@bongos/core 1.19.452 → 1.19.454

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.452",
-  "core_contract": "1.19.452",
-  "source_commit": "a59941e00bdc972cede45d82263d6bb9a334d59d",
+  "core_version": "1.19.454",
+  "core_contract": "1.19.454",
+  "source_commit": "4b419dfb5f2bb554648dbaaa7cf5e6c1eeb05f52",
   "source_ref": "HEAD",
-  "built_at": "2026-09-01T19:56:39.788Z",
+  "built_at": "2026-09-01T20:23:17.614Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 371,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1788,
+    "functional_verbatim": 1790,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2183,
-  "tree_sha256": "d6e755d26822b3fbb320367835d28cb2e6e317309a6da4985730541e202fec63",
+  "file_count": 2185,
+  "tree_sha256": "9497797c979a0e4da67c6094cf2bd050cde6f532f00a8890f9dbe4c0a4065527",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2092,7 +2092,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1b44d9a28067aee44f6461a6ec2ff31dcbcd1d92aba9b5e5d53ac97dcb782cbe"
+      "sha256": "1f9bf7b7d0d9e7c4ea7bc03285e12b1859443c4197dd241e3ee1aec331a32507"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6302,12 +6302,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a24646cf791a4ef41bf5fbca236cf24a27c9d05ba0f4419483054f38b849688e"
+      "sha256": "3cf929a4fd6e48bffbaacc887e14004384e99789cf49751816cca91e5e12b31b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "76ba0c0adc1241f0051796e43d8519486163d142b23a57704d60aabd56806cb6"
+      "sha256": "028b1cb8d72191904fc916ca6e4c4d3b819c4b0a6b3ebadb8274d9d94a0bfa2f"
     },
     {
       "path": "public-docs/index.html",
@@ -7957,7 +7957,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4b7bee96fc2dfb083dcc43f811b46f135c4103cf719e68546ee2b898569cfc65"
+      "sha256": "eb69000bc81b5e5947fbd10736783070e11c38d0cc63d15eea61fcccfdb37d67"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8864,6 +8864,11 @@
       "mode": "0000644",
       "sha256": "387eb4455a5e79f930fccae875278841094a52900a1158617345db8b58147d1a"
     },
+    {
+      "path": "tests/filing_abuse_matrix.mjs",
+      "mode": "0000644",
+      "sha256": "3688a9615a05eb94de9905698c4ed9dd044e9b67ef234124c548cf9aeffa338f"
+    },
     {
       "path": "tests/first_admin_bootstrap.mjs",
       "mode": "0000644",
@@ -9479,6 +9484,11 @@
       "mode": "0000644",
       "sha256": "51e1286235cbde1b56188f29b0e2bd12ac73a9637dbf1c16b325f10147256f27"
     },
+    {
+      "path": "tests/idea_route_attribution.mjs",
+      "mode": "0000644",
+      "sha256": "99a4665c1ddd97bb27238082c0e6e420eb66ab3c18ec92b543c3b35ba607ebda"
+    },
     {
       "path": "tests/idea_routing.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1341,5 +1341,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.450 with no explicit bump. run 33549781105. (task 1002620)
   1.19.452 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.451 with no explicit bump. run 33552353620. (task 1002620)
+  1.19.453 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.452 with no explicit bump. run 33553290345. (task 1002620)
+  1.19.454 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.453 with no explicit bump. run 33554965618. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.452",
+  "version": "1.19.454",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.452",
+      "version": "1.19.454",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.452",
+  "version": "1.19.454",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.452'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.454'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/filing_abuse_matrix.mjs

@@ -0,0 +1,355 @@
+// tests/filing_abuse_matrix.mjs — the FILING wall's ABUSE MATRIX (BV1.R06,
+// task 1003073, goal 1000071 "Idea routing"). Criterion C4: "filing can't outrun
+// rank — scope walls and rank floors hold on routed tasks."
+//
+// THE SISTER FILE. tests/goal_abuse_matrix.mjs is the same document for the
+// AUTHORING wall — POST /goals/:id/tasks, where a joined member deliberately
+// writes a task. This one covers the other door goal 1000071 opened: FILING, where
+// somebody reports a thing and the system turns it into work on their behalf.
+// Authoring is a member's privilege and is gated by membership; filing is open to
+// anyone by design (criterion C5: "the filer never has to know the goal map"), so
+// the safety has to come from somewhere else. This file is where "somewhere else"
+// is written down and made executable.
+//
+// THE ATTACKER, unless a row says otherwise: a Xenos with a valid session, filing
+// as fast as they can, naming whatever goal they like.
+//
+//   #   attack vector                                          → server response
+//   ──  ───────────────────────────────────────────────────     ────────────────────
+//   F1  file a bug naming an ordinary goal                     → routes, but 'backlog'
+//   F2  file a bug naming a PROTECTED-scope goal               → refused (protected_scope)
+//   F3  claim a higher rank in the request body                → ignored; rank is from auth
+//   F4  file a non-bug kind hoping it hard-lands               → 'backlog', every kind
+//   F5  file with a junk kind                                 → refused upstream (BAD_KIND)
+//   F5b …and if one slipped that validator                    → 'backlog' (fail-closed)
+//   F6  file with a junk/absent RANK                           → 'backlog' (fail-closed)
+//   F7  a criterion-proposal or decision (judgment kinds)      → never routes at all
+//   F8  a Full Idea naming a goal                              → never routes (Board Room's)
+//   F9  MASS-file through Discord #bugs                        → capped per rolling hour
+//   F10 make the rate-limit COUNT fail, to slip past the cap   → denied (fail-closed)
+//   F11 file through Discord #bugs at all, as a sub-Metic      → 'backlog', never 'ready'
+//   F12 file through Discord #ideas naming a goal              → that vector cannot route
+//   F13 declare touches[] outside the goal to widen blast area → the real wall refuses
+//   F14 file against a SHIPPED version's goal                  → refused (version not building)
+//   P1  a Metic+ files a bug in an ordinary goal               → 'ready' (the C1 grant)
+//   P2  a Metic+ files into protected scope                    → allowed, floored to metic
+//
+// AND THE ANTI-DRIFT PIN (the point of the file, really). The rows above are true
+// of the four capture vectors that exist TODAY. Nothing stops a fifth being added
+// next month that quietly skips all of it — which is exactly how the 1000771 bug
+// got in. So the last section ENUMERATES the vectors from source and fails when
+// the roster changes, forcing a new vector's author to come here and add its row.
+//
+// PURE: the decision cores only (decideLanding, authorizeRoutedLanding,
+// decideBugLanding, rateLimitPerHour) — no DB, no network. The transaction that
+// obeys them is proven in tests/idea_routing.mjs; the end-to-end attribution trail
+// in tests/idea_route_attribution.mjs.
+//
+// MUTATION-VERIFIED (task 1003073). Each of these was applied to the source and the
+// file confirmed RED before reverting, so the matrix is known to have teeth:
+//
+//   METIC_PLUS widened to include xenos ....................... 4 of 23 fail
+//   the protected-scope refusal short-circuited to false ...... 1 of 23 fail
+//   NEVER_ROUTE_KINDS emptied ................................. 1 of 23 fail
+//   #bugs READY_RANKS widened to include thetes ............... 2 of 23 fail
+//   the rate cap made env-uncappable (negatives accepted) ..... 1 of 23 fail
+//
+// Run:  node tests/filing_abuse_matrix.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => readFileSync(path.join(ROOT, rel), 'utf8');
+
+const routing = require('../modules/ideas/routing.js');
+const { decideLanding, authorizeRoutedLanding, routedPriority, PROTECTED_SCOPE_FLOOR } = routing;
+const bugs = require('../modules/discord/discord-bugs.js');
+const { decideBugLanding, rateLimitPerHour } = bugs;
+const { scopeIncludesProtected, isModuleKey } = require('../src/bongos/module-scope-map.js');
+
+const { test, summary } = makeRunner();
+
+// Ranks below the trust boundary. 'thetes' and 'xenos' are the real sub-Metic
+// tiers; the rest are the shapes a hostile or buggy caller actually produces.
+const SUB_METIC = ['xenos', 'thetes', null, undefined, '', 'METIC ', 'admin', 'root', 'archon ', 42, {}];
+const TRUSTED = ['metic', 'archon', 'Metic', 'ARCHON'];
+
+// A routed filing lands claimable ONLY when decideLanding says 'ready' AND
+// authorizeRoutedLanding lets it through. Both, because either alone is half the
+// gate — this helper is the composition the server actually runs.
+function landing({ kind = 'bug', filerRank = 'xenos', goalId = 5, grade = null, scopeProtected = false, scopeCheck = null } = {}) {
+  const verdict = decideLanding({ goalId, kind, grade, filerRank });
+  if (!verdict.route) return { landed: false, status: null, reason: verdict.reason };
+  const authorized = authorizeRoutedLanding({ landing: verdict, scopeProtected, scopeCheck, filerRank });
+  if (!authorized.ok) return { landed: false, status: null, refused: authorized.code };
+  return { landed: true, status: authorized.status, requiresRank: authorized.requiresRank, reason: verdict.reason };
+}
+
+// =========================================================================
+// Fixtures anchored in real facts, so the matrix cannot drift into fiction.
+// =========================================================================
+
+await test('fixtures: ideas is a real UNprotected module, lifecycle a protected one', () => {
+  assert.ok(isModuleKey('ideas') && isModuleKey('lifecycle'), 'both fixture modules are real');
+  assert.equal(scopeIncludesProtected(['ideas']), false, 'an ordinary goal scope');
+  assert.equal(scopeIncludesProtected(['lifecycle']), true, 'a protected one — the matrix depends on this');
+});
+
+// =========================================================================
+// F1–F8 — the filing matrix: a sub-Metic can report anything and set nothing
+// =========================================================================
+
+await test('[F1] a Xenos bug in an ordinary goal routes, but lands at backlog — never claimable', () => {
+  const r = landing({ kind: 'bug', filerRank: 'xenos' });
+  assert.equal(r.landed, true, 'the report is accepted — refusing it would be the triage tax this goal removes');
+  assert.equal(r.status, 'backlog', 'and it waits for a nod');
+  assert.equal(r.reason, 'bug_awaiting_nod');
+});
+
+await test('[F2] a Xenos bug in a PROTECTED-scope goal is refused outright, not merely floored', () => {
+  const r = landing({ kind: 'bug', filerRank: 'xenos', scopeProtected: true });
+  assert.equal(r.landed, false, 'no row is minted in the permission/ship/deploy core queue at all');
+  assert.equal(r.refused, 'protected_scope');
+});
+
+await test('[F3] rank comes from AUTH, never the body — the route never reads a body rank', () => {
+  // The decision core is handed a rank; the guarantee that it is the authenticated
+  // one lives at the call site, so assert it there, in source.
+  const src = read('modules/ideas/routes/inbox.js');
+  assert.match(src, /filerRank:\s*req\.builder\?\.rank/,
+    'POST /inbox must pass the AUTHENTICATED rank');
+  assert.ok(!/filerRank:\s*body\./.test(src), 'and must never take one from the request body');
+  assert.match(src, /capturedBy:\s*req\.builder\.id/, 'the filer identity is likewise from auth');
+});
+
+await test('[F4] no NON-BUG kind hard-lands, whoever files it — a filer cannot set the agenda', () => {
+  for (const kind of ['feature', 'cleanup', 'refactor', 'infra', 'chore', 'docs']) {
+    for (const rank of [...SUB_METIC, ...TRUSTED]) {
+      const r = landing({ kind, filerRank: rank });
+      assert.equal(r.status, 'backlog', `${kind} filed by ${JSON.stringify(rank)} must soft-land`);
+    }
+  }
+});
+
+await test('[F5] a junk kind never even reaches the matrix — captureIdea refuses it first', () => {
+  // The real wall for a bogus kind is upstream of routing: captureIdea resolves
+  // kind (or auto-classifies an absent one) and then refuses anything outside
+  // VALID_KINDS with BAD_KIND, before any write. So the matrix is never asked
+  // about 'BUG' or '__proto__' in production.
+  const src = read('modules/ideas/inbox.js');
+  assert.match(src, /const resolvedKind = kind \|\| classify\(/,
+    'an absent kind is auto-classified, never passed through as null');
+  assert.match(src, /VALID_KINDS\.includes\(resolvedKind\)/, 'and an unknown one is rejected');
+  assert.match(src, /BAD_KIND/, 'by a named refusal');
+});
+
+await test('[F5b] and if one DID reach the matrix, it soft-lands — belt to that braces', () => {
+  // decideLanding called directly: no helper default can stand in for the input.
+  // Only the exact string 'bug' hard-lands; every near-miss casing and shape is
+  // a soft landing, so a kind that slipped a future validator still cannot make
+  // claimable work.
+  for (const kind of [null, undefined, '', 'BUG', 'bug ', 'Bug', 'bugs', '__proto__', 0, {}]) {
+    const v = decideLanding({ goalId: 5, kind, grade: null, filerRank: 'archon' });
+    assert.equal(v.route, true, 'it still finds a home');
+    assert.equal(v.status, 'backlog', `kind ${JSON.stringify(kind)} must not hard-land`);
+  }
+  assert.equal(decideLanding({ goalId: 5, kind: 'bug', filerRank: 'archon' }).status, 'ready',
+    'only the exact kind hard-lands — otherwise this test would pass vacuously');
+});
+
+await test('[F6] a junk or absent RANK never reads as trusted (the fail-closed posture)', () => {
+  for (const rank of SUB_METIC) {
+    const r = landing({ kind: 'bug', filerRank: rank });
+    assert.equal(r.status, 'backlog', `rank ${JSON.stringify(rank)} must not hard-land a bug`);
+  }
+});
+
+await test('[F7] judgment kinds never route, so they cannot be laundered into work', () => {
+  for (const kind of ['criterion-proposal', 'decision']) {
+    for (const rank of [...SUB_METIC, ...TRUSTED]) {
+      const r = landing({ kind, filerRank: rank });
+      assert.equal(r.landed, false, `${kind} must stay in the inbox`);
+      assert.equal(r.reason, 'judgment_kind');
+    }
+  }
+});
+
+await test('[F8] a Full Idea never routes, even a bug-kinded one from an Archon', () => {
+  const r = landing({ kind: 'bug', filerRank: 'archon', grade: 'full' });
+  assert.equal(r.landed, false, "a Full Idea is the Board Room's subject, not its filer's task");
+  assert.equal(r.reason, 'full_idea_never_routes');
+});
+
+// =========================================================================
+// F9–F11 — MASS FILING through Discord #bugs
+// =========================================================================
+
+await test('[F9] the #bugs vector is capped per builder per rolling hour, and the cap is sane', () => {
+  const n = rateLimitPerHour({});
+  assert.ok(Number.isInteger(n) && n > 0, 'a real positive cap exists by default');
+  assert.ok(n <= 50, `the default cap bounds a flood (got ${n})`);
+  // A hostile env cannot uncap it with a non-number, a negative, or zero.
+  for (const bad of ['', 'lots', '-1', '0', 'Infinity', null, undefined, '1e999']) {
+    const got = rateLimitPerHour({ DISCORD_BUGS_RATE_PER_HOUR: bad });
+    assert.ok(Number.isInteger(got) && got > 0 && got <= 50,
+      `env ${JSON.stringify(bad)} must fall back to a finite cap, got ${got}`);
+  }
+});
+
+await test('[F10] a rate-limit COUNT failure DENIES — you cannot break the counter to slip the cap', () => {
+  // The behaviour is proven end-to-end in tests/discord_bugs.mjs; pinned here in
+  // source because "fail closed" is the property this matrix is about, and a
+  // future refactor that flips the catch to allow would pass every other test.
+  const src = read('modules/discord/discord-bugs.js');
+  assert.match(src, /fail-closed/i, 'the deny-on-count-error intent is stated');
+  assert.match(src, /rate_limit_count_error/,
+    'and audited under its own reason, so a broken counter is visible rather than silent');
+});
+
+await test('[F11] #bugs lands a sub-Metic at backlog and only Metic+ at ready', () => {
+  for (const rank of SUB_METIC) {
+    assert.equal(decideBugLanding(rank), 'backlog', `${JSON.stringify(rank)} must not reach ready`);
+  }
+  for (const rank of TRUSTED) {
+    assert.equal(decideBugLanding(rank), 'ready', `${rank} is the C1 straight-through grant`);
+  }
+});
+
+await test('[F9+F11] the flood, composed: at the cap, EVERY landed row is still backlog', () => {
+  const cap = rateLimitPerHour({});
+  const landedStatuses = [];
+  for (let i = 0; i < cap + 25; i++) {
+    if (i >= cap) continue; // the counter refuses past the cap (F9/F10)
+    landedStatuses.push(decideBugLanding('xenos'));
+  }
+  assert.equal(landedStatuses.length, cap, 'the cap bounds how many rows exist at all');
+  assert.ok(landedStatuses.every((s) => s === 'backlog'),
+    'and not one of them is claimable — a flood costs a Metic+ nothing but a queue to ignore');
+});
+
+// =========================================================================
+// F12 — the #ideas vector cannot route at all
+// =========================================================================
+
+await test('[F12] Discord #ideas never routes: it passes no goal, so every filing is an inbox row', () => {
+  const src = read('modules/discord/discord-inbound.js');
+  const call = src.slice(src.indexOf('deps.captureIdea({'));
+  assert.ok(call, 'the capture call is findable');
+  const body = call.slice(0, call.indexOf('});') + 3);
+  assert.ok(!/goalId/.test(body), 'no goalId is passed, so decideLanding returns no_goal');
+  assert.ok(!/filerRank/.test(body), 'and no rank, so it could not hard-land even if a goal appeared');
+  // Belt and braces: prove the decision, not just the absence.
+  assert.equal(decideLanding({ goalId: null, kind: 'bug', filerRank: 'archon' }).route, false,
+    'no goal ⇒ the inbox, which is the default path every goal-unaware vector keeps');
+});
+
+// =========================================================================
+// F13–F14 — the walls that are NOT the matrix's own
+// =========================================================================
+
+await test('[F13] a declared touches[] outside the goal is refused by the real scope wall, verbatim', () => {
+  // authorizeRoutedLanding passes the wall's verdict through unchanged — the same
+  // refusal an authored task gets, so there is only one definition of out-of-scope.
+  const refusal = { ok: false, code: 'out_of_scope', reason: 'nope', details: { offender: 'src/bongos/db.js' } };
+  const r = landing({ kind: 'bug', filerRank: 'archon', scopeCheck: refusal });
+  assert.equal(r.landed, false, 'even an Archon is bounded by the goal scope');
+  assert.equal(r.refused, 'out_of_scope');
+});
+
+await test('[F14] a goal on a non-building version cannot receive routed work (the 1000771 wall)', () => {
+  // Enforced inside the transaction, so pin it at its source: the locked read
+  // carries the version status and refuses anything but 'building'.
+  const src = read('modules/ideas/inbox.js');
+  assert.match(src, /VERSION_NOT_BUILDING/, 'the refusal exists and is named');
+  assert.match(src, /goal\.version_status !== 'building'/,
+    "and it admits ONLY a building version — 'shipped' is the tomb 1000771 was filed over");
+});
+
+// =========================================================================
+// P1–P2 — the grants, so the matrix is not vacuously "everything is refused"
+// =========================================================================
+
+await test('[P1] a Metic+ bug in an ordinary goal IS claimable immediately — criterion C1 still holds', () => {
+  const r = landing({ kind: 'bug', filerRank: 'metic' });
+  assert.equal(r.status, 'ready', 'the whole point of the goal: no triage stop for a trusted bug report');
+  assert.equal(r.requiresRank, null, 'and no floor is imposed — createTask derives it as for any vector');
+});
+
+await test('[P2] a Metic+ CAN file into protected scope, and the task is floored to metic', () => {
+  const r = landing({ kind: 'bug', filerRank: 'archon', scopeProtected: true });
+  assert.equal(r.landed, true);
+  assert.equal(r.requiresRank, PROTECTED_SCOPE_FLOOR, 'so no sub-Metic can claim it however it got there');
+});
+
+await test('priority cannot be weaponised: an out-of-band suggestion is clamped, never honoured', () => {
+  for (const p of [99, -5, 0, 6, 'urgent', null, Infinity, 1.5]) {
+    const got = routedPriority(p);
+    assert.ok(Number.isInteger(got) && got >= 1 && got <= 5, `priority ${JSON.stringify(p)} → ${got}`);
+  }
+  assert.equal(routedPriority(1), 1, 'a sane suggestion still rides through');
+});
+
+// =========================================================================
+// THE ANTI-DRIFT PIN — a fifth vector cannot arrive unaudited
+// =========================================================================
+
+// Every place a FILING becomes work, and the row above that covers it. Adding a
+// vector without adding it here is what this pin is for: the 1000771 bug got in
+// because #bugs was written as its own path and nobody re-read the matrix.
+const KNOWN_FILING_VECTORS = {
+  'modules/ideas/inbox.js': 'routeIdeaToGoal — the ONE transaction every routed filing runs (F1–F8, F13, F14)',
+  'modules/ideas/routes/inbox.js': 'POST /inbox — the web + CLI door onto it (F3)',
+  'modules/discord/discord-inbound.js': 'Discord #ideas — files an idea, never routes (F12)',
+  'modules/discord/discord-bugs.js': 'Discord #bugs — the direct-createTask bypass R11 retires (F9–F11)',
+};
+
+await test('[pin] every declared vector still reaches a task-minting path', () => {
+  const found = Object.keys(KNOWN_FILING_VECTORS).filter((rel) => /captureIdea\(|createTask\(/.test(read(rel)));
+  assert.deepEqual(found.sort(), Object.keys(KNOWN_FILING_VECTORS).sort(),
+    'a vector that no longer files needs its row retired, not left as decoration');
+});
+
+await test('[pin] no OTHER module file mints a task from a filing without a row here', () => {
+  // Scan the two filing-facing modules for task-minting call sites. A new file
+  // that creates work from a report has to be classified here before it ships.
+  const { execFileSync } = require('node:child_process');
+  const tracked = execFileSync('git', ['ls-files', 'modules/ideas/*.js', 'modules/ideas/**/*.js', 'modules/discord/*.js', 'modules/discord/**/*.js'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((l) => l.trim()).filter(Boolean);
+
+  const minters = tracked.filter((rel) => {
+    if (rel.includes('/tests/') || rel.endsWith('.mjs')) return false;
+    const src = read(rel);
+    // A minter CALLS a task-create; declaring/forwarding the dep is not minting.
+    return /(?:deps|lifecycle|db|api)\.createTask\(|resolve\('lifecycle'\)[\s\S]{0,80}createTask\(/.test(src);
+  });
+
+  const unaudited = minters.filter((rel) => !(rel in KNOWN_FILING_VECTORS));
+  assert.deepEqual(unaudited, [],
+    `a new filing vector must be added to KNOWN_FILING_VECTORS and given a matrix row: ${unaudited.join(', ')}`);
+});
+
+await test('[pin] the trusted tier is Metic+ in BOTH decision cores — one boundary, not two', () => {
+  // routing.js and discord-bugs.js each spell the tier locally (both are pure and
+  // import-free by design). They must agree, or "Metic+" means two things.
+  const routingSrc = read('modules/ideas/routing.js');
+  const bugsSrc = read('modules/discord/discord-bugs.js');
+  assert.match(routingSrc, /METIC_PLUS = new Set\(\['metic', 'archon'\]\)/);
+  assert.match(bugsSrc, /READY_RANKS = new Set\(\['metic', 'archon'\]\)/);
+  // And behaviourally, which is what actually matters:
+  for (const rank of [...SUB_METIC, ...TRUSTED]) {
+    const viaRouting = landing({ kind: 'bug', filerRank: rank }).status;
+    const viaBugs = decideBugLanding(rank);
+    assert.equal(viaRouting, viaBugs,
+      `the two vectors must agree on ${JSON.stringify(rank)} (routing=${viaRouting}, bugs=${viaBugs})`);
+  }
+});
+
+summary();

package/tests/idea_route_attribution.mjs

@@ -0,0 +1,330 @@
+// tests/idea_route_attribution.mjs
+//
+// THE PROOF — task 1003072 (BV1.R04, goal 1000071 "Idea routing"). Criterion
+// C3, "no route loses the person who thought of it":
+//
+//   (1) every routed task has an ideas_task_lineage row (origin='route') back to
+//       an idea_inbox row with captured_by;
+//   (3) sourceIdeaForTask on a routed, SHIPPED task returns the filer — the trail
+//       goal 1000067's ideator credit will pay against;
+//   (4) an unlinked Discord author still yields an idea row (captured_by null)
+//       rather than an attribution-free task.
+//
+// WHY THIS FILE EXISTS ALONGSIDE tests/idea_routing.mjs. That file proves the
+// WRITE: a routed capture emits idea + task + lineage in one transaction, in FK
+// order, and rolls all three back together. tests/idea_task_lineage.mjs proves
+// the READ: given a hand-seeded lineage row, sourceIdeaForTask names the idea and
+// its author. Neither proves the two HALVES COMPOSE — that the row routing
+// actually writes is the row the credit hook actually finds. A typo'd origin, a
+// task id written where an idea id was meant, a captured_by dropped on the way
+// in: each passes both existing files and still loses the ideator their credit,
+// silently, months before anyone tries to pay them.
+//
+// So this file runs the write and the read against ONE store. Nothing is
+// hand-seeded: every row the assertions read was put there by captureIdea.
+//
+// THE STORE, not a matcher table. The other two files answer per-statement with
+// canned rows, which is right for asserting statement SEQUENCE. Here the point is
+// end-to-end agreement, so the fake speaks the three tables as maps and the
+// queries genuinely join across them. A canned answer would prove nothing: it
+// would be the test asserting its own fixture.
+//
+// MUTATION-VERIFIED (task 1003072). A proof that has never failed is a rumour, so
+// each of these was applied to modules/ideas/inbox.js and the file was confirmed RED
+// before being reverted:
+//
+//   origin 'route' -> 'promote' in the lineage insert ......... 4 of 9 fail
+//   createdBy: capturedBy -> null on the task ................. 1 of 9 fail
+//   lineage params [task.id, idea.id] swapped ................. 5 of 9 fail
+//   captured_by -> null on the idea insert .................... 3 of 9 fail
+//   the lineage INSERT deleted (the #bugs bypass shape) ....... 5 of 9 fail
+//
+// Re-run that check if this file is ever rewritten: the store fake is expressive
+// enough that a careless edit could make it answer its own questions.
+//
+// Run:  node tests/idea_route_attribution.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+// ---------------------------------------------------------------------------
+// The store: idea_inbox, tasks, ideas_task_lineage as three maps.
+// ---------------------------------------------------------------------------
+
+const GOAL = {
+  id: 7, status: 'open', version_id: 'BONGOS-V1', version_status: 'building', scope_modules: ['ideas'],
+};
+
+function makeStore() {
+  return {
+    ideas: new Map(),    // id -> row
+    tasks: new Map(),    // id -> row
+    lineage: new Map(),  // task_id -> { idea_id, origin }
+    nextIdeaId: 500,
+    nextTaskId: 9000,
+    goal: { ...GOAL },
+  };
+}
+
+// One SQL handler over the store, shared by the transaction client and the
+// module-level pool — so the write path and the read path cannot disagree about
+// what is in the database.
+function handlerFor(store) {
+  return async (s, params = []) => {
+    // the locked goal read (routeIdeaToGoal step a)
+    if (/FROM goals g JOIN versions v/.test(s)) {
+      return { rows: store.goal ? [store.goal] : [] };
+    }
+    // the idea row (step b)
+    if (/INSERT INTO idea_inbox/.test(s)) {
+      const [title, bodyMd, kind, suggestedVersion, suggestedPriority, capturedBy, suggestedGoalId] = params;
+      const id = store.nextIdeaId++;
+      const row = {
+        id,
+        title,
+        body_md: bodyMd,
+        kind,
+        suggested_version: suggestedVersion ?? null,
+        suggested_priority: suggestedPriority ?? null,
+        // captured_by is THE field under test: it must survive the write
+        // unmodified, including when it is null (the unlinked-Discord case).
+        captured_by: capturedBy ?? null,
+        status: 'promoted',
+        suggested_goal_id: suggestedGoalId ?? null,
+        promoted_to_task_id: null,
+        reviewed_at: 'T0',
+        merged_into_idea_id: null,
+        triage_note: null,
+        captured_at: 'T0',
+      };
+      store.ideas.set(String(id), row);
+      return { rows: [row] };
+    }
+    // the lineage row (step d)
+    if (/INSERT INTO ideas_task_lineage/.test(s)) {
+      const [taskId, ideaId] = params;
+      // origin is a literal in the statement, not a param — read it from the SQL
+      // so a change to that literal is caught here rather than assumed.
+      const origin = (s.match(/VALUES \(\$1, \$2, '(\w+)'\)/) || [])[1] ?? null;
+      store.lineage.set(String(taskId), { idea_id: String(ideaId), origin });
+      return { rowCount: 1, rows: [] };
+    }
+    // closing the FK loop (step e)
+    if (/UPDATE idea_inbox SET promoted_to_task_id/.test(s)) {
+      const [ideaId, taskId] = params;
+      const row = store.ideas.get(String(ideaId));
+      if (row) row.promoted_to_task_id = taskId;
+      return { rows: row ? [row] : [] };
+    }
+    // sourceIdeaForTask — the read the ship hook does
+    if (/l\.idea_id, l\.origin, i\.captured_by/.test(s)) {
+      const link = store.lineage.get(String(params[0]));
+      if (!link) return { rows: [] };
+      const idea = store.ideas.get(String(link.idea_id));
+      if (!idea) return { rows: [] }; // an INNER JOIN finds nothing
+      return { rows: [{ idea_id: link.idea_id, origin: link.origin, captured_by: idea.captured_by }] };
+    }
+    // countShippedTasksForIdea
+    if (/COUNT\(\*\)::int AS n/.test(s)) {
+      const ideaId = String(params[0]);
+      let n = 0;
+      for (const [taskId, link] of store.lineage) {
+        if (link.idea_id === ideaId && (store.tasks.get(taskId) || {}).status === 'shipped') n++;
+      }
+      return { rows: [{ n }] };
+    }
+    return { rows: [] }; // BEGIN / COMMIT / ROLLBACK and anything unmatched
+  };
+}
+
+// A pool whose query() and connect().query() both run the same handler against
+// the same store, and which records every statement for ordering assertions.
+function poolFor(store) {
+  const handler = handlerFor(store);
+  const queries = [];
+  const client = {
+    queries,
+    async query(sql, params) {
+      queries.push({ sql: String(sql).replace(/\s+/g, ' ').trim(), params });
+      return handler(String(sql).replace(/\s+/g, ' ').trim(), params);
+    },
+    release() {},
+  };
+  return {
+    queries,
+    query: client.query,
+    connect: async () => client,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Wiring: the lifecycle port (createTask) writes into the SAME store.
+// ---------------------------------------------------------------------------
+
+const seams = require('../src/module-seams.js');
+seams._reset();
+
+let activeStore = makeStore();
+
+seams.registerProvider('lifecycle', {
+  createTask: async (args) => {
+    const id = activeStore.nextTaskId++;
+    const row = {
+      id,
+      status: args.status,
+      goal_id: args.goalId,
+      version_id: args.versionId,
+      title: args.title,
+      kind: args.kind,
+      source: args.source,
+      source_ref: args.sourceRef,
+      created_by: args.createdBy ?? null,
+    };
+    activeStore.tasks.set(String(id), row);
+    return row;
+  },
+});
+
+const inbox = require('../modules/ideas/inbox.js');
+const { captureIdea, sourceIdeaForTask, countShippedTasksForIdea } = inbox;
+
+// sourceIdeaForTask and countShippedTasksForIdea read the MODULE-LEVEL pool (no
+// deps seam), so point that at the live store too. Same object the module
+// captured at load, so replacing the method is enough.
+api.pool.query = async (sql, params) => handlerFor(activeStore)(String(sql).replace(/\s+/g, ' ').trim(), params);
+
+const { test, summary } = makeRunner();
+
+// Route one bug and hand back everything the assertions need.
+async function routeABug({ capturedBy = 42, filerRank = 'metic', title = 'the thing is broken' } = {}) {
+  activeStore = makeStore();
+  const pool = poolFor(activeStore);
+  const idea = await captureIdea(
+    { title, bodyMd: 'steps to reproduce', kind: 'bug', goalId: GOAL.id, capturedBy, filerRank },
+    { pool }
+  );
+  return { idea, pool, store: activeStore };
+}
+
+const ship = (store, taskId) => { store.tasks.get(String(taskId)).status = 'shipped'; };
+
+// =========================================================================
+// C3 (1) — the routed task HAS a lineage row, and it points at a real idea
+// =========================================================================
+
+await test('a routed bug writes lineage origin=route from the task back to the idea', async () => {
+  const { idea, store } = await routeABug();
+  const taskId = idea.routing.task_id;
+
+  assert.ok(taskId, 'the capture became a task');
+  const link = store.lineage.get(String(taskId));
+  assert.ok(link, 'a lineage row exists for the task that was just created');
+  assert.equal(link.origin, 'route', "origin is 'route' — not 'promote', which would misattribute the lane");
+  assert.equal(link.idea_id, String(idea.id), 'and it points at the idea this very capture wrote');
+  assert.ok(store.ideas.has(String(idea.id)), 'that idea id is a real row, not a dangling reference');
+});
+
+await test('the idea row carries the filer, and the task records them as its creator', async () => {
+  const { idea, store } = await routeABug({ capturedBy: 42 });
+  assert.equal(store.ideas.get(String(idea.id)).captured_by, 42, 'the filer is on the idea row');
+  assert.equal(store.tasks.get(String(idea.routing.task_id)).created_by, 42,
+    'and on the task — routing an idea attributes the work to whoever reported it');
+});
+
+// =========================================================================
+// C3 (3) — THE COMPOSITION. What routing wrote is what the ship hook reads.
+// =========================================================================
+
+await test('sourceIdeaForTask on the routed, SHIPPED task returns the filer', async () => {
+  const { idea, store } = await routeABug({ capturedBy: 42 });
+  const taskId = idea.routing.task_id;
+  ship(store, taskId);
+
+  const src = await sourceIdeaForTask(taskId);
+  assert.ok(src, 'the ship hook finds a source idea — nothing to pay is the failure this goal exists to prevent');
+  assert.equal(String(src.idea_id), String(idea.id), 'it names the idea the filing created');
+  assert.equal(src.origin, 'route', 'and says the route is where it came from');
+  assert.equal(src.captured_by, 42, 'and names the person to pay');
+});
+
+await test('the shipped-task count for that idea is exactly one — the credit lane can meter it', async () => {
+  const { idea, store } = await routeABug();
+  assert.equal(await countShippedTasksForIdea(idea.id), 0, 'nothing is owed before it ships');
+  ship(store, idea.routing.task_id);
+  assert.equal(await countShippedTasksForIdea(idea.id), 1, 'and exactly one afterwards — never double-paid');
+});
+
+await test('the trail survives with NOTHING hand-seeded — every row came from the capture', async () => {
+  const { idea, store } = await routeABug({ capturedBy: 77 });
+  // The point of the whole file, asserted directly: three tables, one act.
+  assert.equal(store.ideas.size, 1, 'one idea');
+  assert.equal(store.tasks.size, 1, 'one task');
+  assert.equal(store.lineage.size, 1, 'one lineage row');
+  ship(store, idea.routing.task_id);
+  const src = await sourceIdeaForTask(idea.routing.task_id);
+  assert.deepEqual(
+    { idea: String(src.idea_id), origin: src.origin, who: src.captured_by },
+    { idea: String(idea.id), origin: 'route', who: 77 }
+  );
+});
+
+// =========================================================================
+// C3 (4) — an unlinked author still leaves a trail
+// =========================================================================
+
+await test('an UNLINKED filer (captured_by null) still yields an idea row, not an attribution-free task', async () => {
+  // A Discord author with no Bongos account. The report must not become a task
+  // that exists with no idea behind it — that is precisely the #bugs bypass this
+  // goal retires. The trail exists and is honestly empty at the person-shaped
+  // end, which is recoverable later; a missing lineage row never is.
+  const { idea, store } = await routeABug({ capturedBy: null, filerRank: 'metic' });
+  const taskId = idea.routing.task_id;
+
+  assert.ok(store.lineage.get(String(taskId)), 'the lineage row exists even with no known author');
+  ship(store, taskId);
+  const src = await sourceIdeaForTask(taskId);
+  assert.ok(src, 'the ship hook still finds the idea');
+  assert.equal(src.origin, 'route');
+  assert.equal(src.captured_by, null, 'unattributed, and honestly so — never guessed');
+  assert.equal(store.tasks.get(String(taskId)).created_by, null, 'the task does not invent a creator either');
+});
+
+// =========================================================================
+// The negative: a task with no route has no trail, so a passing test above
+// cannot be the fake answering itself.
+// =========================================================================
+
+await test('a task that was never routed has no source idea (the read is not vacuously true)', async () => {
+  activeStore = makeStore();
+  activeStore.tasks.set('4242', { id: 4242, status: 'shipped' });
+  assert.equal(await sourceIdeaForTask(4242), null,
+    'no lineage row → null; if this returned a row the store would be answering blind');
+});
+
+await test('lineage pointing at a missing idea reads as no source, never as a half-row', async () => {
+  activeStore = makeStore();
+  activeStore.tasks.set('4243', { id: 4243, status: 'shipped' });
+  activeStore.lineage.set('4243', { idea_id: '999', origin: 'route' }); // idea absent
+  assert.equal(await sourceIdeaForTask(4243), null,
+    "the INNER JOIN drops it — the credit lane must never see an author-less 'source'");
+});
+
+// =========================================================================
+// The provenance pair, so one idea can only ever mint one routed task
+// =========================================================================
+
+await test('the routed task carries the idempotency provenance the create-vector read keys on', async () => {
+  const { idea, store } = await routeABug();
+  const task = store.tasks.get(String(idea.routing.task_id));
+  assert.equal(task.source, 'idea-route', 'source names the vector');
+  assert.equal(task.source_ref, `idea-${idea.id}`,
+    'and source_ref names the idea — db.findTaskBySourceRef is what stops a second task being minted');
+});
+
+summary();