@bongos/core 1.19.50 → 1.19.51

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.50",
-  "core_contract": "1.19.50",
-  "source_commit": "1a7b11b4377e9fefb36560c0cda9d4b1030a05c9",
+  "core_version": "1.19.51",
+  "core_contract": "1.19.51",
+  "source_commit": "fe0b1449ce7c972b972778e74945261c35565c48",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:44:57.114Z",
+  "built_at": "2026-08-11T18:53:46.990Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1529,
-  "tree_sha256": "e96a0d29e2d6adc516aaa0d095dbb1c4d543dbec0508228b2cbcf16a1b400dbd",
+  "tree_sha256": "c3aec243f4a401c529edd9c426192e56b1264abfa615e29045ac5cf054e33d57",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "649065862779b6a9b871607debfee5ca18bde8cccbde4d00ea42b0d175938c9d"
+      "sha256": "a5b9642b383c8c415158e091785ff40f28490d8341b4010f4c051b1a68942daf"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1307,12 +1307,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "8f83ea78edb348688196414bf2fb7352df3de0ded6abbbe44f2371c099431016"
+      "sha256": "27e9c0ab46db5386833b9e03bcff0dae31f4606882e845e7e830f9ef6f2550b5"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "27cf9c2b8548168f13dd2add1633bc9b3ca57f2fd5aa3b42ac8dbfb5cf60c41f"
+      "sha256": "612c7a81756f61f2c18d4b35540379cf63f32a4caa9e8d84a64b247d497ad7a3"
     },
     {
       "path": "docs/architecture.md",
@@ -3387,7 +3387,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "57c88852ff0aa9f0b3673fa62b35f352d92cc9070e7872137003e395c42eb026"
+      "sha256": "8e67cd1325da44cf95d5d8c34427222e555e0458bb17f23f33c1055b1ae7e211"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3492,7 +3492,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "8a6ecd6c7ecadcbec79483a589fef11957d13e2c94b569a9ff9da97f2908b713"
+      "sha256": "68b4f47e3a5016645893c60eca2fe11a242012abf6625c99d6a774356d82d1ce"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4037,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ffd1f91d40f2098324c3054cd3accdfdf210a668972dcb8702104cd11ed6c4dc"
+      "sha256": "43bd308850fdf28f3fa803c778af55a4a86e72edb62ccd8dc2d3297da95efbe2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cd444deb3940b96b8afedb89f5ece513d842d4a9148b3a50304d8d77866dd904"
+      "sha256": "a402f396d0bfd5b10f24685a15ac36f9022c182db018787fbdd96b296e26c5db"
     },
     {
       "path": "public-docs/index.html",
@@ -5662,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2d8b78d34893b1e4c25d081c343ad1b0d1deb2a675cae9a3c4e96500c6cea821"
+      "sha256": "3c2f62e446506de3fa855989e8606aad486566e37eed47b61c3a18b835a404f4"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6882,7 +6882,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "08db201ebec44ea5a711e3c86e36dda63ec22881a400e910dd7c64961c80f6e9"
+      "sha256": "6755c9568cd6cdb7b8600ae2c6651856d63c053684dcb8b765f7329590a9fc08"
     },
     {
       "path": "tests/migration_namespace.mjs",

package/clients/bongos-client/index.d.ts

@@ -131,7 +131,7 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
-export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; status?: unknown }
+export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; status?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }
 export interface PostAccessRequestsResponse { ok: boolean; request?: unknown; already_pending?: boolean }
 export interface PostAuthAppPairApproveRequest { pair_code: string }

package/docs/api/openapi.json

@@ -13792,6 +13792,11 @@
           "needs_migration": {
             "type": "boolean"
           },
+          "description": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 50000
+          },
           "status": {}
         },
         "additionalProperties": false

package/docs/api-reference.md

@@ -463,7 +463,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/tasks` | `any-builder` | — | reads (filtered task list); preserved per CRITICAL §4. |
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
-| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
+| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
 | POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |

package/modules/lifecycle/db.js

@@ -1477,7 +1477,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
-  'needs_migration', 'module_key',
+  'needs_migration', 'module_key', 'description',
 ]);
 
 async function updateTaskColumn(id, column, value) {
@@ -1532,6 +1532,12 @@ async function updateTaskGoal(id, goalId) {
 
 async function updateTaskKind(id, kind) { return updateTaskColumn(id, 'kind', kind); }
 
+// task 1002647 (choke-point map s4.3): the task body is a load-bearing prompt —
+// it was settable only at create, un-editable at every rank. Editable now under
+// the same task.edit permission as the other planning fields; the global
+// write-audit middleware captures each edit's new body in audit_log.
+async function updateTaskDescription(id, description) { return updateTaskColumn(id, 'description', description); }
+
 
 async function updateTaskDiscipline(id, discipline) { return updateTaskColumn(id, 'discipline', discipline); }
 
@@ -5457,6 +5463,7 @@ module.exports = {
   updateTaskGoal,
   createCriterion,
   updateTaskKind,
+  updateTaskDescription,
   updateTaskDiscipline,
   updateTaskNewcomerFriendly,
   updateTaskRequiresRank,

package/modules/lifecycle/routes/tasks.js

@@ -793,6 +793,12 @@ module.exports = function buildTasksRouter() {
       security_sensitive: { type: 'boolean' },           // task 990 — Archon-only ship broadcast
       automation_tag: { type: 'string', maxLength: 64 },
       needs_migration: { type: 'boolean' },              // task 1002648 — correct the create-time heuristic's flag (the claim-time allocator keys off it)
+      // task 1002647 (map s4.3): the task body is a load-bearing builder prompt
+      // and was settable only at create — no route edited it at any rank. Now
+      // editable under this route's task.edit permission. minLength 1: a body
+      // can be rewritten, never blanked (and null is refused by the type check).
+      // Each edit's new body lands in audit_log via the write-audit middleware.
+      description: { type: 'string', minLength: 1, maxLength: LIMITS.DESCRIPTION },
       // task 1002614 (map D-18): DECLARED so strict-mode admits the request far
       // enough to reach the deliberate status_not_patchable hint below (#514) —
       // the hint had been unreachable dead code behind unknown_field since the
@@ -818,6 +824,7 @@ module.exports = function buildTasksRouter() {
     const hasRequiresRank = Object.prototype.hasOwnProperty.call(body, 'requires_rank');
     const hasModuleKey = Object.prototype.hasOwnProperty.call(body, 'module_key');
     const hasGoalId = Object.prototype.hasOwnProperty.call(body, 'goal_id');
+    const hasDescription = Object.prototype.hasOwnProperty.call(body, 'description');
     // #514: status is a lifecycle field, not a PATCH-able column — it moves only
     // through the dedicated transition routes. The #506 session tried
     // `PATCH status=ready`, got the generic no_supported_fields error, and had
@@ -829,8 +836,8 @@ module.exports = function buildTasksRouter() {
     if (Object.prototype.hasOwnProperty.call(body, 'status')) {
       return res.fail('status_not_patchable', { status: 400, message: STATUS_HINT });
     }
-    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId) {
-      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
+    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription) {
+      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, description, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
     // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
     // ---- FIRST write. The previous shape validated-and-wrote per field in ----
@@ -976,6 +983,15 @@ module.exports = function buildTasksRouter() {
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
       }
     }
+    if (hasDescription) {
+      try {
+        updated = await db.updateTaskDescription(id, body.description);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id description', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
     if (hasGoalId) {
       try {
         updated = await db.updateTaskGoal(id, body.goal_id);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.50",
+  "version": "1.19.51",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.50",
+      "version": "1.19.51",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.50",
+  "version": "1.19.51",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -527,8 +527,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.48 with no explicit bump. run 31523559509. (task 1002620)
 //   1.19.50 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.49 with no explicit bump. run 31524280584. (task 1002620)
+//   1.19.51 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.50 with no explicit bump. run 31525032273. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.50'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.51'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/migration_allocation.mjs

@@ -197,6 +197,7 @@ function shouldReserveMigrationNumber(task) {
         [() => db.updateTaskAutomationTag(1, 'live-only'), 'automation_tag'],
         [() => db.updateTaskNeedsMigration(1, false), 'needs_migration'],
         [() => db.updateTaskModuleKey(1, null), 'module_key'],
+        [() => db.updateTaskDescription(1, 'edited body'), 'description'], // task 1002647
       ];
       for (const [call, column] of setters) {
         const before = seen.length;