@bongos/core 1.19.375 → 1.19.377

package/modules/lifecycle/goal-rollup.js

@@ -0,0 +1,118 @@
+'use strict';
+
+// modules/lifecycle/goal-rollup.js — per-goal task rollups, computed in Postgres
+// instead of in the browser (task 1003278, goal 1000072, criterion
+// legibility-sort-and-staleness).
+//
+// THE MEASUREMENT THAT FORCED THIS. The Goals page derived each goal's readiness
+// counters, its last-activity timestamp and (task 1003278) its craft set by
+// FETCHING EVERY TASK IN THE VERSION — `GET /tasks?version=BONGOS-V1&include=deps`
+// — and reducing them client-side. On the real corpus that request is
+// **5,229,455 bytes for ~1,400 tasks**, measured 2026-08-25, to produce roughly
+// forty small counter objects. The criterion's own words: "~1,357 tasks on
+// BONGOS-V1 alone. A view that does not survive that number is not a solution."
+// It did not survive it; it merely did not fall over.
+//
+// So the reduction moves to where the rows already are. One query per version
+// returns one row per goal, and the payload stops scaling with the task count.
+//
+// THE BUCKETS ARE THE CLIENT'S, VERBATIM. goals-lib.js `readinessOf` is the
+// definition of record and this SQL mirrors it exactly — done (shipped |
+// confirmed | completed) · cut (abandoned | dropped, excluded from the total the
+// way migration 017 keeps them out of version_progress) · active · ready ·
+// blocked (backlog with >=1 unshipped dependency) · backlog. A divergence here
+// would show a person different numbers depending on which surface they opened,
+// so tests/goal_sort_staleness.mjs pins the two against each other.
+//
+// LAST ACTIVITY is `max(updated_at, shipped_at)` — the same "any task activity
+// counts" rule the client uses (task 1002965, the owner's call), now expressed
+// once in SQL and once in task-lib.js because the browser still needs it for
+// rows it holds itself.
+
+const api = require('../../src/module-api');
+const { pool } = api;
+
+// The status vocabularies, kept beside the SQL that uses them so a reader can
+// check them against goals-lib.js in one glance.
+const DONE_STATUSES = ['shipped', 'confirmed', 'completed'];
+const CUT_STATUSES = ['abandoned', 'dropped'];
+
+// goalRollups — one row per goal that has at least one task in `versionId`.
+// Returns [{ goal_id, done, active, ready, blocked, backlog, cut, total,
+//            last_activity_at, disciplines[], next_ready_id, next_ready_title }].
+//
+// `blocked` needs the dependency edges, so the CTE resolves each backlog task's
+// unshipped-dependency count once rather than per row. deps.pool honors the #538
+// test seam (NODE_ENV==='test' only), like every other helper in this module.
+// VISIBILITY. A rollup is a COUNT, and counts on a private goal are not the
+// secret — its prose is (ADR 0112's leak rule: a non-member must not learn a
+// private goal's title or scope). But `next_ready_title` is a real task title
+// off a real goal, so this returns it ONLY to a member or an Archon. Everyone
+// else gets the counters and a null title: the board still renders the ring and
+// the readiness line, and the "Claim next" affordance simply has no name to show
+// — which is correct, because they cannot claim it either (task 1003137's
+// membership gate). Raised in review; the pre-existing GET /goals listing has
+// the same unfiltered shape, and tightening THAT is its own task, not something
+// to smuggle in here.
+async function goalRollups({ versionId = null, viewerId = null, viewerIsArchon = false } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const { rows } = await activePool.query(
+    `WITH scoped AS (
+       SELECT t.id, t.goal_id, t.status, t.title, t.priority, t.discipline,
+              GREATEST(COALESCE(t.updated_at, 'epoch'::timestamptz),
+                       COALESCE(t.shipped_at, 'epoch'::timestamptz)) AS activity_at,
+              EXISTS (
+                SELECT 1 FROM dependencies d
+                  JOIN tasks dep ON dep.id = d.to_id
+                 WHERE d.from_kind = 'task' AND d.from_id = t.id
+                   AND d.to_kind = 'task' AND dep.status <> 'shipped'
+              ) AS has_unshipped_dep
+         FROM tasks t
+        WHERE t.goal_id IS NOT NULL
+          AND ($1::text IS NULL OR t.version_id = $1)
+     ), bucketed AS (
+       SELECT s.*,
+              CASE
+                WHEN s.status = ANY($2::text[]) THEN 'done'
+                WHEN s.status = ANY($3::text[]) THEN 'cut'
+                WHEN s.status = 'active'  THEN 'active'
+                WHEN s.status = 'ready'   THEN 'ready'
+                WHEN s.status = 'backlog' AND s.has_unshipped_dep THEN 'blocked'
+                ELSE 'backlog'
+              END AS bucket
+         FROM scoped s
+     ), next_ready AS (
+       -- The goal's next claimable task, picked the way the board orders work:
+       -- priority first (NULLS LAST), then oldest id. DISTINCT ON gives one row
+       -- per goal without a second round trip.
+       SELECT DISTINCT ON (goal_id) goal_id, id, title
+         FROM bucketed
+        WHERE bucket = 'ready'
+        ORDER BY goal_id, priority NULLS LAST, id
+     )
+     SELECT b.goal_id::text                                          AS goal_id,
+            COUNT(*) FILTER (WHERE b.bucket = 'done')::int           AS done,
+            COUNT(*) FILTER (WHERE b.bucket = 'active')::int         AS active,
+            COUNT(*) FILTER (WHERE b.bucket = 'ready')::int          AS ready,
+            COUNT(*) FILTER (WHERE b.bucket = 'blocked')::int        AS blocked,
+            COUNT(*) FILTER (WHERE b.bucket = 'backlog')::int        AS backlog,
+            COUNT(*) FILTER (WHERE b.bucket = 'cut')::int            AS cut,
+            COUNT(*) FILTER (WHERE b.bucket <> 'cut')::int           AS total,
+            MAX(b.activity_at)                                       AS last_activity_at,
+            ARRAY_AGG(DISTINCT COALESCE(b.discipline, 'unclassified')) AS disciplines,
+            MAX(nr.id)::text                                         AS next_ready_id,
+            CASE WHEN bool_or(g.visibility IS DISTINCT FROM 'private')
+                   OR $4::boolean
+                   OR bool_or(gm.builder_id IS NOT NULL)
+                 THEN MAX(nr.title) END                              AS next_ready_title
+       FROM bucketed b
+       JOIN goals g ON g.id = b.goal_id
+       LEFT JOIN next_ready nr ON nr.goal_id = b.goal_id
+       LEFT JOIN goal_members gm ON gm.goal_id = b.goal_id AND gm.builder_id = $5::bigint
+      GROUP BY b.goal_id`,
+    [versionId, DONE_STATUSES, CUT_STATUSES, viewerIsArchon === true, viewerId]
+  );
+  return rows;
+}
+
+module.exports = { goalRollups, DONE_STATUSES, CUT_STATUSES };

package/modules/lifecycle/kickoff-checklist.js

@@ -0,0 +1,138 @@
+// modules/lifecycle/kickoff-checklist.js — the kickoff checklist: the launch steps a fresh
+// instance needs that the platform CANNOT do for its owner, as task specs (task 1003239).
+//
+// ONE list, two filers. `bongos init` files it at scaffold time on the self-host path
+// (scripts/gds/init.js kickoffTasks); the lifecycle module files it at the founder's
+// FIRST SIGN-IN on the control-plane path (modules/lifecycle/kickoff-seed.js), where
+// the scaffold ran `init --no-seed` and no Archon existed to file anything — walk
+// finding W4: the founder reached an empty board. Moved here from init.js so both
+// filers read the same steps and the copy cannot drift. It lives with the lifecycle
+// module because tasks are its domain and the kernel doorway must not grow a domain
+// import (ADR 0091 §1); init is a core CLI and, like abandon.js or audit-deps.js,
+// may require module code directly. Pure — imports nothing.
+//
+// Each step becomes a real, claimable task so it is tracked, never silently skipped
+// (grounded in the onboarding/deploy surfaces; the task 1204 mapping pass). Per-module
+// prerequisites are appended only for the modules the owner enabled.
+
+'use strict';
+
+// The one kickoff step the provisioning module AUTOMATES (ADR 0111 §3): standing up
+// production hosting/TLS/DNS/managed-DB. Kept as a named builder so init can either
+// FILE it (no provisioning requested, or the request couldn't be enqueued) or OMIT
+// it (a request went in — the control-plane runner covers this leg).
+function productionTopologyKickoff() {
+  return {
+    title: 'Production topology: TLS, real origins, managed Postgres',
+    kind: 'infra',
+    description: 'For a real (non-localhost) launch: front the instance with TLS (Caddy/Cloudflare/nginx), point ' +
+      'publicOrigin/buildersOrigin/statusOrigin at the real domain (the OAuth callback depends on this), and move off the bundled container DB volume to managed/backed-up Postgres.',
+  };
+}
+
+// The admission step as the SELF-HOST owner meets it: an env flag on their own box.
+const ADMISSION_SELF_HOST = {
+  title: 'Set the admission posture and invite the first builders',
+  kind: 'infra',
+  description: 'Enrollment is invite-only by default. Beyond you, no one can join until you approve an access request ' +
+    'or set <ENVPREFIX>_OPEN_XENOS_ENROLLMENT=1. Decide who can join and invite/approve the first builders.',
+};
+
+// The same decision as a HUB-PROVISIONED founder meets it: the door is the project's
+// "How people join" setting on the hub (task 1003044), never an env var they cannot
+// reach; invites are the Watch page's "Invite by GitHub username". Names only surfaces
+// that exist — a blank board is better than untrue copy (task 1003239).
+const ADMISSION_AT_FIRST_SIGN_IN = {
+  title: 'Decide how people join, and invite the first builders',
+  kind: 'infra',
+  description: 'Unless you opened the door when you created the project, nobody beyond you can join until you invite them. ' +
+    'Set "How people join" (open / apply to join / invite-only) from your project\'s manage page on the hub, ' +
+    'and invite the first builders by GitHub username from your project\'s Watch page.',
+};
+
+const MERGE_GATE = {
+  title: 'Arm the merge gate before a second builder joins (ci deploy mode)',
+  kind: 'infra',
+  description: 'For a shared instance on ci deploy mode, enable branch protection on main + required checks ' +
+    '(unit / secret-scan / gate-review), so untrusted builders cannot push straight to production. No review requirement — gates are CI checks, not human approvals (ADR 0162). Skippable for a solo/local instance.',
+};
+
+const INSTANCE_LOOK = {
+  title: 'Fill the instance look with your own LLM',
+  // 'ideator' is a DISCIPLINE, not a kind — tasks_kind_check rejects it as a
+  // kind and the task silently vanished from the checklist (the one non-infra
+  // kickoff step). Deciding the instance look is a decision by an ideator.
+  kind: 'decision',
+  discipline: 'ideator',
+  description: 'init wrote a lean config/branding.json and left the LOOK to you (a locked project rule: brand with your ' +
+    'own LLM, not a generator). Hand docs/branding-fill-prompt.md to your AI to design a palette/fonts/wordmark, or keep the vanilla look.',
+};
+
+// Steps that are already TRUE the moment a hub-provisioned founder signs in: auth
+// works (they just used it), the sign-in is this one, and the scaffold bound the repo
+// and chose the deploy mode. Filed on the self-host path only.
+function selfHostOnlySteps(spec, origin) {
+  return [
+    {
+      title: 'Register a GitHub OAuth app and set its credentials',
+      kind: 'infra',
+      description: 'Auth is the hard prerequisite for every sign-in — without it the server returns 503 ' +
+        'auth_not_configured and nobody (including you) can log in. Create a GitHub OAuth app, set ' +
+        `<ENVPREFIX>_GITHUB_CLIENT_ID/SECRET, tick "Enable Device Flow" (a separate save), and set the callback URL to ${origin}/api/gds/auth/web/callback.`,
+    },
+    {
+      title: `Sign in once as ${spec.firstAdmin} to seat the founding owner`,
+      kind: 'infra',
+      description: `A fresh database has no owner. Signing in as the configured firstAdmin (${spec.firstAdmin}) ` +
+        'the first time auto-seats that account as the founding Archon (owner). Config alone does nothing — you must actually sign in.',
+    },
+    {
+      title: 'Confirm the GitHub repo binding and deploy mode',
+      kind: 'infra',
+      description: `This instance ships work to ${spec.repo.owner}/${spec.repo.name}. Confirm the git remote / repo binding ` +
+        'and pick deploy mode in config/deploy.json (ci = server-mediated PR auto-merge, or laptop). A wrong/absent repo binding lets a task grade but never merge.',
+    },
+  ];
+}
+
+// Per-module prerequisites — a key the module cannot run without.
+function moduleKeySteps(spec) {
+  const enabled = new Set(Array.isArray(spec.modules) ? spec.modules : []);
+  const tasks = [];
+  if (enabled.has('art-pipeline')) {
+    tasks.push({ title: 'Provide a Google Gemini API key for the art pipeline', kind: 'infra',
+      description: 'The art-pipeline module needs a Google AI Studio (Gemini) key (GOOGLE_AI_STUDIO_KEY, a shared key, or per-builder keys) or it cannot generate art.' });
+  }
+  if (enabled.has('discord')) {
+    tasks.push({ title: 'Provide Discord bot token + webhooks', kind: 'infra',
+      description: 'The discord module needs a bot token + webhook URLs + DISCORD_BOT_ENABLED=true. Note: outbound/link surfaces fire on credentials even if the module flag is later turned off.' });
+  }
+  if (enabled.has('dev-box')) {
+    tasks.push({ title: 'Provide a DigitalOcean API token for dev boxes', kind: 'infra',
+      description: 'The dev-box module needs a DigitalOcean API token (and optionally Cloudflare) on the operator control plane before any builder box can be provisioned.' });
+  }
+  return tasks;
+}
+
+// kickoffChecklist(spec, opts) → task specs ({ title, kind, description[, discipline] }).
+//   provisioned — the owner opted into provisioning at init: the control-plane runner
+//                 covers production topology, so that step is omitted (ADR 0111 §3).
+//   firstSignIn — filed the moment the founder of a hub-provisioned project is seated:
+//                 only the steps still true after the standup, with the admission door
+//                 described as the hub setting it now is.
+// Pure — no I/O; the caller files them.
+function kickoffChecklist(spec = {}, { provisioned = false, firstSignIn = false } = {}) {
+  const origin = (spec.domains && spec.domains.publicOrigin) || 'http://localhost:3000';
+  const tasks = firstSignIn ? [] : selfHostOnlySteps(spec, origin);
+  tasks.push(firstSignIn ? ADMISSION_AT_FIRST_SIGN_IN : ADMISSION_SELF_HOST);
+  tasks.push(MERGE_GATE);
+  // Production topology is either AUTOMATED (the owner opted into provisioning — the
+  // control-plane runner stands up TLS/DNS/managed-DB) or a tracked manual step.
+  // Keep it in its infra slot, before the look step, when it's still manual.
+  if (!provisioned && !firstSignIn) tasks.push(productionTopologyKickoff());
+  tasks.push(INSTANCE_LOOK);
+  tasks.push(...moduleKeySteps(spec));
+  return tasks.map((t) => ({ ...t }));
+}
+
+module.exports = { kickoffChecklist, productionTopologyKickoff };

package/modules/lifecycle/kickoff-seed.js

@@ -0,0 +1,69 @@
+// modules/lifecycle/kickoff-seed.js — file the kickoff checklist at the founder's first
+// sign-in (task 1003239; behind the `lifecycle.kickoffSeed` port).
+//
+// WHY HERE, WHY THEN. `bongos init` files the kickoff checklist as tasks — but the
+// control-plane scaffold runs `init --no-seed` (scripts/gds/provision-repo.js), and a
+// hub-provisioned project has no Archon until its founder signs in, so nothing could
+// be filed earlier: the founder reached an EMPTY board (walk finding W4). The kernel's
+// first-admin seating (src/bongos/auth-admission.js) resolves this port the moment the
+// owner is seated — the first moment the checklist CAN be filed.
+//
+// IDEMPOTENT BY EMPTINESS, not by path. It seeds only when the tasks table is empty:
+// the self-host path already filed its checklist before anyone signed in, so it is
+// skipped there with no "was I provisioned" marker to keep true. The caller treats a
+// failure as best-effort — a seed hiccup must never fail the sign-in that just seated
+// the owner.
+//
+// THE BOUNDARY (ADR 0093 §1): core is reached only through ../../src/module-api.js.
+
+'use strict';
+
+const api = require('../../src/module-api');
+const db = require('./db');
+const { kickoffChecklist } = require('./kickoff-checklist');
+
+// The spec the checklist reads, from the instance's own branding pack. `modules` is
+// empty on purpose: a hub-provisioned project is scaffolded with every optional module
+// off, and its founder cannot have enabled one before their first sign-in.
+function specFromBranding(b = api.branding()) {
+  return {
+    firstAdmin: b.firstAdmin,
+    repo: b.repo || {},
+    domains: { publicOrigin: b.domains && b.domains.publicOrigin },
+    modules: [],
+  };
+}
+
+// The version the checklist lands under: the building one, else the first by id. The
+// scaffold seeds exactly one (provision-repo.js seedFirstVersionCmd).
+const FIRST_VERSION_SQL = `SELECT id FROM versions ORDER BY (status = 'building') DESC, id ASC LIMIT 1`;
+
+// seedKickoffIfEmpty({ builderId }, deps) → { seeded, versionId } | { seeded: 0, skipped }.
+// deps.pool / deps.createTask / deps.spec are test seams; production reads the doorway.
+async function seedKickoffIfEmpty({ builderId = null } = {}, deps = {}) {
+  const pool = deps.pool || api.pool;
+  const insert = deps.createTask || ((row) => db.createTask(row));
+  const { rows: [{ n }] } = await pool.query('SELECT count(*)::int AS n FROM tasks');
+  if (n > 0) return { seeded: 0, skipped: 'tasks_exist' };
+  const { rows: versions } = await pool.query(FIRST_VERSION_SQL);
+  if (!versions.length) return { seeded: 0, skipped: 'no_version' };
+  const versionId = versions[0].id;
+  const steps = kickoffChecklist(deps.spec || specFromBranding(), { firstSignIn: true });
+  let seeded = 0;
+  for (const t of steps) {
+    await insert({
+      versionId,
+      title: t.title,
+      description: t.description || '',
+      status: 'ready',
+      kind: t.kind || 'infra',
+      discipline: t.discipline || 'engineer',
+      source: 'first-sign-in',
+      createdBy: builderId,
+    });
+    seeded += 1;
+  }
+  return { seeded, versionId };
+}
+
+module.exports = { seedKickoffIfEmpty, specFromBranding, FIRST_VERSION_SQL };

package/modules/lifecycle/module.json

@@ -21,14 +21,16 @@
       "help-requests",
       "recommendations",
       "closeness",
-      "visuals"
+      "visuals",
+      "kickoff-seed"
     ],
     "pollers": [
       "publish-reconciler"
     ]
   },
   "provides": [
-    "lifecycle"
+    "lifecycle",
+    "lifecycle.kickoffSeed"
   ],
   "consumes": []
 }

package/modules/lifecycle/routes/goals.js

@@ -29,6 +29,7 @@ const hierarchy = require('../hierarchy');
 const goalSuggest = require('../goal-suggest.js'); // task 1003062 — pre-creation goal suggester
 const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edit handlers
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
+const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
 const { suggestCriteria } = require('../criterion-suggest');
 const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { validateOrRespond, parseId, LIMITS } = api;
@@ -145,6 +146,29 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // GET /goals/rollups?version= — one small row per goal: readiness counters, the
+  // last-activity timestamp, the craft set, and the next claimable task
+  // (task 1003278). It replaces the Goals page's whole-version task fetch, which
+  // measured 5,229,455 bytes for ~1,400 tasks on 2026-08-25 to produce ~40 counter
+  // objects. Registered BEFORE /goals/:id or Express routes 'rollups' to the param.
+  // rank: any-builder — the same read as the goal board it feeds.
+  router.get('/goals/rollups', auth.requireBuilder, async (req, res) => {
+    try {
+      // The viewer decides whether a PRIVATE goal's next-ready task TITLE comes
+      // back (counters always do — a count is not the secret, the prose is;
+      // ADR 0112). Identity from the authenticated request, never the query.
+      const rollups = await goalRollup.goalRollups({
+        versionId: req.query.version || null,
+        viewerId: req.builder.id,
+        viewerIsArchon: req.builder.rank === 'archon',
+      });
+      return res.json({ rollups });
+    } catch (err) {
+      log.error('[gds] GET /goals/rollups', err);
+      return res.fail('rollups_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // GET /goals?version=&status= — list goals (read).
   // rank: any-builder — viewing the goal board.
   router.get('/goals', auth.requireBuilder, async (req, res) => {
@@ -1150,6 +1174,8 @@ module.exports = function buildGoalsRouter() {
         discipline,
         source: 'goal-authored',
         goalId: goal.id,
+        // task 1003278 — attribution from the authenticated request (never the body).
+        createdBy: req.builder.id,
       });
 
       // Attach the sub-task parent (validated above; attachParent re-checks the

package/modules/lifecycle/routes/kickoff-seed.js

@@ -0,0 +1,29 @@
+'use strict';
+
+// modules/lifecycle/routes/kickoff-seed.js — registers the `lifecycle.kickoffSeed` port
+// (task 1003239): the founder's first board, filed the moment the kernel seats them.
+//
+// Resolved by ONE caller — the first-admin bootstrap in src/bongos/auth-admission.js —
+// through resolveOptional, so an instance without this module signs in exactly as
+// before. A route factory for a routeless capability, for the reason routes/lifecycle.js
+// and routes/rank-sync.js give: mountModuleRoutes is the boot hook that runs in the live
+// server AND whenever a test rebuilds the router. The router stays EMPTY — seeding has
+// no HTTP surface, and an endpoint here would let anyone re-file a founder's checklist.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const seed = require('../kickoff-seed');
+
+// Delegates at call time (never spreads) so a stubbed seed still bites.
+const kickoffSeedPort = {
+  seedIfEmpty: (...a) => seed.seedKickoffIfEmpty(...a),
+};
+
+module.exports = function buildLifecycleKickoffSeedRouter() {
+  if (!api.hasProvider('lifecycle.kickoffSeed')) {
+    api.registerProvider('lifecycle.kickoffSeed', kickoffSeedPort);
+  }
+  return express.Router();
+};
+
+module.exports.kickoffSeedPort = kickoffSeedPort;

package/modules/lifecycle/routes/task-write-routes.js

@@ -195,6 +195,9 @@ module.exports = function registerTaskWriteRoutes(router) {
         requiresRank: body.requires_rank ?? null,
         moduleKey: body.module_key ?? null,
         goalId: body.goal_id ?? null,
+        // task 1003278 — attribution, from the AUTHENTICATED request, never the
+        // body: who created a task is a fact about the caller, not an input.
+        createdBy: req.builder.id,
       });
       // task 438: link resolved criteria (source='planning' — task-create is the
       // planning vector). The ids were version-checked above, so this is a single

package/modules/lifecycle/routes/tasks.js

@@ -71,6 +71,25 @@ module.exports = function buildTasksRouter() {
   const router = express.Router();
 
   // rank: any-builder — reads (filtered task list); preserved per CRITICAL §4.
+  // task 1003278 — shared by GET /tasks and GET /tasks/claimable, so the two
+  // surfaces cannot drift on what a valid creator id or age window is. Returns
+  // undefined (absent), a number, or { bad } for the caller to turn into a 400.
+  const posInt = (raw, code, max) => {
+    if (raw === undefined || raw === '') return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0 || (max && n > max)) return { bad: code };
+    return n;
+  };
+  // 'none' is a REAL value here — the unattributed set ("what has no owner"), not
+  // a missing filter. Anything else must be a positive builder id.
+  function parseCreatedBy(raw) {
+    if (raw === undefined || raw === '') return undefined;
+    if (raw === 'none') return 'none';
+    const n = Number(raw);
+    return (Number.isInteger(n) && n > 0) ? n : { bad: 'bad_created_by' };
+  }
+  const CREATED_BY_MSG = "created_by must be a positive builder id, or 'none' for the unattributed.";
+
   router.get('/tasks', auth.requireBuilder, async (req, res) => {
     const { version, status, kind, discipline, goal_id } = req.query;
     if (kind && !VALID_KINDS.has(kind)) {
@@ -88,7 +107,25 @@ module.exports = function buildTasksRouter() {
         return res.fail('bad_goal_id', { status: 400, message: 'goal_id must be a positive integer.' });
       }
     }
-    const tasks = await db.listTasks({ versionId: version, status, kind, discipline, goalId });
+    // task 1003278 — created_by / stale_days / limit / offset, so a board can ask
+    // the server a narrow question instead of reducing the whole table in the
+    // browser. All four are optional; omitting them is exactly today's behaviour.
+    const { created_by: createdByRaw, stale_days: staleRaw, limit: limitRaw, offset: offsetRaw } = req.query;
+    const createdBy = parseCreatedBy(createdByRaw);
+    if (createdBy && createdBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
+    const staleDays = posInt(staleRaw, 'bad_stale_days', 3650);
+    if (staleDays && staleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
+    // The cap is the point of the parameter: an unbounded limit would be the
+    // whole-table read this axis exists to stop.
+    const limit = posInt(limitRaw, 'bad_limit', 1000);
+    if (limit && limit.bad) return res.fail('bad_limit', { status: 400, message: 'limit must be a positive integer up to 1000.' });
+    const offset = posInt(offsetRaw, 'bad_offset');
+    if (offset && offset.bad) return res.fail('bad_offset', { status: 400, message: 'offset must be a positive integer.' });
+
+    const tasks = await db.listTasks({
+      versionId: version, status, kind, discipline, goalId,
+      createdBy, staleDays, limit, offset,
+    });
     // ?include=deps (hall redesign task 1002439) — enrich each task with its
     // dependency summary (`blocked_by[]` with per-target satisfied state, and a
     // `blocks` count) so the Goals rollup + Tasks dependency view can paint
@@ -117,12 +154,21 @@ module.exports = function buildTasksRouter() {
     if (fit && !VALID_FITS.has(fit)) {
       return res.fail('bad_fit', 400, { valid: Array.from(VALID_FITS) });
     }
+    // task 1003278 — the creator + staleness axes, so the Work Board narrows the
+    // feed at the SOURCE instead of downloading it and reducing it in the browser.
+    // Same validators as GET /tasks: one vocabulary, two surfaces.
+    const claimCreatedBy = parseCreatedBy(req.query.created_by);
+    if (claimCreatedBy && claimCreatedBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
+    const claimStaleDays = posInt(req.query.stale_days, 'bad_stale_days', 3650);
+    if (claimStaleDays && claimStaleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
     const [claimable, active] = await Promise.all([
       db.listClaimableTasks({
         versionId: version || null,
         builderId: req.builder.id,
         discipline: discipline || null,
         fit: fit || null,
+        createdBy: claimCreatedBy ?? null,
+        staleDays: claimStaleDays ?? null,
       }),
       db.listActiveClaims(),
     ]);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.375",
+  "version": "1.19.377",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.375",
+      "version": "1.19.377",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.375",
+  "version": "1.19.377",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1308,6 +1308,7 @@ const CHECKS = [
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
   require('./baseline-staleness.js').checkBaselineFloors, // Check 26 — task 1003210: a shrink-only baseline that never shrinks is unmanaged debt; a floor exempting one must say why
   require('./client-baseurl-guard.js').checkClientBaseUrl,
+  require('./test-path-guard.js').checkTestsUseFileUrlToPath, // Check 30 — task 1002889: a test builds its repo root with fileURLToPath, never URL.pathname (a %20 or a Windows drive slash makes require() throw at load; CI's spaceless checkout can't see it)
   // Check 29 — task 1003275 / ADR 0189: a work category ORIENTS a human and steers
   // Claude; it authorises nothing. The owner said so twice, and the goal's own prose
   // predicts the failure: a second thing that looks like a hierarchy gets mistaken