,
+    action,
+    ...(isPrivate ? {} : { goal_title: goal.title }),
+    what_to_do: action === 'join'
+      ? `Join the goal (POST /api/bongos/goals/${goalId}/join), then retry the claim.`
+      : `Apply to join (POST /api/bongos/goals/${goalId}/requests); nothing can be claimed until an owner approves.`,
+    message: isPrivate
+      ? `This task lives in goal ${goalId}, which is private — you are not a member.`
+      : `This task lives in goal ${goalId} ("${goal.title}") — you are not a member.`,
+  };
+}
+
+module.exports = { isGoalOwner, isGoalOwnerOrManager, authorizeGoalManagement, goalMembershipClaimRefusal };

package/modules/lifecycle/routes/claims.js

@@ -301,6 +301,12 @@ module.exports = function buildClaimsRouter() {
           // builder's. Same 403 semantics as the Xenos gate; the body carries
           // { required, actual } so the CLI can render a clean message.
           err.code === 'INSUFFICIENT_RANK' ? 403 :
+          // task 1003137: the task's goal requires membership. The body carries
+          // goal_id, visibility, and the action (join|apply) + what_to_do —
+          // enough for the CLI to offer the join inline (task 1003138). A
+          // private goal's body deliberately omits its title/scope (leak rule
+          // in goal-authz.goalMembershipClaimRefusal).
+          err.code === 'GOAL_MEMBERSHIP_REQUIRED' ? 403 :
           500;
         // V4.R14 (#952): a TASK_NOT_READY 409 names the way forward instead of
         // leaving the caller to discover the promote route by spelunking (#506).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.278",
+  "version": "1.19.280",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.278",
+      "version": "1.19.280",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.278",
+  "version": "1.19.280",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claim.js

@@ -2,7 +2,7 @@
 // Builder claim — atomically claim a task.
 //
 // Usage:
-//   node scripts/gds/claim.js <task-id> [--worktree NAME]
+//   node scripts/gds/claim.js <task-id> [--worktree NAME] [--enforce-touches] [--join]
 //
 // On success: prints the claim id, the task title, and the touches[] so the
 // builder knows the parallel-safety boundary they're working within.
@@ -165,22 +165,31 @@ function printClaimCard(task, widgetsEnabled = true) {
   } catch (_) { /* never block a claim on the card */ }
 }
 
+// task 1003138: the envelope/flat normalization from formatClaimFailure, pulled
+// out so the goal-join flow reads the same { code, message, d } regardless of
+// response shape. Pure + exported (tested through both consumers).
+function claimErrorInfo(r) {
+  const errRaw = r && r.data ? r.data.error : undefined;
+  const isEnvelope = errRaw !== null && typeof errRaw === 'object';
+  return {
+    code: isEnvelope ? errRaw.code : errRaw,
+    message: isEnvelope ? errRaw.message : undefined,
+    // Structured fields live under .details in the envelope; fall back to the
+    // top-level body for the legacy flat shape (so both keep working).
+    d: { ...(r && r.data ? r.data : {}), ...((isEnvelope && errRaw.details) || {}) },
+  };
+}
+
 // task 1476: render a failed claim as GUIDANCE, not a raw object dump. The API
 // returns the R01 error envelope (ADR 0116): { error: { code, message, details } }.
-// Older paths returned a flat { error: 'CODE', ...fields } shape. This normalizes
-// BOTH — without it `r.data.error` is now an object (never === a string), so every
-// branch below silently missed and the refusal printed as `[object Object]`. Pure
-// (no console / no process.exit) + exported so it can be unit-tested against the
-// real envelope shapes. Returns { lines, exit }.
+// Older paths returned a flat { error: 'CODE', ...fields } shape. claimErrorInfo
+// normalizes BOTH — without it `r.data.error` is now an object (never === a
+// string), so every branch below silently missed and the refusal printed as
+// `[object Object]`. Pure (no console / no process.exit) + exported so it can be
+// unit-tested against the real envelope shapes. Returns { lines, exit }.
 function formatClaimFailure(r, taskId) {
   const lines = [];
-  const errRaw = r && r.data ? r.data.error : undefined;
-  const isEnvelope = errRaw !== null && typeof errRaw === 'object';
-  const code = isEnvelope ? errRaw.code : errRaw;
-  const message = isEnvelope ? errRaw.message : undefined;
-  // Structured fields live under .details in the envelope; fall back to the
-  // top-level body for the legacy flat shape (so both keep working).
-  const d = { ...(r && r.data ? r.data : {}), ...((isEnvelope && errRaw.details) || {}) };
+  const { code, message, d } = claimErrorInfo(r);
 
   // #766: a generic onboarding stage gate (kept rendering cleanly, not as raw JSON).
   if (code === 'stage_required') {
@@ -263,17 +272,147 @@ function formatClaimFailure(r, taskId) {
     lines.push('Resolve it first (/blocker-solve N drives one to done; resolving auto-promotes its linked tasks) — or pick another task from /builder-start.');
     return { lines, exit: 1 };
   }
+  if (code === 'GOAL_MEMBERSHIP_REQUIRED') {
+    // task 1003138: the non-interactive rendering of the membership refusal —
+    // the interactive offer (runGoalJoinFlow) normally intercepts this code
+    // before it gets here; this branch covers a retry that re-refused, an
+    // unexpected body, or a decline.
+    lines.push(`Task #${taskId} lives in goal ${d.goal_id}${d.goal_title ? ` ("${d.goal_title}")` : ''}${d.visibility ? ` (${d.visibility})` : ''} — you are not a member.`);
+    lines.push(d.action === 'apply'
+      ? `  Apply to join (POST /api/bongos/goals/${d.goal_id}/requests) — nothing can be claimed until an owner approves. Re-run with --join to file the application from here.`
+      : `  Join and claim in one command:  node scripts/gds/claim.js ${taskId} --join`);
+    return { lines, exit: 1 };
+  }
   // Fallback — still readable: the message + code, never a raw [object Object].
   lines.push(`Claim failed (${r ? r.status : '?'})${code ? ` [${code}]` : ''}${message ? `: ${message}` : ''}.`);
   return { lines, exit: 1 };
 }
 
+// task 1003138 (owner ask, verbatim: 'claude should offer to join so they dont
+// need to go through the ui') — the goal-membership refusal (403
+// GOAL_MEMBERSHIP_REQUIRED, the task-1003137 gate) is resolvable in-session.
+// goalMembershipOfferPlan is the PURE half: given the refusal details it names
+// the offer to make. Exported for unit tests; the I/O lives in runGoalJoinFlow.
+// Returns null when the body is missing the fields the flow needs (falls back
+// to formatClaimFailure), else { action, headerLines, question }.
+function goalMembershipOfferPlan(d, taskId) {
+  if (!d || d.goal_id == null || (d.action !== 'join' && d.action !== 'apply')) return null;
+  const g = d.goal_id;
+  if (d.action === 'join') {
+    return {
+      action: 'join',
+      headerLines: [
+        `✗ Task ${taskId} lives in goal ${g}`,
+        ...(d.goal_title ? [`    "${d.goal_title}" (${d.visibility || 'public'})`] : []),
+        '    You are not a member.',
+      ],
+      question: `Join goal ${g} and claim? [Y/n] `,
+    };
+  }
+  // 'apply' — a private goal, or a public one whose scope is Archon-mediated
+  // (the server folds both to apply; a pending request grants nothing yet).
+  return {
+    action: 'apply',
+    headerLines: d.visibility === 'private'
+      ? [`✗ Goal ${g} is private.`]
+      : [
+        `✗ Task ${taskId} lives in goal ${g}${d.goal_title ? ` ("${d.goal_title}")` : ''} — joining needs approval (Archon-mediated scope).`,
+      ],
+    question: 'Apply to join? [Y/n] ',
+  };
+}
+
+// One yes/no on the real terminal (default yes — the owner-approved [Y/n]
+// shape). Returns null when there is no TTY to ask — the caller then prints
+// the --join re-run hint instead of hanging a non-interactive session.
+async function promptYesNo(question) {
+  if (!process.stdin.isTTY) return null;
+  const readline = require('node:readline/promises');
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const a = (await rl.question(question)).trim().toLowerCase();
+    return a === '' || a === 'y' || a === 'yes';
+  } finally {
+    rl.close();
+  }
+}
+
+// The I/O half of the offer. Outcomes: 'retry' (joined — re-POST the claim),
+// 'stop' (declined / filed / blocked — everything already printed, exit 1),
+// 'unhandled' (fall through to formatClaimFailure). Never joins or files
+// without a yes: --join is the standing yes for non-interactive sessions.
+async function runGoalJoinFlow({ api, d, taskId, assumeYes }) {
+  const plan = goalMembershipOfferPlan(d, taskId);
+  if (!plan) return 'unhandled';
+  const goalId = d.goal_id;
+  for (const line of plan.headerLines) console.error(line);
+
+  const yes = assumeYes ? true : await promptYesNo(plan.question);
+  if (yes === null) {
+    // Non-interactive (an agent session): make the one-command path explicit.
+    console.error(plan.action === 'join'
+      ? `  To join goal ${goalId} and claim in one command:  node scripts/gds/claim.js ${taskId} --join`
+      : `  To file the application from here:  node scripts/gds/claim.js ${taskId} --join   (nothing claimable until approved)`);
+    return 'stop';
+  }
+  if (!yes) {
+    // The owner chose the explicit-join model — declining leaves NO membership
+    // row and NO request.
+    console.error(plan.action === 'join'
+      ? '  Declined — nothing joined, nothing claimed.'
+      : '  Declined — no application filed, nothing claimed.');
+    return 'stop';
+  }
+
+  if (plan.action === 'join') {
+    const jr = await api.goals.postGoalsIdJoin({ id: goalId, body: {} });
+    if (jr.status === 200 || jr.status === 201) {
+      console.error(`+ joined goal ${goalId} (member)`);
+      return 'retry';
+    }
+    const j = claimErrorInfo(jr);
+    if (j.code === 'archon_approval_required') {
+      // The third branch, handled honestly (routes/goals.js:615): a PUBLIC goal
+      // with protected scope is not self-joinable — don't loop, name the path.
+      console.error(`✗ Goal ${goalId}'s scope is Archon-mediated — self-join is not allowed.`);
+      console.error(`  Request to join instead:  node scripts/gds/claim.js ${taskId} --join  (after the server re-offers apply), or ask an Archon to add you.`);
+      return 'stop';
+    }
+    if (j.code === 'goal_private') {
+      // Visibility flipped between refusal and join — report, don't loop.
+      console.error(`✗ Goal ${goalId} is private now — request to join (POST /api/bongos/goals/${goalId}/requests) and wait for approval.`);
+      return 'stop';
+    }
+    console.error(`✗ join failed (${jr.status})${j.code ? ` [${j.code}]` : ''}${j.message ? `: ${j.message}` : ''}.`);
+    return 'stop';
+  }
+
+  // 'apply' — file the request; a pending row grants nothing, so never retry
+  // the claim here.
+  const ar = await api.goals.postGoalsIdRequests({ id: goalId, body: {} });
+  if (ar.status === 201) {
+    console.error('+ request filed — pending owner approval');
+    console.error('  (nothing to claim until approved)');
+    return 'stop';
+  }
+  const a = claimErrorInfo(ar);
+  if (a.code === 'request_pending') {
+    // The core_188 partial-unique: one pending ask per goal per builder —
+    // re-running reports, it does not error.
+    console.error('• already pending — your earlier request for this goal awaits owner approval.');
+    console.error('  (nothing to claim until approved)');
+    return 'stop';
+  }
+  console.error(`✗ application failed (${ar.status})${a.code ? ` [${a.code}]` : ''}${a.message ? `: ${a.message}` : ''}.`);
+  return 'stop';
+}
+
 async function main() {
   await requireSession();
   const args = process.argv.slice(2);
   const taskId = Number(args[0]);
   if (!Number.isFinite(taskId)) {
-    console.error('usage: node scripts/gds/claim.js <task-id> [--worktree NAME] [--enforce-touches]');
+    console.error('usage: node scripts/gds/claim.js <task-id> [--worktree NAME] [--enforce-touches] [--join]');
     process.exit(2);
   }
   const wIdx = args.indexOf('--worktree');
@@ -287,10 +426,15 @@ async function main() {
   // --enforce-touches so adjacency becomes a HARD refusal (it fans concurrent
   // unsupervised agents that could clobber each other on shared files).
   const enforceTouches = args.includes('--enforce-touches');
+  // task 1003138: --join is the standing yes to the goal-membership offer —
+  // join (public) or file the application (private/protected) and, for a join,
+  // retry the claim, all in one command. Without it an interactive session is
+  // asked [Y/n]; a non-TTY session is shown the --join re-run line.
+  const assumeYes = args.includes('--join');
   const headSha = captureHeadSha();
 
   const api = await cliClient();
-  const r = await api.claims.postClaims({
+  const postClaim = () => api.claims.postClaims({
     body: {
       task_id: taskId,
       worktree_name: worktree,
@@ -298,6 +442,19 @@ async function main() {
       enforce_touches: enforceTouches,
     },
   });
+  let r = await postClaim();
+  // task 1003138: a goal-membership refusal (the task-1003137 gate) is
+  // resolvable in-session — offer the join/application, and on a successful
+  // join retry the claim ONCE (a second refusal falls through to the plain
+  // rendering; never loop).
+  if (r.status !== 201 && claimErrorInfo(r).code === 'GOAL_MEMBERSHIP_REQUIRED') {
+    const outcome = await runGoalJoinFlow({ api, d: claimErrorInfo(r).d, taskId, assumeYes });
+    if (outcome === 'retry') {
+      r = await postClaim();
+    } else if (outcome === 'stop') {
+      process.exit(1); // everything already printed; no claim landed
+    }
+  }
   if (r.status === 201) {
     const { claim, task } = r.data;
     console.log(`Claimed task #${task.id}: ${task.title}`);
@@ -433,4 +590,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { formatClaimFailure };
+module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan };

package/src/module-api.js

@@ -983,8 +983,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.276 with no explicit bump. run 32503053532. (task 1002620)
 //   1.19.278 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.277 with no explicit bump. run 32508270995. (task 1002620)
+//   1.19.279 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.278 with no explicit bump. run 32521664476. (task 1002620)
+//   1.19.280 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.279 with no explicit bump. run 32523185119. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.278'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.280'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claim_error_surface.mjs

@@ -14,7 +14,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { formatClaimFailure } = require('../scripts/gds/claim.js');
+const { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan } = require('../scripts/gds/claim.js');
 
 let passed = 0;
 let failed = 0;
@@ -36,7 +36,7 @@ t('never dumps [object Object] for any known code', () => {
     'session_already_has_bound_claim',
     'newcomer_must_ship_first', 'ALREADY_CLAIMED', 'MODULE_CONFLICT',
     'TOUCHES_CONFLICT', 'TASK_NOT_READY', 'TASK_NOT_FOUND', 'DEPS_NOT_SHIPPED',
-    'OPEN_BLOCKER',
+    'OPEN_BLOCKER', 'GOAL_MEMBERSHIP_REQUIRED',
     'some_unmapped_future_code',
   ];
   for (const c of codes) {
@@ -138,5 +138,58 @@ t('unknown code: fallback carries code + message, exit 1', () => {
   assert.match(text(r), /boom/);
 });
 
+// ---- task 1003138: the goal-membership refusal is resolvable in-session ----
+// The task-1003137 gate returns 403 GOAL_MEMBERSHIP_REQUIRED with { goal_id,
+// visibility, action: join|apply, goal_title? }. claim.js offers the join (or
+// files the application) inline; these pin the pure halves — the offer plan and
+// the non-interactive fallthrough rendering.
+
+t('GOAL_MEMBERSHIP_REQUIRED fallthrough: join names the one-command path, apply names the approval wait', () => {
+  const join = text(formatClaimFailure(
+    envelope('GOAL_MEMBERSHIP_REQUIRED', { goal_id: 1000045, visibility: 'public', action: 'join', goal_title: 'Public builder profiles' }, 'not a member', 403), 1002784));
+  assert.match(join, /goal 1000045/);
+  assert.match(join, /Public builder profiles/);
+  assert.match(join, /--join/, 'join path advertises the one-command re-run');
+  const apply = text(formatClaimFailure(
+    envelope('GOAL_MEMBERSHIP_REQUIRED', { goal_id: 1000099, visibility: 'private', action: 'apply' }, 'not a member', 403), 5));
+  assert.match(apply, /goal 1000099/);
+  assert.match(apply, /approv/i, 'apply path says approval gates the claim');
+});
+
+t('goalMembershipOfferPlan: join offer matches the owner-approved shape (goal named, title shown, [Y/n])', () => {
+  const p = goalMembershipOfferPlan({ goal_id: 1000045, visibility: 'public', action: 'join', goal_title: 'Public builder profiles' }, 1002784);
+  assert.equal(p.action, 'join');
+  assert.match(p.headerLines[0], /Task 1002784 lives in goal 1000045/);
+  assert.match(p.headerLines[1], /"Public builder profiles" \(public\)/);
+  assert.match(p.headerLines[2], /not a member/i);
+  assert.equal(p.question, 'Join goal 1000045 and claim? [Y/n] ');
+});
+
+t('goalMembershipOfferPlan: private goal offers apply and shows no title (there is none to leak)', () => {
+  const p = goalMembershipOfferPlan({ goal_id: 1000099, visibility: 'private', action: 'apply' }, 5);
+  assert.equal(p.action, 'apply');
+  assert.deepEqual(p.headerLines, ['✗ Goal 1000099 is private.']);
+  assert.equal(p.question, 'Apply to join? [Y/n] ');
+});
+
+t('goalMembershipOfferPlan: public protected-scope goal offers apply and says why', () => {
+  const p = goalMembershipOfferPlan({ goal_id: 7, visibility: 'public', action: 'apply', goal_title: 'Core wall' }, 5);
+  assert.equal(p.action, 'apply');
+  assert.match(p.headerLines[0], /Archon-mediated/i);
+});
+
+t('goalMembershipOfferPlan: a malformed body plans nothing (falls back to formatClaimFailure)', () => {
+  assert.equal(goalMembershipOfferPlan(null, 5), null);
+  assert.equal(goalMembershipOfferPlan({ action: 'join' }, 5), null, 'no goal_id → no plan');
+  assert.equal(goalMembershipOfferPlan({ goal_id: 7, action: 'teleport' }, 5), null, 'unknown action → no plan');
+});
+
+t('claimErrorInfo: reads envelope and flat shapes identically', () => {
+  const env = claimErrorInfo(envelope('X', { a: 1 }, 'msg'));
+  assert.equal(env.code, 'X'); assert.equal(env.message, 'msg'); assert.equal(env.d.a, 1);
+  const flat = claimErrorInfo({ status: 409, data: { error: 'X', a: 1 } });
+  assert.equal(flat.code, 'X'); assert.equal(flat.d.a, 1);
+});
+
 console.log(`\nclaim_error_surface: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/goal_abuse_matrix.mjs

@@ -29,6 +29,10 @@
 //   O1  ordering: non-member + out-of-scope                  → not_a_member (no scope hint leaks)
 //   O2  ordering: a closed goal short-circuits first         → goal_not_open
 //   P   Metic+ on an in-scope protected path                 → ALLOW (rank clears the floor)
+//   Q*  CLAIM a task in a goal you never joined (task 1003137)→ 403 GOAL_MEMBERSHIP_REQUIRED
+//       (join for public, apply for private/protected; a private goal's refusal
+//       leaks no title and no scope; goal_id NULL is not gated; both INSERT
+//       INTO claims sites run the same extracted gate)
 //
 // Ordering is fail-closed (a missing/ambiguous input denies), and membership is
 // checked BEFORE scope so a non-member never learns the scope (O1 vs B). Per-branch
@@ -155,6 +159,74 @@ await test('[K] a protected-scope goal is recognized as protected; a normal goal
   assert.equal(scopeIncludesProtected(G_IDEAS.scope_modules), false, 'ideas is a normal, open-join module');
 });
 
+// ---- [Q] the CLAIM-time membership wall (task 1003137) ----
+// A task that lives in a goal is claimable only by that goal's members — every
+// goal, the '<version> — general' catch-alls included (owner ruling 2026-08-19).
+// The decision is the pure goalMembershipClaimRefusal (goal-authz.js); db.js
+// feeds BOTH claim paths through the one extracted db.goalMembershipFailures.
+const { goalMembershipClaimRefusal } = require('../modules/lifecycle/goal-authz.js');
+const G_PUBLIC = { id: 21, title: 'Public builder profiles', visibility: 'public' };
+const G_PRIVATE = { id: 22, title: 'SECRET-TITLE-MUST-NOT-LEAK', visibility: 'private', scope_modules: ['lifecycle'] };
+
+await test('[Q1] goal_id NULL is NOT gated — a NULL goal has no membership to check (migration 160 nullable)', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: null, isMember: false, actorRank: 'xenos', scopeProtected: false }), null);
+});
+await test('[Q2] a member claims freely', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: true, actorRank: 'xenos', scopeProtected: false }), null);
+});
+await test('[Q3] an Archon is an implicit member (the isMemberOrArchon convention)', () => {
+  assert.equal(goalMembershipClaimRefusal({ goal: G_PRIVATE, isMember: false, actorRank: 'archon', scopeProtected: true }), null);
+});
+await test('[Q4] non-member on a public unprotected goal → GOAL_MEMBERSHIP_REQUIRED, action=join, title rides along', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: false, actorRank: 'metic', scopeProtected: false });
+  assert.equal(r.code, 'GOAL_MEMBERSHIP_REQUIRED');
+  assert.equal(r.action, 'join');
+  assert.equal(r.goal_id, 21);
+  assert.equal(r.visibility, 'public');
+  assert.equal(r.goal_title, 'Public builder profiles');
+  assert.ok(/join/i.test(r.what_to_do), 'the way forward names the join route');
+});
+await test('[Q5] non-member on a PRIVATE goal → action=apply, and the refusal leaks NO title and NO scope', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PRIVATE, isMember: false, actorRank: 'metic', scopeProtected: true });
+  assert.equal(r.code, 'GOAL_MEMBERSHIP_REQUIRED');
+  assert.equal(r.action, 'apply');
+  assert.equal(r.visibility, 'private');
+  assert.ok(!('goal_title' in r), 'a private goal\'s title must not leak to a non-member');
+  const flat = JSON.stringify(r);
+  assert.ok(!flat.includes('SECRET-TITLE-MUST-NOT-LEAK'), 'no field may carry the private title');
+  assert.ok(!flat.includes('scope_modules') && !flat.includes('lifecycle'), 'no field may carry the private scope');
+});
+await test('[Q6] non-member on a public PROTECTED-scope goal → action=apply (self-join is Archon-mediated)', () => {
+  const r = goalMembershipClaimRefusal({ goal: G_PUBLIC, isMember: false, actorRank: 'metic', scopeProtected: true });
+  assert.equal(r.action, 'apply', 'a protected-scope goal is never offered as open-join');
+});
+await test('[Q7] source contract: BOTH INSERT INTO claims sites run the extracted gate (batch cannot bypass)', () => {
+  const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  const insertSites = dbSrc.match(/INSERT INTO claims \(/g) || [];
+  assert.equal(insertSites.length, 2, 'exactly two claim-insert sites (claimTask + claimTasksBatch) — a third needs the gate too');
+  const gateCalls = dbSrc.match(/await goalMembershipFailures\(/g) || [];
+  assert.equal(gateCalls.length, 3, 'the membership gate must run on both claim paths + validateClaimBatch (the dry-run twin that must stay in sync)');
+});
+await test('[Q8] feed contract: a non-member row is flagged joinable, never silently claimable (leak rule holds)', () => {
+  const { decorateGoalMembership } = require('../modules/lifecycle/db.js');
+  // member / goal-less rows pass through shaped as today
+  assert.deepEqual(decorateGoalMembership({ id: 1, goal_id: null }), { id: 1, goal_id: null });
+  assert.deepEqual(
+    decorateGoalMembership({ id: 2, goal_id: 21, g_visibility: 'public', g_scope_modules: ['ideas'], g_title: 'T', g_is_member: true }),
+    { id: 2, goal_id: 21 }
+  );
+  // non-member public → flagged join, title carried, scope stripped
+  const pub = decorateGoalMembership({ id: 3, goal_id: 21, g_visibility: 'public', g_scope_modules: ['ideas'], g_title: 'T', g_is_member: false });
+  assert.deepEqual(pub.goal_membership, { required: true, goal_id: 21, visibility: 'public', action: 'join', goal_title: 'T' });
+  assert.ok(!('g_scope_modules' in pub) && !('g_title' in pub), 'scratch columns must not leave the feed');
+  // non-member private → flagged apply, NO title
+  const priv = decorateGoalMembership({ id: 4, goal_id: 22, g_visibility: 'private', g_scope_modules: ['ideas'], g_title: 'SECRET', g_is_member: false });
+  assert.deepEqual(priv.goal_membership, { required: true, goal_id: 22, visibility: 'private', action: 'apply' });
+  // non-member public but protected-scope → apply (matches the join route's Archon-mediation)
+  const prot = decorateGoalMembership({ id: 5, goal_id: 23, g_visibility: 'public', g_scope_modules: ['lifecycle'], g_title: 'L', g_is_member: false });
+  assert.equal(prot.goal_membership.action, 'apply');
+});
+
 // ---- the pins that make a rank drift on a goal route a red build (BV1.R61) ----
 // The wall is only drift-proof if the goal routes are PINNED and the LIVE routes
 // classify to those pins. The catch-violation (a downgrade → blocker) is proven in

package/tests/reward_gate.mjs

@@ -163,9 +163,10 @@ t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', (
   // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
   // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
   // past the old edge; 6000 -> 7000 in task 1002613, when the enriched
-  // rank_too_low_for_task denial did the same. Keep it comfortably below the
-  // claimTasksBatch boundary (~15.5k chars in).
-  const body = dbSrc.slice(start, start + 7000);
+  // rank_too_low_for_task denial did the same; 7000 -> 8500 in task 1003137, when
+  // the goal-membership gate landed between the rank gates and deps. Keep it
+  // comfortably below the claimTasksBatch boundary (~16.5k chars in).
+  const body = dbSrc.slice(start, start + 8500);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.