@bongos/core 1.19.302 → 1.19.303

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.302",
-  "core_contract": "1.19.302",
-  "source_commit": "d2bc099b7707a0e3e29c2b48b796bc95785d7c74",
+  "core_version": "1.19.303",
+  "core_contract": "1.19.303",
+  "source_commit": "fd08cc750b621521b54d357645136366c89f0316",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T23:12:06.332Z",
+  "built_at": "2026-08-22T23:32:40.774Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 322,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1411,
+    "functional_verbatim": 1412,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1755,
-  "tree_sha256": "f1bb517fc8d0b3ac176f07c721aaa32bec280b6937905b78fdde9966e084d99e",
+  "file_count": 1756,
+  "tree_sha256": "42829db3492386930a68c9936d55f1e7d7895fc1e6194a65e6d659e81be98c05",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -172,7 +172,7 @@
     {
       "path": ".claude/skills/idea-triage/SKILL.md",
       "mode": "0000644",
-      "sha256": "cbecde1c3fe60e02e6b008b80232e8866d7924aaefa9614377044dce5973d1d0"
+      "sha256": "b64fe42bb2a542304802b48bea348ae817608ac47f026d98c4de9bea5aa90174"
     },
     {
       "path": ".claude/skills/ideate/SKILL.md",
@@ -4577,12 +4577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "06de1a2274d6eafe7a544b7e0c1f157b42191eb0ad151d6e7f821180604d74bb"
+      "sha256": "5721cb7973d1dc844692348aeb2462d3adfcba9929f7146f6a872c6de15dd710"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "45ca3b2302b14730ce004fdc64f37ab82cc0dc85518c55c4c3119b85851ddf20"
+      "sha256": "441e6e4bea0f538d4c0e63eb17cee0f65077775be47c930b8876cb022bc0966b"
     },
     {
       "path": "public-docs/index.html",
@@ -6237,7 +6237,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "938f69ad6350189382990706f63b41c1781f9c7b19610d7275144152c65412d7"
+      "sha256": "dcb27806a84ffee473f8e69ca78530535b7d7c51e30780e09982ba8489768f9c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7614,6 +7614,11 @@
       "mode": "0000644",
       "sha256": "4e75030cf2320c2715c5e764394e9d56f66861712176261c878bc99183622b69"
     },
+    {
+      "path": "tests/idea_triage_recommends.mjs",
+      "mode": "0000644",
+      "sha256": "c7ba20839a7b33df0eb7e8bfc2f463217e7d3a538d888e89774107d55d34556d"
+    },
     {
       "path": "tests/idp_device_exchange.mjs",
       "mode": "0000644",

package/.claude/skills/idea-triage/SKILL.md

@@ -134,6 +134,54 @@ Then ask the user (concise prompt — Lars is an EE, not a software engineer; fr
 
 > Idea #N: "{title}". {one-sentence developed summary}. **Open questions:** {the subagent's open_questions}. **Promote, discard, or merge with another idea?**
 
+**Step 2.5 — for a FULL IDEA, work out its SHAPE and recommend one (task 1002925 / BV1.R149).**
+
+Only for `grade='full'`. A quick idea promotes straight to a task — that is what a
+quick idea is *for* — and a spark is not yours to convert at all (its author
+offered it up for development, and promoting it discards that invitation).
+
+**Why this step exists, in the owner's words:** *for ideators it is hard to say
+what is a task or a goal, because it is often hard to have the full picture.* So a
+Full Idea gets **thought about** at triage instead of being forced down a fixed
+path. The person who wrote it was not required to know whether it was one task or
+a quarter of work; that is the judgement triage adds.
+
+**Three shapes it can take.** Read the five answers — especially *how does it fit*
+— and decide which one it actually is:
+
+| Shape | It looks like this | What you would create |
+|---|---|---|
+| **Goal** | several distinct pieces of work, or an outcome you would measure rather than finish; the "big picture" answer names more than one surface | a goal, plus **draft done-when criteria** taken from what the idea says "done" means |
+| **Task** | one concrete change with an obvious end | a single task in whatever goal already owns that area |
+| **Merge** | work that already exists — an open goal, a live task, or another idea says the same thing | nothing; point it at the existing record |
+
+**Do the legwork before recommending.** A recommendation with nothing behind it is
+worse than no recommendation, because it looks like an answer. Run
+`/recall <the idea's subject>`, check the goal board
+(`node scripts/gds/goal.js list`), and look for an existing task before proposing
+anything new — "merge" is the recommendation people skip, and it is often the right
+one.
+
+**Then RECOMMEND, and show the reasoning.** Say which shape and *why*, name the
+alternative you rejected and why, and — for a goal — sketch the criteria you would
+draft. One short paragraph, not a report:
+
+> Idea #N (Full, 84/100) — **I'd make this a goal.** Its "big picture" answer names
+> three separate surfaces (the CLI, the hall, and the Discord mirror), so a single
+> task would either be a month long or quietly deliver only one of them. Draft
+> criteria: *(1) the CLI can do X; (2) the same is reachable in the hall; (3) the
+> Discord path stops needing the old flag.* I considered a task in goal 1000071
+> since the routing work overlaps, but this outlives that goal's scope.
+> **Goal, task, or merge?**
+
+**NOTHING CONVERTS UNTIL THEY ANSWER.** The recommendation is a recommendation:
+do not create the goal, do not create the task, do not mark the idea promoted
+until the human has chosen. If they pick a different shape than you recommended,
+that is the step working — build what they chose, not what you argued for. (The
+server backs this up at the capture end: a Full Idea never auto-routes,
+`full_idea_never_routes` in `modules/ideas/routing.js`. This step is the same rule
+at the triage end, where the judgement is.)
+
 **Step 3 — apply the verdict.**
 
 **Promote → pick the tier (BV1.R64 / ADR 0086).** An idea no longer only becomes a *task* — it can promote into any tier of the work hierarchy: a **goal** (a whole module-scoped workspace), a **criterion** (a new done-when test), or a **task** (a single unit of work). Choose by the idea's size: a broad objective → goal; a "we should also require X to be done" → criterion; a concrete piece of work → task. Frame the choice to the user in those terms, then create the right record and mark the idea promoted.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.302",
+  "version": "1.19.303",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.302",
+      "version": "1.19.303",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.302",
+  "version": "1.19.303",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1031,8 +1031,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.300 with no explicit bump. run 32602146266. (task 1002620)
 //   1.19.302 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.301 with no explicit bump. run 32604538465. (task 1002620)
+//   1.19.303 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.302 with no explicit bump. run 32605477232. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.302'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.303'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_triage_recommends.mjs

@@ -0,0 +1,155 @@
+// tests/idea_triage_recommends.mjs
+//
+// task 1002925 (BV1.R149, goal 1000062) — a Full Idea's SHAPE is recommended, not
+// decided for the builder.
+//
+// The done-when: "triage presents a recommendation plus its reasoning; the human
+// decides; nothing converts without that decision."
+//
+// Two halves, and they live in different places:
+//   • the SERVER half already exists and is enforced — a Full Idea never
+//     auto-routes at capture (routing.js). This file re-asserts it, because R149's
+//     rule is meaningless if the row can convert itself before triage ever sees
+//     it, and an invariant relied on by a prompt should be pinned next to that
+//     prompt's test too.
+//   • the TRIAGE half is a prompt, so what is checkable is the CONTRACT: a
+//     recommendation is required to carry reasoning, the three shapes are named,
+//     the legwork is required before recommending, and nothing converts until the
+//     human answers.
+//
+// Prose assertions run against a whitespace-normalised copy — markdown is
+// hard-wrapped, and a phrase worth asserting will straddle a newline.
+//
+// Run:  node tests/idea_triage_recommends.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKILL = fs.readFileSync(path.join(ROOT, '.claude/skills/idea-triage/SKILL.md'), 'utf8');
+const NORM = SKILL.replace(/\s+/g, ' ');
+const { decideLanding } = require('../modules/ideas/routing.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// --- the server half: it cannot convert itself before triage looks -------
+
+test('a Full Idea never auto-routes, whatever else is true of it', () => {
+  // R149's whole premise is that a human judges the shape. If capture-time
+  // routing could turn a Full Idea into a task, that judgement would arrive too
+  // late to matter.
+  for (const grade of ['full', 'FULL', 'Full']) {
+    const d = decideLanding({ goalId: 1000062, kind: 'feature', grade, filerRank: 'archon' });
+    assert.equal(d.route, false, `grade ${grade}`);
+    assert.equal(d.reason, 'full_idea_never_routes');
+  }
+});
+
+test('and a quick idea still routes — R149 is not a brake on everything', () => {
+  // The contrast is the point: quick ideas promoting straight through is what a
+  // quick idea is FOR, and slowing that down would be a regression dressed as care.
+  const d = decideLanding({ goalId: 1000062, kind: 'bug', grade: 'quick', filerRank: 'archon' });
+  assert.equal(d.route, true);
+});
+
+// --- the triage half: recommend, with reasoning --------------------------
+
+test('the step is scoped to a Full Idea, and says what the other grades do', () => {
+  assert.match(NORM, /Only for `grade='full'`/);
+  assert.match(NORM, /quick idea promotes straight to a task/);
+  // A spark is not triage's to convert: promoting it discards its author's offer.
+  assert.match(NORM, /discards that invitation/);
+});
+
+test('it carries the owner\'s REASON, not just the instruction', () => {
+  // Without the why, "recommend instead of convert" reads as ceremony and gets
+  // optimised away by the next person trying to make triage faster.
+  assert.match(NORM, /hard to say what is a task or a goal/);
+  assert.match(NORM, /full picture/);
+});
+
+test('all three shapes are named — including MERGE', () => {
+  assert.match(NORM, /\*\*Goal\*\*/);
+  assert.match(NORM, /\*\*Task\*\*/);
+  assert.match(NORM, /\*\*Merge\*\*/);
+  // Merge is the one people skip, and it is often right.
+  assert.match(NORM, /"merge" is the recommendation people skip/);
+});
+
+test('a goal recommendation drafts criteria rather than just naming the tier', () => {
+  assert.match(NORM, /draft.{0,4}done-when criteria/i);
+});
+
+test('the legwork is REQUIRED before recommending', () => {
+  // A recommendation with nothing behind it is worse than none, because it looks
+  // like an answer.
+  assert.match(NORM, /worse than no recommendation/);
+  assert.match(NORM, /\/recall/);
+  assert.match(NORM, /goal\.js list/);
+});
+
+test('the reasoning must include the REJECTED alternative', () => {
+  // "I recommend a goal" is an assertion; "a task would deliver only one of the
+  // three surfaces" is a reason someone can disagree with.
+  assert.match(NORM, /name the alternative you rejected/i);
+});
+
+// --- nothing converts without the human ---------------------------------
+
+test('the no-convert rule is stated absolutely, and enumerated', () => {
+  assert.match(NORM, /NOTHING CONVERTS UNTIL THEY ANSWER/);
+  // Enumerated because "do not convert" is vague about the three separate writes
+  // an eager agent might make.
+  assert.match(NORM, /do not create the goal, do not create the task, do not mark the idea promoted/);
+});
+
+test('a human choosing differently is framed as the step WORKING', () => {
+  // Otherwise the recommendation becomes something to defend, and the next turn
+  // is an argument instead of a build.
+  assert.match(NORM, /that is the step working/);
+  assert.match(NORM, /build what they chose, not what you argued for/);
+});
+
+test('it names the server invariant it leans on', () => {
+  // So the next reader knows the two halves are one rule in two places, and does
+  // not "simplify" either half away believing the other covers it.
+  assert.match(NORM, /full_idea_never_routes/);
+});
+
+// --- it does not restate the template ----------------------------------
+
+test('the skill restates no field label, and no key as a code identifier', () => {
+  const { BASE_TEMPLATE } = require('../modules/ideas/templates.js');
+  // LABELS are checked over the whole file: they are distinctive canonical
+  // question text, so any occurrence is a restatement.
+  for (const f of BASE_TEMPLATE.fields) {
+    assert.ok(!SKILL.includes(f.label), `restates the label "${f.label}"`);
+  }
+  // KEYS are checked only inside CODE — backticks and fenced blocks. One of them
+  // is `fit`, an ordinary English word, and this skill legitimately says "how does
+  // it fit" in prose. What would actually be a forked template is a key written as
+  // an identifier: a hard-coded field list, a JSON example, a payload sketch. So
+  // the assertion follows the meaning rather than the substring.
+  const code = [
+    ...[...SKILL.matchAll(/```[\s\S]*?```/g)].map((m) => m[0]),
+    ...[...SKILL.matchAll(/`([^`\n]+)`/g)].map((m) => m[1]),
+  ].join('\n');
+  for (const f of BASE_TEMPLATE.fields) {
+    assert.ok(
+      !new RegExp(`\\b${f.key}\\b`).test(code),
+      `the key "${f.key}" appears as a code identifier — the template is being restated`,
+    );
+  }
+});
+
+console.log(`\nidea_triage_recommends: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);