@bongos/core 1.19.287 → 1.19.289

package/modules/lifecycle/done-when.js

@@ -32,6 +32,14 @@ const { pool } = require('../../src/module-api');
 // (db.listCriteriaForGoal, task 1002164) both call it; listPendingReviewCriteria
 // expresses the same rule as a SQL HAVING clause. Counts are coerced because
 // node-postgres renders count() as a string unless cast.
+// DELIBERATELY WIDER THAN AUTO-CLOSE (task 1002069). This flag means "a human
+// should LOOK at this", and task 1002651 chose on purpose that a criterion whose
+// linked tasks were all ABANDONED surfaces here — its work was cut, so someone
+// must decide whether the criterion still means anything. Auto-close is the
+// strictly NARROWER question ("may this close itself, unattended?") and carries
+// an extra >=1-shipped guard of its own; see autoSatisfyShippedCriteria. So
+// everything that auto-closes was flagged here, but not everything flagged here
+// auto-closes — the all-abandoned case stays for a person. Do not "align" them.
 function isPendingReview({ satisfied, linked, unshipped }) {
   return !satisfied && Number(linked) > 0 && Number(unshipped) === 0;
 }
@@ -357,6 +365,140 @@ async function unmarkCriterion(criterionId) {
   return rows[0] ?? null;
 }
 
+// -------------------------------------------------------------------------
+// Auto-satisfy (task 1002069 / ADR 0183)
+// -------------------------------------------------------------------------
+
+// autoSatisfyShippedCriteria — flip every criterion whose gating set is fully
+// DELIVERED to satisfied=true, then cascade any goal whose criteria are now all
+// satisfied to `achieved`. This retires the manual /goal-review confirm step as
+// the ONLY way a criterion closes (owner request 2026-07-05): the review queue
+// becomes a place to look, not a gate to pass.
+//
+// `exec` is a pg client OR the pool — the caller decides. That is the whole
+// design: shipTask passes its OPEN TRANSACTION CLIENT so the criterion flip and
+// the goal cascade commit atomically with the task's own status change (a
+// half-applied close would leave a goal achieved on a task that rolled back),
+// while the publish-reconciler sweep passes the pool. Never reach for the module
+// pool in here.
+//
+// TWO CALL SHAPES:
+//   { taskId }  — SCOPED: only criteria the just-shipped task gates. The hot
+//                 path, inside the ship txn.
+//   {}          — UNSCOPED: every unsatisfied criterion. The sweep, which both
+//                 drains the backlog of criteria that completed before this
+//                 feature existed and self-heals anything the hot path missed
+//                 (a ship that predates the hook, a manual DB status change).
+//
+// IDEMPOTENT by construction — it only ever reads `satisfied = false` rows, so a
+// second run over the same data is a no-op, which is what makes the sweep safe
+// to run on every reconciler tick.
+//
+// THE DELIVERY GUARD. Two conditions, and BOTH are required:
+//   - nothing still pending: no linked task outside {shipped, abandoned}
+//   - something delivered:   at least one linked task actually SHIPPED
+// The second is not redundant. Since task 1002651 made `abandoned` terminal, a
+// criterion whose linked tasks were ALL abandoned satisfies the first condition
+// vacuously — every task is accounted for, none is pending — and would auto-close
+// on ZERO delivered work, cascading its goal to `achieved`. Under the old manual
+// gate that was merely a bad row in a review queue a human would reject; automatic,
+// it silently declares goals complete. See isPendingReview, which carries the
+// same guard so the queue and the automation cannot disagree.
+//
+// Returns { criteria: [...], goals: [...] } — the rows actually changed, so a
+// caller can log or broadcast exactly what closed (empty arrays on a no-op).
+async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
+  const scopedTaskId = taskId == null ? null : Number(taskId);
+  if (scopedTaskId != null && !Number.isFinite(scopedTaskId)) {
+    throw new Error('autoSatisfyShippedCriteria: taskId must be numeric');
+  }
+  const { rows: criteria } = await exec.query(
+    `WITH candidate AS (
+       SELECT c.id,
+              -- Attribute the close to a task that actually shipped. In scoped
+              -- mode that is the shipping task; unscoped, the highest shipped id
+              -- (deterministic, and the most recent contributor).
+              max(tc.task_id) FILTER (WHERE t.status = 'shipped') AS by_task
+         FROM done_when_criteria c
+         JOIN task_criteria tc ON tc.criterion_id = c.id
+         JOIN tasks t          ON t.id = tc.task_id
+        WHERE c.satisfied = false
+          AND ($1::bigint IS NULL OR c.id IN (
+                SELECT criterion_id FROM task_criteria WHERE task_id = $1::bigint))
+        GROUP BY c.id
+       HAVING count(*) FILTER (WHERE t.status NOT IN ('shipped', 'abandoned')) = 0
+          AND count(*) FILTER (WHERE t.status = 'shipped') >= 1
+     )
+     UPDATE done_when_criteria c
+        SET satisfied            = true,
+            satisfied_by_task_id = COALESCE($1::bigint, candidate.by_task),
+            checked_at           = now()
+       FROM candidate
+      WHERE c.id = candidate.id
+     RETURNING c.id, c.version_id, c.criterion_id, c.criterion_md, c.goal_id,
+               c.satisfied_by_task_id`,
+    [scopedTaskId]
+  );
+  if (criteria.length === 0) return { criteria: [], goals: [] };
+
+  // Cascade. Deliberately re-derived from the table rather than from `criteria`:
+  // a goal completes when ALL of its criteria are satisfied, and the ones that
+  // closed in THIS call may not be all of them. Mirrors db.achieveGoalIfComplete
+  // exactly — open goals only, >=1 criterion, zero unsatisfied — but on `exec`,
+  // so it sees the flips above inside the same transaction.
+  const goalIds = [...new Set(criteria.map((c) => c.goal_id).filter((g) => g != null))].map(Number);
+  if (goalIds.length === 0) return { criteria, goals: [] };
+  const { rows: goals } = await exec.query(
+    `UPDATE goals g
+        SET status = 'achieved', updated_at = now()
+      WHERE g.id = ANY($1::bigint[])
+        AND g.status = 'open'
+        AND EXISTS     (SELECT 1 FROM done_when_criteria d WHERE d.goal_id = g.id)
+        AND NOT EXISTS (SELECT 1 FROM done_when_criteria d WHERE d.goal_id = g.id AND NOT d.satisfied)
+     RETURNING g.id, g.title, g.version_id, g.status`,
+    [goalIds]
+  );
+  return { criteria, goals };
+}
+
+// describeAutoClose — the one-line summary of what a close actually closed, or
+// null on a no-op. Pure + here rather than in db.js because db.js is over the
+// fitness oversize threshold: growth there has to be paid for, and formatting is
+// not state-machine work (task 1002069).
+// closeCompletedWorkForShip — the whole ship-time hook behind ONE call, so the
+// oversized db.js pays ~4 lines for it instead of ~15 (the fitness excess-lines
+// ratchet is why that matters). Takes the ship's OPEN TXN CLIENT so the closes
+// commit atomically with the task's flip to 'shipped'. Swallows its own failure
+// and reports it in the returned line — a criterion close must never fail a
+// ship, and the reconciler's unscoped sweep retries every tick. Returns a
+// summary string, or null when nothing closed (the common case).
+async function closeCompletedWorkForShip(client, taskId, log = console.log) {
+  let line;
+  try {
+    line = describeAutoClose(await autoSatisfyShippedCriteria(client, { taskId }));
+  } catch (e) {
+    line = `auto-satisfy skipped (sweep retries): ${e && e.message}`;
+  }
+  // Logged HERE, which means INSIDE the caller's transaction — the one honest
+  // wart in this design. shipTask's other observability is deliberately
+  // post-commit, so on the rare rolled-back ship this line describes closes that
+  // did not persist. Accepted because the alternative was threading the summary
+  // back out through withTx, and those ~5 extra lines land in db.js, which is
+  // over the fitness oversize threshold (shrink-only policy). A rolled-back ship
+  // fails loudly on its own, so a stray line here cannot be mistaken for success.
+  if (line) log(`[gds] shipTask ${taskId}: ${line}`);
+  return line || null;
+}
+
+function describeAutoClose(closed) {
+  const criteria = closed?.criteria || [];
+  const goals = closed?.goals || [];
+  if (!criteria.length && !goals.length) return null;
+  const c = criteria.map((x) => x.criterion_id).join(', ') || 'none';
+  const g = goals.map((x) => `${x.id} "${x.title}"`).join(', ') || 'none';
+  return `auto-satisfied criteria [${c}]; auto-ACHIEVED goals [${g}]`;
+}
+
 module.exports = {
   listCriteria,
   listGoalsForVersion,
@@ -367,6 +509,9 @@ module.exports = {
   buildCriterionProgress,
   buildGoals,
   isPendingReview,
+  autoSatisfyShippedCriteria,
+  describeAutoClose,
+  closeCompletedWorkForShip,
   markCriterion,
   unmarkCriterion,
 };

package/modules/lifecycle/goal-suggest.js

@@ -0,0 +1,171 @@
+'use strict';
+
+// modules/lifecycle/goal-suggest.js — "which goal should this work live in?",
+// answered BEFORE anything is created (task 1003062 / R07 of goal 1000071).
+//
+// THE GAP. `buildGoalAdvisory` (goal-advisory.js) already answers this — but only
+// AFTER a task exists, as a hint attached to the 201. Every consumer R07 feeds
+// needs it BEFORE: the hall filing surface offering a goal picker (R08), the CLI
+// asking at capture time (R09), and the Discord suggestion (R11) all have a draft
+// title and no row yet. So the candidate logic is lifted into a pure read that
+// creates nothing.
+//
+// WHY THIS RANKS, rather than returning "the first five open goals". Unranked
+// candidates are useless here: BONGOS-V1 carries dozens of open goals, so an
+// arbitrary five is noise dressed as a suggestion. Ranking is what makes it a
+// suggester. It reuses `tokenize` from criterion-suggest.js — a sibling, already
+// covering the weighting idea (title terms 2, body terms 1) and already tested —
+// so there is one notion of "these two texts are about the same thing" in the
+// module, not two.
+//
+// WHAT A GOAL IS MATCHED ON: its title and its scope_modules. Deliberately NOT
+// its description — a goal description is where a whole planning spec lives (goal
+// 1000062 carries an entire decision record in its), so it shares tokens with
+// almost any draft and would flatten every score toward the same number. Modules
+// are included because they are a strong, cheap signal: a draft about the hall
+// really does belong with a goal scoped to `hall-ui`.
+
+const { tokenize } = require('./criterion-suggest.js');
+const { candidateGoals } = require('./goal-advisory.js');
+const api = require('../../src/module-api');
+// Through the published logger seam, not a raw console call (est-advisory.js precedent).
+const proseErr = (err) => api.logger('lifecycle').error({ err: err && err.message }, 'GET /goals/suggestions failed');
+
+// Matches suggestCriteria's default so the two suggesters feel the same.
+const SUGGEST_LIMIT = 5;
+
+// Rank open goals against a DRAFT capture. Pure — no DB, no writes; the caller
+// supplies the goal rows.
+//
+//   goals   — open goal rows { id, title, scope_modules }
+//   draft   — { title, body } (body optional: a capture's prose, weighted lower)
+//   opts    — { versionId, limit, includeZero }
+//
+// Returns [{ id, title, scope_modules, score, matched_terms }] best-first, ties
+// broken by ascending id so output is stable for a picker.
+//
+// `includeZero` defaults FALSE, following suggestCriteria: a draft that matches
+// nothing returns [] — "no confident suggestion" — rather than five arbitrary
+// goals. The route reports the open-goal count alongside so a caller can still
+// offer "browse all" without this function pretending to a confidence it lacks.
+function suggestGoals(goals, draft = {}, opts = {}) {
+  const { title = '', body = '' } = draft;
+  const { versionId = null, limit = SUGGEST_LIMIT, includeZero = false } = opts;
+
+  // Weighted term map: body terms at 1, title terms override to 2 (a term in
+  // both IS a title term — the stronger signal wins). suggestCriteria's rule.
+  const weights = new Map();
+  for (const t of tokenize(body)) weights.set(t, 1);
+  for (const t of tokenize(title)) weights.set(t, 2);
+
+  // candidateGoals drops the "<version> — general" catch-all and normalises the
+  // row shape. Reused rather than re-filtered so "which goals may be suggested"
+  // has one definition — the catch-all is never a suggestion, it is the fallback
+  // when there is no home, which is a different question (R03 owns that).
+  const ranked = candidateGoals(goals, versionId).map((g) => {
+    const goalTerms = new Set([
+      ...tokenize(g.title),
+      // A module key like `hall-ui` tokenizes to ['hall','ui']; 'ui' is dropped
+      // by the >=3-char filter, which is fine — 'hall' is the signal.
+      ...tokenize((g.scope_modules || []).join(' ')),
+    ]);
+    let score = 0;
+    const matched = [];
+    for (const [term, w] of weights) {
+      if (goalTerms.has(term)) { score += w; matched.push(term); }
+    }
+    return { ...g, score, matched_terms: matched.sort() };
+  }).sort((a, b) => (b.score - a.score) || (Number(a.id) - Number(b.id)));
+
+  const kept = includeZero ? ranked : ranked.filter((r) => r.score > 0);
+  return kept.slice(0, Math.max(0, limit));
+}
+
+
+// goalSuggestHandler — GET /goals/suggestions. Handler lives here, not inline in
+// routes/goals.js, because that file is over the fitness oversize threshold and
+// the ratchet is shrink-only; collaborators are injected so this module still
+// requires nothing but its siblings.
+//
+// Creates NOTHING — that is the point of R07. A caller with a draft title gets
+// candidates and decides; POST /inbox (R01) is what actually routes.
+//
+// VISIBILITY, stated rather than silently decided: this returns open goals
+// without filtering on `visibility`, which MATCHES the existing GET /goals — that
+// route already lists private goals' titles to any signed-in builder
+// (db.listGoals has no visibility predicate). So this neither widens nor narrows
+// the status quo. It is worth knowing that the status quo is wider than the
+// private-goal leak rule the CLAIM refusal follows (goal-authz
+// goalMembershipClaimRefusal withholds a private goal's title); reconciling the
+// two is a real decision about the goal board as a whole, not something a
+// suggester should settle on its own.
+function goalSuggestHandler({ db, LIMITS }) {
+  return async function getGoalSuggestions(req, res) {
+    const versionId = String(req.query.version || '').trim();
+    if (!versionId) return res.fail('version_required', 400, { message: 'Pass ?version=<version_id> — suggestions are scoped to one version.' });
+    const title = String(req.query.title || '').slice(0, (LIMITS && LIMITS.TITLE) || 200);
+    const body = String(req.query.body || '').slice(0, 4000);
+    if (!title && !body) {
+      return res.fail('draft_text_required', 400, { message: 'Pass ?title= (and optionally ?body=) — there is nothing to rank against otherwise.' });
+    }
+    const rawLimit = Number(req.query.limit);
+    const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(1, Math.trunc(rawLimit)), 20) : SUGGEST_LIMIT;
+    // Wrapped like criteriaSuggestHandler below: without it a db error escapes to
+    // Express's default handler, which can put internal detail on a JSON API
+    // response. The sibling in this same file already did this; not matching it
+    // was an oversight, not a decision.
+    try {
+      const open = await db.listGoals({ versionId, status: 'open' });
+      const suggestions = suggestGoals(open, { title, body }, { versionId, limit });
+      return res.json({
+        version_id: versionId,
+        // `kind` is echoed, NOT ranked on. Kind decides how a capture LANDS (the
+        // R05 landing matrix: a bug hard-lands, a feature soft-lands); it does not
+        // indicate WHICH goal the work belongs to. Saying so here stops a caller
+        // reading the echo as a ranking input.
+        kind: req.query.kind ? String(req.query.kind).slice(0, 64) : null,
+        suggestions,
+        // So a caller can offer "browse all" honestly when nothing scored: an empty
+        // `suggestions` means "no confident match", never "this version has no goals".
+        open_goal_count: (open || []).length,
+        created: null,
+      });
+    } catch (err) {
+      proseErr(err);
+      return res.fail('suggest_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+// criteriaSuggestHandler — GET /goals/:id/suggest-criteria (task 2165), moved
+// here in task 1003062. Same reason as its sibling above: routes/goals.js is over
+// the fitness oversize threshold and the ratchet is shrink-only, so adding the
+// goal suggester there had to be PAID FOR — and paying with a cohesion
+// improvement beats shaving comments. It belongs beside the other suggester
+// anyway: both answer "what should this draft attach to", one at goal level and
+// one at criterion level. Behaviour byte-identical; only the registration line
+// stays in the route file so route-rank-check still classifies it.
+function criteriaSuggestHandler({ db, suggestCriteria, parseId }) {
+  return async function getSuggestCriteria(req, res) {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    try {
+      const goal = await db.getGoal(id);
+      if (!goal) return res.fail('goal_not_found', 404);
+      const criteria = await db.listCriteriaForGoal(id);
+      const limit = Math.min(10, Math.max(1, Number(req.query.limit) || 3));
+      const suggestions = suggestCriteria(
+        criteria,
+        { title: req.query.title, description: req.query.description },
+        { limit }
+      );
+      return res.json({ goal_id: goal.id, suggestions });
+    } catch (err) {
+      // Same seam as its sibling above — one error-handling pattern per file.
+      api.logger('lifecycle').error({ err: err && err.message }, 'GET /goals/:id/suggest-criteria failed');
+      return res.fail('fetch_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+module.exports = { suggestGoals, goalSuggestHandler, criteriaSuggestHandler, SUGGEST_LIMIT };

package/modules/lifecycle/publish-reconciler.js

@@ -777,9 +777,17 @@ async function runSweep(deps = {}) {
 // prevents any double-count if the client also posted. Unlike the confirmed→
 // shipped work, this is PURE DB — it needs no push credential — so it runs even
 // on a host where getPublishStatus would 503. Best-effort + injected-deps pure.
+// One logger resolver for every sweep (task 1002069). Was copy-pasted per sweep;
+// three copies of `deps.log || console.log` is three places to drift.
+function loggers(deps = {}) {
+  return { logFn: deps.log || console.log, errFn: deps.error || console.error };
+}
+
+// A single crash handler for the tick's fire-and-forget sweeps — same reason.
+const crashHandler = (name) => (e) => loggers().errFn(`[publish-reconciler] ${name} crashed: ${e && e.message}`);
+
 async function runCostSweep(deps = {}) {
-  const logFn = deps.log || console.log;
-  const errFn = deps.error || console.error;
+  const { logFn, errFn } = loggers(deps);
   // reconcileSessionCosts carved into modules/economy/ (BV1.R77 / ADR 0093 §1-2):
   // prefer an injected deps.db (the test seam — tests inject a db with the
   // method), else resolve the `reward` kernel port (production; economy default-on).
@@ -804,6 +812,40 @@ async function runCostSweep(deps = {}) {
   }
 }
 
+// runCriterionSweep — the UNSCOPED half of auto-satisfy (task 1002069 / ADR 0183).
+// shipTask closes what its own ship completed, in its own txn; this closes
+// everything else, on every tick. Two jobs, and the second is why it is not
+// merely belt-and-braces:
+//   BACKLOG DRAIN — every criterion whose gating tasks shipped BEFORE this
+//     feature existed. Without the sweep those stay unsatisfied forever, since
+//     nothing will ship against them again.
+//   SELF-HEAL — a criterion linked AFTER its tasks shipped, a task status changed
+//     by hand, or a ship whose in-txn close was skipped by the best-effort catch.
+// Pure DB like runCostSweep — no push credential — so it runs on hosts where
+// getPublishStatus 503s. Idempotent: it only reads satisfied=false rows.
+async function runCriterionSweep(deps = {}) {
+  const { logFn, errFn } = loggers(deps);
+  // Injected deps.doneWhen is the test seam; the sibling module is production.
+  const dw = (deps.doneWhen && typeof deps.doneWhen.autoSatisfyShippedCriteria === 'function')
+    ? deps.doneWhen
+    : require('./done-when.js');
+  const exec = deps.pool || seams.pool;
+  if (typeof dw.autoSatisfyShippedCriteria !== 'function') return { skipped: 'unsupported' };
+  try {
+    const closed = await dw.autoSatisfyShippedCriteria(exec, {});
+    for (const c of closed.criteria) {
+      logFn(`[publish-reconciler] criterion ${c.criterion_id} (${c.version_id}) auto-satisfied — all gating tasks shipped`);
+    }
+    for (const g of closed.goals) {
+      logFn(`[publish-reconciler] goal ${g.id} "${g.title}" auto-ACHIEVED — every criterion satisfied`);
+    }
+    return closed;
+  } catch (e) {
+    errFn(`[publish-reconciler] criterion sweep (non-blocking): ${e && e.message}`);
+    return { skipped: 'error', error: e && e.message };
+  }
+}
+
 // Start the periodic sweep. Idempotent (a second call is a no-op). Kill-switched
 // by PUBLISH_RECONCILER_DISABLED=1 (purely additive bookkeeping, so it's ON by
 // default whenever a push credential is configured; the route's getPublishStatus
@@ -816,11 +858,13 @@ function start(deps = {}) {
   }
   if (intervalTimer) return; // already started
 
+  // Each sweep is INDEPENDENT on purpose: the cost (task 1366) and criterion
+  // (task 1002069) sweeps are pure DB — no push credential — and a failure in
+  // either must never touch the confirmed→shipped work.
   const tick = () => {
-    runSweep(deps).catch((e) => console.error(`[publish-reconciler] sweep crashed: ${e && e.message}`));
-    // task 1366 — runs independently of the confirmed→shipped sweep (pure DB, no
-    // push credential) and never lets a cost-reconcile error touch that sweep.
-    runCostSweep(deps).catch((e) => console.error(`[publish-reconciler] cost sweep crashed: ${e && e.message}`));
+    runSweep(deps).catch(crashHandler('sweep'));
+    runCostSweep(deps).catch(crashHandler('cost sweep'));
+    runCriterionSweep(deps).catch(crashHandler('criterion sweep'));
   };
 
   firstTimer = setTimeout(tick, FIRST_SWEEP_DELAY_MS);
@@ -857,6 +901,7 @@ module.exports = {
   stop,
   runSweep,
   runCostSweep,
+  runCriterionSweep,
   couldBeStaleGenerated,
   describeTarget,
   INTERVAL_MS,

package/modules/lifecycle/routes/goals.js

@@ -26,6 +26,7 @@ const api = require('../../../src/module-api');
 const auth = api;
 const db = require('../db');
 const hierarchy = require('../hierarchy');
+const goalSuggest = require('../goal-suggest.js'); // task 1003062 — pre-creation goal suggester
 const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edit handlers
 const { suggestCriteria } = require('../criterion-suggest');
 const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, TASK_FIELD_BOUNDS } = require('../task-classifier');
@@ -535,6 +536,13 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // GET /goals/suggestions — "which goal should this draft live in?", answered
+  // before anything is created (task 1003062 / R07). Handler + the ranking and
+  // visibility rationale: ../goal-suggest.js. Mounted BEFORE GET /goals/:id so
+  // 'suggestions' is never captured as an id.
+  // rank: any-builder — a read of open goal titles, same surface as GET /goals.
+  router.get('/goals/suggestions', auth.requireBuilder, goalSuggest.goalSuggestHandler({ db, LIMITS }));
+
   // GET /goals/inbox — the caller's private-goals inbox (task 1952 / ADR 0112):
   // { invitations: invites addressed to me (accept/decline); joinRequests: pending
   // join-requests on goals I own or manage (approve/deny); myPendingRequests: my own
@@ -578,25 +586,7 @@ module.exports = function buildGoalsRouter() {
   // task, so a create flow can SUGGEST which done-when criterion to link (the
   // author confirms/overrides — nothing is auto-linked). Read-only + advisory;
   // rank: any-builder (same as GET /goals/:id).
-  router.get('/goals/:id/suggest-criteria', auth.requireBuilder, async (req, res) => {
-    const id = parseId(req, res, { code: 'bad_goal_id' });
-    if (id === null) return;
-    try {
-      const goal = await db.getGoal(id);
-      if (!goal) return res.fail('goal_not_found', 404);
-      const criteria = await db.listCriteriaForGoal(id);
-      const limit = Math.min(10, Math.max(1, Number(req.query.limit) || 3));
-      const suggestions = suggestCriteria(
-        criteria,
-        { title: req.query.title, description: req.query.description },
-        { limit }
-      );
-      return res.json({ goal_id: goal.id, suggestions });
-    } catch (err) {
-      console.error('[gds] GET /goals/:id/suggest-criteria', err);
-      return res.fail('fetch_failed', { status: 500, message: 'internal error' });
-    }
-  });
+  router.get('/goals/:id/suggest-criteria', auth.requireBuilder, goalSuggest.criteriaSuggestHandler({ db, suggestCriteria, parseId }));
 
   // POST /goals/:id/join — join an open goal.
   // rank: any-builder — open join for a NORMAL goal. A PROTECTED-scope goal is

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.287",
+  "version": "1.19.289",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.287",
+      "version": "1.19.289",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.287",
+  "version": "1.19.289",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -362,6 +362,9 @@ const MODULE_EXPECTED_RANKS = {
     // Pinning catches an accidental requireRank re-gate that would lock builders
     // out of asking/accepting, and any gate removal.
     'GET /goals/inbox': 'any-builder',
+    // task 1003062 (R07): a pre-creation READ of open goal titles — same surface
+    // and same rank as GET /goals. Creates nothing.
+    'GET /goals/suggestions': 'any-builder',
     'PATCH /goals/:id/visibility': 'any-builder',
     // task 1003102: a goal's own authority (owner|manager|Archon, in-handler
     // authorizeGoalManagement) corrects its own title/description — same shape
@@ -506,8 +509,20 @@ function classifyGate(lines, i, { floors } = {}) {
   // (not any `=>`) avoids cutting at an inline-arrow middleware like
   // `rateLimit({ key: (req) => req.ip })`. If there's no `=> {` in the window
   // (e.g. a `function` handler), fall back to the full window — prior behaviour.
-  const handlerAt = window.search(/=>\s*\{/);
-  const tail = handlerAt === -1 ? window : window.slice(0, handlerAt);
+  // task 1003062: FIRST clamp the window to THIS route's own declaration. The
+  // `=> {` truncation below only fires for an inline-arrow handler; a route whose
+  // handler is a FACTORY CALL — `router.get(p, auth.requireBuilder, mk({...}))` —
+  // contains no `=> {`, so the old code fell back to the full 20 lines and
+  // absorbed the NEXT route's requirePermission, recording an any-builder read as
+  // metic+archon. Wrong in the tightening direction, but still wrong: the pin and
+  // the audit then describe a gate that is not there. Factory handlers became
+  // common because the fitness oversize ratchet pushes handler bodies out of large
+  // route files, so this is not an exotic shape. A window must never cross into a
+  // sibling declaration.
+  const nextRouteAt = window.search(/\n\s*router\.(get|post|patch|put|delete|use)\s*\(/);
+  const own = nextRouteAt === -1 ? window : window.slice(0, nextRouteAt);
+  const handlerAt = own.search(/=>\s*\{/);
+  const tail = handlerAt === -1 ? own : own.slice(0, handlerAt);
 
   const perms = permissionKeysIn(tail);
   const byRank = rankFromRankGate(tail);

package/src/module-api.js

@@ -1001,8 +1001,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.285 with no explicit bump. run 32533647172. (task 1002620)
 //   1.19.287 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.286 with no explicit bump. run 32539649191. (task 1002620)
+//   1.19.288 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.287 with no explicit bump. run 32546561232. (task 1002620)
+//   1.19.289 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.288 with no explicit bump. run 32549912116. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.287'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.289'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');