@bongos/core 1.19.555 → 1.19.556

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.555",
-  "core_contract": "1.19.555",
-  "source_commit": "24fee783e3642be3f89811525120bcc2714f4fe7",
+  "core_version": "1.19.556",
+  "core_contract": "1.19.556",
+  "source_commit": "630915928321f40355bf907504db7d3808103819",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T16:20:21.615Z",
+  "built_at": "2026-09-06T16:24:47.828Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 443,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2019,
+    "functional_verbatim": 2020,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2486,
-  "tree_sha256": "d57c07e4504ac8b16360e27f874cfc39373a7dfc066c854f1da2e7cb84443a6f",
+  "file_count": 2487,
+  "tree_sha256": "8afebde5b8e0633b5f7bab9c710cf9377d7723223debe626b5d25141306945b8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2657,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4fbdf9b8a0c6ed21e403472dcec14bfc4cad53d58e43dd717e6bea8531a8cb47"
+      "sha256": "f11f56a37c620d20df67c30b4b52a4028f716ec76ab81f6089365a0177191095"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5647,7 +5647,7 @@
     {
       "path": "modules/lifecycle/routes/goal-route-authz.js",
       "mode": "0000644",
-      "sha256": "be82985479547bd602dbad544b5e71a3c491cea3c7b0273394c136f1df675b37"
+      "sha256": "909686de2d34b184e9676370782e4b07179b784c72eb6db4af22399051b15642"
     },
     {
       "path": "modules/lifecycle/routes/goals.js",
@@ -5697,7 +5697,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "0a086a473b3e0267b4ad250a98a6551c952370da5bfdf5232738e04b0eaf59d6"
+      "sha256": "f8fb76f7aaf035974472c011a379b450ee001adc33c01c56ed8a38a3dc4a8fc8"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -7477,12 +7477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "04c6a38f5cf60c8912b9254235861cc431f7af898d7ae34924248f34c9f62ac2"
+      "sha256": "9572c814d88a40b50276ab717eda1552f5e5083f619aca169a1f769ab85605e1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "057cb53bcef464cfe8d189bbc80b9d9860a32c19b20e33a6ae58ce64b1aeb775"
+      "sha256": "6ce32885b125422348ef232ab9dc1aed9b542e40331f9c34d84b985e9dc69608"
     },
     {
       "path": "public-docs/index.html",
@@ -9177,7 +9177,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "aa7e5a37bf8cdacca8bd176ac732662b81d868df50e21930a23517c040882534"
+      "sha256": "07e66085dcd49d32044edf2caca55c4a3f5ec8d9f150281ed0e97c5859a6cb6e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11322,7 +11322,7 @@
     {
       "path": "tests/patch_gate_ordering.mjs",
       "mode": "0000644",
-      "sha256": "0412f6874d6046b7f74025b2b14c90cf345e904769502c2679365cd6d1fb8b11"
+      "sha256": "b0690cf28c30bfa4ef1ecc4ceffa7d4be1666dbb09a6605ceb02cc057d2a9cc4"
     },
     {
       "path": "tests/path_match.mjs",
@@ -12244,6 +12244,11 @@
       "mode": "0000644",
       "sha256": "514be815c0466e4e2865ad85cb7a2ca206e5b46abc7b345da2c36278667c8bb2"
     },
+    {
+      "path": "tests/task_goal_open_gate.mjs",
+      "mode": "0000644",
+      "sha256": "93a5d1e91bfea7af8487b409e60cd609ea25a690df9099d278ebd35f253abcb8"
+    },
     {
       "path": "tests/task_lib.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1559,5 +1559,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.553 with no explicit bump. run 34044540046. (task 1002620)
   1.19.555 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.554 with no explicit bump. run 34045075186. (task 1002620)
+  1.19.556 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.555 with no explicit bump. run 34045323629. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/routes/goal-route-authz.js

@@ -44,14 +44,36 @@ async function isMemberOrArchon(builder, goalId) {
 // (grader permission/route-rank pre-passes + serverSideGuards, gate-review
 // ESCALATE floor, post-push main-audit — ADR 0086 §7). Returns { ok:true } or
 // { ok:false, status, body } (the exact HTTP status + JSON the route sends).
+// goalNotOpenRefusal — the ONE definition of "this goal takes no new work", so the
+// three vectors that can put a task into a goal cannot drift apart (BV1.R05, task
+// 1003590, goal 1000086). Returns null when the goal is open, or the refusal's
+// parts when it is not; each caller renders them in its own idiom (this module's
+// { ok, status, body }, or res.fail in task-write-routes.js). Assumes the caller
+// has already established the goal EXISTS — a missing goal is a 404, a different
+// answer to a different question.
+//
+// Only 'open' takes new work: 'achieved' and 'archived' are closures, and a task
+// added to either is exactly how a goal that reported done silently reacquires
+// unfinished work.
+function goalNotOpenRefusal(goal) {
+  if (goal && goal.status === 'open') return null;
+  return {
+    status: 409,
+    error: 'goal_not_open',
+    goalStatus: goal ? goal.status : null,
+    message: 'Tasks can only be authored under an open goal.',
+  };
+}
+
 function authorizeGoalTaskCreate({ goal, version, isMember, builderRank, touches }) {
   if (!goal) {
     return { ok: false, status: 404, body: { error: 'goal_not_found' } };
   }
-  if (goal.status !== 'open') {
-    return { ok: false, status: 409, body: {
-      error: 'goal_not_open', status: goal.status,
-      message: 'Tasks can only be authored under an open goal.',
+  const notOpen = goalNotOpenRefusal(goal);
+  if (notOpen) {
+    return { ok: false, status: notOpen.status, body: {
+      error: notOpen.error, status: notOpen.goalStatus,
+      message: notOpen.message,
     } };
   }
   if (!isMember) {
@@ -445,6 +467,7 @@ module.exports = {
   authorizeRescindInvitation,
   authorizeWithdrawJoinRequest,
   decorateGoalScope,
+  goalNotOpenRefusal,
   isMemberOrArchon,
   protectedScopeAdmissionBlock,
 };

package/modules/lifecycle/routes/task-write-routes.js

@@ -26,6 +26,7 @@ const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, VOTABLE_TASK_STATUSES,
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
 const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, detectsMigration } = require('./task-route-helpers.js');
+const { goalNotOpenRefusal } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 
@@ -169,6 +170,16 @@ module.exports = function registerTaskWriteRoutes(router) {
       if (!goal || String(goal.version_id) !== String(body.version_id)) {
         return res.fail('bad_goal_id', { status: 400, message: `goal_id ${body.goal_id} does not exist on version '${body.version_id}'.` });
       }
+      // BV1.R05 (task 1003590, goal 1000086): a task may only be authored under
+      // an OPEN goal. `POST /goals/:id/tasks` has always refused this via
+      // authorizeGoalTaskCreate; this vector validated only existence + version,
+      // so the same task refused on the goal-scoped route landed in an achieved
+      // or archived goal when created here. Same named 409, deliberately, so a
+      // caller handles ONE code rather than learning which door it came through.
+      const notOpen = goalNotOpenRefusal(goal);
+      if (notOpen) {
+        return res.fail(notOpen.error, { status: notOpen.status, message: notOpen.message, details: { goal_status: notOpen.goalStatus } });
+      }
     }
     try {
       const task = await db.createTask({
@@ -401,6 +412,13 @@ module.exports = function registerTaskWriteRoutes(router) {
         if (String(goal.version_id) !== String(task.version_id)) {
           return res.fail('goal_version_mismatch', { status: 409, message: `Goal #${goalId} is in version '${goal.version_id}' but task #${id} is in '${task.version_id}'. A task can only join a goal in its own version.` });
         }
+        // BV1.R05 (task 1003590, goal 1000086): the same open-goal rule as the
+        // create vectors. Moving a task INTO a closed goal is how a goal that
+        // reported achieved silently reacquires unfinished work.
+        const notOpen = goalNotOpenRefusal(goal);
+        if (notOpen) {
+          return res.fail(notOpen.error, { status: notOpen.status, message: notOpen.message, details: { goal_status: notOpen.goalStatus } });
+        }
       } catch (err) {
         log.error('[gds] PATCH /tasks/:id goal_id', err);
         return res.fail('patch_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.555",
+  "version": "1.19.556",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.555",
+      "version": "1.19.556",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.555",
+  "version": "1.19.556",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.555'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.556'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/patch_gate_ordering.mjs

@@ -42,6 +42,9 @@ const REFUSALS = [
   "'bad_goal_id'",
   "'goal_not_found'",
   "'goal_version_mismatch'",
+  // BV1.R05 (task 1003590): the open-goal refusal joins the list — it is
+  // rendered from goalNotOpenRefusal, so the pin looks for the call.
+  'goalNotOpenRefusal(goal)',
   "'bad_requires_rank'",
   'badKind(res)',
   "'bad_discipline'",

package/tests/task_goal_open_gate.mjs

@@ -0,0 +1,141 @@
+// tests/task_goal_open_gate.mjs — a task may only be authored under an OPEN goal,
+// on every vector that can put one there (BV1.R05, task 1003590, goal 1000086).
+//
+// THE ASYMMETRY THIS CLOSES. `POST /goals/:id/tasks` has always refused a closed
+// goal — it runs the ordered gate `authorizeGoalTaskCreate`, whose second check is
+// `goal_not_open`. The other two vectors did not: `POST /tasks` validated only that
+// the goal EXISTS and belongs to the version, and `PATCH /tasks/:id` only that the
+// versions match. So the very same task, refused at the goal-scoped door, landed in
+// an `achieved` or `archived` goal when created through the general one — which is
+// how a goal that reported done silently reacquires unfinished work, the failure
+// goal 1000086 exists to make impossible.
+//
+// The refusal is now ONE predicate, `goalNotOpenRefusal`, consumed by all three, so
+// a caller handles a single named 409 rather than learning which door it came
+// through — and the three cannot drift apart later. This file pins the predicate's
+// behaviour, that each vector actually consumes it, and that the shared 409 stays
+// named the same on the goal-scoped route.
+//
+// Run:  node --test tests/task_goal_open_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const authz = require('../modules/lifecycle/routes/goal-route-authz.js');
+const { goalNotOpenRefusal, authorizeGoalTaskCreate } = authz;
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const WRITE_ROUTES = src('modules/lifecycle/routes/task-write-routes.js');
+
+// The handler slices, so "the vector consumes the predicate" is asserted about the
+// right handler rather than anywhere in a 1,000-line file.
+function slice(source, start, end) {
+  const a = source.indexOf(start);
+  assert.notEqual(a, -1, 'handler not found: ' + start);
+  // `end` absent means the handler runs to the end of the file — PATCH /tasks/:id
+  // is currently the last route declared here, and a slice that silently came back
+  // empty would make every assertion below pass vacuously.
+  const b = end ? source.indexOf(end, a + 1) : source.length;
+  assert.notEqual(b, -1, 'no route follows: ' + start);
+  const out = source.slice(a, b);
+  assert.ok(out.length > 500, 'the slice must actually contain the handler');
+  return out;
+}
+const POST_TASKS = slice(WRITE_ROUTES, "router.post('/tasks'", "router.patch('/tasks/:id'");
+const PATCH_TASK = slice(WRITE_ROUTES, "router.patch('/tasks/:id'", null);
+
+// ---- the predicate ----------------------------------------------------------
+
+test('open takes new work; achieved and archived do not', () => {
+  assert.equal(goalNotOpenRefusal({ status: 'open' }), null,
+    'an open goal is the only one that takes new work');
+  for (const status of ['achieved', 'archived']) {
+    const r = goalNotOpenRefusal({ status });
+    assert.ok(r, status + ' must refuse');
+    assert.equal(r.status, 409);
+    assert.equal(r.error, 'goal_not_open');
+    assert.equal(r.goalStatus, status, 'the caller can say WHICH closure refused');
+  }
+});
+
+test('an unknown or absent status refuses — the predicate is fail-closed', () => {
+  // Not a hypothetical: a future goal status nobody taught this function about
+  // must not become a hole. Anything that is not exactly 'open' is refused.
+  assert.ok(goalNotOpenRefusal({ status: 'paused' }), 'an unknown status is not open');
+  assert.ok(goalNotOpenRefusal({}), 'a goal row with no status is not open');
+  assert.ok(goalNotOpenRefusal(null), 'a nullish goal is not open');
+  assert.equal(goalNotOpenRefusal(null).goalStatus, null,
+    'and it reports no status rather than throwing');
+});
+
+// ---- the three vectors ------------------------------------------------------
+
+test('POST /goals/:id/tasks — the ordered gate still renders the same 409', () => {
+  const out = authorizeGoalTaskCreate({
+    goal: { id: 1, status: 'archived', version_id: 'V1' },
+    version: { id: 'V1', status: 'building' },
+    isMember: true, builderRank: 'metic', touches: [],
+  });
+  assert.equal(out.ok, false);
+  assert.equal(out.status, 409);
+  assert.equal(out.body.error, 'goal_not_open');
+  assert.equal(out.body.status, 'archived',
+    "the goal-scoped route's body shape is unchanged by the extraction");
+});
+
+test('POST /tasks consumes the shared predicate and refuses with its code', () => {
+  assert.match(POST_TASKS, /const notOpen = goalNotOpenRefusal\(goal\);/,
+    'the general create vector must ask the same question');
+  assert.match(POST_TASKS, /res\.fail\(notOpen\.error, \{ status: notOpen\.status/,
+    'and render that answer, rather than a second hand-typed 409');
+});
+
+test('PATCH /tasks/:id consumes it too — moving INTO a closed goal is the same act', () => {
+  assert.match(PATCH_TASK, /const notOpen = goalNotOpenRefusal\(goal\);/);
+  assert.match(PATCH_TASK, /res\.fail\(notOpen\.error, \{ status: notOpen\.status/);
+});
+
+test('no task-authoring vector re-types the refusal behind the predicate', () => {
+  // The point of the extraction: three copies of `goal.status !== 'open'` is three
+  // things to forget to update. Scoped to the vectors that author a TASK — the
+  // other `goal_not_open` refusals in goal-route-authz.js (membership change,
+  // ownership transfer, join request, invitation accept) share the code but answer
+  // different questions with their own messages, and folding them into this
+  // predicate would flatten four distinct explanations into one.
+  const AUTHZ = src('modules/lifecycle/routes/goal-route-authz.js');
+  const gateStart = AUTHZ.indexOf('function authorizeGoalTaskCreate');
+  assert.notEqual(gateStart, -1);
+  const taskAuthoring = [
+    ['task-write-routes.js', WRITE_ROUTES],
+    ['authorizeGoalTaskCreate', AUTHZ.slice(gateStart, AUTHZ.indexOf('\nfunction ', gateStart + 1))],
+  ];
+  for (const [name, body] of taskAuthoring) {
+    const hand = body.match(/goal\.status !== 'open'/g) || [];
+    assert.equal(hand.length, 0,
+      name + ' must call goalNotOpenRefusal, not compare goal.status itself');
+  }
+  assert.match(AUTHZ, /goal && goal\.status === 'open'/,
+    'the one comparison lives inside the predicate');
+});
+
+// ---- the refusal is reachable, i.e. it precedes the write -------------------
+
+test('POST /tasks settles the refusal BEFORE it creates anything', () => {
+  const gate = POST_TASKS.indexOf('goalNotOpenRefusal');
+  const write = POST_TASKS.indexOf('await db.createTask(');
+  assert.notEqual(write, -1, 'the create call must be in this slice');
+  assert.ok(gate !== -1 && gate < write,
+    'a refusal after the insert is not a refusal — it is a row plus an error');
+});
+
+test('PATCH /tasks/:id settles it before the first update write (the G-22 rule)', () => {
+  const gate = PATCH_TASK.indexOf('goalNotOpenRefusal');
+  const write = PATCH_TASK.search(/await db\.updateTask\w+\(/);
+  assert.notEqual(write, -1, 'an updateTask* write must be in this slice');
+  assert.ok(gate !== -1 && gate < write,
+    'task 1002609 G-22: authorization settles before any field is written');
+});