@bongos/core 1.19.291 → 1.19.292

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.291",
-  "core_contract": "1.19.291",
-  "source_commit": "c05eeaf6f713e548b9a30460ce153d4388041ebc",
+  "core_version": "1.19.292",
+  "core_contract": "1.19.292",
+  "source_commit": "57bc876c876c64bf07069a3646e253006a917fc6",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T15:00:29.764Z",
+  "built_at": "2026-08-22T15:49:03.336Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 320,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1389,
+    "functional_verbatim": 1391,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1731,
-  "tree_sha256": "d46fa302ab0b4aba74a3c947cfc01de0cf9bc482d5fec65df8ea2c518b29153b",
+  "file_count": 1733,
+  "tree_sha256": "ca47008669375b8c24cbecd5f6142a05b189fce9c02e8c3d2bdc29a2da237f87",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2434,6 +2434,11 @@
       "mode": "0000644",
       "sha256": "9939ee2c641caa8ae4f5055c60e3208a6ed4e379b1bfd1aaa67247a8ed4a4fd8"
     },
+    {
+      "path": "migrations/core_223_blocker_resolve_respects_other_open_blockers.sql",
+      "mode": "0000644",
+      "sha256": "8fc38c0353811699e19d861321d4fca8fe8fd5cca1f66ff96312d7f44fb0290e"
+    },
     {
       "path": "modules/autonomy/CLAUDE.md",
       "mode": "0000644",
@@ -4522,12 +4527,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7dc929fd01010d29e076564007cdb27b3cfecbf5b2f318f1b045a742d405ab04"
+      "sha256": "417cc856bf6eca0ed8c214b12624c6bc7567bb96b07a5999ebf5b72ab6b4ca05"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ccb290e054afd40d91c5058a10cbaae6c3d7c7d18a4afdad65f593825ee1ec4c"
+      "sha256": "06e136123405fad423973fd79250b7baae689b122c0975e41f369ae87cdfe9e9"
     },
     {
       "path": "public-docs/index.html",
@@ -6172,7 +6177,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4699911082270a5de6b6692df442c0901c6153e2eef39139fdd2118bd5cb4869"
+      "sha256": "a00525dccc2576669f8793418e40f7232dd2f8662163900142b561ce3c93a2db"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6449,6 +6454,11 @@
       "mode": "0000644",
       "sha256": "0ade9bbcb1782ffa2dd01799002dee7d88f6b17dab8ee418fe58e1a06ffb925e"
     },
+    {
+      "path": "tests/blocker_resolve_guard.mjs",
+      "mode": "0000644",
+      "sha256": "3a85b9e9bee4258aa64d26ca025d52c605f5f33938d3fdd5a31c393f1ec3f249"
+    },
     {
       "path": "tests/bongos_box_connect.mjs",
       "mode": "0000644",

package/migrations/core_223_blocker_resolve_respects_other_open_blockers.sql

@@ -0,0 +1,74 @@
+-- core_223_blocker_resolve_respects_other_open_blockers.sql — resolving ONE of a
+-- task's blockers must not release it while others are still open (task 1003149).
+--
+-- Bug: 009's resolve trigger promotes on ANY resolve, with no check for the
+-- task's OTHER blockers:
+--
+--     UPDATE tasks SET status = 'ready'
+--      WHERE id IN (SELECT task_id FROM task_blockers WHERE blocker_id = NEW.id)
+--        AND status = 'blocked';
+--
+-- So a task blocked by N blockers becomes claimable the moment the FIRST one
+-- resolves, with N-1 owner decisions still outstanding.
+--
+-- It is the ASYMMETRY that makes this a bug rather than a policy. Migration 176
+-- (V4.R15 / task 953) fixed exactly this hazard on the DEPENDENCY promotion path
+-- by folding a "no open blocker" check into task_is_fully_unblocked, and its own
+-- header defers to this trigger — "009's blocker-resolve trigger is what should
+-- release it, not a dep ship". But 009 releases on the first resolve, not the
+-- last. One path fail-closes; the other did not. This aligns them.
+--
+-- Live at the time of writing: task 1000594 was blocked by BOTH blocker 1000065
+-- and blocker 1000093 — duplicates covering the same two owner decisions — so
+-- closing either as a duplicate would have released the task with the decision
+-- still open. That is what made a routine duplicate-close unsafe, and there is
+-- no unlink route to detach one first.
+--
+-- `b.id <> NEW.id` IS LOAD-BEARING, NOT COSMETIC. This is a BEFORE UPDATE
+-- trigger, so the blockers row for NEW.id still reads status = 'open' in the
+-- table while the function body runs. Without the exclusion the guard would see
+-- the blocker being resolved as still open and NOTHING would ever promote —
+-- turning an over-eager release into a permanent stall. For the same reason this
+-- cannot simply call task_is_fully_unblocked(): that predicate reads the live
+-- table and would always be false here.
+--
+-- Deliberately NOT also checking dependencies. A task left in 'blocked' because
+-- its deps are unshipped would be STRANDED: the dep-promotion triggers (163)
+-- only ever flip 'backlog' -> 'ready', never 'blocked' -> 'ready', so no path
+-- would release it. Blocker-clearing and dep-clearing stay separate concerns.
+--
+-- Legacy markdown-anchor links (task_blockers.blocker_ref with no blocker_id
+-- row) are not tracked here and behave exactly as before — same scope as 176.
+--
+-- Idempotent: pure CREATE OR REPLACE of the function. The trigger created in 009
+-- resolves the function by name, so it needs no redefinition.
+
+BEGIN;
+
+CREATE OR REPLACE FUNCTION trg_promote_tasks_on_blocker_resolve()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.status = 'resolved' AND (OLD.status IS NULL OR OLD.status <> 'resolved') THEN
+    IF NEW.resolved_at IS NULL THEN
+      NEW.resolved_at := now();
+    END IF;
+
+    UPDATE tasks
+       SET status = 'ready', updated_at = now()
+     WHERE id IN (SELECT task_id FROM task_blockers WHERE blocker_id = NEW.id)
+       AND status = 'blocked'
+       -- … and no OTHER blocker on this task is still open (task 1003149).
+       AND NOT EXISTS (
+         SELECT 1
+           FROM task_blockers tb
+           JOIN blockers b ON b.id = tb.blocker_id
+          WHERE tb.task_id = tasks.id
+            AND b.id <> NEW.id
+            AND b.status = 'open'
+       );
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.291",
+  "version": "1.19.292",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.291",
+      "version": "1.19.292",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.291",
+  "version": "1.19.292",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1009,8 +1009,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.289 with no explicit bump. run 32552538814. (task 1002620)
 //   1.19.291 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.290 with no explicit bump. run 32580353000. (task 1002620)
+//   1.19.292 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.291 with no explicit bump. run 32582800234. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.291'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.292'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/blocker_resolve_guard.mjs

@@ -0,0 +1,96 @@
+// tests/blocker_resolve_guard.mjs
+//
+// Task 1003149 — resolving ONE of a task's blockers must not release it while
+// others are still open. Static shape guard for core_223, in the style of
+// dependencies_migration.mjs: no live DB, assert the SQL TEXT so a future edit
+// cannot silently drop the guard or "simplify" it back into the bug. The runtime
+// behaviour is proven against real Postgres at deploy; this pins the contract.
+//
+// Run:  node tests/blocker_resolve_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+const require = createRequire(import.meta.url);
+
+const MIG = 'core_223_blocker_resolve_respects_other_open_blockers.sql';
+const mig = read('migrations', MIG);
+const migN = mig.replace(/\s+/g, ' ');
+// Comments carry the load-bearing rationale; strip them when asserting on the
+// executable body so a claim in prose can never stand in for the real SQL.
+const body = mig.replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
+
+const { test, summary } = makeRunner();
+
+await test('223 replaces the resolve trigger function (and only replaces it)', () => {
+  assert.match(mig, /CREATE OR REPLACE FUNCTION trg_promote_tasks_on_blocker_resolve\(\)/);
+  // The trigger from 009 binds by name, so redefining it here would be noise —
+  // and a DROP TRIGGER would leave a window where resolves promote nothing.
+  assert.doesNotMatch(body, /DROP TRIGGER/i);
+  assert.doesNotMatch(body, /CREATE TRIGGER/i);
+});
+
+await test('the promote UPDATE is guarded by a NOT EXISTS over the task\'s OTHER open blockers', () => {
+  assert.match(body, /UPDATE tasks SET status = 'ready'/);
+  assert.match(body, /AND status = 'blocked'/);
+  assert.match(body, /AND NOT EXISTS \( SELECT 1 FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id/);
+  assert.match(body, /WHERE tb\.task_id = tasks\.id/);
+  assert.match(body, /AND b\.status = 'open'/);
+});
+
+await test("`b.id <> NEW.id` is present — without it a BEFORE trigger stalls forever", () => {
+  // The blockers row for NEW.id still reads 'open' while a BEFORE UPDATE trigger
+  // body runs, so dropping this exclusion would mean NOTHING ever promotes —
+  // trading an over-eager release for a permanent stall. This is the single
+  // most important character sequence in the migration.
+  assert.match(body, /AND b\.id <> NEW\.id/);
+});
+
+await test('223 does NOT also gate on dependencies — that would strand blocked tasks', () => {
+  // The dep-promotion triggers (163) only flip backlog -> ready, never
+  // blocked -> ready, so a task held in 'blocked' for unshipped deps would have
+  // no release path at all.
+  assert.doesNotMatch(body, /task_is_fully_unblocked/);
+  assert.doesNotMatch(body, /FROM dependencies/);
+});
+
+await test('the resolved_at capture from 009 is preserved', () => {
+  assert.match(body, /IF NEW\.resolved_at IS NULL THEN NEW\.resolved_at := now\(\);/);
+  assert.match(body, /IF NEW\.status = 'resolved' AND \(OLD\.status IS NULL OR OLD\.status <> 'resolved'\) THEN/);
+});
+
+await test('223 is transactional and idempotent (pure CREATE OR REPLACE)', () => {
+  assert.match(migN, /BEGIN;.*COMMIT;/);
+  assert.doesNotMatch(body, /ALTER TABLE/i);
+  assert.doesNotMatch(body, /DROP FUNCTION/i);
+});
+
+await test('009 remains the only OTHER definition — 223 is the last word', () => {
+  const defs = readdirSync(join(repoRoot, 'migrations'))
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => /FUNCTION trg_promote_tasks_on_blocker_resolve/.test(read('migrations', f)))
+    .sort();
+  assert.deepEqual(defs, ['009_pms_v2_blockers_table.sql', MIG]);
+  // Ordering matters: migrate.sh applies in filename order, so a lower-numbered
+  // redefinition landing later would silently reinstate the bug.
+  assert.ok(MIG > '009_pms_v2_blockers_table.sql', 'core_223 must sort after 009');
+});
+
+await test('the JS resolve path still only OBSERVES — promotion stays in the trigger', () => {
+  const src = read('modules', 'ideas', 'blockers.js');
+  // resolveBlocker flips the blocker and then reads back which tasks are ready;
+  // if it ever started UPDATE-ing tasks.status itself, this guard would be
+  // bypassable and the fix would need to live in two places.
+  assert.doesNotMatch(src, /UPDATE\s+tasks[\s\S]{0,200}?status\s*=\s*'ready'/);
+  const blockers = require('../modules/ideas/blockers.js');
+  assert.equal(typeof blockers.resolveBlocker, 'function');
+});
+
+summary('blocker_resolve_guard');