@bongos/core 1.19.56 → 1.19.58

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.56",
-  "core_contract": "1.19.56",
-  "source_commit": "0d53ea0c55e27185532763b669dd008990ef4c15",
+  "core_version": "1.19.58",
+  "core_contract": "1.19.58",
+  "source_commit": "138d3a9bbd75c0edac9f89c279e76e9ce9789b0b",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T20:52:25.036Z",
+  "built_at": "2026-08-11T23:20:42.316Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1529,
-  "tree_sha256": "04e6b2b1fce01ae88706efee727647c81f1124bab26434229dffa6cc02c53663",
+  "tree_sha256": "08cfb44880c063d98dfdd34b729592669fd80917f30027532bf691f3f0a2abe4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3057,7 +3057,7 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "bacccdcedf5abfe57ebe6ae4f521f00dace123c11509554b2ef6c934fde2afb4"
+      "sha256": "fcfe94b3e0cd00ddc881283d9897121518a7acc00b3d05b0715552911e2a0705"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
@@ -3382,7 +3382,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "89febe6a0002d2277a61b14cc08c4076d1ab6c738fdea8f8a4a1348e330c0b9e"
+      "sha256": "37303ffa7a795ea41db83f346bc736898720a3d1521434f566a71bbeb7b4dc15"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3477,7 +3477,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "9651f16e968983ab378aabc3d2a5e3d6ef6ba3fc3aaa00727fc5aff673b8d10e"
+      "sha256": "a291701ef3b3f8bb548d8e3475707e52562d0c9f03d334a885ff2022c90358dc"
     },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
@@ -4032,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cb6369b4e8b98aeb502ff170d6d9f49c8b9155f5fa7c63698bf0379233acead8"
+      "sha256": "32227d0bece0f036772ed8a6f01a5aee0ea6c47d81b471a3e7cf734aeb24f1ed"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f460270fbecb69d9310b33c0274f122b561b45fd0a567758948c2921913a8c1a"
+      "sha256": "b2931ffd8ff5d2fd5d320c3c435e3bc16d59a2757c248529d6160f305216a24d"
     },
     {
       "path": "public-docs/index.html",
@@ -5657,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "18e724e13e387b61822904c5e435d28cce5cc57e95ab710db3bbf9fde238858b"
+      "sha256": "98dd7f963174211b172a2023fe2d13a249362d7471d59ab6eb411424332bee3f"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6497,7 +6497,7 @@
     {
       "path": "tests/goal_membership_requests.mjs",
       "mode": "0000644",
-      "sha256": "5a90f9030e1e50a62779460788ac6a56374fd36a839adf40433dd6a184a9b787"
+      "sha256": "4bc1ecb2bec4345b55e074a06009d31f97e4b5e06b214669a72e485298307ac8"
     },
     {
       "path": "tests/goal_routes.mjs",
@@ -6512,7 +6512,7 @@
     {
       "path": "tests/goal_tier.mjs",
       "mode": "0000644",
-      "sha256": "b2f2a0d1bb3c518f1a23a203d2525c1e27bd13f02bc52b287d82219af13ca383"
+      "sha256": "508b8b99afe67f64c86b5e1b382052e02a4cc916bec58e28d396ba3716998baf"
     },
     {
       "path": "tests/goal_wall_proof.mjs",

package/modules/hall-ui/public/goals-page.js

@@ -1237,7 +1237,13 @@
       // manager-only).
       const lockSpan = g.visibility === 'private'
         ? '<span class="goal-badge goal-badge--locked" title="Private — join is by invitation or an approved request">🔒 Private</span>' : '';
-      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${lockSpan} ${scope} ${depsSpan}`;
+      // task 1002689 — a PROTECTED-scope goal is join-gated too (Archon-mediated
+      // membership, ADR 0086 §3): badge it so it doesn't read as open-join. The
+      // flag is server-derived (scope_protected on the goal payload) — the client
+      // still never re-derives the protected roster.
+      const gateSpan = g.scope_protected
+        ? '<span class="goal-badge goal-badge--locked" title="Protected module scope — join by request; an Archon admits members">🛡 Archon-mediated</span>' : '';
+      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${lockSpan} ${gateSpan} ${scope} ${depsSpan}`;
     }
 
     // task 1762: the goal's own owner/manager (or an Archon) can invite/manage
@@ -1266,11 +1272,13 @@
 
   // task 1953 — the goal-detail Actions row: Leave/Join (unchanged), a manager's
   // Private/Public toggle (PATCH /goals/:id/visibility), and — for a non-member
-  // viewer of a PRIVATE goal — Request to join / Requested (withdraw) in place of
-  // Join (private goals are join-GATED: POST /goals/:id/join 409s goal_private for
-  // a non-Archon non-member). An Archon keeps the plain Join button: the server
-  // lets them self-join any goal regardless of visibility (POST /goals/:id/join),
-  // so "request" would be a pointless extra step for them.
+  // viewer of a PRIVATE or PROTECTED-scope goal — Request to join / Requested
+  // (withdraw) in place of Join. Both are join-GATED for a non-Archon non-member:
+  // POST /goals/:id/join 409s goal_private on a private goal and 403s
+  // archon_approval_required on a protected-scope one, while the server accepts a
+  // join-request on either (task 1002689 — scope_protected is server-derived on
+  // the goal payload). An Archon keeps the plain Join button: the server lets
+  // them self-join any goal, so "request" would be a pointless extra step.
   function renderActions(g, { joined, canManage }) {
     const actions = $('#goal-detail-actions');
     if (!actions) return;
@@ -1283,7 +1291,7 @@
     if (g.status === 'open') {
       if (joined) {
         parts.push('<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>');
-      } else if (g.visibility === 'private' && !isArchon()) {
+      } else if ((g.visibility === 'private' || g.scope_protected) && !isArchon()) {
         if (state.myPendingRequest) {
           parts.push('<span class="role-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
           parts.push('<button class="btn-ghost" id="goal-withdraw-btn" type="button">Withdraw</button>');
@@ -1468,7 +1476,7 @@
       renderList();
     } catch (err) {
       const code = err?.data?.error;
-      if (code === 'archon_approval_required') toast('This goal is Archon-mediated — an Archon must add you.');
+      if (code === 'archon_approval_required') toast('This goal is Archon-mediated — request to join instead.');
       else if (code === 'goal_private') toast('This goal is private — request to join instead.');
       else if (code === 'not_a_member') toast('You are not a member of this goal.');
       else if (code === 'goal_not_open') toast('This goal is not open.');

package/modules/lifecycle/db.js

@@ -823,16 +823,20 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
   return { achieved: true, goal: updated };
 }
 
-// addGoalMember — join (or change role on re-join). Upserts on the (goal_id,
-// builder_id) PK so a member re-joining as lead is promoted, not a duplicate-key
-// error. role defaults to 'member'.
+// addGoalMember — join. Upserts on the (goal_id, builder_id) PK so a re-join is
+// not a duplicate-key error, and the conflict arm PRESERVES the stored role
+// (task 1002689): overwriting it let POST /goals/:id/join (always role 'member')
+// and a POST /goals/:id/members re-add silently demote a lead — including the
+// owner's row — bypassing authorizeMemberRoleChange's owner-only-demotion
+// guards. Role changes go through PATCH /goals/:id/members/:builderId only
+// (the acceptMembershipRequestAndAddMember precedent). role defaults to 'member'.
 
 async function addGoalMember({ goalId, builderId, role = 'member' }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `INSERT INTO goal_members (goal_id, builder_id, role)
           VALUES ($1, $2, $3)
-     ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = EXCLUDED.role
+     ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
      RETURNING goal_id, builder_id, role, joined_at`,
     [goalId, builderId, role]
   );

package/modules/lifecycle/routes/goals.js

@@ -373,6 +373,16 @@ function authorizeWithdrawJoinRequest({ request, goalId, actorId }) {
   return { ok: true };
 }
 
+// decorateGoalScope — additive, derived scope_protected flag on goal payloads
+// (task 1002689). A protected-scope goal is join-gated like a private one
+// (Archon-mediated membership, ADR 0086 §3), but the hall cannot re-derive the
+// protected roster client-side (module-scope-map is server-only) — so the
+// list/detail reads carry the boolean and the UI renders the request-to-join
+// path instead of a dead-end Join button. Never persisted; a pure map.
+function decorateGoalScope(goal) {
+  return goal ? { ...goal, scope_protected: scopeIncludesProtected(goal.scope_modules) } : goal;
+}
+
 module.exports = function buildGoalsRouter() {
   const router = express.Router();
 
@@ -443,7 +453,7 @@ module.exports = function buildGoalsRouter() {
     }
     try {
       const goals = await db.listGoals({ versionId: version || null, status: status || null });
-      return res.json({ goals });
+      return res.json({ goals: goals.map(decorateGoalScope) });
     } catch (err) {
       console.error('[gds] GET /goals', err);
       return res.fail('list_failed', { status: 500, message: 'internal error' });
@@ -512,7 +522,7 @@ module.exports = function buildGoalsRouter() {
         db.listCriteriaForGoal(id),
         db.getGoalDependencies(id),  // task 1761 — prerequisite goals + satisfied state
       ]);
-      return res.json({ goal, members, criteria, dependencies });
+      return res.json({ goal: decorateGoalScope(goal), members, criteria, dependencies });
     } catch (err) {
       console.error('[gds] GET /goals/:id', err);
       return res.fail('fetch_failed', { status: 500, message: 'internal error' });
@@ -559,7 +569,7 @@ module.exports = function buildGoalsRouter() {
         return res.fail('goal_not_open', 409, { status: goal.status });
       }
       if (scopeIncludesProtected(goal.scope_modules) && req.builder.rank !== 'archon') {
-        return res.fail('archon_approval_required', { status: 403, message: 'This goal is scoped to a protected module; an Archon must add you (POST /goals/:id/members).' });
+        return res.fail('archon_approval_required', { status: 403, message: 'This goal is scoped to a protected module; request to join (POST /goals/:id/requests) or ask an Archon to add you (POST /goals/:id/members).' });
       }
       // Private goals are join-GATED (task 1952 / ADR 0112): a non-member can't
       // self-join — they request to join or wait for an invite. An existing member
@@ -1493,3 +1503,6 @@ module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
 // task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
 // same precedent as its siblings above.
 module.exports.authorizeWithdrawJoinRequest = authorizeWithdrawJoinRequest;
+// task 1002689: the derived scope_protected payload decorator — exported for
+// tests/goal_membership_requests.mjs (DB-free), same precedent.
+module.exports.decorateGoalScope = decorateGoalScope;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.56",
+  "version": "1.19.58",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.56",
+      "version": "1.19.58",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.56",
+  "version": "1.19.58",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -539,8 +539,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.54 with no explicit bump. run 31534150701. (task 1002620)
 //   1.19.56 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.55 with no explicit bump. run 31535063954. (task 1002620)
+//   1.19.57 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.56 with no explicit bump. run 31542659439. (task 1002620)
+//   1.19.58 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.57 with no explicit bump. run 31546064883. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.56'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.58'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_membership_requests.mjs

@@ -41,6 +41,7 @@ const {
   authorizeInvitationResponse,
   authorizeJoinRequestResponse,
   authorizeWithdrawJoinRequest,
+  decorateGoalScope,
 } = require('../modules/lifecycle/routes/goals.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
 
@@ -338,6 +339,30 @@ await test('authorizeWithdrawJoinRequest: the requester (string vs number id)
   assert.deepEqual(authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: '5', actorId: 2 }), { ok: true });
 });
 
+// =========================================================================
+// decorateGoalScope (task 1002689) — goal payloads carry a derived
+// scope_protected flag so the hall can render the join-gate on a
+// protected-scope goal without re-deriving the roster client-side
+// (module-scope-map is server-only). 'kernel' is definitionally protected;
+// 'ideas' is not in the protected set.
+// =========================================================================
+
+await test('decorateGoalScope: protected-scope goal → scope_protected true', () => {
+  const g = decorateGoalScope({ id: 1, scope_modules: ['kernel'] });
+  assert.equal(g.scope_protected, true);
+});
+await test('decorateGoalScope: unprotected / empty scope → false; null passes through', () => {
+  assert.equal(decorateGoalScope({ id: 1, scope_modules: ['ideas'] }).scope_protected, false);
+  assert.equal(decorateGoalScope({ id: 1, scope_modules: [] }).scope_protected, false);
+  assert.equal(decorateGoalScope(null), null);
+});
+await test('decorateGoalScope: returns a copy, never mutates the row', () => {
+  const row = { id: 1, scope_modules: ['ideas'] };
+  const out = decorateGoalScope(row);
+  assert.notEqual(out, row);
+  assert.equal('scope_protected' in row, false);
+});
+
 // =========================================================================
 // route-rank pins (task 1952/1953) — the walls are in-handler, so the routes
 // stay 'any-builder'; an accidental requireRank re-gate must be a red build.

package/tests/goal_tier.mjs

@@ -154,13 +154,14 @@ await test('setGoalStatus: unknown goal returns null', async () => {
 // =========================================================================
 // addGoalMember
 // =========================================================================
-await test('addGoalMember: upserts on the PK (re-join changes role, no dup-key)', async () => {
+await test('addGoalMember: upsert PRESERVES the existing role (re-join cannot demote a lead)', async () => {
   const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
-  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'lead' }, { pool });
-  assert.equal(out.role, 'lead');
+  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'member' }, { pool });
+  assert.equal(out.role, 'lead', 'an existing lead row survives a role:member re-add');
   const ins = find(pool.queries, /^INSERT INTO goal_members/);
-  assert.deepEqual(ins.params, [7, 42, 'lead']);
-  assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = EXCLUDED.role/, 'upsert, not plain insert');
+  assert.deepEqual(ins.params, [7, 42, 'member']);
+  assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = goal_members\.role/,
+    'conflict keeps the stored role — role changes go through PATCH /goals/:id/members/:builderId only (task 1002689)');
 });
 
 await test('addGoalMember: role defaults to member', async () => {