@bongos/core 1.19.453 → 1.19.455

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.453",
+  "version": "1.19.455",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.453",
+      "version": "1.19.455",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.453",
+  "version": "1.19.455",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.453'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.455'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/discord_bugs.mjs

@@ -3,7 +3,8 @@
 // Unit tests for Discord #bugs → GDS tasks (kind='bug') (Phase 3 F8, ADR 0047).
 // Pure screening/landing + orchestration via injected fakes — no Discord, no DB:
 //   - screenBug: message → { ok, title, bodyMd }; blank/short/text-free rejected.
-//   - decideBugLanding: Metic+ → 'ready'; everyone else linked → 'backlog'.
+//   - the landing: Metic+ → 'ready'; everyone else linked → 'backlog'. Decided by
+//     the ideas landing matrix since task 1003067, not by this module.
 //   - recordInboundBug: files via createTask under the anti-abuse guard —
 //     linked-only (unlinked rejected), rank-aware landing, per-builder
 //     rate-limit, body screen; audits surface='discord_bot'; never throws.
@@ -23,7 +24,9 @@ function t(name, fn) {
 }
 
 const GOOD_ID = '123456789012345678';
-const CFG = { rateLimitPerHour: 5, versionId: 'GDS-V3', credits: 10 };
+// task 1003067: versionId and credits are gone from this vector's config — the
+// goal carries the version and the reward auto-assigns at the create layer.
+const CFG = { rateLimitPerHour: 5 };
 
 console.log('Discord #bugs → GDS tasks (Phase 3 F8):');
 
@@ -51,21 +54,16 @@ await t('screenBug: long first line is capped (≤200, ellipsis)', () => {
   assert.ok(s.title.endsWith('…'));
 });
 
-// ---- decideBugLanding ------------------------------------------------------
-await t('decideBugLanding: Metic+ → ready', () => {
-  assert.equal(bg.decideBugLanding('metic'), 'ready');
-  assert.equal(bg.decideBugLanding('archon'), 'ready');
-  assert.equal(bg.decideBugLanding('ARCHON'), 'ready');
-});
-await t('decideBugLanding: Xenos/Thetes/unknown → backlog', () => {
-  for (const r of ['xenos', 'thetes', 'periokoi', '', null, undefined]) {
-    assert.equal(bg.decideBugLanding(r), 'backlog');
-  }
-});
 
 // ---- recordInboundBug (fakes) ---------------------------------------------
+// The fake capture mirrors the real landing rule rather than hardcoding a status,
+// so a matrix change shows up here as a failure instead of a stale fixture.
+// task 1003067: the fake defers to the REAL landing matrix, so this fixture can
+// never quietly disagree with the rule the server actually applies.
+const { decideLanding } = require('../modules/ideas/routing.js');
+const READY_OR_BACKLOG = (rank) => (rank == null ? null : decideLanding({ goalId: 7, kind: 'bug', filerRank: rank }).status);
 function makeDeps(over = {}) {
-  const calls = { create: [], audit: [], count: [], persist: [] };
+  const calls = { create: [], audit: [], count: [], persist: [], suggest: [] };
   const deps = {
     getBuilderByDiscordUserId: async () => (over.builder === undefined ? null : over.builder),
     countRecentDiscordBugFilings: async (id, since) => {
@@ -73,7 +71,29 @@ function makeDeps(over = {}) {
       if (over.countThrows) throw new Error('count boom');
       return over.recent ?? 0;
     },
-    createTask: async (a) => { calls.create.push(a); if (over.createThrows) throw new Error('db boom'); return { id: over.taskId ?? 555 }; },
+    // task 1003067: the vector files through ideas.capture now. `calls.create`
+    // keeps its name — it is still "what this vector asked to be created" — but
+    // the argument shape is a CAPTURE, and the landing status comes back from the
+    // matrix rather than being posted in.
+    suggestGoalForCapture: async (draft) => {
+      calls.suggest.push(draft);
+      if (over.suggestThrows) throw new Error('suggest boom');
+      return over.goal === undefined ? { id: 7, title: 'A goal', version_id: 'BONGOS-V1', score: 4 } : over.goal;
+    },
+    captureIdea: async (a) => {
+      calls.create.push(a);
+      if (over.createThrows) throw new Error('db boom');
+      // routeIdeaToGoal refuses a landing by THROWING, which rolls the idea row
+      // back with it — the case the goal-dropping retry exists for.
+      if (over.refuseRouted && a.goalId != null) throw { code: 'ROUTE_NOT_AUTHORIZED', gate: 'protected_scope' };
+      const routes = a.goalId != null && READY_OR_BACKLOG(a.filerRank) !== null;
+      return {
+        id: over.ideaId ?? 900,
+        routing: routes
+          ? { routed: true, task_id: over.taskId ?? 555, goal_id: a.goalId, status: READY_OR_BACKLOG(a.filerRank) }
+          : { routed: false, reason: 'no_goal' },
+      };
+    },
     insertAuditLog: async (a) => { calls.audit.push(a); if (over.auditThrows) throw new Error('audit boom'); return { id: 1 }; },
     persistImages: async (urls, opts) => {
       calls.persist.push({ urls, opts });
@@ -90,13 +110,16 @@ await t('recordInboundBug: linked Metic → filed at ready, kind=bug, attributed
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'Boats vanish at the dock', messageId: 'm1' }, deps, CFG);
   assert.equal(r.outcome, 'filed');
   assert.equal(r.taskId, 555);
+  assert.equal(r.ideaId, 900, 'the idea row is the attribution the old path threw away');
   assert.equal(r.status, 'ready');
-  assert.equal(calls.create[0].kind, 'bug');
-  assert.equal(calls.create[0].status, 'ready');
-  assert.equal(calls.create[0].source, 'discord:bugs');
-  assert.equal(calls.create[0].sourceRef, 'discord:m1');
-  assert.equal(calls.create[0].versionId, 'GDS-V3');
-  assert.match(calls.create[0].description, /reported from Discord #bugs by mona/);
+  assert.equal(calls.create[0].kind, 'bug', 'the channel IS the classification');
+  assert.equal(calls.create[0].filerRank, 'metic', 'the LIVE rank is handed to the matrix');
+  assert.equal(calls.create[0].capturedBy, 9, 'and the reporter is attached to the capture');
+  assert.equal(calls.create[0].goalId, 7, 'the suggester found it a home');
+  // task 1003067: no versionId is passed AT ALL. It used to be the hardcoded
+  // 'GDS-V3' — a shipped version, which is idea 1000771. The goal carries it now.
+  assert.equal(calls.create[0].versionId, undefined, 'this vector no longer names a version');
+  assert.match(calls.create[0].bodyMd, /reported from Discord #bugs by mona/);
   assert.equal(calls.audit[0].surface, 'discord_bot');
   assert.equal(calls.audit[0].responseStatus, 201);
   assert.equal(calls.audit[0].builderId, 9);
@@ -106,18 +129,74 @@ await t('recordInboundBug: linked Xenos → filed at backlog (needs confirm)', a
   const { deps, calls } = makeDeps({ builder: { id: 4, github_login: 'newbie', rank: 'xenos' } });
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'Typo on the welcome sign', messageId: 'm2' }, deps, CFG);
   assert.equal(r.outcome, 'filed');
-  assert.equal(r.status, 'backlog');
-  assert.equal(calls.create[0].status, 'backlog');
+  assert.equal(r.status, 'backlog', 'a sub-Metic report waits for a nod, as before');
+  assert.equal(calls.create[0].filerRank, 'xenos');
 });
 
-await t('recordInboundBug: UNLINKED author → ignored, nothing created', async () => {
+await t('recordInboundBug: UNLINKED author → an inbox idea, never a task [changed by 1003067]', async () => {
+  // WAS: dropped entirely ('unlinked'), because this path minted claimable work
+  // and ADR 0047 would not let an unaccountable author near that. It no longer
+  // mints work, so the report is kept — as an idea row with no author and NO
+  // GOAL, which is exactly what #ideas has always done for the same person.
+  // The security property survives structurally: no goal ⇒ the matrix cannot
+  // route ⇒ no task exists to claim.
   const { deps, calls } = makeDeps({ builder: null });
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'something is broken here', messageId: 'm3' }, deps, CFG);
-  assert.equal(r.outcome, 'ignored');
-  assert.equal(r.reason, 'unlinked');
+  assert.equal(r.outcome, 'filed');
+  assert.equal(r.ideaId, 900, 'the report is recorded rather than silently dropped');
+  assert.equal(r.taskId, null, 'and it is NOT work');
+  assert.equal(r.status, null);
+  assert.equal(calls.create[0].capturedBy, null, 'unattributed, and honestly so');
+  assert.equal(calls.create[0].goalId, null, 'no home is offered to an unlinked author');
+  assert.equal(calls.suggest.length, 0, 'we do not even ask for one');
+  assert.match(calls.create[0].bodyMd, /unlinked author/);
+});
+
+await t('recordInboundBug: an unlinked author is NOT rate-limited by builder id (there is none)', async () => {
+  const { deps, calls } = makeDeps({ builder: null, recent: 999 });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'another unlinked report', messageId: 'm3b' }, deps, CFG);
+  assert.equal(r.outcome, 'filed', 'the per-builder cap cannot express an author with no builder row');
+  assert.equal(calls.count.length, 0, 'so it is not consulted');
+  assert.equal(r.taskId, null, 'the bound that matters is that none of it becomes work');
+});
+
+await t('recordInboundBug: a suggester failure still files — to the inbox [1003067]', async () => {
+  // A suggester that throws must not lose the bug report. No goal ⇒ inbox row.
+  const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, suggestThrows: true });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'the suggester is down', messageId: 'm3c' }, deps, CFG);
+  assert.equal(r.outcome, 'error', 'it surfaces as an error rather than pretending to have filed');
   assert.equal(calls.create.length, 0);
 });
 
+await t('recordInboundBug: a REFUSED goal drops the guess and still files the report [1003067]', async () => {
+  // The suggester picks the home; the goal can still refuse it (protected scope, a
+  // scope-wall verdict, an archive mid-flight). Because routing is one transaction
+  // that refusal takes the idea row with it — so a goal WE guessed at would lose a
+  // report the reporter did nothing wrong to file. Drop the guess, keep the report.
+  const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, refuseRouted: true });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'a bug whose words match a protected goal', messageId: 'm7' }, deps, CFG);
+  assert.equal(r.outcome, 'filed', 'the report survives the refusal');
+  assert.equal(calls.create.length, 2, 'one routed attempt, then one homeless retry');
+  assert.equal(calls.create[0].goalId, 7, 'the first carried the suggested home');
+  assert.equal(calls.create[1].goalId, null, 'the retry drops it');
+  assert.equal(r.taskId, null, 'and it lands in the inbox, where triage will see it');
+});
+
+await t('recordInboundBug: a refusal with NO goal to drop is a real error, not a retry loop', async () => {
+  const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, goal: null, refuseRouted: true, createThrows: true });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'the database is simply down', messageId: 'm8' }, deps, CFG);
+  assert.equal(r.outcome, 'error', 'nothing to drop ⇒ surface it rather than retrying forever');
+  assert.equal(calls.create.length, 1, 'exactly one attempt');
+});
+
+await t('recordInboundBug: NO confident goal → the report still lands, in the inbox', async () => {
+  const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, goal: null });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'a bug matching no goal at all', messageId: 'm3d' }, deps, CFG);
+  assert.equal(r.outcome, 'filed');
+  assert.equal(r.taskId, null, 'no home ⇒ no task, which is the homeless-inbox contract (C2)');
+  assert.equal(calls.create[0].goalId, null);
+});
+
 await t('recordInboundBug: over rate-limit → ignored + audited 429, nothing created', async () => {
   const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, recent: 5 });
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'yet another bug report', messageId: 'm4' }, deps, CFG);
@@ -170,7 +249,7 @@ await t('recordInboundBug: audit failure does NOT undo the filing', async () =>
   assert.equal(calls.create.length, 1);
 });
 
-await t('recordInboundBug: createTask error → {error}, never throws', async () => {
+await t('recordInboundBug: a capture error → {error}, never throws', async () => {
   const { deps } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, createThrows: true });
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'valid bug body here', messageId: 'm' }, deps, CFG);
   assert.equal(r.outcome, 'error');
@@ -202,8 +281,8 @@ await t('recordInboundBug: text + images → persists images + embeds durable li
   assert.equal(r.images, 1);
   assert.equal(calls.persist.length, 1);
   assert.deepEqual(calls.persist[0].urls, ['https://cdn.discordapp.com/a.png']);
-  assert.match(calls.create[0].description, /Attachments \(1\)/);
-  assert.match(calls.create[0].description, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
+  assert.match(calls.create[0].bodyMd, /Attachments \(1\)/);
+  assert.match(calls.create[0].bodyMd, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
 });
 
 await t('recordInboundBug: image-only (empty text) → filed with screenshot title', async () => {
@@ -225,7 +304,7 @@ await t('recordInboundBug: image persist failure → still files (without images
   );
   assert.equal(r.outcome, 'filed');
   assert.equal(r.images, 0);
-  assert.doesNotMatch(calls.create[0].description, /Attachments/);
+  assert.doesNotMatch(calls.create[0].bodyMd, /Attachments/);
 });
 
 await t('recordInboundBug: all images refused (stored empty) → filed, no Attachments block', async () => {
@@ -236,7 +315,7 @@ await t('recordInboundBug: all images refused (stored empty) → filed, no Attac
   );
   assert.equal(r.outcome, 'filed');
   assert.equal(r.images, 0);
-  assert.doesNotMatch(calls.create[0].description, /Attachments/);
+  assert.doesNotMatch(calls.create[0].bodyMd, /Attachments/);
 });
 
 // ---- combineParts ----------------------------------------------------------