@bongos/core 1.19.298 → 1.19.300

package/modules/hall-ui/public/ideas.js

@@ -0,0 +1,338 @@
+// modules/hall-ui/public/ideas.js — the hall "Ideas" tab (/builders/ideas).
+// Task 1002928 / BV1.R152 of goal 1000062 (three grades of idea).
+//
+// WHY THE HALL AT ALL (the owner's principle, recorded on the goal): anything
+// fundamentally simple, that does not need the Claude terminal, should be doable
+// inside the builders hall. Writing down a thought is exactly that — so a Full
+// Idea can be authored and filed here without a terminal, which is this task's
+// first done-when.
+//
+// THE ONE RULE THIS FILE OBEYS: IT CONTAINS NO RULES.
+// Not the five questions, not their character floors, not the scoring
+// arithmetic. The done-when says the meter must reflect the REAL scorer, "not a
+// second copy of the rules", and the cheapest way to violate that is not a
+// re-implemented formula — it is five hand-written <textarea> elements, which
+// quietly fork the template one step before any scoring happens. So:
+//
+//   the FORM   is rendered from GET  /inbox/template   (the R141 declaration)
+//   the METER  is filled   from POST /inbox/score      (the R142 scorer itself)
+//
+// Both are pure server calls with no DB behind them, which is what makes a
+// debounced call per keystroke reasonable.
+//
+// WHAT THE METER DELIBERATELY DOES NOT SAY: whether this will PASS. The pass bar
+// lives in the economy module with the credit it gates (and the board applies its
+// own), and the ideas scorer is documented as bar-AGNOSTIC. Printing a threshold
+// here would be a second copy of a DIFFERENT rule — the exact mistake this file
+// is organised to avoid — so the gauge reports completeness and stops there.
+//
+// DRAFTS ARE LOCAL. "A partial draft is not lost on navigation" is a done-when,
+// and a half-written thought is not something to put in the database: it has no
+// title yet, no grade, and nothing downstream should be able to see it. It lives
+// in localStorage under one key, is restored on load, and is cleared only when
+// the idea is actually filed.
+
+(() => {
+  'use strict';
+
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml, $, toast } = window.OTB;
+
+  // One key, this page only. Versioned by template key at save time so a project
+  // that changes its template (R156) cannot restore a draft shaped for the old one.
+  const DRAFT_KEY = 'hall-full-idea-draft';
+  const SCORE_DEBOUNCE_MS = 300;
+  const DRAFT_DEBOUNCE_MS = 500;
+
+  let template = null;      // { key, label, fields: [{key,label,required,substance_min}] }
+  let lastScore = null;
+  let scoreTimer = null;
+  let draftTimer = null;
+  let filing = false;
+
+  // ---------------------------------------------------------------------------
+  // draft persistence
+  // ---------------------------------------------------------------------------
+
+  // Every localStorage access is wrapped: a private window, cleared site data or
+  // a browser set to block storage all THROW on read, and losing the draft
+  // feature must never take the composer down with it (the shell.js NAV_COLLAPSE
+  // precedent, which guards the same way).
+  function readDraft() {
+    try {
+      const raw = window.localStorage.getItem(DRAFT_KEY);
+      if (!raw) return null;
+      const d = JSON.parse(raw);
+      return (d && typeof d === 'object') ? d : null;
+    } catch (_) { return null; }
+  }
+
+  function writeDraft() {
+    if (!template) return;
+    try {
+      window.localStorage.setItem(DRAFT_KEY, JSON.stringify({
+        template_key: template.key,
+        title: titleEl().value,
+        field_values: collect(),
+        at: new Date().toISOString(),
+      }));
+      note('Draft saved in this browser.');
+    } catch (_) {
+      // Storage refused. Say so once rather than pretending it saved — a builder
+      // who believes a draft is safe and navigates away loses the thought.
+      note('This browser is not storing drafts — keep the tab open.');
+    }
+  }
+
+  function clearDraft() {
+    try { window.localStorage.removeItem(DRAFT_KEY); } catch (_) { /* nothing to clear */ }
+  }
+
+  function note(msg) {
+    const el = $('#fi-draft');
+    if (el) el.textContent = msg;
+  }
+
+  // ---------------------------------------------------------------------------
+  // the form, rendered from the template declaration
+  // ---------------------------------------------------------------------------
+
+  const titleEl = () => $('#fi-title');
+  const fieldEl = (key) => document.getElementById(`fi-f-${key}`);
+
+  function renderForm(draft) {
+    const host = $('#fi-fields');
+    host.innerHTML = template.fields.map((f) => `
+      <div class="fi-field" data-key="${escapeHtml(f.key)}">
+        <label class="fi-label" for="fi-f-${escapeHtml(f.key)}">
+          ${escapeHtml(f.label)}${f.required ? '' : ' <span class="fi-hint">(optional)</span>'}
+        </label>
+        <textarea id="fi-f-${escapeHtml(f.key)}" class="fi-text" rows="4"
+                  data-key="${escapeHtml(f.key)}"
+                  placeholder="…"></textarea>
+        <p class="fi-fieldnote" id="fi-n-${escapeHtml(f.key)}"></p>
+      </div>
+    `).join('');
+
+    // Restore BEFORE wiring listeners, so restoring does not itself fire a save.
+    if (draft && draft.field_values) {
+      for (const f of template.fields) {
+        const v = draft.field_values[f.key];
+        if (typeof v === 'string') fieldEl(f.key).value = v;
+      }
+    }
+    if (draft && typeof draft.title === 'string') titleEl().value = draft.title;
+
+    for (const f of template.fields) {
+      fieldEl(f.key).addEventListener('input', onEdit);
+    }
+    titleEl().addEventListener('input', onEdit);
+
+    $('#fi-meter').hidden = false;
+    renderMeterSkeleton();
+  }
+
+  function collect() {
+    const out = {};
+    for (const f of template.fields) out[f.key] = fieldEl(f.key).value;
+    return out;
+  }
+
+  // ---------------------------------------------------------------------------
+  // the meter — every number in it came from the server
+  // ---------------------------------------------------------------------------
+
+  function renderMeterSkeleton() {
+    $('#fi-meter-list').innerHTML = template.fields.map((f) => `
+      <li class="fi-mrow" id="fi-m-${escapeHtml(f.key)}">
+        <span class="fi-mrow__l">${escapeHtml(f.label)}</span>
+        <span class="fi-mrow__bar"><span class="fi-mrow__fill" style="width:0%"></span></span>
+      </li>
+    `).join('');
+  }
+
+  function renderScore(payload) {
+    lastScore = payload;
+    const score = payload && Number.isInteger(payload.score) ? payload.score : null;
+    const fill = $('#fi-gauge-fill');
+    const num = $('#fi-gauge-n');
+    fill.style.width = `${score == null ? 0 : score}%`;
+    // Three bands, and they describe the TEXT rather than a verdict: this number
+    // is not a pass mark (see the header note), so the words must not imply one.
+    fill.dataset.band = score == null ? 'none' : (score >= 80 ? 'full' : score >= 40 ? 'part' : 'thin');
+    num.textContent = score == null ? '—' : `${score}/100`;
+
+    const byKey = new Map((payload && payload.fields ? payload.fields : []).map((f) => [f.key, f]));
+    for (const f of template.fields) {
+      const row = document.getElementById(`fi-m-${f.key}`);
+      const s = byKey.get(f.key);
+      const pct = s ? Math.round(s.ratio * 100) : 0;
+      if (row) row.querySelector('.fi-mrow__fill').style.width = `${pct}%`;
+      // Per-field prose under the textarea: how much more text this answer wants
+      // before it stops costing the total. `floor` and `substance` are the
+      // server's numbers — this only subtracts them.
+      const n = document.getElementById(`fi-n-${f.key}`);
+      if (!n) continue;
+      if (!s || s.substance === 0) { n.textContent = ''; continue; }
+      const missing = Math.max(0, s.floor - s.substance);
+      n.textContent = missing > 0
+        ? `about ${missing} more characters before this answer counts in full`
+        : 'counts in full';
+      n.dataset.ok = missing > 0 ? '0' : '1';
+    }
+
+    // The file button turns on when every REQUIRED field has something in it —
+    // capture validation's actual rule (R143 refuses a missing required field and
+    // does NOT enforce the substance floor, because a thin answer is a scoring
+    // problem, not a capture error). Matching that exactly means the button never
+    // promises an outcome the server will refuse, and never blocks one it accepts.
+    const missingRequired = template.fields.some((f) => f.required && !fieldEl(f.key).value.trim());
+    $('#fi-submit').disabled = filing || missingRequired || !titleEl().value.trim();
+  }
+
+  async function scoreNow() {
+    const body = { field_values: collect() };
+    if (template.key) body.template_key = template.key;
+    const r = await api.inbox.postInboxScore({ body });
+    // A scoring hiccup must not stop someone writing. The gauge simply stops
+    // updating; the composer keeps working and filing still validates server-side.
+    if (!r.ok) { note('Could not reach the scorer just now — you can still file.'); return; }
+    renderScore(r.data);
+  }
+
+  function onEdit() {
+    clearTimeout(scoreTimer);
+    clearTimeout(draftTimer);
+    scoreTimer = setTimeout(() => { scoreNow(); }, SCORE_DEBOUNCE_MS);
+    draftTimer = setTimeout(writeDraft, DRAFT_DEBOUNCE_MS);
+    // Re-evaluate the button on the keystroke rather than waiting for the score
+    // round-trip: it depends only on what is typed.
+    if (lastScore) renderScore(lastScore);
+    else $('#fi-submit').disabled = filing
+      || !titleEl().value.trim()
+      || template.fields.some((f) => f.required && !fieldEl(f.key).value.trim());
+  }
+
+  // ---------------------------------------------------------------------------
+  // filing
+  // ---------------------------------------------------------------------------
+
+  function showErr(msg) {
+    const el = $('#fi-err');
+    el.textContent = msg || '';
+    el.dataset.visible = msg ? '1' : '0';
+  }
+
+  // The server names the field it refused (R143's done-when). Render that rather
+  // than a generic failure, and point at the field so it can be found.
+  function explainFiling(status, data) {
+    const err = data && data.error;
+    const code = err && typeof err === 'object' ? err.code : err;
+    const details = (err && typeof err === 'object' && err.details) || {};
+    if (code === 'invalid_field_values') {
+      const errors = Array.isArray(details) ? details : (details.errors || []);
+      const labelOf = (k) => {
+        const f = template.fields.find((x) => x.key === k);
+        return f ? f.label : (k || 'the idea');
+      };
+      return errors.length
+        ? `Not filed — ${errors.map((e) => `${labelOf(e.field)}: ${String(e.reason || '').replace(/_/g, ' ')}`).join('; ')}`
+        : 'Not filed — the five answers were refused.';
+    }
+    if (code === 'validation_failed') return 'Not filed — the title is required and must be under 200 characters.';
+    if (status === 401 || status === 403) return 'Not filed — your session may have expired. Reload and try again.';
+    return `Not filed (${status}). Nothing was saved; your draft is still here.`;
+  }
+
+  async function file(ev) {
+    ev.preventDefault();
+    if (filing) return;
+    filing = true;
+    showErr('');
+    $('#fi-submit').disabled = true;
+
+    const r = await api.inbox.postInbox({
+      body: {
+        title: titleEl().value.trim(),
+        grade: 'full',
+        template_key: template.key,
+        field_values: collect(),
+      },
+    });
+
+    filing = false;
+    if (!r.ok) {
+      showErr(explainFiling(r.status, r.data));
+      renderScore(lastScore);
+      return;
+    }
+
+    // Filed. NOW the draft goes — not before, so a failed POST never costs the text.
+    clearDraft();
+    const idea = r.data && r.data.idea;
+    const score = idea && Number.isInteger(idea.completeness_score) ? idea.completeness_score : null;
+    // The capture path is fail-open on grading (R143): the idea lands even if the
+    // grade write did not, and says so. Repeat that here instead of claiming a
+    // Full Idea was stored when the response says otherwise.
+    const landedFull = idea && idea.grade === 'full';
+    toast(landedFull
+      ? `Filed as a Full Idea${score == null ? '' : ` — ${score}/100`}.`
+      : 'Filed, but stored as a quick idea — the grade could not be written.');
+
+    titleEl().value = '';
+    for (const f of template.fields) fieldEl(f.key).value = '';
+    lastScore = null;
+    renderScore(null);
+    note('');
+    if (idea && idea.id) {
+      // The detail PAGE (task 1002929 / R153), not the #/idea/N overlay: the
+      // thing just filed has five prose answers, which is what the page is for.
+      const base = location.hostname.startsWith('builders.') ? '' : '/builders';
+      $('#fi-sub').innerHTML = `Filed <a href="${base}/idea/${encodeURIComponent(idea.id)}">idea ${escapeHtml(String(idea.id))}</a>. Write another below.`;
+    }
+  }
+
+  function discard() {
+    if (!template) return;
+    clearDraft();
+    titleEl().value = '';
+    for (const f of template.fields) fieldEl(f.key).value = '';
+    lastScore = null;
+    renderScore(null);
+    showErr('');
+    note('Draft discarded.');
+    toast('Draft discarded.');
+  }
+
+  // ---------------------------------------------------------------------------
+  // boot
+  // ---------------------------------------------------------------------------
+
+  async function main() {
+    const r = await api.inbox.getInboxTemplate({});
+    if (!r.ok || !r.data || !r.data.template) {
+      $('#fi-sub').textContent = 'Could not load the idea template. Reload, or file from the terminal with capture.js.';
+      return;
+    }
+    template = r.data.template;
+
+    const draft = readDraft();
+    // A draft written against a different template is not restorable — the keys
+    // may not exist any more. Drop it rather than half-restoring it.
+    const usable = draft && (!draft.template_key || draft.template_key === template.key) ? draft : null;
+
+    $('#fi-sub').textContent = 'Five questions, and a score that counts how much of each you actually answered.';
+    renderForm(usable);
+    $('#fi-form').addEventListener('submit', file);
+    $('#fi-clear').addEventListener('click', discard);
+
+    if (usable) {
+      note('Draft restored.');
+      scoreNow();
+    } else {
+      renderScore(null);
+    }
+  }
+
+  main();
+})();

package/modules/hall-ui/public/shell.js

@@ -130,6 +130,14 @@
       // craft rather than a rank, so hiding this behind one would hide the
       // artist's own queue from the artist. The module gate drops the tab on an
       // instance that disables copy-desk.
+      // task 1002928 (R152 of goal 1000062): the Full Idea composer. In the FIRST
+      // group — this is the project's own work-intake, beside Goals and Tasks,
+      // not one of "your numbers". gate 'signed' and NOT a craft or rank gate, on
+      // the goal's own settled decision: there is no permission gate on Full
+      // Ideas, completeness scoring and triage do the filtering. Hiding the page
+      // behind the ideator craft would hide the ideator's own surface from
+      // everyone else who has a thought, which is most of the value.
+      { id: 'ideas', label: 'Ideas', icon: 'goals', href: '/ideas', gate: 'signed' },
       { id: 'copy-desk', label: 'Copy desk', icon: 'docs', href: '/copy-desk', gate: 'signed', module: 'copy-desk' },
     ] },
     // Your own numbers. task 2174 folded Achievements into Standing and this task

package/modules/hall-ui/public/task-detail.js

@@ -118,6 +118,19 @@
     }
     if (r.shipped_at) nodes.push(h('p', 'deeplink-card__note', 'Shipped ' + fmtRel(r.shipped_at)));
 
+    // task 1002929 (R153): an idea now has a real page, and this card cannot show
+    // a Full Idea's five prose answers legibly — so it stops pretending to and
+    // points at the page instead. The overlay KEEPS the triage panel below (~320
+    // lines of promote/merge/discard); this is the summary→detail relationship the
+    // Work board already has with /task/:id, not a replacement.
+    if (kind === 'idea') {
+      var fv = h('p', 'deeplink-card__note');
+      var fl = h('a', 'deeplink-card__link', r.grade === 'full' ? 'Read the full idea →' : 'Open this idea →');
+      fl.href = hallBase() + '/idea/' + encodeURIComponent(r.id);
+      fv.appendChild(fl);
+      nodes.push(fv);
+    }
+
     // task 759 → task 1002447: Metic+ idea triage, right in the overlay (no
     // /idea-triage skill and no LLM in the loop). 759 shipped Discard alone;
     // 1002447 adds the other two verbs so the whole verdict set is reachable

package/modules/ideas/inbox.js

@@ -507,11 +507,24 @@ async function listOpenIdeas({ kind = null, limit = 50, viewerRank = null } = {}
   return rows;
 }
 
+// The by-id read. It carries the two people's LOGINS as well as their ids
+// (task 1002929 / R153): an idea's attribution is a claim about humans, and
+// "captured_by: 41" is not attribution to anyone reading it. Named to match the
+// R145 spark queue's `filed_by_login` so the two idea surfaces agree.
+//
+// Both joins are LEFT: a builder row can be missing (an FK that went
+// ON DELETE SET NULL), and an idea nobody developed has no developer at all —
+// which is the common case, not an error. A plain JOIN here would drop most of
+// the inbox, the same trap the grade join documents above.
 async function getIdea(id) {
   const { rows } = await pool.query(
-    `SELECT ${IDEA_COLS_Q}, ${GRADE_COLS_Q}
+    `SELECT ${IDEA_COLS_Q}, ${GRADE_COLS_Q},
+            ba.github_login AS filed_by_login,
+            bd.github_login AS developed_by_login
        FROM idea_inbox i
        ${IDEA_JOIN_GRADE}
+       LEFT JOIN builders ba ON ba.id = i.captured_by
+       LEFT JOIN builders bd ON bd.id = g.developed_by
       WHERE i.id = $1`,
     [id]
   );

package/modules/ideas/routes/inbox.js

@@ -6,8 +6,8 @@ const api = require('../../../src/module-api');
 const inbox = require('../inbox');
 // Full Idea capture (task 1002919 / BV1.R143): the template validator (R141)
 // and the deterministic scorer (R142) — both pure, both walk the declaration.
-const { validateFieldValues } = require('../templates');
-const { completenessScore, weakestSectionPayload } = require('../completeness');
+const { validateFieldValues, templateFor, fieldOrder } = require('../templates');
+const { completenessScore, weakestSectionPayload, scoreFieldValues } = require('../completeness');
 const { validateOrRespond, LIMITS, parseId } = api;
 
 const INBOX_STATUS_VALUES = ['open', 'promoted', 'discarded', 'merged'];
@@ -313,6 +313,94 @@ module.exports = function buildInboxRouter() {
   });
 
 
+
+  // -----------------------------------------------------------------------
+  // The two reads the hall's Full Idea composer is built from
+  // (task 1002928 / BV1.R152, goal 1000062).
+  //
+  // The done-when says the live meter must reflect THE REAL SCORER, "not a
+  // second copy of the rules". A browser cannot require() this module —
+  // completeness.js and templates.js are CJS and templates.js reaches inbox.js
+  // for DEFAULT_TEMPLATE_KEY, which reaches the pool — so the choice is between
+  // re-implementing the arithmetic in page JS and asking the server. These two
+  // routes are that ask, and they are why the composer contains no rules at all:
+  //
+  //   GET  /inbox/template  → what the five fields ARE (so the FORM is rendered
+  //                           from the R141 declaration, not from five <textarea>
+  //                           elements hand-written into the HTML — a hard-coded
+  //                           form is the same "second copy" defect as a
+  //                           hard-coded scorer, one step earlier, and it would
+  //                           silently ignore a per-project template (R156)).
+  //   POST /inbox/score     → what it is WORTH right now (the R142 scorer itself,
+  //                           per-field, in template order).
+  //
+  // BOTH ARE PURE. No DB read, no write, no idea id: they describe and score a
+  // payload the caller already holds. That is what makes a debounced call on
+  // every keystroke reasonable, and why scoring carries no rank beyond sign-in —
+  // it tells you nothing you did not just type.
+  //
+  // DECLARED BEFORE `GET /inbox/:id`, and for GET /inbox/template that ordering
+  // is LOAD-BEARING: Express matches in declaration order, so with `:id` first
+  // the literal "/inbox/template" binds id='template' and parseId 400s it. Same
+  // trap as /inbox/sparks and /inbox/awaiting-nod above.
+  //
+  // rank: any-builder — filing a Full Idea is open to every role by the goal's
+  // own settled decision ("no permission gate on Full Ideas; completeness scoring
+  // and triage do the filtering"), so describing and scoring one must be too.
+  // Deliberately NOT pinned in route-rank-check: neither has a gate to protect.
+  router.get('/inbox/template', api.requireBuilder, api.asyncHandler('GET /inbox/template', async (req, res) => {
+    // templateFor deliberately does NOT default — it returns null for anything
+    // that is not a declared own key, which is what makes it safe against an
+    // attacker-supplied 'constructor'/'__proto__' (the R143 grader's finding). So
+    // the DEFAULT is supplied here, explicitly, from the one place that declares
+    // it. Leaving it undefined 404s the normal page load, which is exactly what
+    // the first run of tests/idea_hall_composer.mjs caught.
+    const key = typeof req.query.template_key === 'string' && req.query.template_key
+      ? req.query.template_key
+      : inbox.DEFAULT_TEMPLATE_KEY;
+    const template = templateFor(key);
+    if (!template) {
+      return res.fail('unknown_template', 404, { template_key: key });
+    }
+    // Projected rather than passed through: the declaration is frozen and the
+    // composer needs exactly these four things per field.
+    const byKey = new Map(template.fields.map((f) => [f.key, f]));
+    return res.json({
+      template: {
+        key: template.key,
+        label: template.label,
+        // ORDER from fieldOrder (which returns KEYS — the one legal source of
+        // display order, since jsonb does not preserve key order), DATA from the
+        // declaration itself. Spelled as a lookup rather than mapping over
+        // template.fields directly so the provenance of the order is visible at
+        // the call site and cannot drift into an Object.keys() somewhere.
+        fields: fieldOrder(template).map((key) => {
+          const f = byKey.get(key);
+          return {
+            key: f.key,
+            label: f.label,
+            required: !!f.required,
+            substance_min: f.substanceMin || 0,
+          };
+        }),
+      },
+    });
+  }, { errorCode: 'template_read_failed' }));
+
+  router.post('/inbox/score', api.requireBuilder, api.asyncHandler('POST /inbox/score', async (req, res) => {
+    if (validateOrRespond(req, res, {
+      field_values: { required: true, type: 'object' },
+      template_key: { type: 'string', maxLength: inbox.TEMPLATE_KEY_MAX },
+    })) return;
+    const templateKey = req.body.template_key || undefined;
+    // scoreFieldValues NEVER throws (R142's contract) and answers
+    // { score: null, fields: [] } for anything it cannot score — an unknown
+    // template, a non-object, a non-string field. A draft in progress is exactly
+    // that kind of half-formed input, so the composer wants the null rather than
+    // a 400: "not scorable yet" is a legal state on the way to a Full Idea.
+    const { score, fields } = scoreFieldValues(req.body.field_values, templateKey ? { templateKey } : undefined);
+    return res.json({ score, fields, template_key: templateKey || null });
+  }, { errorCode: 'score_failed' }));
   // GET /inbox/sparks — THE SPARK QUEUE (task 1002921 / BV1.R145, goal 1000062).
   //
   // Big Idea Sparks awaiting development: the ideator craft's pickup surface,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.298",
+  "version": "1.19.300",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.298",
+      "version": "1.19.300",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.298",
+  "version": "1.19.300",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -881,9 +881,15 @@ function mountInternalSurfaces(app) {
   // needs its own two-segment match ahead of the single-segment resolution
   // below. Same gate tier as Work/Roadmap/Goals (SIGNEDIN_BUILDERS_PAGE_RE).
   const TASK_DETAIL_PAGE_RE = /^\/builders\/task\/(\d+)\/?$/;
+  // task 1002929 (R153 of goal 1000062): the idea-detail page is the SECOND
+  // two-segment hall page — /builders/idea/:id — for the same reason task 751 gave
+  // the task one: a record with real prose in it deserves a shareable URL and
+  // working back/forward, not a modal. Same gate tier as the task page.
+  const IDEA_DETAIL_PAGE_RE = /^\/builders\/idea\/(\d+)\/?$/;
   function buildersHtmlName(reqPath) {
     if (reqPath === '/builders' || reqPath === '/builders/') return 'index.html';
     if (TASK_DETAIL_PAGE_RE.test(reqPath)) return buildersHtml['task.html'] ? 'task.html' : null;
+    if (IDEA_DETAIL_PAGE_RE.test(reqPath)) return buildersHtml['idea.html'] ? 'idea.html' : null;
     // e.g. /builders/ranks or /builders/ranks.html → ranks.html
     const m = reqPath.match(BUILDERS_PAGE_RE);
     if (m) {
@@ -927,6 +933,11 @@ function mountInternalSurfaces(app) {
   // flag is open to every rank by design (see the nav comment in shell.js), so
   // the page's only real gate is sign-in — the writes behind it self-gate, and
   // closing someone else's flag is checked server-side at metic-or-author.
+  // task 1002928: `ideas` (the R152 Full Idea composer) joins the same tier for
+  // the same reason — goal 1000062's settled decision is that there is NO
+  // permission gate on Full Ideas; scoring and triage do the filtering. Its two
+  // reads (GET /inbox/template, POST /inbox/score) are pure and any-builder, and
+  // the file itself goes through POST /inbox, which carries its own rules.
   //
   // NB the assignment below must stay `const NAME_RE = /…/;` with NOTHING between
   // the `=` and the literal: tests/hall_page_gate_map.mjs reconstructs the whole
@@ -934,7 +945,7 @@ function mountInternalSurfaces(app) {
   // the regex out of its map — which reads as "every page on this tier is
   // ungated". It fails loudly by design; keep prose above the const.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|ideas|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;
@@ -951,7 +962,7 @@ function mountInternalSurfaces(app) {
     // behind the proxy's path normalization.
     const norm = path.posix.normalize(req.path);
     if (SIGNEDIN_BUILDERS_PAGE_RE.test(norm) || SIGNEDIN_BUILDERS_PREFIX_RE.test(norm)
-      || TASK_DETAIL_PAGE_RE.test(norm)) {
+      || TASK_DETAIL_PAGE_RE.test(norm) || IDEA_DETAIL_PAGE_RE.test(norm)) {
       return gdsAuth.requireBuilderPage(req, res, next);
     }
     next();

package/src/module-api.js

@@ -1023,8 +1023,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.296 with no explicit bump. run 32592502621. (task 1002620)
 //   1.19.298 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.297 with no explicit bump. run 32597859474. (task 1002620)
+//   1.19.299 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.298 with no explicit bump. run 32600322268. (task 1002620)
+//   1.19.300 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.299 with no explicit bump. run 32601521458. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.298'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.300'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_nav.mjs

@@ -137,7 +137,12 @@ test('sidebar groups read by audience, in order', () => {
   // whose subject is a person rather than the product. Deliberate addition to
   // this oracle: the group is pinned exactly so a new tab in the hall's most
   // valuable nav real estate is a reviewed decision, not a drift.
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'copy-desk'],
+  // task 1002928 (R152 of goal 1000062): 'ideas' — the Full Idea composer — joins
+  // the same group, placed BEFORE copy-desk so the run reads as the four project
+  // pages followed by the two CRAFT surfaces side by side: the ideator's queue and
+  // the artist's. Same reasoning as copy-desk for why it is here rather than Docs
+  // (a place you act, not reference material) or You (its subject is the project).
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'ideas', 'copy-desk'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.