@bongos/core 1.19.472 → 1.19.473

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.472",
-  "core_contract": "1.19.472",
-  "source_commit": "6b69181019333048f1fcb17d03f9d04b6b098fb5",
+  "core_version": "1.19.473",
+  "core_contract": "1.19.473",
+  "source_commit": "f858b1895c3573e86927088c29b26f2ad38491a8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-02T15:04:57.327Z",
+  "built_at": "2026-09-02T15:11:50.486Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 411,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1833,
+    "functional_verbatim": 1834,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2268,
-  "tree_sha256": "d824d0535e867ee19410330bc863104779eab940c7a8403f755f98805c928072",
+  "file_count": 2269,
+  "tree_sha256": "75c680a966e595c6ecad7c239e057f8c023780495df07c5195c859e293942c0b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2137,7 +2137,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "901d3e0044c9b6f0437df6424de404e6d367a0e2dceb7226eb3b1c4df7d906b8"
+      "sha256": "f0ec801852ae00f83d8f1a14319f04a442a85541624b3c96e7c9606e80f3a046"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6667,12 +6667,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9950b1cf51f93769fdfe48d5001b54bb1274cc4359988e0a2ec98865fe551be0"
+      "sha256": "f7be3efd0df18000603a05ccfb7a2b2f11e6b7aee81298c66cbbd4820d51a191"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2c9a8851c9bfeaa466c27bc933049734fcde9b77ce276bf2604882a0feff20b7"
+      "sha256": "34165e1371803af75314357a120c881daefc4611a3a3669bd0cb483b9d127893"
     },
     {
       "path": "public-docs/index.html",
@@ -7527,7 +7527,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "9a173b5e307f5c1396f1d72b88d0b05534cccbff53af0a39a620001df69bf1a8"
+      "sha256": "56478faf9ee0b9df3c7285096dacb88e37d95744bbb18552d46005fc580dfce0"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -8327,7 +8327,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "35edfe1acbfd33316d1bbc681817dc06af19336873acd4abe239af41efbc22f2"
+      "sha256": "7b8c9a525a256e4c0428b2b600220ceb8b7c3665bbc1146da9e6bccc832994da"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9834,6 +9834,11 @@
       "mode": "0000644",
       "sha256": "fd96eb0dd472810854d9e0a7ee29725764cf0c3f4ad502c57d6d4a324da25ef5"
     },
+    {
+      "path": "tests/idea_credit_streams_db.mjs",
+      "mode": "0000644",
+      "sha256": "3e43b2afa7ea9e8ccee99759c27f7ab28f7a49823cc3b7e921071714d2d0d7f1"
+    },
     {
       "path": "tests/idea_detail_page.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1381,5 +1381,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.470 with no explicit bump. run 33645344292. (task 1002620)
   1.19.472 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.471 with no explicit bump. run 33646171957. (task 1002620)
+  1.19.473 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.472 with no explicit bump. run 33646919877. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.472",
+  "version": "1.19.473",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.472",
+      "version": "1.19.473",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.472",
+  "version": "1.19.473",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -95,6 +95,17 @@ const INTEGRATION = new Set([
   // set out of the source, so a quoted word in a comment reads as an entry.)
   'copy_desk_flags_db',
   'discord_autojoin', 'discord_oauth',
+  // task 1003000 (IC6): the three ideator credit streams against a real Postgres.
+  // The three DB-free sibling suites stub the client and SIMULATE the
+  // INSERT ... WHERE NOT EXISTS, so the whole no-double-pay argument of the lane
+  // is asserted against a fake there; here the statement meets a real transaction
+  // engine and the real credit trigger that moves a balance. Every fixture and
+  // credit row is written inside a transaction that is always rolled back, so it
+  // is safe against a dev database and never TRUNCATEs anything.
+  // (Prose here avoids apostrophes and single-quoted tokens: the review gate
+  // parses this set out of the source, so a quoted word in a comment reads as an
+  // entry — the same reason the copy_desk_flags_db note above is worded that way.)
+  'idea_credit_streams_db',
   // RENAMED by ADR 0174 (goal 1000068) — these entries said governance_* until task
   // 1003091. A curated set keyed by a stem that no longer exists silently stops
   // covering its file: both of these dropped OUT of the integration set and INTO the

package/src/module-api.js

@@ -34,7 +34,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.472'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.473'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/idea_credit_streams_db.mjs

@@ -0,0 +1,326 @@
+// tests/idea_credit_streams_db.mjs
+//
+// task 1003000 (BV1.R176 / IC6, goal 1000067) — the ideator credit lane's three
+// streams against a REAL Postgres, so the claims IC6 makes are executable rather
+// than argued. ADR 0172; docs/governance/bongos-v1-ideator-pay-proofs.md is the
+// proof record this harness belongs to.
+//
+// WHY A DB TEST EXISTS AT ALL, when three DB-free suites already cover these
+// functions: those suites stub the client and SIMULATE `INSERT ... WHERE NOT
+// EXISTS` in JavaScript. The whole idempotency argument of the credit lane — the
+// thing that stops an author being paid twice for one idea — is therefore
+// asserted against a fake. Here the statement meets a real transaction engine,
+// real unique indexes, and the real `pms_apply_credit` trigger that moves
+// builders.total_credits. That is the only way to prove the money semantics
+// rather than restate them.
+//
+// NON-DESTRUCTIVE BY CONSTRUCTION: every fixture and every credit row is written
+// inside ONE transaction that is ALWAYS rolled back, so this is safe to point at
+// a dev database that holds real rows. It never TRUNCATEs and never commits.
+//
+// Real-DB (self-skips without Postgres; belongs in the INTEGRATION set so the
+// DB-free lane stays DB-free).
+//
+// Run:  DATABASE_URL=postgres://... node tests/idea_credit_streams_db.mjs
+//
+// PROVENANCE, stated plainly: written from the migration DDL and NOT executed by
+// its author — the machine it was written on could not run Postgres at all
+// (no docker, no psql, and an embedded server died on the Windows shared-memory
+// reserve, error 487). The first person to run it with a DATABASE_URL is the
+// first person to see it pass. Treat a failure here as a bug in this file until
+// proven otherwise, and record the outcome in the proof document above.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const credits = require('../modules/economy/credits.js');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// The reward policy the live instance runs: builder estimate OFF, ideator lane
+// ON. Every stream below is driven through THIS, so a pass here is also the
+// ADR 0172 §2 exemption holding under the real configuration.
+const COST_PLUS_ONLY = credits.rewardPolicy({ mode: 'cost-plus-only' });
+
+// insertRow — insert into `table`, supplying `explicit` and auto-filling every
+// other NOT NULL column that has no default. Schema-driven rather than
+// hand-listed: the fixture tables (versions, tasks, idea_inbox) carry columns
+// this test does not care about, and a hand-written column list would rot the
+// first time a migration adds a NOT NULL one. Identity/serial columns are left
+// to the sequence. Returns the inserted row.
+const schemaCache = new Map();
+
+async function columnsOf(client, table) {
+  if (schemaCache.has(table)) return schemaCache.get(table);
+  const { rows } = await client.query(
+    `SELECT column_name, data_type, is_nullable, column_default, is_identity
+       FROM information_schema.columns
+      WHERE table_schema = 'public' AND table_name = $1`,
+    [table]
+  );
+  schemaCache.set(table, rows);
+  return rows;
+}
+
+// `table` and the column names are interpolated rather than parameterised
+// because SQL cannot parameterise an identifier. Both are trusted by
+// construction: `table` is always a literal from this file's own fixture(), and
+// the column names come from information_schema metadata for that table — never
+// from input. Nothing here is reachable from a request.
+async function insertRow(client, table, explicit = {}) {
+  const cols = await columnsOf(client, table);
+  if (cols.length === 0) throw new Error(`table ${table} not found — is this database migrated?`);
+  const values = { ...explicit };
+  for (const c of cols) {
+    if (c.column_name in values) continue;
+    if (c.is_nullable === 'YES') continue;          // NULL is fine
+    if (c.column_default !== null) continue;        // the default covers it
+    if (c.is_identity === 'YES') continue;          // sequence owns it
+    values[c.column_name] = placeholderFor(c.data_type, c.column_name);
+  }
+  const names = Object.keys(values);
+  const params = names.map((_, i) => `$${i + 1}`);
+  const { rows } = await client.query(
+    `INSERT INTO ${table} (${names.map((n) => `"${n}"`).join(', ')})
+     VALUES (${params.join(', ')}) RETURNING *`,
+    names.map((n) => values[n])
+  );
+  return rows[0];
+}
+
+function placeholderFor(dataType, columnName) {
+  switch (dataType) {
+    case 'integer': case 'bigint': case 'smallint':
+    case 'numeric': case 'real': case 'double precision':
+      return 0;
+    case 'boolean': return false;
+    case 'timestamp with time zone': case 'timestamp without time zone': case 'date':
+      return new Date();
+    case 'json': case 'jsonb': return {};
+    case 'ARRAY': return [];
+    default: return `ic6-${columnName}`;
+  }
+}
+
+// One fully-wired idea: an author, an optional developer, a Full Idea at
+// `completeness`, and `taskCount` shipped tasks descended from it (the IC3
+// lineage stream 1 counts). Ids come from the sequences, never hardcoded.
+async function fixture(client, { completeness = 70, developed = false, taskCount = 0 } = {}) {
+  const author = await insertRow(client, 'builders', {
+    github_id: `ic6-author-${Date.now()}-${Math.random()}`,
+    github_login: 'ic6-author', display_name: 'ic6 author', total_credits: 0,
+  });
+  const developer = developed
+    ? await insertRow(client, 'builders', {
+      github_id: `ic6-dev-${Date.now()}-${Math.random()}`,
+      github_login: 'ic6-dev', display_name: 'ic6 developer', total_credits: 0,
+    })
+    : null;
+  const idea = await insertRow(client, 'idea_inbox', {
+    title: 'ic6 — a Full Idea used to prove the ideator credit lane',
+    kind: 'feature', status: 'open', captured_by: author.id,
+  });
+  await insertRow(client, 'ideas_grades', {
+    idea_id: idea.id,
+    grade: 'full',
+    completeness_score: completeness,
+    ...(developer ? { developed_by: developer.id } : {}),
+  });
+  const version = await insertRow(client, 'versions', { id: `IC6-${Date.now()}-${Math.random()}`.slice(0, 40) });
+  const tasks = [];
+  for (let i = 0; i < taskCount; i++) {
+    const task = await insertRow(client, 'tasks', {
+      version_id: version.id, title: `ic6 task ${i + 1}`, status: 'shipped',
+    });
+    await insertRow(client, 'ideas_task_lineage', {
+      task_id: task.id, idea_id: idea.id, origin: 'promote',
+    });
+    tasks.push(task);
+  }
+  return { author, developer, idea, tasks };
+}
+
+// Every ideator-lane row for ONE idea, matched on EXACT reason keys.
+//
+// The obvious spelling of this — `reason LIKE 'idea.credit.%' || ideaId || '%'` —
+// is an unanchored substring match on the id, so for idea 5 it also matches
+// `idea.credit.task_ship:15:99` and `idea.credit.full_pass:51`. Against a
+// database that already holds real ideator rows (which this file promises is
+// safe) that silently inflates the counts the assertions below turn on, which
+// is the opposite of the guarantee. So: the two per-idea keys are compared for
+// equality, and the per-task key is matched on the `<id>:` prefix — anchored by
+// the delimiter, so idea 5 can never collide with idea 15 or 51.
+async function ledger(client, ideaId) {
+  const id = String(ideaId);
+  const { rows } = await client.query(
+    `SELECT builder_id, delta, reason FROM credit_log
+      WHERE reason = 'idea.credit.full_pass:' || $1
+         OR reason = 'idea.credit.governance_pass:' || $1
+         OR reason LIKE 'idea.credit.task_ship:' || $1 || ':%'
+      ORDER BY id`,
+    [id]
+  );
+  return rows;
+}
+
+// Every test runs in its own always-rolled-back transaction.
+async function inTx(fn) {
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    await fn(client);
+  } finally {
+    await client.query('ROLLBACK').catch(() => {});
+    client.release();
+  }
+}
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`idea_credit_streams_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  process.exit(0);
+}
+
+await test('the reward policy under test is the live one: estimate off, ideator lane on', async () => {
+  assert.equal(COST_PLUS_ONLY.perTaskCredit, false);
+  assert.equal(COST_PLUS_ONLY.ideatorCredit, true);
+});
+
+await test('stream 2 — a passing Full Idea books exactly 5, and the REAL trigger moves the balance', async () => {
+  await inTx(async (client) => {
+    const { author, idea } = await fixture(client, { completeness: 72 });
+    const r = await credits.awardIdeaFullPassCredit(client, {
+      ideaId: idea.id, authorId: author.id, completenessScore: 72, config: COST_PLUS_ONLY,
+    });
+    assert.equal(r.credited, 5);
+    const rows = await ledger(client, idea.id);
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].reason, `idea.credit.full_pass:${idea.id}`);
+    // The DB-free suites cannot see this: pms_apply_credit is a real trigger.
+    const { rows: [b] } = await client.query('SELECT total_credits FROM builders WHERE id = $1', [author.id]);
+    assert.equal(Number(b.total_credits), 5, 'builders.total_credits is moved by the ledger trigger, not by the award fn');
+  });
+});
+
+await test('stream 2 — REAL SQL idempotency: three calls, one row, one payment', async () => {
+  await inTx(async (client) => {
+    const { author, idea } = await fixture(client, { completeness: 72 });
+    const args = { ideaId: idea.id, authorId: author.id, completenessScore: 72, config: COST_PLUS_ONLY };
+    const first = await credits.awardIdeaFullPassCredit(client, args);
+    const second = await credits.awardIdeaFullPassCredit(client, args);
+    const third = await credits.awardIdeaFullPassCredit(client, args);
+    assert.equal(first.credited, 5);
+    assert.equal(second.credited, 0);
+    assert.equal(second.reason, 'already_paid');
+    assert.equal(third.credited, 0);
+    assert.equal((await ledger(client, idea.id)).length, 1, 'WHERE NOT EXISTS held against a real engine');
+    const { rows: [b] } = await client.query('SELECT total_credits FROM builders WHERE id = $1', [author.id]);
+    assert.equal(Number(b.total_credits), 5, 'no double-pay reached the balance either');
+  });
+});
+
+await test('stream 1 — each shipped task under the idea pays, grade-scaled, once per task', async () => {
+  await inTx(async (client) => {
+    const { author, idea, tasks } = await fixture(client, { completeness: 80, taskCount: 3 });
+    let total = 0;
+    for (const t of tasks) {
+      const r = await credits.awardIdeaTaskShipCredit(client, { taskId: t.id, config: COST_PLUS_ONLY });
+      assert.equal(r.reason, 'paid', `task ${t.id} should pay`);
+      total += r.credited;
+    }
+    // round(5 × 80/100) = 4, three times.
+    assert.equal(total, 12);
+    // Re-driving every one pays nothing more.
+    for (const t of tasks) {
+      const again = await credits.awardIdeaTaskShipCredit(client, { taskId: t.id, config: COST_PLUS_ONLY });
+      assert.equal(again.credited, 0);
+      assert.equal(again.reason, 'already_paid');
+    }
+    const { rows: [b] } = await client.query('SELECT total_credits FROM builders WHERE id = $1', [author.id]);
+    assert.equal(Number(b.total_credits), 12, 'one idea, many tasks — paid per task, never twice');
+  });
+});
+
+await test('stream 3 — a board-ratified Full Idea books its completeness percent, once per idea', async () => {
+  await inTx(async (client) => {
+    const { author, idea } = await fixture(client, { completeness: 70 });
+    const args = { ideaId: idea.id, authorId: author.id, completenessScore: 70, config: COST_PLUS_ONLY };
+    const r = await credits.awardIdeaGovernancePassCredit(client, args);
+    assert.equal(r.credited, 70, "the owner's worked example: 70%-complete + passes = 70");
+    const again = await credits.awardIdeaGovernancePassCredit(client, args);
+    assert.equal(again.credited, 0);
+    assert.equal(again.reason, 'already_paid');
+    const rows = await ledger(client, idea.id);
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0].reason, `idea.credit.governance_pass:${idea.id}`);
+  });
+});
+
+await test('stream 3 — a constitutional amendment books nothing', async () => {
+  await inTx(async (client) => {
+    const { author, idea } = await fixture(client, { completeness: 90 });
+    const r = await credits.awardIdeaGovernancePassCredit(client, {
+      ideaId: idea.id, authorId: author.id, completenessScore: 90,
+      subjectType: 'constitutional_amendment', config: COST_PLUS_ONLY,
+    });
+    assert.equal(r.credited, 0);
+    assert.equal(r.reason, 'not_a_full_idea');
+    assert.equal((await ledger(client, idea.id)).length, 0);
+  });
+});
+
+await test('the spark split is real rows: 70/30 under ONE reason key, total conserved', async () => {
+  await inTx(async (client) => {
+    const { author, developer, idea } = await fixture(client, { completeness: 70, developed: true });
+    const r = await credits.awardIdeaGovernancePassCredit(client, {
+      ideaId: idea.id, authorId: author.id, completenessScore: 70, config: COST_PLUS_ONLY,
+    });
+    assert.equal(r.credited, 70);
+    const rows = await ledger(client, idea.id);
+    assert.equal(rows.length, 2, 'two payees, one reason — the builder-scoped predicate is load-bearing here');
+    assert.equal(rows[0].reason, rows[1].reason);
+    const byBuilder = new Map(rows.map((x) => [String(x.builder_id), Number(x.delta)]));
+    assert.equal(byBuilder.get(String(developer.id)), 49, '70% of 70, rounded');
+    assert.equal(byBuilder.get(String(author.id)), 21, 'the remainder — never independently rounded');
+  });
+});
+
+await test('all three streams coexist on one idea without double-paying', async () => {
+  await inTx(async (client) => {
+    const { author, idea, tasks } = await fixture(client, { completeness: 70, taskCount: 1 });
+    await credits.awardIdeaFullPassCredit(client, { ideaId: idea.id, authorId: author.id, completenessScore: 70, config: COST_PLUS_ONLY });
+    await credits.awardIdeaTaskShipCredit(client, { taskId: tasks[0].id, config: COST_PLUS_ONLY });
+    await credits.awardIdeaGovernancePassCredit(client, { ideaId: idea.id, authorId: author.id, completenessScore: 70, config: COST_PLUS_ONLY });
+    const rows = await ledger(client, idea.id);
+    const reasons = rows.map((r) => r.reason.split(':')[0]).sort();
+    assert.deepEqual([...new Set(reasons)], ['idea.credit.full_pass', 'idea.credit.governance_pass', 'idea.credit.task_ship']);
+    // 5 (grade) + round(5 × 0.7) = 4 (one shipped task) + 70 (ratification) = 79
+    const { rows: [b] } = await client.query('SELECT total_credits FROM builders WHERE id = $1', [author.id]);
+    assert.equal(Number(b.total_credits), 79, 'three distinct reasons, three distinct payments, no overlap');
+  });
+});
+
+// DELIBERATELY NOT ASSERTED HERE: claim 6, that the retired ADR 0023 slice no
+// longer fires alongside stream 1. The tempting test — call
+// awardIdeaTaskShipCredit, then check no `idea_promotion_bonus` row appeared —
+// is a TAUTOLOGY: that function contains no code path that could write that
+// reason, so the assertion passes without touching the thing claim 6 is about,
+// which is the CALL SITE in modules/lifecycle/db-ship.js. Driving the real
+// awardLandingCredit needs a claim/session fixture well beyond this harness, so
+// claim 6's evidence stays the static read recorded in the proof document
+// (db-ship.js:236 calls stream 1 and nothing else, and no ship path calls the
+// slice). A test that cannot fail is worse than no test: it reads as coverage.
+
+console.log(`\nidea_credit_streams_db: ${passed} passed, ${failed} failed`);
+await pool.end();
+if (failed > 0) process.exit(1);