@bongos/core 1.19.304 → 1.19.305

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.304",
-  "core_contract": "1.19.304",
-  "source_commit": "8c22da0cc4ab95a1684933ef98112abb201bc850",
+  "core_version": "1.19.305",
+  "core_contract": "1.19.305",
+  "source_commit": "6dc5a84be60b26f11d572eeccf10b8092c7352ae",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T19:13:32.623Z",
+  "built_at": "2026-08-23T19:20:49.275Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 322,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1413,
+    "functional_verbatim": 1414,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1757,
-  "tree_sha256": "644acfeea1c7e902934e366c56379f0191e6de8e08e6338567155722b916b2fd",
+  "file_count": 1758,
+  "tree_sha256": "3a7cd2627a967fe3dbe7edf3dc916b4d728170b826669b64ae457d5e92ac10d1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -177,7 +177,7 @@
     {
       "path": ".claude/skills/ideate/SKILL.md",
       "mode": "0000644",
-      "sha256": "8c89cdb688f39e9ca9009cfb0345f8f75fb12ff91de31914d410c5b7f78d18c2"
+      "sha256": "7e2c13e70e3ac208c4754f32685c2453c501f35b3742310ee49a5855bc0c399b"
     },
     {
       "path": ".claude/skills/merge-mode/SKILL.md",
@@ -4577,12 +4577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3f027a59178132ea747301cbcc78f7404c0f0ec820c6651affcf8854b1cf70f3"
+      "sha256": "4678a5bfd751ffe8ac5c3283eb25af2e011ccb14d32032bf373c7c77bcb61a3d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "79d94ba55244fa52d3f8f35717803666064daecb4d91d5547060baaa2143692d"
+      "sha256": "5ff86f97c1df0bf8d224512adc339aac2859db0a65e40e7783032b0128f7cbbd"
     },
     {
       "path": "public-docs/index.html",
@@ -6237,7 +6237,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b8db1ca313e0156a5891a779be650f8c56069015529e064a18b8e4970e7e312f"
+      "sha256": "a59a54dc09613fc6d95a2efa1262b6d8099fabfb1ef90289462b81accd9c7fea"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7564,6 +7564,11 @@
       "mode": "0000644",
       "sha256": "1e6d0784ecb37e613561cc8ee45fa23e178ecf112d5a8f218b9795dca0e7d0fc"
     },
+    {
+      "path": "tests/idea_ideate_full.mjs",
+      "mode": "0000644",
+      "sha256": "5000ed6a7b1a24eced0f070e556af354c8fa9c7937f43c7b932a3ca29f8a5f35"
+    },
     {
       "path": "tests/idea_quick_guard.mjs",
       "mode": "0000644",

package/.claude/skills/ideate/SKILL.md

@@ -72,6 +72,76 @@ The body should carry the development, not just a sentence. Use these line-tag c
 - The developed block when you have it: `surfaces:`, `risks:`, `open questions:`.
 - In autonomous mode only: `origin: autonomous`.
 
+## Authoring a FULL IDEA in conversation (task 1002931 / BV1.R155)
+
+A **Full Idea** is the ideator craft's real output: five answered questions that
+are a baseline scope of work someone else can deliver against *without
+re-interviewing the person who had the thought*. Drawing those five answers out
+of a conversation is exactly this skill's dynamic — and it is the path for
+someone who thinks by talking rather than by filling in a form.
+
+**Get the questions from the template, never from memory.** They are declared
+once, as data, and a project can define its own:
+
+```
+node scripts/gds/spark.js --template
+```
+
+That prints each field, its label, and the substance floor the scorer expects.
+Ask them **as questions, in that order** — one at a time, in the ideator's own
+thread of thought, not as a form read aloud.
+
+### The rule that governs this whole section: you write down what they said
+
+You are already "the instrument, not the author". Here that stops being a stance
+and becomes a hard constraint, because **the completeness score is deterministic
+and it feeds credits** (R142 scores substance; ADR 0172 pays on it). If you
+ghost-write a field, the number is fraudulent and the builder is paid for your
+words. So:
+
+- **Never invent field content.** Not a sentence, not a clause.
+- **Never pad a thin answer** to clear the floor. A short answer scores short —
+  that is the scorer working, not a problem to fix.
+- **Never polish an answer into words they did not use.** Tightening *their*
+  phrasing when they ask is help; rewriting it is authorship.
+- **An unanswered question stays empty.** If they do not want to answer "why does
+  it matter", file it without that field and let the score say so. A Full Idea
+  with a gap is honest; a Full Idea you completed for them is not.
+- What you *should* do is what this skill is for: **press on a thin answer.**
+  "That is one line — what is behind it?" is the sounding board doing its job.
+  Their next sentence is theirs. Yours would not be.
+
+Read the answers back before filing and let them correct you. They bless it; you
+file it.
+
+### Filing it
+
+Write their answers to a JSON file keyed by the template's field keys, then:
+
+```
+node scripts/gds/capture.js "<their title>" --full --fields-file <path>
+```
+
+That is the **same route** the hall form uses (`POST /inbox` with `grade='full'`),
+so the record is identical — same validation against the R141 template, same R142
+score, same ideator-credit lane. There is deliberately no separate write path for
+conversational authoring: a second one would drift, and "indistinguishable in the
+database" is this task's done-when.
+
+The command reports what the server **stored**. If it says the idea landed as
+*quick*, say so plainly — capture is fail-open on grading, and telling someone
+they filed a Full Idea when they did not is the one outcome worse than the
+failure itself.
+
+### Developing someone else's spark
+
+The same conversation works on a **Big Idea Spark** — a quick idea whose author
+marked it as needing development. `node scripts/gds/spark.js --list` shows what is
+waiting; develop one with `spark.js --develop <id> --fields-file <path>`. The
+author keeps the credit for having had the thought and the payout splits with
+them (ADR 0185), so the never-invent rule applies with more force, not less:
+those five answers are now going out under two people's names.
+
 ## Trust boundary — filing is open, triage is not
 
 Filing into the inbox is open to **any** authenticated builder (Xenos included) — that path stays open here. **Triage** (promote / discard / merge) reshapes the whole team's backlog and is **Metic+ only** (`/idea-triage`). So in this skill you *file*; you never verdict. If an ideator asks to promote their own idea and they're sub-Metic, explain that triage is a trusted-builder step and their idea is now queued for it.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.304",
+  "version": "1.19.305",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.304",
+      "version": "1.19.305",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.304",
+  "version": "1.19.305",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1035,8 +1035,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.302 with no explicit bump. run 32605477232. (task 1002620)
 //   1.19.304 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.303 with no explicit bump. run 32660527575. (task 1002620)
+//   1.19.305 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.304 with no explicit bump. run 32660902666. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.304'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.305'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_ideate_full.mjs

@@ -0,0 +1,170 @@
+// tests/idea_ideate_full.mjs
+//
+// task 1002931 (BV1.R155, goal 1000062) — /ideate authors a Full Idea
+// conversationally.
+//
+// A skill is a prompt, so the thing to pin is the PROMPT'S CONTRACT. Two
+// done-when clauses, and both are checkable:
+//
+//   1. "indistinguishable in the database from one authored in the hall" — so the
+//      skill must file through the SAME route the hall uses, and must not describe
+//      a bespoke write path of its own. A second path is how two surfaces start
+//      producing subtly different rows.
+//   2. "never invents field content on the builder's behalf" — the sharp one. The
+//      completeness score is deterministic and feeds credits (ADR 0172), so a
+//      ghost-written field is a fraudulent number and the builder is paid for the
+//      model's words. The rule must be present WITH that reason: an instruction
+//      whose justification is missing is the first one dropped under pressure.
+//
+// Plus the rule this goal applies to every surface: the five questions live in the
+// R141 declaration, so no consumer restates them.
+//
+// Run:  node tests/idea_ideate_full.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKILL = fs.readFileSync(path.join(ROOT, '.claude/skills/ideate/SKILL.md'), 'utf8');
+// Prose assertions run against a WHITESPACE-NORMALISED copy. Markdown is hard-
+// wrapped, so any phrase long enough to be worth asserting will eventually
+// straddle a newline — and a regex that does not allow for that fails on a
+// reflow that changed nothing. Structural assertions (code fences, list markers)
+// still use SKILL itself.
+const NORM = SKILL.replace(/\s+/g, ' ');
+const { BASE_TEMPLATE } = require('../modules/ideas/templates.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// --- (1) the same record as the hall ------------------------------------
+
+// THE COMMAND THE SKILL NAMES MUST ACTUALLY EXIST — and this assertion is here
+// because a grader caught its absence. A test that pins prompt text and stops
+// there will happily pass while the skill documents a command that does nothing:
+// R155's branch was cut before R151 added these flags, so for a while the skill
+// said `capture.js --full` to a capture.js that had never heard of it. Prompt
+// tests must reach the executable, or they only prove the prose is self-consistent.
+test('capture.js really supports the flags the skill tells you to use', () => {
+  const capture = path.join(ROOT, 'scripts/gds/capture.js');
+  const usage = spawnSync(process.execPath, [capture], { encoding: 'utf8', timeout: 20000 });
+  assert.equal(usage.status, 2, 'the no-args usage path');
+  assert.match(usage.stderr, /--full/, 'usage advertises --full');
+  assert.match(usage.stderr, /--fields-file/, 'usage advertises --fields-file');
+
+  // Stronger than the usage text: --full must be UNDERSTOOD, not merely listed.
+  // An unrecognised flag would be silently ignored and file a quick idea; the
+  // R151 guard proves the flag is wired to real behaviour.
+  const guard = spawnSync(process.execPath, [capture, 'a title', '--full'], { encoding: 'utf8', timeout: 20000 });
+  assert.equal(guard.status, 2);
+  assert.match(guard.stderr, /--full needs --fields-file/, '--full is parsed and validated');
+
+  // And it can actually send a grade — the thing that makes the record match the
+  // hall's. Asserted over the payload assignment, not the file text.
+  const src = fs.readFileSync(capture, 'utf8');
+  const grades = [...src.matchAll(/payload\.grade\s*=\s*'([a-z]+)'/g)].map((m) => m[1]);
+  assert.deepEqual(grades, ['full'], 'capture.js sends grade=full');
+});
+
+test('it files through capture.js --full — the route the hall form uses', () => {
+  assert.match(SKILL, /capture\.js "<their title>" --full --fields-file/);
+  // Named explicitly so the next reader knows WHY it is that command and not a
+  // bespoke one.
+  assert.match(NORM, /same.{0,10}route.{0,40}hall form uses/i);
+});
+
+test('it describes NO second write path', () => {
+  // The failure this guards: a skill that tells an agent to curl the API by hand
+  // ends up sending a different payload than the form does, and the two records
+  // drift while both claim to be Full Ideas.
+  assert.ok(!/curl/i.test(SKILL), 'no hand-rolled HTTP');
+  assert.ok(!/api\.js POST \/api\/gds\/inbox/.test(SKILL), 'no raw POST for filing an idea');
+  const grade = [...SKILL.matchAll(/grade\s*=\s*'([a-z]+)'/g)].map((m) => m[1]);
+  assert.ok(grade.every((g) => g === 'full'), `only the full grade is named: ${JSON.stringify(grade)}`);
+});
+
+test('it says the report comes from the SERVER, not from the request', () => {
+  // Capture is fail-open on grading (R143): an idea can land as quick.
+  assert.match(NORM, /reports what the server \*\*stored\*\*/);
+  assert.match(NORM, /landed as.{0,20}quick/);
+});
+
+// --- (2) it never invents field content ---------------------------------
+
+test('the never-invent rule is stated, in more than one form', () => {
+  assert.match(NORM, /Never invent field content/);
+  assert.match(NORM, /Never pad a thin answer/);
+  assert.match(NORM, /Never polish an answer into words they did not use/);
+});
+
+test('and it carries the REASON — the score feeds credits', () => {
+  // An instruction without its justification is the first one dropped when the
+  // model is trying to be helpful. This is the sentence that makes ghost-writing
+  // legible as fraud rather than as service.
+  assert.match(NORM, /deterministic/);
+  assert.match(NORM, /feeds credits/);
+  assert.match(NORM, /fraudulent/);
+  assert.match(NORM, /paid for your words/i);
+});
+
+test('an unanswered question is allowed to stay empty', () => {
+  // The tempting failure is completing the set "to be helpful", which is exactly
+  // the ghost-writing the rule forbids.
+  assert.match(NORM, /stays empty/);
+  assert.match(NORM, /honest/);
+});
+
+test('it names the thing to do INSTEAD — press on a thin answer', () => {
+  // A rule that only forbids leaves the model with nothing to do; this is the
+  // sounding-board behaviour the whole skill exists for.
+  assert.match(NORM, /press on a thin answer/i);
+  assert.match(NORM, /Their next sentence is theirs/);
+});
+
+test('the builder blesses it; the skill files it', () => {
+  assert.match(NORM, /They bless it; you file it\./);
+});
+
+// --- the five questions are not restated -------------------------------
+
+test('the skill names NO field key and NO field label', () => {
+  // Same rule the hall composer obeys (R152): the questions are declared once, in
+  // the R141 template, and a copy here would silently ignore a per-project one.
+  for (const f of BASE_TEMPLATE.fields) {
+    assert.ok(!SKILL.includes(f.key), `restates the field key "${f.key}"`);
+    assert.ok(!SKILL.includes(f.label), `restates the label "${f.label}"`);
+  }
+});
+
+test('it points at the command that PRINTS the questions', () => {
+  assert.match(SKILL, /spark\.js --template/);
+  assert.match(NORM, /never from memory/i);
+});
+
+// --- the sibling path ---------------------------------------------------
+
+test('it can also develop someone else\'s spark, with the rule reinforced', () => {
+  assert.match(SKILL, /spark\.js --list/);
+  assert.match(SKILL, /spark\.js --develop/);
+  // The never-invent rule matters MORE there: the answers go out under two names.
+  assert.match(NORM, /two people's names/);
+});
+
+test('the section does not contradict the skill\'s founding rule', () => {
+  // "you are the instrument, not the author" is the whole premise; the Full Idea
+  // section has to be an application of it, not an exception to it.
+  assert.match(NORM, /you are the instrument, not the author/);
+  assert.match(NORM, /stops being a stance and becomes a hard constraint/);
+});
+
+console.log(`\nidea_ideate_full: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);