@bongos/core 1.19.371 → 1.19.373

package/modules/hall-ui/public/dom-utils.js

@@ -269,11 +269,42 @@
     return (data && typeof data === 'object') ? data : {};
   }
 
+  // task 1003276 (goal 1000072, criterion legibility-categories) — a work
+  // CATEGORY as a chip. Lives HERE, not in goals-lib.js, because three surfaces
+  // render it — the Goals page, the Tasks board and the task page — and
+  // dom-utils.js is the only script all three load. One renderer means the
+  // goal's chip and the task's inherited chip cannot drift.
+  //
+  // A LABEL and nothing more: no href, no pointer affordance. A per-category
+  // destination would be a navigation tier, and that is precisely how an
+  // advisory word becomes the second hierarchy in practice even when no code
+  // gates on it (ADR 0192 — a category authorises nothing).
+  //
+  // `inherited` marks a TASK's chip. A task stores no category; it reads its
+  // goal's through goal_id, and saying so out loud stops anyone hunting for a
+  // per-task editor that does not exist.
+  //
+  // Uncategorised renders NOTHING rather than an "Uncategorised" pill: most
+  // goals will carry one, and a board of grey placeholders reads worse than a
+  // board with gaps. The Category filter's "not categorised yet" option is how
+  // you find them.
+  function categoryChip(category, opts) {
+    const label = category && category.label ? String(category.label).trim() : '';
+    if (!label) return '';
+    const inherited = !!(opts && opts.inherited);
+    const title = inherited
+      ? `Category: ${label} — inherited from this task's goal (a task carries no category of its own)`
+      : `Category: ${label}`;
+    return `<span class="gr-cat${inherited ? ' gr-cat--inherited' : ''}" title="${escapeHtml(title)}">`
+      + `${escapeHtml(label)}${inherited ? '<i class="gr-cat__from" aria-hidden="true">via goal</i>' : ''}</span>`;
+  }
+
   window.OTB = {
     escapeHtml, $, fmtNum, num, fmtInt, fmtCompact, fmtDate, rankLabel, toast, moduleOn,
     errCode, errMessage, errDetails, // task 1002462 — ADR 0116 envelope readers
     contributeSettingsPanel, settingsPanels,
     contributeHallWidget, hallWidgets, hallWidgetIds,
     splitCriterion,
+    categoryChip, // task 1003276 — shared by the Goals page, the Tasks board and the task page
   };
 })();

package/modules/hall-ui/public/goals-page.js

@@ -228,6 +228,34 @@
     }
   }
 
+  // task 1003276 — the Category dropdown. Unlike Version and Owner (derived from
+  // the loaded goals), the options come from the project's SET — GET
+  // /work-categories — so a category nobody has used yet is still offered, and a
+  // client never hard-codes the labels ("present in every builders hall on any
+  // project" only holds if the vocabulary travels over the wire). The 'none'
+  // option finds the uncategorised, which is the set this feature exists to
+  // shrink. Best-effort: a failed fetch leaves the control with just "— any —".
+  async function populateCategoryFilter() {
+    const sel = $('#f-goal-category');
+    if (!sel) return;
+    let cats = [];
+    try {
+      cats = (await getJSON(`${API}/work-categories`))?.categories || [];
+    } catch (_) { return; }
+    for (const c of cats) {
+      const opt = document.createElement('option');
+      opt.value = c.slug;
+      opt.textContent = c.label;
+      sel.appendChild(opt);
+    }
+    if (cats.length) {
+      const opt = document.createElement('option');
+      opt.value = 'none';
+      opt.textContent = 'not categorised yet';
+      sel.appendChild(opt);
+    }
+  }
+
   // Archon check for the detail view's manage/visibility affordances (the
   // server-side rank gates are the real enforcement). The task-1760 drag-reorder
   // affordance this once also served is retired — see the note where
@@ -797,6 +825,9 @@
       // task 1003135 — fire-and-forget: the Owner options fill when the (cached)
       // directory resolves; boot never waits on a label lookup.
       populateOwnerFilter().catch(() => {});
+      // task 1003276 — same fire-and-forget posture: boot never waits on the
+      // category vocabulary, and the board renders fine before it lands.
+      populateCategoryFilter().catch(() => {});
       // Prefetch details (ring + members on the cards). Sequentially-parallel,
       // failure-tolerant: a card without detail still renders.
       // task 1002439 — also fold in per-goal task-readiness rollups (one request
@@ -859,6 +890,9 @@
       { id: 'f-goal-status', label: 'Status', options: [{ value: '', label: '— any —' }, 'open', 'achieved', 'archived'] },
       { id: 'f-goal-mine', label: 'Membership', options: [{ value: '', label: 'All goals' }, { value: 'mine', label: 'My goals' }] },
       { id: 'f-goal-owner', label: 'Owner', options: [{ value: '', label: '— any —' }] },
+      // task 1003276 — filled from GET /work-categories after boot
+      // (populateCategoryFilter), the populateOwnerFilter pattern.
+      { id: 'f-goal-category', label: 'Category', options: [{ value: '', label: '— any —' }] },
       { id: 'f-goal-order',
         label: 'Sort',
         value: GOAL_SORTS[savedGoalSort] ? savedGoalSort : undefined,

package/modules/hall-ui/public/goals-render.js

@@ -19,7 +19,7 @@
 
   window.OTBGoalsRender = function createGoalsRender(ctx) {
     const { API, curLabel, getJSON, patchJSON, postJSON, sameId, selfId, state } = ctx;
-    const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel } = window.OTB;
+    const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel, categoryChip } = window.OTB;
     const {
       priorityRank, touchesConflict, rankTagHtml, deHashRefs,
       creditsPerMinute, buildPromptForTask, friendlyBatchReason,
@@ -81,11 +81,18 @@
     const q = ($('#f-goals-search')?.value || '').trim().toLowerCase();
     const needle = q.replace(/^#/, '');
     const owner = $('#f-goal-owner')?.value || '';
+    // task 1003276 — the Category dropdown. Matches on the SLUG (the stable
+    // machine key) so re-wording a label never breaks a filter, and 'none' is
+    // the uncategorised set — which must be findable, because "what has nobody
+    // placed yet" is exactly the prompt this feature is built around.
+    const cat = $('#f-goal-category')?.value || '';
     const matchesSearch = (g) => !needle
       || String(g.id).includes(needle)
       || (g.title || '').toLowerCase().includes(needle);
     const matchesOwner = (g) => !owner
       || (owner === 'none' ? g.created_by == null : String(g.created_by) === owner);
+    const matchesCategory = (g) => !cat
+      || (cat === 'none' ? !g.category : (g.category?.slug === cat));
     const myId = selfId();
     const iAmMember = (g) => {
       const d = state.details.get(String(g.id));
@@ -96,6 +103,7 @@
       (!status || g.status === status) &&
       matchesSearch(g) &&
       matchesOwner(g) &&
+      matchesCategory(g) &&
       (!mineOnly || iAmMember(g)));
   }
   function goalStampHtml(g) {
@@ -127,10 +135,13 @@
       right = `<span class="gr-quiet">No tasks yet</span>`;
     }
     const metaHtml = `#${escapeHtml(String(g.id))} · ${escapeHtml(g.version_id || '')}${(achieved || g.status === 'open') ? '' : ' · ' + escapeHtml(g.status)}${goalStampHtml(g)}`;
-    return { r, achieved, ringHtml, goalHref, right, metaHtml };
+    // task 1003276 — the category chip. Computed here with the rest of the facts
+    // so the row and the card (task 1003136) cannot drift on it.
+    const catHtml = categoryChip(g.category);
+    return { r, achieved, ringHtml, goalHref, right, metaHtml, catHtml };
   }
   function goalRowHtml(g) {
-    const { r, achieved, ringHtml, goalHref, right, metaHtml } = goalRenderFacts(g, 44);
+    const { r, achieved, ringHtml, goalHref, right, metaHtml, catHtml } = goalRenderFacts(g, 44);
     // NOTE: a rollup row nests real links (title → goal, Claim → task overlay,
     // drill → goal), so the row itself is a <div>, not an <a> — nested anchors
     // are invalid. Only the explicit links navigate.
@@ -138,20 +149,20 @@
       <div class="gr-ringcol">${ringHtml}</div>
       <div class="gr-main">
         <a class="gr-title" href="${goalHref}"${subtitleAttr(g)}>${escapeHtml(g.title || 'Untitled goal')}</a>
-        <div class="gr-meta">${metaHtml}</div>
+        <div class="gr-meta">${metaHtml}${catHtml}</div>
         ${achieved ? '' : goalRollLine(r)}
       </div>
       <div class="gr-right">${right}</div>
     </div>`;
   }
   function goalCardHtml(g) {
-    const { r, achieved, ringHtml, goalHref, right, metaHtml } = goalRenderFacts(g, 36);
+    const { r, achieved, ringHtml, goalHref, right, metaHtml, catHtml } = goalRenderFacts(g, 36);
     return `<div class="goal-card" data-goal-id="${escapeHtml(String(g.id))}">
       <div class="goal-card__head">
         <div class="gr-ringcol">${ringHtml}</div>
         <a class="goal-card__title gr-title" href="${goalHref}"${subtitleAttr(g)}>${escapeHtml(g.title || 'Untitled goal')}</a>
       </div>
-      <div class="goal-card__meta">${metaHtml}</div>
+      <div class="goal-card__meta">${metaHtml}${catHtml}</div>
       ${achieved ? '' : goalRollLine(r)}
       <div class="goal-card__foot">${right}</div>
     </div>`;
@@ -709,7 +720,10 @@
       // still never re-derives the protected roster.
       const gateSpan = g.scope_protected
         ? '<span class="goal-badge goal-badge--locked" title="Protected module scope — join by request; an Archon admits members">🛡 Archon-mediated</span>' : '';
-      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${lockSpan} ${gateSpan} ${scope} ${depsSpan}`;
+      // task 1003276 — the human category, beside the machine-readable module
+      // scope so the difference is visible: `scope` is the wall that refuses work
+      // (ADR 0086); the chip is a word for a person and gates nothing (ADR 0192).
+      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${categoryChip(g.category)} ${lockSpan} ${gateSpan} ${scope} ${depsSpan}`;
     }
 
     // task 1762: the goal's own owner/manager (or an Archon) can invite/manage

package/modules/hall-ui/public/style.css

@@ -2172,3 +2172,12 @@ html.palette-open { overflow: hidden; }
   .palette__panel { margin-top: 6vh; }
   .palette__group { min-width: 56px; }
 }
+/* task 1003276 — the human CATEGORY chip. Quiet by design: it sits beside the
+   meta line, not above the title, because it is a label a person scans, never a
+   status or a permission (ADR 0192). No hover/pointer affordance and no href —
+   a per-category destination would be a navigation tier, which is exactly the
+   second hierarchy this feature must not become. On a TASK the chip is the one
+   inherited from its goal, and says so, so nobody hunts for a per-task editor. */
+.gr-cat { display: inline-flex; align-items: baseline; gap: 5px; margin-left: 8px; padding: 1px 8px; border: 1px solid var(--rule-soft); border-radius: 999px; font-size: 11px; font-weight: 600; letter-spacing: .01em; color: var(--ink-soft); background: var(--surface-2); vertical-align: baseline; white-space: nowrap; }
+.gr-cat--inherited { font-weight: 550; color: var(--ink-faint); }
+.gr-cat__from { font-style: normal; font-weight: 500; font-size: 10px; color: var(--ink-faint); opacity: .85; }

package/modules/hall-ui/public/task.js

@@ -193,7 +193,7 @@
       `Task description:\n${desc}`;
   }
 
-  function renderTask(t, lastClaim, viewer) {
+  function renderTask(t, lastClaim, viewer, goal) {
     document.title = `#${t.id} — ${t.title || 'Task'} — ${document.title.split(' — ').pop()}`;
     const sub = $('#task-sub');
     if (sub) sub.textContent = `Task #${t.id}`;
@@ -222,7 +222,14 @@
     }
 
     if (t.goal_id) {
-      parts.push(`<p class="td-goal">Goal: <a href="/goals#/goal/${encodeURIComponent(t.goal_id)}">Goal #${escapeHtml(String(t.goal_id))}</a></p>`);
+      // task 1003276 — the goal line names the goal and carries the category this
+      // task INHERITS from it. Two legibility fixes in one line: the link used to
+      // read "Goal #1000072", which tells a person nothing they didn't already
+      // know, and the chip answers "what kind of work is this" without opening
+      // the goal. Marked inherited because a task carries no category of its own.
+      const goalName = goal && goal.title ? ` — ${escapeHtml(goal.title)}` : '';
+      const catChip = window.OTB.categoryChip(goal && goal.category, { inherited: true });
+      parts.push(`<p class="td-goal">Goal: <a href="/goals#/goal/${encodeURIComponent(t.goal_id)}">Goal #${escapeHtml(String(t.goal_id))}</a>${goalName}${catChip}</p>`);
     }
 
     // Claim history (task 751 — best-effort: the API surfaces the most recent
@@ -356,7 +363,17 @@
         const me = await getJSON(`${API}/me`, { softAuth: true });
         viewer = (me && me.builder) ? me.builder : null;
       } catch (_) { /* cosmetic — the server enforces regardless */ }
-      renderTask(d.task, d.last_claim || null, viewer);
+      // task 1003276 — the task's goal, for its name and the category the task
+      // inherits. Best-effort and non-blocking on failure: the page has always
+      // rendered without it, and a category is a nicety, never a prerequisite.
+      let goal = null;
+      if (d.task.goal_id != null) {
+        try {
+          const g = await getJSON(`${API}/goals/${encodeURIComponent(d.task.goal_id)}`, { softAuth: true });
+          goal = (g && g.goal) ? g.goal : null;
+        } catch (_) { /* cosmetic — the goal link still resolves without it */ }
+      }
+      renderTask(d.task, d.last_claim || null, viewer, goal);
     } catch (err) {
       if (err && err.code === AUTH_NEEDED) { toAuth(); return; }
       if (err && err.status === 404) { renderNotFound(id); return; }

package/modules/hall-ui/public/work.js

@@ -337,6 +337,12 @@
       // task 1002955: how old is this task? A ready queue reads as equally fresh
       // without it; the exact date rides the tooltip.
       const ageChip = window.OTBKit.ageChipHtml(t.created_at);
+      // task 1003276 — the category this task inherits from its goal, marked as
+      // inherited so nobody looks for a per-task editor that does not exist. It
+      // is a label only: it never filters or orders this board, because nothing
+      // a person may not act on should decide what the queue offers (ADR 0192).
+      const catChip = window.OTB.categoryChip(
+        (taskState.goalCategories || {})[String(t.goal_id)], { inherited: true });
       const selected = selection.claim.has(String(t.id));
       return `
         <div class="task${selected ? ' task--selected' : ''}" data-task-id="${t.id}">
@@ -358,6 +364,7 @@
               <span>${cpmText}</span>
               ${touchesChip}
               ${ageChip}
+              ${catChip}
             </div>
           </div>
           <div class="task__credits">
@@ -1071,9 +1078,17 @@
 
     // task 1755: goal id → title map for the Goal filter (best-effort).
     taskState.goalTitles = {};
+    // task 1003276 — a task INHERITS its goal's category (it stores none of its
+    // own), so the board resolves the label the same way the schema does: through
+    // goal_id. The goals fetch below is already made for the titles, so the chip
+    // costs no extra request and no server change.
+    taskState.goalCategories = {};
     try {
       const gr = await getJSON(`${API}/goals`);
-      (gr.goals || []).forEach((g) => { taskState.goalTitles[g.id] = g.title; });
+      (gr.goals || []).forEach((g) => {
+        taskState.goalTitles[g.id] = g.title;
+        taskState.goalCategories[g.id] = g.category || null;
+      });
     } catch (_) { /* filter labels fall back to 'Goal #id' */ }
 
     // Claimable + active claims in one call. A 403 means the primer gate — show

package/modules/lifecycle/goal-category.js

@@ -134,6 +134,33 @@ async function setGoalCategory({ goalId, categoryId }, deps = {}) {
   return rows[0] ?? null;
 }
 
+// -------------------------------------------------------------------------
+// The advisory (task 1003277)
+// -------------------------------------------------------------------------
+
+// adviseCategory — PURE, FAIL-OPEN (the goal-advisory.js posture: this is advice
+// appended to a request that ALREADY SUCCEEDED, so a wrong guess must nag nobody).
+// Returns null when the goal is categorised, or the advisory body when it is not.
+//
+// The criterion is explicit about what an uncategorised goal IS: "Claude assigns
+// where it can; where it cannot, the human is prompted to create a new category —
+// that failure is a designed prompt, not an error." So the advisory carries the
+// live SET (so the client can offer real choices, never hard-coded labels) and
+// names the create endpoint (so the prompt has somewhere to write into). It never
+// escalates past advice — the moment a missing category can refuse a write, the
+// label has become a gate (ADR 0192).
+function adviseCategory({ categoryId, categories = [] } = {}) {
+  if (categoryId != null) return null;
+  return {
+    reason: 'uncategorised',
+    message: 'This goal has no human category yet. A category orients a person scanning the board '
+      + '(it gates nothing — ADR 0192). Pick one from the set below via PATCH /goals/:id/category, '
+      + 'or — if none fits — ask the human to name a new one and create it with POST /work-categories: '
+      + 'that failure is a designed prompt, not an error.',
+    categories: categories.map((c) => ({ id: String(c.id), slug: c.slug, label: c.label })),
+  };
+}
+
 // -------------------------------------------------------------------------
 // Decoration
 // -------------------------------------------------------------------------
@@ -263,6 +290,7 @@ module.exports = {
   isValidSlug,
   listCategories,
   getCategory,
+  adviseCategory,
   createCategory,
   setGoalCategory,
   decorateGoalCategory,

package/modules/lifecycle/routes/goals.js

@@ -129,7 +129,16 @@ module.exports = function buildGoalsRouter() {
       if (succeedsId != null) {
         await db.setGoalSuccessor({ goalId: succeedsId, successorId: goal.id });
       }
-      return res.status(201).json({ ok: true, goal, succeeds_goal_id: succeedsId });
+      // task 1003277 — the category advisory, the goal_advisory precedent: advice
+      // on a request that already succeeded, null when the goal has a category.
+      // Best-effort: a failed set read must not turn advice into a 500.
+      let category_advisory = null;
+      if (categoryId === null) {
+        try {
+          category_advisory = goalCategory.adviseCategory({ categoryId, categories: await goalCategory.listCategories() });
+        } catch (_) { /* fail-open — advice only */ }
+      }
+      return res.status(201).json({ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory });
     } catch (err) {
       log.error('[gds] POST /goals', err);
       return res.fail('goal_create_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.371",
+  "version": "1.19.373",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.371",
+      "version": "1.19.373",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.371",
+  "version": "1.19.373",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/bump-version.js

@@ -86,5 +86,45 @@ function isReleaseCommit(subject) {
   return RELEASE_COMMIT_RE.test(String(subject == null ? '' : subject));
 }
 
-module.exports = { bumpPatch, CONST_RE, RELEASE_COMMIT_RE, isReleaseCommit };
+// laneReleasedVersions — every version THIS lane has announced it published, read
+// from its own release commits (task 1003202).
+//
+// WHY THIS EXISTS. publish.yml used to answer "is HEAD's version already on the
+// registry?" with `npm view @bongos/core@<v>`. That needs a credential:
+// @bongos/core is PRIVATE, so an unauthenticated read is a flat E404, not a
+// "no". Moving the lane to OIDC trusted publishing removes the token — and OIDC
+// only authenticates `npm publish`, nothing else — so the old check would have
+// silently reported "not taken" on EVERY run, skipped the auto-bump, and then
+// collided on the already-published version. It would have looked fine for
+// exactly one release.
+//
+// The answer is already in the repo. Every version this lane ships is announced
+// by a `release: core X.Y.Z — CI auto-patch carrier` commit it writes itself, and
+// RELEASE_COMMIT_RE above is that contract. So the registry is not the only place
+// that knows; git knows too, needs no auth, and is the same source the cascade
+// terminator already trusts.
+//
+// Deliberately shares RELEASE_COMMIT_RE with isReleaseCommit, so a HUMAN release
+// commit ("release: core 1.19.2 — carrier for the init-blocker fixes") is NOT
+// counted here either — that version is new and still needs publishing, which is
+// exactly the distinction the constant was written to make.
+//
+// BOTH failure directions are safe, which is what makes this acceptable on a
+// release-critical lane:
+//   • commit written, publish then failed  → version looks taken, next run bumps
+//     past it. A gap in the version sequence; harmless.
+//   • published, commit push then failed   → version looks free, the publish
+//     retries and npm refuses with EPUBLISHCONFLICT. Loud, and nothing wrong ships.
+function laneReleasedVersions(subjects = []) {
+  const out = new Set();
+  for (const subject of subjects) {
+    const line = String(subject == null ? '' : subject);
+    if (!RELEASE_COMMIT_RE.test(line)) continue;
+    const m = /^release: core (\d+\.\d+\.\d+) /.exec(line);
+    if (m) out.add(m[1]);
+  }
+  return out;
+}
+
+module.exports = { bumpPatch, CONST_RE, RELEASE_COMMIT_RE, isReleaseCommit, laneReleasedVersions };
 if (require.main === module) main();

package/src/module-api.js

@@ -1172,8 +1172,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.369 with no explicit bump. run 32904231221. (task 1002620)
 //   1.19.371 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.370 with no explicit bump. run 32904582252. (task 1002620)
+//   1.19.372 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.371 with no explicit bump. run 32905166786. (task 1002620)
+//   1.19.373 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.372 with no explicit bump. run 32906118616. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.371'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.373'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bump_version.mjs

@@ -16,7 +16,10 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { bumpPatch, CONST_RE } = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
+const bump = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
+const { bumpPatch, CONST_RE } = bump;
+// The LIVE test below reads this repo's real release history (task 1003202).
+const { execFileSync } = require('node:child_process');
 
 const SAMPLE = [
   '// prologue',
@@ -111,3 +114,76 @@ test('publish.yml wires the terminator: guard step present, every armed step gat
   const gates = (PUBLISH_YML.match(/steps\.relhead\.outputs\.release_head == 'false'/g) || []).length;
   assert.ok(gates >= 7, `every post-guard armed step must carry the gate (setup-node, install, resolve, bump, pack, publish, tag) — found ${gates}`);
 });
+
+// ---------------------------------------------------------------------------
+// laneReleasedVersions — the token-free "is this version already published?"
+// (task 1003202 / blocker 1000115, the OIDC trusted-publishing migration).
+//
+// publish.yml used to ask the REGISTRY, which needs a credential: @bongos/core is
+// private, so an unauthenticated `npm view` is a flat E404 rather than a "no".
+// OIDC authenticates `npm publish` and nothing else, so keeping that check would
+// have reported "not taken" every run, skipped the auto-bump, and collided on the
+// published version — working for exactly one release before breaking. git holds
+// the same answer, needs no auth, and is the source the cascade terminator above
+// already trusts.
+// ---------------------------------------------------------------------------
+
+test('laneReleasedVersions reads the versions this lane announced', () => {
+  const subjects = [
+    'release: core 1.19.368 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
+    'Merge pull request #385 from lars589/some-branch',
+    'release: core 1.19.367 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
+    'feat(security): something unrelated',
+  ];
+  const v = bump.laneReleasedVersions(subjects);
+  assert.deepEqual([...v].sort(), ['1.19.367', '1.19.368']);
+  assert.equal(v.has('1.19.369'), false, 'a version never announced must read as free');
+});
+
+test('a HUMAN release commit is NOT counted — that version still needs publishing', () => {
+  // The same distinction RELEASE_COMMIT_RE was written to make for the cascade
+  // terminator. Counting it here would skip the publish of a hand-cut release.
+  const v = bump.laneReleasedVersions([
+    'release: core 1.19.2 — carrier for the init-blocker fixes',
+    'release: core 1.20.0 — hand-cut minor',
+  ]);
+  assert.equal(v.size, 0);
+});
+
+test('malformed and empty input yields an empty set, never a throw', () => {
+  // This runs inside the publish lane. A crash here would take down releases;
+  // an empty set degrades to "nothing is taken", which the publish itself
+  // catches with EPUBLISHCONFLICT — loud, and nothing wrong ships.
+  assert.equal(bump.laneReleasedVersions([]).size, 0);
+  assert.equal(bump.laneReleasedVersions().size, 0);
+  assert.equal(bump.laneReleasedVersions([null, undefined, '', 42]).size, 0);
+});
+
+test('laneReleasedVersions and isReleaseCommit agree on what a lane release looks like', () => {
+  // They share RELEASE_COMMIT_RE on purpose: if one ever recognises a subject the
+  // other does not, the cascade terminator and the version check disagree about
+  // the same commit, and the lane either double-publishes or silently no-ops.
+  const subjects = [
+    'release: core 1.19.368 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
+    'release: core 1.19.2 — carrier for the init-blocker fixes',
+    'chore: not a release at all',
+  ];
+  for (const s of subjects) {
+    const counted = bump.laneReleasedVersions([s]).size === 1;
+    assert.equal(counted, bump.isReleaseCommit(s), `disagreement on: ${s}`);
+  }
+});
+
+test('LIVE: the version HEAD declares is one this lane already released', () => {
+  // The steady state the lane depends on: HEAD carries the version set by the
+  // previous release commit, so `taken` is true and the auto-bump fires. If this
+  // ever reads false on a normal main checkout, the lane would try to republish
+  // an existing version.
+  const headVersion = /^const CORE_VERSION = '([0-9.]+)';/m
+    .exec(fs.readFileSync(path.join(ROOT, 'src', 'module-api.js'), 'utf8'))[1];
+  const subjects = execFileSync('git', ['log', '--format=%s', 'HEAD'], { encoding: 'utf8', cwd: ROOT }).split('\n');
+  const released = bump.laneReleasedVersions(subjects);
+  assert.ok(released.size > 100, `expected a long release history, saw ${released.size}`);
+  assert.equal(released.has(headVersion), true,
+    `HEAD declares ${headVersion}, which this lane has no release commit for — the auto-bump would not fire`);
+});

package/tests/goal_category.mjs

@@ -145,6 +145,34 @@ test('an unknown category is a 404, not a silently-created one', async () => {
   assert.equal(res.statusCode, 404);
 });
 
+// ---- the advisory (task 1003277) --------------------------------------------
+
+test('an uncategorised goal earns an advisory that carries the live set and the create path', () => {
+  const adv = gc.adviseCategory({ categoryId: null, categories: [
+    { id: 3, slug: 'security', label: 'Security' },
+    { id: 6, slug: 'economics', label: 'Economics' },
+  ] });
+  assert.equal(adv.reason, 'uncategorised');
+  assert.deepEqual(adv.categories.map((c) => c.slug), ['security', 'economics'],
+    'the live set rides along so a client offers real choices, never hard-coded labels');
+  assert.match(adv.message, /POST \/work-categories/, 'the prompt has somewhere to write into');
+  assert.match(adv.message, /designed prompt, not an error/, 'the criterion\'s own framing travels with the advice');
+  assert.match(adv.message, /gates nothing/, 'and so does the rule that outranks the feature');
+});
+
+test('a categorised goal gets NO advisory — silence, the fail-open posture', () => {
+  assert.equal(gc.adviseCategory({ categoryId: 3, categories: [] }), null);
+});
+
+test('the advisory is advice on a 201, never a refusal', () => {
+  // Pinned in source: POST /goals attaches category_advisory to its SUCCESS body
+  // and never fails the create over it (best-effort, wrapped in try).
+  const routes = read('modules', 'lifecycle', 'routes', 'goals.js');
+  assert.match(routes, /category_advisory = goalCategory\.adviseCategory/);
+  assert.match(routes, /res\.status\(201\)\.json\(\{ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory \}\)/,
+    'it rides the 201 — advice appended to a request that already succeeded');
+});
+
 // ---- decoration ------------------------------------------------------------
 
 test('a goal carries a readable category, and an uncategorised one carries null', () => {