@bongos/core 1.19.568 → 1.19.570

package/tests/reward_gate.mjs

@@ -210,7 +210,7 @@ async function withStubbedCreatePool(run) {
 
 t('a task CREATED with NO reward is born with a positive, capped value', async () => {
   await withStubbedCreatePool(async (captured) => {
-    const row = await db.createTask({ versionId: 1, title: 't', kind: 'feature', estMinutes: 40 });
+    const row = await db.createTask({ versionId: 1, goalId: 77, title: 't', kind: 'feature', estMinutes: 40 });
     assert.ok(captured.creditsReward > 0, 'INSERT must bind a positive credits_reward');
     assert.equal(captured.creditsReward, 40, 'feature @40min -> 40 drachmae');
     assert.ok(captured.creditsReward <= db.REWARD_SUGGESTION_CAP, 'must respect the cap');
@@ -220,7 +220,7 @@ t('a task CREATED with NO reward is born with a positive, capped value', async (
 
 t('a task CREATED with credits_reward 0 (the route default) is auto-assigned', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', creditsReward: 0, kind: 'bug', estMinutes: 40 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', creditsReward: 0, kind: 'bug', estMinutes: 40 });
     // bug weight 1.25 -> 50; 0 is treated as "unset" so the default kicks in.
     assert.equal(captured.creditsReward, 50);
   });
@@ -228,14 +228,14 @@ t('a task CREATED with credits_reward 0 (the route default) is auto-assigned', a
 
 t('a huge-est new task is CAPPED at creation, not ballooned', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', kind: 'feature', estMinutes: 9999 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', kind: 'feature', estMinutes: 9999 });
     assert.equal(captured.creditsReward, db.REWARD_SUGGESTION_CAP);
   });
 });
 
 t('an EXPLICIT positive credits_reward is PRESERVED (never overridden)', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', creditsReward: 17, kind: 'feature', estMinutes: 40 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', creditsReward: 17, kind: 'feature', estMinutes: 40 });
     assert.equal(captured.creditsReward, 17, 'author-set positive value must survive untouched');
   });
 });

package/tests/task_goal_required.mjs

@@ -0,0 +1,223 @@
+// tests/task_goal_required.mjs — a goal-less create is no longer SILENT
+// (BV1.R11, task 1003598, goal 1000086, ADR 0250 D4).
+//
+// WHAT WAS ACTUALLY WRONG. Task 1763 made `createTask` default any create with no
+// `goalId` into its version's catch-all "<version> — general" goal, at the lowest
+// layer, so that no caller had to think about it. The invariant "every task
+// belongs to a goal" then held — technically — while 53 open tasks accumulated in
+// two buckets nobody reads. Unscoped work never snuck past the rule; the rule
+// filed it out of sight.
+//
+// So the defect is the SILENCE, not the bucket. A caller now either names a goal
+// or says out loud that it cannot, by passing `allowCatchAll: true`: same landing
+// place, same never-break-a-creator promise, but the exceptions are a one-command
+// grep instead of an absence, and a create vector added next year gets a thrown
+// error at its first test run rather than a quiet home in a bucket.
+//
+// NOT FULLY DELETED, and that is a recorded decision rather than an oversight.
+// R11 literally asks for the fallback's deletion, but two in-repo vectors have no
+// goal to name yet — `newcomer-restock` (the beginner queue) and `copy-desk`
+// (copy proposals) — whose honest home is the per-version maintenance goal, task
+// 1003605 (R18), still behind R06 and R12. Deleting today would drain the
+// newcomer queue. The owner chose to remove the silent half now and leave the
+// true deletion to R18. This file pins the opt-in roster so it cannot grow
+// quietly in the meantime.
+//
+// Run:  node --test tests/task_goal_required.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { createTask } = require('../modules/lifecycle/db.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+
+// A pool that would happily create the row, so a rejection can only come from the
+// guard and never from a database that was never reached.
+const permissivePool = {
+  query: async () => ({ rows: [{ id: '1', goal_id: null, title: 'x' }] }),
+  connect: async () => ({ query: async () => ({ rows: [] }), release() {} }),
+};
+
+// ---- the guard --------------------------------------------------------------
+
+test('a create with no goalId THROWS instead of quietly filing into a bucket', async () => {
+  await assert.rejects(
+    () => createTask({ versionId: 'BONGOS-V1', title: 't' }, { pool: permissivePool }),
+    /goalId is required/,
+    'the old behaviour was to succeed and say nothing');
+});
+
+test('the error tells the caller both ways out', async () => {
+  const err = await createTask({ versionId: 'BONGOS-V1', title: 't' }, { pool: permissivePool })
+    .then(() => null, (e) => e);
+  assert.ok(err, 'must reject');
+  assert.match(err.message, /BV1\.R11/, 'names the rule, so the reason is findable');
+  assert.match(err.message, /allowCatchAll: true/, 'and the escape hatch, spelled exactly');
+});
+
+test('only a literal true opts in — a truthy value still throws', async () => {
+  for (const v of [1, 'yes', {}, 'true']) {
+    await assert.rejects(
+      () => createTask({ versionId: 'BONGOS-V1', title: 't', allowCatchAll: v }, { pool: permissivePool }),
+      /goalId is required/,
+      `${JSON.stringify(v)} must not open the hatch`);
+  }
+});
+
+test('naming a goal needs no flag at all', async () => {
+  // The ordinary path must stay ordinary: a caller with a goal never learns this
+  // parameter exists.
+  await createTask(
+    { versionId: 'BONGOS-V1', title: 't', goalId: 77 },
+    { pool: permissivePool, client: permissivePool },
+  );
+});
+
+// ---- the route --------------------------------------------------------------
+
+const WRITE = src('modules/lifecycle/routes/task-write-routes.js');
+const POST_TASKS = (() => {
+  const a = WRITE.indexOf("router.post('/tasks'");
+  assert.notEqual(a, -1);
+  return WRITE.slice(a, WRITE.indexOf("router.patch('/tasks/:id'"));
+})();
+
+test('POST /tasks refuses a body with no goal_id, as a 400 that says where to look', () => {
+  assert.match(POST_TASKS, /if \(body\.goal_id == null\) \{/);
+  assert.match(POST_TASKS, /res\.fail\('goal_id_required', \{[\s\S]*?status: 400/,
+    'a missing required field is the caller\'s mistake, not a conflict');
+  assert.match(POST_TASKS, /GET \/goals\?version=/,
+    'a refusal that does not say how to comply gets worked around');
+});
+
+test('the route refuses BEFORE it validates the goal it was not given', () => {
+  const required = POST_TASKS.indexOf("'goal_id_required'");
+  const validate = POST_TASKS.indexOf("'bad_goal_id'");
+  const create = POST_TASKS.indexOf('await db.createTask(');
+  assert.ok(required !== -1 && validate !== -1 && create !== -1);
+  assert.ok(required < validate, 'absent and wrong are different answers');
+  assert.ok(required < create);
+});
+
+test('POST /tasks does NOT pass the escape hatch — this door always has a goal', () => {
+  assert.equal(/allowCatchAll/.test(POST_TASKS), false,
+    '/builder-start lists work by goal; the human/agent vector can always name one');
+});
+
+// ---- the opt-in roster, pinned ----------------------------------------------
+
+const OPT_INS = [
+  ['modules/onboarding/newcomer-restock.js', 'the beginner queue, stamped from templates'],
+  ['modules/copy-desk/routes/copy-desk.js', 'copy-change proposals'],
+  ['modules/lifecycle/kickoff-seed.js', "the founder's first board, on an instance with no goals at all"],
+  ['modules/lifecycle/cascade.js', 'a follow-up off a parent task that is itself goal-less'],
+];
+
+test('exactly four vectors opt in, and each says why', () => {
+  for (const [file, why] of OPT_INS) {
+    const body = src(file);
+    assert.match(body, /allowCatchAll/, `${file} should opt in (${why})`);
+    assert.match(body, /BV1\.R11|1003605|R18/,
+      `${file} must explain itself — an undocumented opt-in is the silence again`);
+  }
+});
+
+test('cascade opts in ONLY when inheritance actually failed', () => {
+  // The others opt in unconditionally because they have no goal to name at all.
+  // A cascade normally inherits its parent's goal and must keep doing so — the
+  // hatch is for a goal-less PARENT (a legacy catch-all row), not for cascades in
+  // general. A blanket `true` here would quietly re-open the hole for every
+  // follow-up task the system files.
+  const body = src('modules/lifecycle/cascade.js');
+  assert.match(body, /allowCatchAll: task\.goal_id == null,/);
+  assert.equal(/allowCatchAll: true/.test(body), false,
+    'an unconditional hatch here would cover every cascade, not just the legacy ones');
+  assert.match(body, /goalId: task\.goal_id != null \? Number\(task\.goal_id\) : null,/,
+    'inheritance stays the primary path');
+});
+
+test('a goal-less parent does not silently lose its cascade task', async () => {
+  // The regression this pair of fixes closes: under the guard, a null goalId
+  // throws; the throw is caught per-rule so the ship is safe, and the cascade
+  // task would have vanished with only a console line — a silent goal-less gap,
+  // which is the exact thing this rule exists to close.
+  const { runCascadesForShip } = require('../modules/lifecycle/cascade.js');
+  const specs = [];
+  const report = await runCascadesForShip({ id: 5 }, {
+    getTask: async () => ({
+      id: 5, version_id: 'BONGOS-V1', goal_id: null, status: 'shipped',
+      discipline: 'artist', kind: 'feature', title: 'legacy', touches: [],
+    }),
+    findTaskBySourceRef: async () => null,
+    createTask: async (spec) => { specs.push(spec); return { id: 9 }; },
+  });
+  assert.deepEqual(report.errors, [], 'no rule may error on a goal-less parent');
+  for (const spec of specs) {
+    assert.equal(spec.goalId, null, 'nothing to inherit');
+    assert.equal(spec.allowCatchAll, true, 'so it declares the catch-all rather than throwing');
+  }
+});
+
+test('a cascade off a NORMAL parent inherits and does not open the hatch', async () => {
+  const { runCascadesForShip } = require('../modules/lifecycle/cascade.js');
+  const specs = [];
+  await runCascadesForShip({ id: 5 }, {
+    getTask: async () => ({
+      id: 5, version_id: 'BONGOS-V1', goal_id: 77, status: 'shipped',
+      discipline: 'artist', kind: 'feature', title: 'normal', touches: [],
+    }),
+    findTaskBySourceRef: async () => null,
+    createTask: async (spec) => { specs.push(spec); return { id: 9 }; },
+  });
+  for (const spec of specs) {
+    assert.equal(spec.goalId, 77, 'the follow-up belongs where the work belongs');
+    assert.equal(spec.allowCatchAll, false, 'and the hatch stays shut');
+  }
+});
+
+test('no FIFTH vector has appeared', () => {
+  // The roster is the point: if this fails, either a new create vector took the
+  // easy way out, or R18 landed and one of these can now name a real goal — in
+  // which case delete its opt-in and this line, do not extend the list.
+  const roster = new Set([...OPT_INS.map(([f]) => f), 'modules/lifecycle/db-tasks.js']);
+  const suspects = [
+    'modules/ideas/inbox.js', 'modules/lifecycle/routes/goals.js',
+    'modules/lifecycle/routes/task-write-routes.js',
+  ];
+  for (const f of suspects) {
+    if (roster.has(f)) continue;
+    assert.equal(/allowCatchAll/.test(src(f)), false,
+      `${f} must name a goal rather than opting out`);
+  }
+});
+test('the vectors that CAN name a goal still do', () => {
+  assert.match(src('modules/ideas/inbox.js'), /goalId: goal\.id/,
+    'idea routing names the goal it routed to');
+  assert.match(src('modules/lifecycle/routes/goals.js'), /db\.createTask\(\{/,
+    'and the goal-authored vector has stamped its goal since BV1.R60');
+});
+
+// ---- the fallback itself ----------------------------------------------------
+
+test('the catch-all resolver survives, reachable only through the declared hatch', () => {
+  const dbTasks = src('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /generalGoalIdForVersion\(versionId\)/,
+    'R18 is when this goes; deleting it today would drain the newcomer queue');
+  const guard = dbTasks.slice(dbTasks.indexOf('let goalIdEffective = goalId;'));
+  const hatch = guard.indexOf('allowCatchAll !== true');
+  const resolve = guard.indexOf('generalGoalIdForVersion(versionId)');
+  assert.ok(hatch !== -1 && hatch < resolve,
+    'the throw comes first — the resolver is unreachable without the flag');
+});
+
+test('the remaining gap is written down where the next reader will stand', () => {
+  const dbTasks = src('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /WHY NOT DELETE THE FALLBACK OUTRIGHT/,
+    'so the partial job reads as a decision, not an unfinished edit');
+  assert.match(dbTasks, /1003605/, 'and names the task that finishes it');
+});