@bongos/core 1.19.495 → 1.19.496

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.495",
-  "core_contract": "1.19.495",
-  "source_commit": "d456884599059e510055174cd419af14c2c4aa25",
+  "core_version": "1.19.496",
+  "core_contract": "1.19.496",
+  "source_commit": "8c795e90254fbc29139c278e0fd6d890b2c32035",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T14:19:17.928Z",
+  "built_at": "2026-09-03T14:22:08.467Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 425,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2387,
-  "tree_sha256": "70c64a38e950751b3798256814cad2f8fc49c6f093306e0f13207ac3ae1268a8",
+  "tree_sha256": "a6e4b7c3e281c43562758626b607ca7c0fa66491a11f41433d821d9a4e94d839",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2567,7 +2567,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9450319d43720c7c5a8867388bd1b7abd31cec031be4d87a36d40558a8cea235"
+      "sha256": "f7ca8307d5cae80f0602080d5d3fc9944cc15d9fc5d2fdf43f45d89626edd039"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5312,7 +5312,7 @@
     {
       "path": "modules/lifecycle/goal-advisory.js",
       "mode": "0000644",
-      "sha256": "9f1a2543b4e575f024fd5dd561c47fd804907a1f8db10ace5b552bdccfe5365e"
+      "sha256": "494c93f4cc64eb8dbc23039fa50a27b8242ba09b5afa0843ca985c807e312b6c"
     },
     {
       "path": "modules/lifecycle/goal-authz.js",
@@ -7212,12 +7212,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "fe8bbe65db50f3e1df895b6e263f8cc2794bee5f9b3d3bf2bf66f4a7ae974479"
+      "sha256": "cb12024e16aedcd701269af77cc73012013873d07e37301c24ae10e3c1f2d28b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "276cf342a895e91fb74c645c84072d1d5cdabb69fab6ae704d9b15fc769d9250"
+      "sha256": "ccfb94ab67d5acffc5c910496496a9cfbe44343ff52b90098857338dda375bae"
     },
     {
       "path": "public-docs/index.html",
@@ -8882,7 +8882,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8d95c79c602e1fc9d80490eaa31503705a481016a34fecb5d733b50bad9c0db6"
+      "sha256": "2b403360f3b811aecd3de800ebb5cb87dbc5df36e045754184dd3924abc187f9"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9917,7 +9917,7 @@
     {
       "path": "tests/goal_advisory.mjs",
       "mode": "0000644",
-      "sha256": "1b1c403574132def4c4beb98595987e90b720a851f29e42f643f1f00f285da5c"
+      "sha256": "1a7498e0a1927485db9a9e99b19012dc7df91825b11077b283a95b23971fe86e"
     },
     {
       "path": "tests/goal_category.mjs",

package/docs/module-api-changelog.md

@@ -1427,5 +1427,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.493 with no explicit bump. run 33697218855. (task 1002620)
   1.19.495 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.494 with no explicit bump. run 33766103175. (task 1002620)
+  1.19.496 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.495 with no explicit bump. run 33766363834. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/goal-advisory.js

@@ -40,8 +40,14 @@ function generalGoalTitle(versionId) {
 // authorization gate. This is advice appended to a request that ALREADY SUCCEEDED;
 // a wrong guess here nags a builder about a task that is fine, which is worse than
 // staying quiet. A missing versionId or an unreadable goal title yields null.
-function adviseGoal({ versionId, goalId, goalTitle } = {}) {
+//
+// kind='bug' is a THIRD silent case (task 1003214, idea 1000828 — the owner
+// directive against manufacturing small goals): a fix sitting in the catch-all,
+// or with no goal at all, is already where it belongs, so both reasons above
+// collapse to null for a bug. The nudge is for homeless FEATURE work only.
+function adviseGoal({ versionId, goalId, goalTitle, kind } = {}) {
   if (goalId == null) {
+    if (kind === 'bug') return null;
     return {
       reason: 'no_goal',
       message: 'This task has no goal to live in — no scope wall, no done-when criteria gating it, '
@@ -53,6 +59,7 @@ function adviseGoal({ versionId, goalId, goalTitle } = {}) {
   }
   if (versionId == null || typeof goalTitle !== 'string') return null;
   if (goalTitle !== generalGoalTitle(versionId)) return null;
+  if (kind === 'bug') return null;
   return {
     reason: 'catch_all',
     message: `This task landed in "${goalTitle}", the version's catch-all bucket rather than a real goal — `
@@ -93,6 +100,7 @@ async function buildGoalAdvisory({ db, versionId, task }) {
       versionId,
       goalId: task.goal_id,
       goalTitle: homeGoal && homeGoal.title,
+      kind: task.kind,
     });
     if (!verdict) return null;
     // LIMIT 6, not 6-in-JS: Postgres truncates instead of shipping every open goal

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.495",
+  "version": "1.19.496",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.495",
+      "version": "1.19.496",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.495",
+  "version": "1.19.496",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.495'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.496'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_advisory.mjs

@@ -55,10 +55,30 @@ await test('catch_all — landing in "<version> — general" is a bucket, not a
   assert.equal(a.goal_id, 3, 'names the catch-all so a caller can PATCH away from it');
 });
 
+// task 1003214 (idea 1000828): a bug in the catch-all is where it belongs, so the
+// advisory goes silent (reuses the same null the module already uses for "no
+// advice needed").
+await test("kind='bug' in the catch-all is quiet — a fix is where it belongs", () => {
+  assert.equal(adviseGoal({ versionId: V, goalId: 3, goalTitle: generalGoalTitle(V), kind: 'bug' }), null);
+});
+
+await test("kind='feature' in the catch-all still gets the nudge — quiet is bug-only", () => {
+  const a = adviseGoal({ versionId: V, goalId: 3, goalTitle: generalGoalTitle(V), kind: 'feature' });
+  assert.equal(a.reason, 'catch_all');
+});
+
+await test("kind='bug' with no goal at all is quiet too — a fix needs no home to be filed correctly", () => {
+  assert.equal(adviseGoal({ versionId: V, goalId: null, kind: 'bug' }), null);
+});
+
 await test('a REAL goal is silent — null, not an empty object', () => {
   assert.equal(adviseGoal({ versionId: V, goalId: 1000025, goalTitle: 'Builder experience — hall, dev box, and skills' }), null);
 });
 
+await test("kind='bug' under a real goal is silent too — already silent, kind changes nothing", () => {
+  assert.equal(adviseGoal({ versionId: V, goalId: 1000025, goalTitle: 'Builder experience — hall, dev box, and skills', kind: 'bug' }), null);
+});
+
 // The bug this guards: a near-miss title must not be mistaken for the catch-all.
 // db.generalGoalIdForVersion resolves the SAME string, so if these two ever disagree
 // a task would be filed into a goal the advisory then calls orphaned (or vice versa).
@@ -164,6 +184,14 @@ await test('buildGoalAdvisory: the catch-all is detected and named', async () =>
   assert.equal(a.goal_id, 3);
 });
 
+// task 1003214: the full POST /tasks path (buildGoalAdvisory reads task.kind
+// off the already-committed row) for a bug landed in the catch-all — silent.
+await test("buildGoalAdvisory: kind='bug' in the catch-all yields null end to end", async () => {
+  const db = stubDb({ goal: { id: 3, title: generalGoalTitle(V) }, goals: [] });
+  const a = await buildGoalAdvisory({ db, versionId: V, task: { id: 7, goal_id: 3, kind: 'bug' } });
+  assert.equal(a, null);
+});
+
 // The invariant a future refactor will quietly break. Both DB calls are covered:
 // getGoal is only reached when goal_id is set, listGoals only on the unhappy path.
 await test('NON-BLOCKING: buildGoalAdvisory returns null when getGoal throws', async () => {