@bongos/core 1.19.377 → 1.19.378

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.377",
-  "core_contract": "1.19.377",
-  "source_commit": "90c7b43a6f0265aaf5d5c117cbe2721c18bd6c35",
+  "core_version": "1.19.378",
+  "core_contract": "1.19.378",
+  "source_commit": "71bcea42aeb104d9931a45ea2fdc5b1816bead92",
   "source_ref": "HEAD",
-  "built_at": "2026-08-26T23:56:55.300Z",
+  "built_at": "2026-08-27T00:03:57.043Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 335,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1922,
-  "tree_sha256": "ef3ea529acb199c38d7dc4bb8bc657b694727f8e8ffaa8fdf2af230913416726",
+  "tree_sha256": "0a04e3d05efdc0ba120a60c0d163afc0c7ac5075cf143d082d047fe6c56fcd16",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "28f456a1b259b898b4bfc0d353c9877b5f10828beae478c2ee6aa1a66e64c33a"
+      "sha256": "e9a6dd8d60741347814d184016bb3eaae1b319ba299121e7a39a55367bc12e56"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1477,12 +1477,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "96e9749fd1a6061c3ae96edf1da81a42fc6f89144bca6844870e5abcc7aeb7fe"
+      "sha256": "1d40e3666f05b4b28d7b9433e84c0ae4bfccc907660053006694814799365bf0"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "a743ea7c9fbe29419a6efc5978472c8fa27da2178eef34edbc988574990733f8"
+      "sha256": "57b66bbfe0c1d7aa8274a43d813c77c83986a3e4cf43046e9e0a637ac4fe308d"
     },
     {
       "path": "docs/architecture.md",
@@ -4077,7 +4077,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "94b785f970615056c9c3e896009868ef762fe78ab9f640889b9286ccef46fcf0"
+      "sha256": "745663b0a264ae742702919fc9486f49723010dd797e1fe7151de5d65b98bf21"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -4087,7 +4087,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "70448ebd079d5167bcf0c9c2b4473d46e996a54202f09f5a8ebc30980aba4166"
+      "sha256": "b7f0d36dc13ebad0206b94879262e661e6c2524539732f31e7cec25f61fd9fd6"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -4277,7 +4277,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "4ef343018b69528ab9518683ba0c6878bfcf5b9398ee7a2ade21780c20218538"
+      "sha256": "10313e3a6bd619fe2cf5cd691927032914fcb25d52ba743e8ae16d51d8d97d5c"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -4942,12 +4942,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e5e8b0e3c6879a8636f96f6bdce1c4fd8d9b06521e431bd6051bb2be2ea96518"
+      "sha256": "f96269625487590e9dc70bff805db37a0f00592178fc6614f6c82b4610ec3c0d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3057a201c65b95c06512dfbf5642b4d3de10c513382e771b478f0eb43dad3ff8"
+      "sha256": "40e93caa20eab8a0602a3fe4a1073e63aca106888f5afcbe28627200e17d84f6"
     },
     {
       "path": "public-docs/index.html",
@@ -6837,7 +6837,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5287468c8e1a2ba691e02ff2150bcb425b00db6c0ce676b063d32cb20ef640c5"
+      "sha256": "f291431298b7e0b6369f71f944d87c5fcf67a651da063a6a7af0f4935d99e33a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8532,7 +8532,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "7b0e40f4b3e348a45ccdc543dd1f3dfd78113ae86348823001e4eabb78f126de"
+      "sha256": "e2f03570b76b4d5af7af3c87a2a4989827eb71d1b50c92ab546a456e85c4024e"
     },
     {
       "path": "tests/migration_namespace.mjs",

package/clients/bongos-client/index.d.ts

@@ -163,7 +163,7 @@ export interface PatchProvisioningInstancesIdSettingsRequest { platform_visibili
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
 export interface PatchTaskRecommendationsIdResponse { ok: boolean; recommendation: unknown }
-export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; status?: unknown }
+export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; title?: string; status?: unknown }
 export interface PostAccessRequestsInviteRequest { github_login: string }
 export interface PostAccessRequestsInviteResponse { ok: boolean; already_invited?: boolean; github_login?: unknown; request?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }

package/docs/api/openapi.json

@@ -16737,6 +16737,11 @@
             "minLength": 1,
             "maxLength": 50000
           },
+          "title": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200
+          },
           "status": {}
         },
         "additionalProperties": false

package/docs/api-reference.md

@@ -542,7 +542,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/tasks` | `any-builder` | — |  |
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
-| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
+| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `title`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
 | POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |

package/modules/lifecycle/db-tasks.js

@@ -203,7 +203,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
-  'needs_migration', 'module_key', 'description',
+  'needs_migration', 'module_key', 'description', 'title',
 ]);
 
 async function updateTaskColumn(id, column, value) {
@@ -264,6 +264,12 @@ async function updateTaskKind(id, kind) { return updateTaskColumn(id, 'kind', ki
 // write-audit middleware captures each edit's new body in audit_log.
 async function updateTaskDescription(id, description) { return updateTaskColumn(id, 'description', description); }
 
+// task 1002792: the title is the MORE visible half of that same prompt — what
+// /builder-start lists and the hall shows — and was write-once at every rank,
+// so a wrong title (two seeded briefs naming tables that hard-fail CI, task
+// 1002791) was permanent. Same permission, same audit trail as the body.
+async function updateTaskTitle(id, title) { return updateTaskColumn(id, 'title', title); }
+
 
 async function updateTaskDiscipline(id, discipline) { return updateTaskColumn(id, 'discipline', discipline); }
 
@@ -853,6 +859,7 @@ module.exports = {
   taskTouchesProtectedPath,
   updateTaskAutomationTag,
   updateTaskDescription,
+  updateTaskTitle,
   updateTaskDiscipline,
   updateTaskGoal,
   updateTaskKind,

package/modules/lifecycle/db.js

@@ -112,6 +112,7 @@ const {
   taskTouchesProtectedPath,
   updateTaskAutomationTag,
   updateTaskDescription,
+  updateTaskTitle,
   updateTaskDiscipline,
   updateTaskGoal,
   updateTaskKind,
@@ -244,6 +245,7 @@ module.exports = {
   createCriterion,
   updateTaskKind,
   updateTaskDescription,
+  updateTaskTitle,
   updateTaskDiscipline,
   updateTaskNewcomerFriendly,
   updateTaskRequiresRank,

package/modules/lifecycle/routes/task-write-routes.js

@@ -285,6 +285,11 @@ module.exports = function registerTaskWriteRoutes(router) {
       // can be rewritten, never blanked (and null is refused by the type check).
       // Each edit's new body lands in audit_log via the write-audit middleware.
       description: { type: 'string', minLength: 1, maxLength: LIMITS.DESCRIPTION },
+      // task 1002792: the title — the more visible half of the same prompt — was
+      // write-once at every rank, so a wrong one was permanent (task 1002791's two
+      // briefs naming tables that hard-fail CI). Same shape as create, same
+      // task.edit permission, same audit_log trail as a description edit.
+      title: { type: 'string', minLength: 1, maxLength: LIMITS.TITLE },
       // task 1002614 (map D-18): DECLARED so strict-mode admits the request far
       // enough to reach the deliberate status_not_patchable hint below (#514) —
       // the hint had been unreachable dead code behind unknown_field since the
@@ -311,6 +316,7 @@ module.exports = function registerTaskWriteRoutes(router) {
     const hasModuleKey = Object.prototype.hasOwnProperty.call(body, 'module_key');
     const hasGoalId = Object.prototype.hasOwnProperty.call(body, 'goal_id');
     const hasDescription = Object.prototype.hasOwnProperty.call(body, 'description');
+    const hasTitle = Object.prototype.hasOwnProperty.call(body, 'title');
     // #514: status is a lifecycle field, not a PATCH-able column — it moves only
     // through the dedicated transition routes. The #506 session tried
     // `PATCH status=ready`, got the generic no_supported_fields error, and had
@@ -322,8 +328,8 @@ module.exports = function registerTaskWriteRoutes(router) {
     if (Object.prototype.hasOwnProperty.call(body, 'status')) {
       return res.fail('status_not_patchable', { status: 400, message: STATUS_HINT });
     }
-    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription) {
-      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, description, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
+    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription && !hasTitle) {
+      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, title, description, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
     // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
     // ---- FIRST write. The previous shape validated-and-wrote per field in ----
@@ -478,6 +484,15 @@ module.exports = function registerTaskWriteRoutes(router) {
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
       }
     }
+    if (hasTitle) {
+      try {
+        updated = await db.updateTaskTitle(id, body.title.trim());
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        log.error('[gds] PATCH /tasks/:id title', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
     if (hasGoalId) {
       try {
         updated = await db.updateTaskGoal(id, body.goal_id);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.377",
+  "version": "1.19.378",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.377",
+      "version": "1.19.378",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.377",
+  "version": "1.19.378",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1194,8 +1194,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.375 with no explicit bump. run 32910331206. (task 1002620)
 //   1.19.377 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.376 with no explicit bump. run 33025011131. (task 1002620)
+//   1.19.378 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.377 with no explicit bump. run 33025512093. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.377'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.378'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/migration_allocation.mjs

@@ -203,6 +203,7 @@ function shouldReserveMigrationNumber(task) {
         [() => db.updateTaskNeedsMigration(1, false), 'needs_migration'],
         [() => db.updateTaskModuleKey(1, null), 'module_key'],
         [() => db.updateTaskDescription(1, 'edited body'), 'description'], // task 1002647
+        [() => db.updateTaskTitle(1, 'corrected title'), 'title'], // task 1002792
       ];
       for (const [call, column] of setters) {
         const before = seen.length;
@@ -218,6 +219,16 @@ function shouldReserveMigrationNumber(task) {
     }
   });
 
+  await test('PATCH /tasks/:id accepts title so a wrong title is correctable (task 1002792)', () => {
+    assert.ok(
+      /title: \{ type: 'string', minLength: 1, maxLength: LIMITS\.TITLE \}/.test(routesSrc),
+      'the PATCH schema must declare title with the create-time limits — a title can be rewritten, never blanked'
+    );
+    assert.ok(/const hasTitle = Object\.prototype\.hasOwnProperty\.call\(body, 'title'\)/.test(routesSrc), 'title is gated like every other field');
+    assert.ok(/&& !hasTitle\) \{/.test(routesSrc), 'a title-only PATCH is a supported request, not no_supported_fields');
+    assert.ok(/db\.updateTaskTitle\(id, body\.title\.trim\(\)\)/.test(routesSrc), 'the write goes through the allowlisted setter');
+  });
+
   await test('PATCH /tasks/:id accepts needs_migration so a wrong flag is correctable', () => {
     assert.ok(
       /needs_migration: \{ type: 'boolean' \}/.test(routesSrc),