@bongos/core 1.19.287 → 1.19.289

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.287",
-  "core_contract": "1.19.287",
-  "source_commit": "0e9c40ea9f9cbd3b8d38d4b84d2cbca469e939e2",
+  "core_version": "1.19.289",
+  "core_contract": "1.19.289",
+  "source_commit": "7fcb844542a0043f5c5beff9a14978d08dba62a9",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T00:14:41.365Z",
+  "built_at": "2026-08-22T03:47:31.708Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 319,
+    "docs_redacted": 320,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1385,
+    "functional_verbatim": 1388,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1726,
-  "tree_sha256": "fc0bf7930e91aebc3ad1c590e667763ca5008d9a2d5edbc91957ae352762443d",
+  "file_count": 1730,
+  "tree_sha256": "08c303ce54af46b2a131d468064b1ec877f3120d3d6df123a8a5e4c88be18af6",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -152,7 +152,7 @@
     {
       "path": ".claude/skills/goal-review/SKILL.md",
       "mode": "0000644",
-      "sha256": "66b744096d83b3b478f7973ac0c123402475257c67b16c7589b1b88a6effb2e3"
+      "sha256": "71bc5b89e2b2793a8f30c0510f4c30249436a9dd26c0eda6d1bd0634620c26ce"
     },
     {
       "path": ".claude/skills/grade-audit/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "75389c8fbcfeb39ce0320d182ea25cc97d2292814743521f834bd98de0ff83da"
+      "sha256": "aaf0bb7dae10d271e9999093935fef5ae8d85c3a2e3d5b4c52e0c11fed8c581e"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "f008fd2b92e818e1734bbbd4388af483730050780d14822daf16ca5e05110401"
+      "sha256": "372a5584ddad52fb524815fc7b50d1aab9163e974aac6f2c64f479e4034914a1"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "ac7eba0af25322341547f46f9daa385bd557e52c1f580d4873a5d4b35a633ca7"
+      "sha256": "7faac7fc48e714c76c2b19feaaf9c730b2c9b10ab71ddc5697c21497d02f10ef"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "6d151ca60431e5346007c1939f10f711111c7b7a38f9914be7c8a6ff12d6a75d"
+      "sha256": "7aba0fe1d782cb6308f57dc2e5f6fe0d5ffe0f537d4ffe846bdc7a03e0f8064d"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "60a6ec5d2b7a41e8727769953bd5b38a6746e2373cd8a271ee7b0ba750b84f34"
+      "sha256": "5f1d221bfbf8d329f883a5dc3e84414728c67201d66faceff04d48732e44b13c"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1394,20 +1394,25 @@
       "mode": "0000644",
       "sha256": "119637165d2d6b89f8c00afccd07d9f073629f1502f4b2f2cdc673001b2f8d2a"
     },
+    {
+      "path": "docs/adr/0183-criteria-close-themselves.md",
+      "mode": "0000644",
+      "sha256": "e7d0245b21406ddcd118dce29ffb1df5a4797e33d66231aa6bc734316c19530f"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "56d478e1b5285c1c133225240c65ec23c6b3b4f280cdda853c50b33564cc2910"
+      "sha256": "5e8bcc7eff0a9940760952e4dffe3855474e506439d677625f411164ae226a35"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "ae992fbebcc171bbc4e669a45f01d3a5dd840bcaad334262136a2060fc362a43"
+      "sha256": "2c4a9b56aea5a8e1a42c70ad5c2646c0d6db6d713c13b8d2068bd3a2fa6ac27e"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "55c2cbd3c8473ed041d0df0c6d9eebe16ed3d333afae9f7dbe3b0ef1a211b4c6"
+      "sha256": "fcb40a7d655517e6dd24b2d4e0e00a9fcace75b2eb0aa89348d2546abf8df422"
     },
     {
       "path": "docs/architecture.md",
@@ -3767,7 +3772,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "74eedb9ee1c423c9ecdea6f09d8555fa3200ac9e3a86a194182774cb72f0cd0b"
+      "sha256": "18b2053d9195936be86d98e00812ab69980986f91cf83bc9db054441036192fd"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -3777,7 +3782,7 @@
     {
       "path": "modules/lifecycle/done-when.js",
       "mode": "0000644",
-      "sha256": "4e6f6af1cdaf026466155c1b0656a0e89872aa2bb264f36c50997ec4f069e808"
+      "sha256": "fab91acf54bea4fca254bfd420a9a934e6eae434101ff57ae2a1bed48d2342d5"
     },
     {
       "path": "modules/lifecycle/est-advisory.js",
@@ -3809,6 +3814,11 @@
       "mode": "0000644",
       "sha256": "0367f88aefa890d8d7f2472dd847467d632150a93db8a96b85717b5fb1cc8c9e"
     },
+    {
+      "path": "modules/lifecycle/goal-suggest.js",
+      "mode": "0000644",
+      "sha256": "5fac15e501d6e5639b9e14d08ab34723b60e3569af913f4d15bb703a4e126a77"
+    },
     {
       "path": "modules/lifecycle/hierarchy.js",
       "mode": "0000644",
@@ -3847,7 +3857,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "1cca02e8eff2b0a7fdc1fa06ad6be2f633e25a29bdd10dddf6147610fdae087a"
+      "sha256": "900fc9ecfe91a0c1e9cd62b619f609c1416196d502c007d0bbb87c41387b6163"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -3877,7 +3887,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "a94284db44e4108b21ff3a5f60ac25c0b16ff4330839f9d37045e90e763d430e"
+      "sha256": "3fcc0339927bcc7f426e93c7a5762b45496ecf4e9b841f905fb5f1c468b5f8c0"
     },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
@@ -4512,12 +4522,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ceaff2d7728751d980cf1e01c3342de37baa727b682bb70a75792f9825752851"
+      "sha256": "4a910e78786de976213abedacfe08553775d9651b46579e1388941d416be82db"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d2d685a112ab41f0698b9fc2436ff0e534bbc3441de3a0ef9c3e1821a92ba37d"
+      "sha256": "9919d125bfcfaccf90bc06727eeec3f410882a6e1c83481e63f79f7a5d2d7a0b"
     },
     {
       "path": "public-docs/index.html",
@@ -6027,7 +6037,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "be8bc6ecd3ab1dbec4d3224d684b64d100920ad2cf7d08c51898160fefdaf534"
+      "sha256": "97b8345a1d891151c3bc134926124a0ac929db661e0cfb26c6760c8c6030bafc"
     },
     {
       "path": "src/bongos/routes.js",
@@ -6162,7 +6172,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4d7fa01bf03ea2b91130272d141e16ac4f11aca831b7e6df8fb54eea7ccc8c1f"
+      "sha256": "fbb190fb4b0b50ef8374412a009f1a4799ecbdb15b37caabac3c8a138ca29622"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6384,6 +6394,11 @@
       "mode": "0000644",
       "sha256": "4697e7e264023c148d1f18cac9695157de56b5dd3db4b60f2ab94d73a8d7af65"
     },
+    {
+      "path": "tests/auto_satisfy_criteria.mjs",
+      "mode": "0000644",
+      "sha256": "1a5524b0e63631a0ebdc5e3e87c04eb862a9be7021b3b1caf5a44afb2dcb455b"
+    },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",
       "mode": "0000644",
@@ -7119,6 +7134,11 @@
       "mode": "0000644",
       "sha256": "447e6376ae5f5e2bedf1a80b3355604544a5e349da87d110fc0135cc3cd98fac"
     },
+    {
+      "path": "tests/goal_suggest.mjs",
+      "mode": "0000644",
+      "sha256": "7fc1d81afc49311a3c8525b644319e4831bff295bef8be244220fea5ebfbbbd1"
+    },
     {
       "path": "tests/goal_tier.mjs",
       "mode": "0000644",

package/.claude/skills/goal-review/SKILL.md

@@ -1,13 +1,26 @@
 ---
 name: goal-review
-description: Walk the Bongos criterion review queue — for each criterion auto-flagged "met — pending review" (all its tasks shipped, not yet confirmed), prompt to confirm (→ satisfied), reject (not actually met), or note/defer. Confirming a goal's LAST criterion auto-flips the goal open→achieved. Triggers when the user says "/goal-review", "review goals", "review flagged criteria", "what criteria are ready to confirm", "confirm criteria", "walk the goal review queue", or runs as a scheduled daily task. Metic+ rank only (Metic and Archon; not Xenos).
+description: Walk the Bongos criterion review queue. As of task 1002069 (ADR 0183) this is NO LONGER A GATE — a criterion whose gating tasks have all shipped satisfies ITSELF, and a goal whose criteria are all satisfied achieves itself. What remains here is the residue automation deliberately refuses: chiefly a criterion whose linked tasks were ALL ABANDONED (nothing delivered), plus rejecting a criterion that is not actually met. Prompt to confirm (→ satisfied), reject, or note/defer. Triggers when the user says "/goal-review", "review goals", "review flagged criteria", "what criteria are ready to confirm", "confirm criteria", "walk the goal review queue", or runs as a scheduled daily task. Metic+ rank only (Metic and Archon; not Xenos).
 ---
 
 You are running the **goal-review** session for this Cloud Bongos instance. It mirrors `/idea-triage`, but for the *closing* end of the work hierarchy (ADR 0086 §6): criteria that have **auto-flagged "met — pending review"** get walked one-at-a-time and dispositioned, so finished work actually closes out instead of sitting in limbo.
 
 > **The other end of this lifecycle is [`/goal-create`](../goal-create/SKILL.md)** — it opens a goal (scope wall, criteria, seed tasks); this one closes it out.
 
-**The auto-flag is derived, not stored.** When every task linked to a criterion has shipped — and the criterion has not yet been confirmed — the server flags it `pending_review` (deterministic from `task_criteria` + ship status; no manual propose step). This skill surfaces that queue and lets a trusted builder confirm or reject each one. Confirming sets the criterion `satisfied=true`; confirming a goal's **last** unsatisfied criterion auto-flips the goal `open → achieved`.
+**The auto-flag is derived, not stored.** When every task linked to a criterion has shipped — and the criterion has not yet been confirmed — the server flags it `pending_review` (deterministic from `task_criteria` + ship status; no manual propose step). Confirming sets the criterion `satisfied=true`; confirming a goal's **last** unsatisfied criterion auto-flips the goal `open → achieved`.
+
+## ⚠ This skill is no longer a GATE (task 1002069 / [ADR 0183](../../../docs/adr/<redacted>.md))
+
+**A criterion now closes itself.** `doneWhen.autoSatisfyShippedCriteria` runs inside `shipTask`'s transaction (immediately, for the ship that completed it) and unscoped on every `publish-reconciler` tick (draining the backlog and self-healing). A goal whose criteria are all satisfied achieves itself the same way. Nobody has to run this skill for finished work to close — that dependence was producing a **lying board** (goal 1000072 measured `6/9 shipped, 0/5 criteria`).
+
+So expect the queue to be **mostly empty**, and read what IS in it as a signal rather than a chore. Automation refuses exactly two shapes, and they are what you are here for:
+
+1. **A criterion whose linked tasks were ALL ABANDONED.** Auto-close requires ≥1 task actually `shipped`, so cut work can never complete anything — but the review flag deliberately still surfaces it, because *somebody must decide whether the criterion still means anything now that its work is gone*. Options: confirm (it was satisfied another way), reject, or re-link it to the work that will actually deliver it. **This is the main reason the skill still exists.**
+2. **A criterion with NO linked tasks.** Automation requires ≥1 linked task, so it never auto-closes. If a criterion is genuinely met by work that was never linked, link the tasks (better — it makes the board true) or confirm manually.
+
+A criterion sitting here with shipped tasks and no explanation means the sweep has not run or errored — check the `publish-reconciler` logs rather than confirming by hand, or you will paper over a broken sweep.
+
+**Rejecting is now the more valuable verdict.** Confirming mostly duplicates what automation already did; rejecting is information only a human has.
 
 ## Rank gate — Metic+ only
 

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 293 operations across 47 resource groups
+- 294 operations across 47 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -355,6 +355,8 @@ function createClient(opts = {}) {
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
+      // GET /goals/suggestions — rank: any-builder — GET /goals/suggestions
+      getGoalsSuggestions: (args) => request("GET", "/goals/suggestions", { hasBody: false }, args),
     },
     "government": {
       // GET /government/assignments — rank: archon — GET /government/assignments

package/clients/bongos-client/index.cjs

@@ -354,6 +354,8 @@ function createClient(opts = {}) {
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
+      // GET /goals/suggestions — rank: any-builder — GET /goals/suggestions
+      getGoalsSuggestions: (args) => request("GET", "/goals/suggestions", { hasBody: false }, args),
     },
     "government": {
       // GET /government/assignments — rank: archon — GET /government/assignments

package/clients/bongos-client/index.d.ts

@@ -40,7 +40,6 @@ export interface GetGithubReposResponse { repos: unknown }
 export interface GetGoalsIdConflictsResponse { ok: boolean; goal_id: unknown; conflicts: unknown; cross_goals_considered: unknown }
 export interface GetGoalsIdRequestsResponse { requests: unknown }
 export interface GetGoalsIdResponse { goal: unknown; members: unknown; criteria: unknown; dependencies: unknown }
-export interface GetGoalsIdSuggestCriteriaResponse { goal_id: unknown; suggestions: unknown }
 export interface GetGoalsResponse { goals: unknown }
 export interface GetGovernmentAssignmentsResponse { assignments: unknown }
 export interface GetGovernmentPermissionsResponse { permissions: unknown; principals: unknown }
@@ -605,7 +604,7 @@ export interface BongosClient {
     /** POST /goals/{id}/scope — rank: metic+archon */
     postGoalsIdScope(args: RequestArgs & { body: PostGoalsIdScopeRequest }): Promise<PostGoalsIdScopeResponse>;
     /** GET /goals/{id}/suggest-criteria — rank: any-builder */
-    getGoalsIdSuggestCriteria(args?: RequestArgs): Promise<GetGoalsIdSuggestCriteriaResponse>;
+    getGoalsIdSuggestCriteria(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /goals/{id}/tasks — rank: any-builder */
     postGoalsIdTasks(args: RequestArgs & { body: PostGoalsIdTasksRequest }): Promise<PostGoalsIdTasksResponse>;
     /** POST /goals/{id}/transfer — rank: any-builder */
@@ -616,6 +615,8 @@ export interface BongosClient {
     getGoalsInbox(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /goals/reorder — rank: metic+archon */
     postGoalsReorder(args: RequestArgs & { body: PostGoalsReorderRequest }): Promise<PostGoalsReorderResponse>;
+    /** GET /goals/suggestions — rank: any-builder */
+    getGoalsSuggestions(args?: RequestArgs): Promise<ApiResponse>;
   };
   "government": {
     /** GET /government/assignments — rank: archon */

package/clients/bongos-client/index.mjs

@@ -351,6 +351,8 @@ export function createClient(opts = {}) {
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
+      // GET /goals/suggestions — rank: any-builder — GET /goals/suggestions
+      getGoalsSuggestions: (args) => request("GET", "/goals/suggestions", { hasBody: false }, args),
     },
     "government": {
       // GET /government/assignments — rank: archon — GET /government/assignments

package/docs/adr/0183-criteria-close-themselves.md

@@ -0,0 +1,58 @@
+# ADR 0183 — A done-when criterion closes itself; the review queue becomes a place to look
+
+- **Status:** accepted
+- **Date:** 2026-08-21
+- **Task:** 1002069 (owner request 2026-07-05, scope owner-confirmed)
+- **Supersedes part of:** [ADR 0086](<redacted>.md) §6 / BV1.R63 — the criterion auto-flag stays, but confirming it is no longer the only way a criterion closes.
+
+## Context
+
+Under ADR 0086 §6 a criterion became `satisfied` in exactly one way: a Metic+ called `POST /done-when/:id/satisfy`, and if it was the goal's last criterion the goal flipped `open→achieved`. The "met — pending review" flag was **derived** — every gating task shipped, nothing stored — and `/goal-review` walked that queue so a human could confirm each one.
+
+That gate cost more than it bought. The signal it gated on is already unambiguous: *every task under this criterion has shipped.* A human confirming that adds no information, and when nobody runs `/goal-review` the consequence is not "a careful pause" but a **lying board** — criteria sitting unsatisfied and goals sitting `open` long after the work landed. The owner asked for the flip to be automatic (2026-07-05).
+
+This session supplied the evidence for how bad the drift gets: goal 1000072 read `6/9 shipped, 0/5 criteria` — six tasks landed, not one criterion moved.
+
+## Decision
+
+**A criterion satisfies itself once its gating set is fully delivered, and a goal achieves itself once all its criteria are satisfied.** One helper, `doneWhen.autoSatisfyShippedCriteria(exec, { taskId })`, run from two places:
+
+| Where | Scope | Why both |
+|---|---|---|
+| `shipTask`, inside its transaction | `{ taskId }` — only what this ship gates | Immediate. A builder shipping a goal's last task sees the goal close *now*. On the txn client, so a rolled-back ship cannot leave a goal achieved. |
+| `publish-reconciler` tick, every ~5 min | `{}` — every unsatisfied criterion | **Backlog drain** (criteria whose tasks shipped before this existed — nothing will ship against them again) and **self-heal** (a criterion linked after its tasks shipped, a hand-edited status, a ship whose best-effort in-txn close was skipped). |
+
+`exec` is caller-supplied on purpose; the helper never reaches for a module pool. It is idempotent — it only reads `satisfied = false` rows — which is what makes an every-tick sweep safe.
+
+`/goal-review` is **not** deleted. It stops being a gate and becomes a place to look: what closed, and the ambiguous cases automation deliberately refuses (below).
+
+### The delivery guard, and a deliberate asymmetry
+
+Auto-close requires **both**:
+
+1. no linked task outside `{shipped, abandoned}` — nothing is still pending; and
+2. **at least one linked task actually `shipped`** — something was delivered.
+
+The second is not redundant, and it is the whole reason this ADR exists rather than a one-line commit. Since [task 1002651](https://cloudbongos.com/builders#/task/1002651) made `abandoned` terminal-not-pending, a criterion whose linked tasks were **all cut** satisfies condition 1 *vacuously* — every task is accounted for, none is pending. Automating on condition 1 alone would satisfy criteria on **zero delivered work** and cascade their goals to `achieved`. Measured, not hypothetical: `buildCriterionProgress` returns `pending_review: true` for exactly that shape today.
+
+**But `pending_review` keeps that wider meaning.** It answers "should a human look at this?", and task 1002651 chose on purpose that an all-abandoned criterion surfaces there — its work was cut, so someone must decide whether the criterion still means anything. Auto-close answers the narrower "may this close itself, unattended?"
+
+> Everything that auto-closes was flagged for review. Not everything flagged for review auto-closes.
+
+An earlier draft of this task "aligned" the two predicates and broke 1002651's intent; `tests/criterion_progress.mjs` caught it. **Do not re-align them.** The gap is the design.
+
+## Consequences
+
+- **Criteria and goals stop lying by default.** No cadence discipline required.
+- **`/goal-review` keeps a real job** — the all-abandoned case, and any criterion a human wants to reject.
+- **The manual `POST /satisfy` route is untouched**, still Metic+. It remains the way to close a criterion that automation cannot judge (e.g. one with no linked tasks at all — automation requires ≥1, so a task-less criterion never auto-closes).
+- **A close is only as good as its task links.** Auto-satisfy cannot help a criterion nothing is linked to; goal 1000072's five criteria have zero linked tasks and will stay `0/5` until they are linked. Automating the flip makes that gap *more* visible, not less — which is the point.
+- **`achieveGoalIfComplete` (db.js) now has a sibling** that re-implements its rules in SQL on a caller's `exec`, because it reads through the module pool and could not see an uncommitted in-txn flip. The duplication is deliberate and noted at both sites; collapsing it would mean either a require cycle (`done-when` ↔ `db`) or moving goal reads out of `db.js`.
+- **Observability:** the in-txn close logs from `closeCompletedWorkForShip`, which means it prints *before* commit — the one wart, accepted and documented there, because threading the summary back out through `withTx` would have cost ~5 lines in the over-threshold `db.js` (shrink-only ratchet policy).
+
+## Alternatives rejected
+
+- **Sweep only, no ship hook.** Simpler, but a builder who ships a goal's last task would wait up to 5 minutes to see it close — losing the moment that makes the board feel alive.
+- **Ship hook only, no sweep.** Leaves every pre-existing completed criterion unsatisfied forever, since nothing will ship against them again.
+- **A stored `pending_review` column.** ADR 0086 §6 deliberately derives the flag; storing it adds a second source of truth to keep in sync.
+- **Deleting `/goal-review`.** It still has the all-abandoned case and rejection to handle.

package/docs/adr/README.md

@@ -256,5 +256,6 @@ This keeps the decision history honest and traceable.
 | 0180 | [**Dependency intake & drift policy: baseline-ratchet audit gate, install scripts off, cooldown via patrol, OIDC publish** ([task 1003127](https://cloudbongos.com/builders#/task/1003127), goal 1000076). The red-team baseline audit found 18 advisories (2 high) sitting unwatched in 9 production deps, the `undici ^6.27.0` override pinned INSIDE a vulnerable range while also breaking Node 26 CLIs, and nothing gated what an agent may install — against a 2025 npm threat wave (chalk/debug, Shai-Hulud, Nx) that ran on postinstall scripts and long-lived publish tokens. Four decisions. (1) `scripts/gds/audit-gate.js` runs in the required `unit` check: a high/critical advisory NOT in the committed `config/audit-baseline.json` fails the merge gate; the baseline is **shrink-only pre-gate debt** (10 findings at adoption) — adding an entry to silence a NEW advisory is out of policy. Fail-OPEN on registry/infra errors, fail-CLOSED on findings: the gate catches new advisories, it does not prove registry uptime. Notably a blanket `npm audit fix` cannot even run here (`workspace:` protocol, EUNSUPPORTEDPROTOCOL) — fixes are explicit tasks. (2) `.npmrc ignore-scripts=true`: the tree needs no install-lifecycle scripts — sharp installs prebuilds via optionalDependencies, proven by a script-less `npm ci` + full 430-test suite; a future dep needing one is an ADR-level exception. (3) Update cooldown is PATROL-enforced (task 1003128 flags versions younger than 7 days + stale overrides + action-pin drift) rather than `.npmrc`-enforced, because CI's npm 10 warns on the npm-11 `minimum-release-age` key for every builder; move it into `.npmrc` when the toolchain floor reaches npm ≥ 11.10. (4) Publish auth moves to npm **trusted publishing (OIDC)** — needs a one-time owner registration on npmjs.com (blocker filed); until then the granular 90-day `NPM_TOKEN` is a documented exception.](<redacted>.md) | devsecops / supply chain |
 | 0181 | [**Teardown accepts every state but `torn_down`, and deliberately keeps the address** ([task 1003042](https://cloudbongos.com/builders#/task/1003042), goal 1000058). Walk finding N5: an instance at `status='error'` could never be removed — the owner's teardown answered 409 `not_teardownable` and the archon `force-teardown`, which exists as the escape hatch, answered the SAME refusal, because both read one hand-kept whitelist `['provisioning','active','tearing_down']` that omitted `requested` and `error`. No role had a path out, so errored rows accumulated permanently (instance 15 `swag` from 2026-08-07). The whitelist justified itself as "nothing running to tear down", which is FALSE for `error`: a provision failing mid-run lands there AFTER it may have created the database, taken a port, and written the systemd unit, Caddy block and DNS record — a partial standup is the thing most in need of reclaiming. `TEARDOWN_FROM` is now DERIVED from `INSTANCE_STATES` minus `torn_down`, so a future state is teardownable by DEFAULT — the bug was an allow-list that silently omitted states, and for a failure mode whose signature is "a row with no exit", the safe default is that an exit exists. The runner needed no change (its steps are each `allowFail`); only the web guard refused. The one surviving refusal is now ONE shared helper: the copies had drifted, and force-teardown's positional `res.fail` form put the bare code `not_teardownable` on the wire as the human text. **The `port` and `domain` are deliberately NOT released** — releasing the port alone would be WORSE than the status quo, because the `<slug>.caddy` block survives teardown and proxies the hostname to a PORT NUMBER, so a later instance given that port would answer at the torn-down project's still-live address (verified live: two projects torn down 2026-08-13 still resolved on 2026-08-19). Holding the port is what keeps the address inert at a harmless 502; releasing both is [task 1002897](https://cloudbongos.com/builders#/task/1002897). Retention is also correct for revive, which re-uses the same hostname. Copy was corrected to match: it had promised "the address stops answering", which was never true.](0181-teardown-state-gate-and-address-retention.md) | provisioning / lifecycle |
 | 0182 | [**Project visibility is TWO axes: a derived publish gate and a stored join door** ([task 1002320](https://cloudbongos.com/builders#/task/1002320), goal 1000046). Goal 1000046 seeded 31 tasks each citing "per R01" — this ADR — so nothing in the goal could start until it landed: it gated **29 open tasks**, the largest single chokepoint in the repo, while itself parked at `backlog` with no dependencies. The spec its planning task cites was never written, so this is the design of record. The goal's criterion says **four** states (Public/Private/Stealth/Unlisted) and R04 says **three** stored plus a derived dark-matter; both are right and conflating them is the trap. There are two INDEPENDENT axes: **publishability** (DERIVED from the identity gate — name + description, per the owner interview) decides whether a project is on the map at all, and **the join door** (STORED `visibility ∈ public|private|stealth`, owner-set) decides how it renders and who gets in. Four user-facing states = 3 × publishable + one derived state that collapses all three. The column name `visibility` is a mild lie kept for consistency with `goals.visibility` (ADR 0112) — it does NOT decide visibility, publishability does — and the ADR is the mitigation. All three stored states are VISIBLE; only the derived state is invisible, which is what makes the 3+1 split honest rather than a workaround. `private` inherits ADR 0112's exact meaning (visible-but-closed); `stealth` exposes EXISTENCE but not IDENTITY, and its redaction is **server-side in the feed** — the naive client-side version leaks to anyone opening the network tab, and the orbs page is a static site OUTSIDE this repo (R09) so it could never be enforced there. Three mechanisms touch "does this appear" and are separated: `status` (operational), `visibility` (owner), `featured` (Archon editorial) — on the map iff `status='active' AND publishable`, with `featured` only ranking among those. That is a real behaviour change: today's predicate is `featured=true AND status='active'`, so **featuring is currently load-bearing for visibility at all** and the goal's owner-control premise silently does not work without it. Visibility is owned by the INSTANCE and the hub row is a CACHE (ADR 0141 §3 + the admin-console spike's D1) — so `owner_github_id` being "advisory, not an authority" is CORRECT rather than a gap, R05 moves to an instance surface, and R08's absent-report default is fail-closed (unreported ⇒ dark matter, off the map rather than exposed by omission). Per-state join rules compose with the separate `open|closed` join policy ([task 1002817](https://cloudbongos.com/builders#/task/1002817)) by one rule: **visibility sets the ceiling, join policy may only narrow** — otherwise the two settings are a coin-flip decided by evaluation order. Finally, `stealth` COLLIDES with the existing instance-wide pre-launch password gate (`STEALTH_PASSWORD`, `src/bongos/stealth-gate.js`), which means nearly the opposite (a whole instance made unreadable vs a project publicly on the map, anonymously); per ADR 0174 the product meaning keeps the word and the infra rename is filed separately rather than decided by an ADR about visibility. Rejected: a stored 4-valued enum (makes `unlisted` compete with `private`, and lets publishable+unlisted disagree), a separate `published` boolean (can drift from the identity it summarises; derived cannot), and keeping `featured` as the visibility gate (an owner who sets public and appears nowhere has not been given control).](<redacted>.md) | platform-identity / project visibility |
+| 0183 | [**A done-when criterion closes itself; the review queue becomes a place to look** ([task 1002069](https://cloudbongos.com/builders#/task/1002069), goal 1000072, owner request 2026-07-05). ADR 0086 §6 made `satisfied` reachable exactly one way — a Metic+ calling `POST /done-when/:id/satisfy` — even though the signal it gated on is unambiguous (**every** gating task shipped) and a human confirming it adds no information. When nobody runs `/goal-review` the result is not a careful pause but a **lying board**: this session measured goal 1000072 at `6/9 shipped, 0/5 criteria`. Now one helper, `doneWhen.autoSatisfyShippedCriteria(exec, {taskId})`, runs from **two** places for two different reasons — inside `shipTask`'s txn (scoped, **immediate**, on the txn client so a rolled-back ship cannot leave a goal achieved) and unscoped on every `publish-reconciler` tick (**backlog drain** for criteria whose tasks shipped before this existed, since nothing will ship against them again, plus **self-heal**). Idempotent by construction — it reads only `satisfied=false` rows — which is what makes an every-tick sweep safe. **The load-bearing subtlety is the delivery guard.** Auto-close needs BOTH "nothing still pending" AND **≥ 1 task actually `shipped`**; the second is not redundant, because since [task 1002651](https://cloudbongos.com/builders#/task/1002651) made `abandoned` terminal-not-pending, a criterion whose tasks were **all cut** satisfies the first clause *vacuously* and would auto-close on ZERO delivered work, cascading its goal to `achieved` (measured: `buildCriterionProgress` returns `pending_review:true` for exactly that shape). Yet `pending_review` **keeps** that wider meaning on purpose — it asks "should a human LOOK at this", and 1002651 chose that an all-abandoned criterion surfaces so someone decides whether it still means anything. So: everything that auto-closes was flagged; not everything flagged auto-closes. An earlier draft "aligned" the two predicates and broke that intent — `tests/criterion_progress.mjs` caught it; **do not re-align them**, the gap is the design. `/goal-review` is kept, demoted from gate to viewing surface; manual `POST /satisfy` stays for what automation cannot judge (a criterion with no linked tasks never auto-closes). Honest limits recorded: auto-satisfy cannot help a criterion nothing is LINKED to, and the in-txn close logs before commit (accepted — threading the summary out through `withTx` would cost ~5 lines in the over-threshold `db.js` under shrink-only ratchet policy). Rejected: sweep-only (up to 5 min to see your own goal close), hook-only (never drains the backlog), a stored `pending_review` column (second source of truth), deleting `/goal-review`.](<redacted>.md) | lifecycle / goal tier |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/api/openapi.json

@@ -4228,6 +4228,37 @@
         ]
       }
     },
+    "/goals/suggestions": {
+      "get": {
+        "operationId": "get_goals_suggestions",
+        "tags": [
+          "goals"
+        ],
+        "summary": "GET /goals/suggestions",
+        "description": "GET /goals/suggestions — \"which goal should this draft live in?\", answered before anything is created (task 1003062 / R07). Handler + the ranking and visibility rationale: ../goal-suggest.js. Mounted BEFORE GET /goals/:id so 'suggestions' is never captured as an id. rank: any-builder — a read of open goal titles, same surface as GET /goals.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/lifecycle/routes/goals.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/goals/{id}": {
       "get": {
         "operationId": "get_goals_id",
@@ -5257,14 +5288,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetGoalsIdSuggestCriteriaResponse"
-                }
-              }
-            }
+            "description": "Success."
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
@@ -13780,17 +13804,6 @@
           "dependencies"
         ]
       },
-      "GetGoalsIdSuggestCriteriaResponse": {
-        "type": "object",
-        "properties": {
-          "goal_id": {},
-          "suggestions": {}
-        },
-        "required": [
-          "goal_id",
-          "suggestions"
-        ]
-      },
       "GetGoalsResponse": {
         "type": "object",
         "properties": {
@@ -18546,9 +18559,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 293,
-  "x-schema-count": 328,
+  "x-endpoint-count": 294,
+  "x-schema-count": 327,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 219,
+  "x-response-schemas": 218,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 293 endpoints across 47 route files.
+> **Generated from the live route files** — the route file is authoritative. 294 endpoints across 47 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -197,7 +197,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/github/repos` | `any-builder` | — | acts only on the caller's OWN GitHub identity (the token they granted). |
 | POST | `/api/bongos/github/repos` | `any-builder` | `name` | creates a repo in the caller's OWN account. |
 
-## `goals` (25)
+## `goals` (26)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -226,6 +226,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | PATCH | `/api/bongos/goals/:id/visibility` | `any-builder` | — | PATCH /goals/:id/visibility — make a goal public\|private (task 1952 / ADR 0112). |
 | GET | `/api/bongos/goals/inbox` | `any-builder` | — | GET /goals/inbox — the caller's private-goals inbox (task 1952 / ADR 0112): { invitations: invites addressed to me (accept/decline); join… |
 | POST | `/api/bongos/goals/reorder` | `metic+archon` | `version_id`, `ordered_ids` | POST /goals/reorder — Archon drag-to-reorder: set the priority order of every goal WITHIN one version (task 1760). |
+| GET | `/api/bongos/goals/suggestions` | `any-builder` | — | GET /goals/suggestions — "which goal should this draft live in?", answered before anything is created (task 1003062 / R07). |
 
 ## `government` (13)
 

package/modules/lifecycle/db.js

@@ -3863,7 +3863,7 @@ async function shipTask({ taskId, builderId }, deps = {}) {
         justUnlocked = [];
       }
     }
-
+    await doneWhen.closeCompletedWorkForShip(client, taskId); // task 1002069/ADR 0183 — in-txn criterion+goal close
     return {
       shipRow: rows[0], graduationBuilder, rankGraduation, actualShipperId,
       closedClaimCount: closedClaims.length,