@bongos/core 1.19.646 → 1.19.648

package/modules/dev-box/box-access.js

@@ -254,6 +254,117 @@ function sparsePathsForScopeKeys(scopeKeys, moduleScopeMap) {
   return [...base, ...extra];
 }
 
+// ---------------------------------------------------------------------------
+// PURE: builder-requested WIDENING (task 1003087 / idea 1000793)
+// ---------------------------------------------------------------------------
+
+// A builder sometimes needs a directory their task scope did not pull — to run
+// the full suite, to read a caller, to regenerate a TREE-DEPENDENT artifact. The
+// obvious move, `git sparse-checkout add <path>`, does not survive: the */10
+// source-fetch cron re-applies the SERVER-computed set and deletes the addition,
+// including WHILE A COMMAND IS RUNNING (a live suite died mid-run with
+// MODULE_NOT_FOUND that read exactly like a code bug; a box-committed
+// gen-repo-map regen off a narrow tree reds CI's freshness gate — learning
+// 1000192, which stranded PR #254).
+//
+// So the widening is recorded SERVER-side and unioned in HERE, which is what
+// makes it tick-surviving: the cron asks this endpoint for the set on every tick,
+// so it gets the union too. Nothing in the instance-owned fetch script changes —
+// which matters, because the neutral core does not ship it (ADR 0150).
+
+// Bounds. Small on purpose: this is an escape hatch for a handful of dirs, not a
+// second scope system. Over the cap the extras are dropped, not an error — a
+// truncated widen still fetches, and failing the source pull over it would be a
+// far worse trade than materializing less.
+const MAX_WIDEN_PATHS = 24;
+const MAX_WIDEN_PATH_LEN = 200;
+
+// withinAny(p, roots) — is p one of roots, or underneath one? Cone mode
+// materializes a directory and everything below it, so "already covered" and
+// "inside the allowed surface" are the same ancestor walk.
+function withinAny(p, roots) {
+  let q = p;
+  for (;;) {
+    if (roots.includes(q)) return true;
+    const cut = q.lastIndexOf('/');
+    if (cut < 0) return false;
+    q = q.slice(0, cut);
+  }
+}
+
+// normalizeWidenPath — repo-relative POSIX directory, or null when it is not one.
+//
+// This is a path that reaches `git sparse-checkout set` on a box, so it is
+// validated as INPUT rather than trusted: absolute paths, Windows drive letters,
+// '..' traversal and empty segments are all refused rather than normalized away,
+// because "cleaned up into something that still works" is how a traversal becomes
+// a shrug. Backslashes are folded to '/' first so a Windows-typed path is judged
+// on what it means, not on its separator.
+function normalizeWidenPath(raw) {
+  if (typeof raw !== 'string') return null;
+  // BACKSLASH by char code, not as a literal: this file is edited through
+  // tooling that has silently collapsed a doubled backslash before, and a
+  // separator fold that quietly stops folding is invisible until a Windows
+  // path slips through as one long segment.
+  const BACKSLASH = String.fromCharCode(92);
+  let p = raw.trim().split(BACKSLASH).join('/');
+  while (p.startsWith('./')) p = p.slice(2);
+  p = p.replace(/\/+/g, '/').replace(/\/+$/, '');
+  if (!p || p === '.' || p.length > MAX_WIDEN_PATH_LEN) return null;
+  if (p.startsWith('/') || /^[A-Za-z]:/.test(p)) return null;
+  const segs = p.split('/');
+  if (!segs.every((s) => s && s !== '.' && s !== '..' && /^[A-Za-z0-9._-]+$/.test(s))) return null;
+  return p;
+}
+
+// admissibleWidenPaths — the widen requests this builder's RANK actually permits,
+// normalized, deduped, capped and sorted.
+//
+// THIS IS THE SECURITY BOUNDARY OF THE FEATURE, so it is stated plainly: widening
+// changes what is MATERIALIZED on a box, and rank decides how much of the repo a
+// box may hold at all (ADR 0031 section 9.2 — 'full' for Metic+, the 'starter'
+// surface below that). Honoring an arbitrary widen would hand a Xenos the whole
+// tree through a convenience flag, which is a rank escalation dressed as
+// ergonomics. So:
+//   - a builder whose RANK scope is 'full' may widen anywhere (they are already
+//     entitled to the entire repo; the widen only decides what gets pulled);
+//   - anyone else may widen only INSIDE the starter surface. That is not a null
+//     grant: a task-scoped box is BASE union its modules, which is NARROWER than
+//     starter, so this is exactly the room to climb back to what their rank
+//     already allowed — and no further.
+// The authoring wall is untouched either way. What a builder may CHANGE is still
+// goal-scope-check against the module globs, never what happens to be on disk
+// (ADR 0148).
+function admissibleWidenPaths(widenPaths, rank) {
+  const unrestricted = boxScopeForRank(rank) === 'full';
+  const out = [];
+  const seen = new Set();
+  for (const raw of Array.isArray(widenPaths) ? widenPaths : []) {
+    const p = normalizeWidenPath(raw);
+    if (!p || seen.has(p)) continue;
+    if (!unrestricted && !withinAny(p, STARTER_SPARSE_PATHS)) continue;
+    seen.add(p);
+    out.push(p);
+    if (out.length >= MAX_WIDEN_PATHS) break;
+  }
+  return out.sort();
+}
+
+// withWidenPaths — union admitted widen dirs into a computed sparse set, skipping
+// any the set already covers (cone mode pulls a dir and everything under it, so
+// adding 'scripts/gds' when 'scripts' is present is noise in the git command and
+// noise in the box's scope readout). A null set is the 'full' clone — there is
+// nothing to widen into, so it passes through untouched.
+function withWidenPaths(sparsePaths, admitted) {
+  if (!Array.isArray(sparsePaths) || !admitted || admitted.length === 0) return sparsePaths;
+  const out = [...sparsePaths];
+  for (const dir of admitted) {
+    if (withinAny(dir, out)) continue;
+    out.push(dir);
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // PURE: the per-fetch access decision (consumed by GET /box/source-access)
 // ---------------------------------------------------------------------------
@@ -295,7 +406,7 @@ function sparsePathsForScopeKeys(scopeKeys, moduleScopeMap) {
 //   { allowed:false, reason:'BUILDER_INACTIVE' }
 //   { allowed:false, reason:'INSUFFICIENT_RANK', required, actual }
 //   { allowed:true,  scope, spec }
-function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, scopeKeys, hasActiveClaims, moduleScopeMap } = {}) {
+function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, scopeKeys, hasActiveClaims, moduleScopeMap, widenPaths } = {}) {
   if (status && status !== 'active') {
     return { allowed: false, reason: 'BUILDER_INACTIVE' };
   }
@@ -307,23 +418,32 @@ function decideSourceAccess({ rank, status, floor = DEFAULT_PROVISION_FLOOR, sco
       actual: rank ?? null,
     };
   }
+  // The builder's own widening, narrowed to what their rank already reaches
+  // (task 1003087). Computed once here so every sparse branch below unions the
+  // SAME set — a widen that applied to one scope and not another would be a
+  // surprise that only surfaces when a claim changes.
+  const widen = admissibleWidenPaths(widenPaths, rank);
+
   // Claim-driven task scope (present → the box asks for exactly its work's code).
   if (Array.isArray(scopeKeys)) {
     if (scopeKeys.length > 0) {
-      const sparsePaths = sparsePathsForScopeKeys(scopeKeys, moduleScopeMap);
+      const sparsePaths = withWidenPaths(sparsePathsForScopeKeys(scopeKeys, moduleScopeMap), widen);
       return { allowed: true, scope: 'task', spec: { scope: 'task', mode: 'sparse', sparsePaths } };
     }
     // Empty. A builder mid-claim whose goals declare no wall gets the rank scope,
     // NOT a stripped box — the planning gap is not theirs to pay for.
     if (!hasActiveClaims) {
-      const sparsePaths = sparsePathsForScopeKeys([], moduleScopeMap);
+      const sparsePaths = withWidenPaths(sparsePathsForScopeKeys([], moduleScopeMap), widen);
       return { allowed: true, scope: 'base', spec: { scope: 'base', mode: 'sparse', sparsePaths } };
     }
   }
   // No claim signal (no lifecycle port on this instance), or claims with an
   // undeclared goal wall: the pre-ADR-0148 rank fallback.
   const scope = boxScopeForRank(rank);
-  return { allowed: true, scope, spec: cloneSpecForScope(scope) };
+  const spec = cloneSpecForScope(scope);
+  // 'full' carries sparsePaths null (the whole repo) — withWidenPaths passes it
+  // through, because there is no sparse set to widen INTO.
+  return { allowed: true, scope, spec: { ...spec, sparsePaths: withWidenPaths(spec.sparsePaths, widen) } };
 }
 
 // scopeMetadata — PURE. The credential-FREE projection of a source-access
@@ -470,6 +590,10 @@ module.exports = {
   boxCanHoldSource,
   cloneSpecForScope,
   sparsePathsForScopeKeys, // ADR 0148 — BASE ∪ the claims' module dirs (cone-mode)
+  MAX_WIDEN_PATHS,         // task 1003087 — the builder-widening cap
+  normalizeWidenPath,      // task 1003087 — repo-relative dir, or null
+  admissibleWidenPaths,    // task 1003087 — the widen requests this RANK permits
+  withWidenPaths,          // task 1003087 — union a widen set into a sparse set
   scopeMetadata, // BV1.R100 — credential-free projection for GET /box/scope
   // pure — decisions
   decideSourceAccess,

package/modules/dev-box/boxes.js

@@ -397,6 +397,26 @@ function decideEnsureAction({ boxState, rank, status, blocked = false, floor = D
 // DB helpers (async). Each takes the pg pool (or a client mid-transaction).
 // ---------------------------------------------------------------------------
 
+// setBoxWidenPaths — replace a box row's builder-requested widen set (task
+// 1003087). Whole-set replace rather than add/remove SQL: the set is tiny and
+// capped, the caller has already normalized and rank-filtered it, and a
+// read-modify-write in one statement keeps two concurrent widens from
+// interleaving into a half-applied list.
+//
+// Returns the stored array, or null when the builder has no box row — the
+// caller turns that into a 404 rather than silently creating one, because a
+// widen with no box to apply it to is a request that has not happened yet.
+async function setBoxWidenPaths(db, builderId, paths) {
+  const { rows } = await db.query(
+    `UPDATE builder_boxes
+        SET widen_paths = $2::text[], updated_at = now()
+      WHERE builder_id = $1
+      RETURNING widen_paths`,
+    [builderId, Array.isArray(paths) ? paths : []]
+  );
+  return rows[0] ? rows[0].widen_paths : null;
+}
+
 async function getBoxByBuilderId(db, builderId) {
   const { rows } = await db.query(
     `SELECT * FROM builder_boxes WHERE builder_id = $1`,
@@ -891,6 +911,7 @@ module.exports = {
   decideEnsureAction,
   // db
   getBoxByBuilderId,
+  setBoxWidenPaths,
   ensureBoxRow,
   listBoxes,
   recordEvent,

package/modules/dev-box/routes/box.js

@@ -480,8 +480,16 @@ module.exports = function buildBoxRouter() {
           hasActiveClaims = undefined;
         }
       }
-      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: api.moduleScopeMap });
+      // Read the box BEFORE deciding: its widen_paths are an INPUT to the sparse
+      // set now (task 1003087). A builder-requested directory is unioned in here,
+      // which is what makes it survive the */10 cron — the cron re-asks THIS
+      // endpoint every tick, so the union comes back with it instead of being
+      // deleted by the next `git sparse-checkout set`.
       const box = await boxes.getBoxByBuilderId(pool, req.builder.id);
+      const decision = boxAccess.decideSourceAccess({
+        rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: api.moduleScopeMap,
+        widenPaths: box ? box.widen_paths : null,
+      });
       const auditDeny = (reason, extra) =>
         box && boxAccess.recordSourceEvent(pool, {
           box, builderId: req.builder.id, event: 'source_deny',
@@ -598,7 +606,13 @@ module.exports = function buildBoxRouter() {
           hasActiveClaims = undefined;
         }
       }
-      const decision = boxAccess.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: api.moduleScopeMap });
+      // Same widen input as the real fetch — this readout exists precisely so it
+      // cannot drift from what the box will actually hold.
+      const scopeBox = await boxes.getBoxByBuilderId(pool, req.builder.id);
+      const decision = boxAccess.decideSourceAccess({
+        rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: api.moduleScopeMap,
+        widenPaths: scopeBox ? scopeBox.widen_paths : null,
+      });
       if (!decision.allowed) {
         return res.fail('SOURCE_ACCESS_REVOKED', 403, {
           reason: decision.reason,
@@ -753,6 +767,98 @@ module.exports = function buildBoxRouter() {
     }
   });
 
+  // GET /box/widen — the caller's own recorded widen set (task 1003087).
+  // rank: any authenticated builder, own resource. Reports what is STORED plus
+  // what is currently ADMITTED, because those differ whenever a request sits
+  // outside the builder's rank scope — showing only the stored list would let a
+  // Xenos believe a widen took effect that the fetch quietly drops.
+  router.get('/box/widen', auth.requireBuilder, async (req, res) => {
+    try {
+      const builder = await gdsDb.getBuilderById(req.builder.id);
+      const box = await boxes.getBoxByBuilderId(pool, req.builder.id);
+      if (!box) return res.fail('no_box', 404, { message: 'no dev box for this builder' });
+      const stored = Array.isArray(box.widen_paths) ? box.widen_paths : [];
+      const admitted = boxAccess.admissibleWidenPaths(stored, builder ? builder.rank : null);
+      res.json({
+        widen_paths: stored,
+        admitted,
+        ignored: stored.filter((p) => !admitted.includes(boxAccess.normalizeWidenPath(p))),
+        max: boxAccess.MAX_WIDEN_PATHS,
+      });
+    } catch (err) {
+      log.error('[gds] GET /box/widen', err);
+      res.fail('widen_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /box/widen — record extra sparse-checkout directories that must SURVIVE
+  // the */10 source-fetch (task 1003087, idea 1000793). rank: any authenticated
+  // builder, OWN box (builder_id-scoped in SQL, so no id from the body can point
+  // this at someone else's box).
+  //
+  // Deliberately NOT allowBoxScope. The on-box crons read source-access with a
+  // box-scoped session (ADR 0053); this is a WRITE that changes what the box
+  // pulls forever after, so it takes the builder's own session — the same posture
+  // that keeps a stolen box token from re-scoping the checkout it was stolen from.
+  //
+  // add/remove are applied to the stored set and the result is re-normalized, so
+  // the endpoint is idempotent: widening twice is not an error, and neither is
+  // removing something that was never there.
+  //
+  // A path outside the caller's rank scope is ACCEPTED into storage but reported
+  // in `ignored` rather than refused. That is the honest shape: rank can change,
+  // and a builder promoted to Metic should find the widen they asked for as a
+  // Xenos simply start working, instead of having been silently discarded months
+  // earlier. What it can never do is take effect early — admissibleWidenPaths is
+  // re-evaluated against the LIVE rank on every single fetch.
+  router.post('/box/widen', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      add: { type: 'array' },
+      remove: { type: 'array' },
+      clear: { type: 'boolean' },
+    })) return;
+    try {
+      const box = await boxes.getBoxByBuilderId(pool, req.builder.id);
+      if (!box) return res.fail('no_box', 404, { message: 'no dev box for this builder' });
+      const builder = await gdsDb.getBuilderById(req.builder.id);
+
+      const current = Array.isArray(box.widen_paths) ? box.widen_paths : [];
+      const next = new Set(req.body && req.body.clear === true ? [] : current);
+
+      const rejected = [];
+      for (const raw of Array.isArray(req.body && req.body.add) ? req.body.add : []) {
+        const p = boxAccess.normalizeWidenPath(raw);
+        if (!p) { rejected.push(String(raw).slice(0, 120)); continue; }
+        next.add(p);
+      }
+      for (const raw of Array.isArray(req.body && req.body.remove) ? req.body.remove : []) {
+        const p = boxAccess.normalizeWidenPath(raw);
+        if (p) next.delete(p);
+      }
+      if (rejected.length) {
+        return res.fail('bad_widen_path', 400, {
+          rejected,
+          message: 'a widen path must be a repo-relative directory: no absolute paths, no "..", no drive letters',
+        });
+      }
+
+      const stored = [...next].sort().slice(0, boxAccess.MAX_WIDEN_PATHS);
+      const saved = await boxes.setBoxWidenPaths(pool, req.builder.id, stored);
+      if (saved === null) return res.fail('no_box', 404, { message: 'no dev box for this builder' });
+      const admitted = boxAccess.admissibleWidenPaths(saved, builder ? builder.rank : null);
+      res.json({
+        ok: true,
+        widen_paths: saved,
+        admitted,
+        ignored: saved.filter((p) => !admitted.includes(p)),
+        max: boxAccess.MAX_WIDEN_PATHS,
+      });
+    } catch (err) {
+      log.error('[gds] POST /box/widen', err);
+      res.fail('widen_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // GET /box/authorized-keys — the box pulls its builder's authorized_keys.
   // rank: any authenticated builder (own resource) — but the ALLOW/DENY is decided
   // INSIDE from the caller's LIVE rank+status (boxAccess.decideSourceAccess), NOT a

package/modules/lifecycle/db-tasks.js

@@ -308,7 +308,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
-  'needs_migration', 'module_key', 'description', 'title', 'priority',
+  'needs_migration', 'module_key', 'description', 'title', 'priority', 'value_summary',
 ]);
 
 async function updateTaskColumn(id, column, value) {
@@ -383,6 +383,17 @@ async function updateTaskTitle(id, title) { return updateTaskColumn(id, 'title',
 // 1 = most urgent, 5 = least; null clears it back to unset (weighted as 5).
 async function updateTaskPriority(id, priority) { return updateTaskColumn(id, 'priority', priority); }
 
+// task 1003817: the shipped-value sentence — what the hall, /status and the
+// Discord #ship-news line all read. It was written in exactly ONE place, the
+// claim-resolve route, so a re-grade (which has no claim — regradeMain
+// synthesizes a claimLike precisely because the claim is gone) could correct
+// the summary in the PR and the merge commit and still leave the RECORD holding
+// the first ship's sentence forever. This is the write vector that path uses.
+// Rewritable, never blankable: the route refuses an empty or whitespace-only
+// value, which is this column's form of the COALESCE/NULLIF posture db-ship.js
+// keeps on every other value_summary write.
+async function updateTaskValueSummary(id, valueSummary) { return updateTaskColumn(id, 'value_summary', valueSummary); }
+
 
 async function updateTaskDiscipline(id, discipline) { return updateTaskColumn(id, 'discipline', discipline); }
 
@@ -1037,5 +1048,6 @@ module.exports = {
   updateTaskRequiresRank,
   updateTaskSecuritySensitive,
   updateTaskStatus,
+  updateTaskValueSummary,
   versionAcceptsNewWork,
 };

package/modules/lifecycle/db.js

@@ -30,10 +30,16 @@
 // FACADE (task 1003204, goal 1000079). This file was a 5,748-line monolith; the
 // R03 de-monolith plan carved it into the twelve db-*.js units required below,
 // each cohesive and well under the 1,500-line ratchet. The carve was STRUCTURAL:
-// no function body changed, and the module.exports block at the bottom is the
-// original one verbatim — so every `require('./db')` call site, and every name
+// no function body changed, and every `require('./db')` call site, and every name
 // reachable through it, behaves exactly as before.
 //
+// The module.exports block was the carve's ORIGINAL list verbatim until task
+// 1003817, which replaced the db-tasks.js third of it with a spread — see the
+// long note above `const dbTasks` for why, and tests/lifecycle_facade_surface.mjs
+// for the assertion that keeps that surface identical. The other eleven units
+// are still re-listed by name; giving one of them a spread means giving it an
+// omit list and a surface pin too, because a bare spread publishes internals.
+//
 // The units form a DAG (no require cycles), in dependency order:
 //   db-shared → db-rank-authz → {db-versions, db-goals, db-tasks} → db-analytics
 //   → db-ship → db-claims;  db-deps-criteria and db-claim-reads stand alone.
@@ -100,38 +106,37 @@ const {
   setGoalVisibility,
   transferGoalOwnership,
 } = require('./db-goals.js');
-const {
-  REWARD_SUGGESTION_CAP,
-  createCriterion,
-  createTask,
-  findTaskBySourceRef,
-  generalGoalIdForVersion,
-  getTask,
-  listActiveClaims,
-  listClaimableTasks,
-  listTasks,
-  rankCrossDisciplineRecommendations,
-  rewardGateAssignment,
-  rewardGateError,
-  rewardMissing,
-  setCreditsReward,
-  suggestCreditsReward,
-  taskTouchesProtectedPath,
-  updateTaskAutomationTag,
-  updateTaskDescription,
-  updateTaskTitle,
-  updateTaskDiscipline,
-  updateTaskGoal,
-  updateTaskKind,
-  updateTaskModuleKey,
-  updateTaskNeedsMigration,
-  updateTaskNewcomerFriendly,
-  updateTaskParallelSafe,
-  updateTaskPriority,
-  updateTaskRequiresRank,
-  updateTaskSecuritySensitive,
-  updateTaskStatus,
-} = require('./db-tasks.js');
+// task 1003817: db-tasks.js's exports ARE this facade's task surface, so they are
+// spread into module.exports below instead of being re-listed name by name.
+//
+// WHY THE TWIN LIST HAD TO GO. What stood here was 31 sorted names destructured
+// from db-tasks.js purely so module.exports could name them again — not one was
+// called anywhere inside this file. Two hand-maintained copies of one list is
+// real duplication, and the `duplicate_window_count` ratchet reads it as such:
+// the lists were 29 identical normalized lines, one under the 30-line window, so
+// task 1003750 adding `updateTaskPriority` to both pushed the run to 30 and cost
+// an owner-decided baseline raise (59 → 60). That decision is recorded in
+// config/fitness-baselines.json along with the instruction for whoever added the
+// NEXT db-tasks function — this task, adding updateTaskValueSummary: fix the
+// facade, do not raise the baseline again. Spreading removes the whole class, so
+// the next setter costs nothing.
+//
+// TASK_FACADE_OMIT is what keeps this surface-PRESERVING rather than quietly
+// wider. Two of db-tasks.js's 33 exports were deliberately never re-exported
+// here, and a bare spread would publish them — which ADR 0091 §3 treats as a
+// real surface change, not a tidy-up. Naming them means dropping one has to be
+// somebody's decision. tests/lifecycle_facade_surface.mjs pins the resulting key
+// set, so this can never silently widen or narrow.
+const dbTasks = require('./db-tasks.js');
+const TASK_FACADE_OMIT = new Set([
+  // Internal to db-tasks.js's own queries — a SQL fragment, not a callable.
+  'CREDITS_AWARDED_SUBQUERY',
+  // The version-gate predicate; routes reach it through db-versions, not here.
+  'versionAcceptsNewWork',
+]);
+const dbTasksFacade = Object.fromEntries(
+  Object.entries(dbTasks).filter(([name]) => !TASK_FACADE_OMIT.has(name))
+);
 const {
   addDependency,
   addTaskCriterion,
@@ -214,6 +219,7 @@ const {
 } = require('./db-claims.js');
 
 module.exports = {
+  ...dbTasksFacade,
   tallyPeerVotes,
   PEER_VOTE_KARMA_LAG_DAYS,
   RANKS,
@@ -263,19 +269,6 @@ module.exports = {
   listCriteriaForGoal,
   archiveGoalWithDispositions,
   openTasksInGoal,
-  createTask,
-  generalGoalIdForVersion,
-  findTaskBySourceRef,
-  getTask,
-  listTasks,
-  updateTaskGoal,
-  createCriterion,
-  updateTaskKind,
-  updateTaskDescription,
-  updateTaskTitle,
-  updateTaskDiscipline,
-  updateTaskNewcomerFriendly,
-  updateTaskRequiresRank,
   xenosClaimAllowed,
   rankAllowsTask,
   REQUIRES_RANK_TIER,
@@ -290,31 +283,14 @@ module.exports = {
   LIVE_RANK_LADDER,
   deriveRequiredRank,
   highestRank,
-  rewardMissing,
-  suggestCreditsReward,
-  REWARD_SUGGESTION_CAP,
-  rewardGateAssignment,
-  rewardGateError,
-  setCreditsReward,
   THETES_GRADUATION_THRESHOLD,
   qualifiesForThetesGraduation,
   countShippedTasksForBuilder,
   singleRungPromotionError,
   disambiguateWorktreeName,
   foldWorktreeName,
-  updateTaskParallelSafe,
-  updateTaskPriority,
-  updateTaskSecuritySensitive,
-  updateTaskAutomationTag,
-  updateTaskNeedsMigration,
-  updateTaskModuleKey,
-  listClaimableTasks,
   capNewcomerTasks,
-  taskTouchesProtectedPath, // SR-12 / G2 (task 994): autonomous-fit protected-path exclusion (pure, testable)
   decorateGoalMembership, // task 1003137: feed-side joinable flag (pure, testable)
-  rankCrossDisciplineRecommendations,
-  listActiveClaims,
-  updateTaskStatus,
   getTaskDependencies,
   getTaskDependents,
   attachTaskDepSummaries,

package/modules/lifecycle/routes/task-write-routes.js

@@ -326,6 +326,14 @@ module.exports = function registerTaskWriteRoutes(router) {
       // A whole-goal re-rank (needed-vs-nice) had no route and had to run as SQL.
       // null clears it back to unset; the 1..5 bounds mirror tasks_priority_check.
       priority: {},                                      // 1..5 or null — checked inline
+      // task 1003817: the shipped-value sentence. Written in exactly one place
+      // before this — the claim-resolve route — so `ship.js --regrade --summary`
+      // (no claim, by definition) could correct it in the PR and the merge commit
+      // and still leave the hall, /status and the Discord ship line reading the
+      // FIRST ship's text forever. Same task.edit permission and audit_log trail
+      // as the title/description/priority edits above; minLength 1 (plus the
+      // whitespace check below) so the record can be rewritten, never blanked.
+      value_summary: { type: 'string', minLength: 1, maxLength: LIMITS.VALUE_SUMMARY },
       // task 1002614 (map D-18): DECLARED so strict-mode admits the request far
       // enough to reach the deliberate status_not_patchable hint below (#514) —
       // the hint had been unreachable dead code behind unknown_field since the
@@ -354,6 +362,7 @@ module.exports = function registerTaskWriteRoutes(router) {
     const hasDescription = Object.prototype.hasOwnProperty.call(body, 'description');
     const hasTitle = Object.prototype.hasOwnProperty.call(body, 'title');
     const hasPriority = Object.prototype.hasOwnProperty.call(body, 'priority');
+    const hasValueSummary = Object.prototype.hasOwnProperty.call(body, 'value_summary');
     // #514: status is a lifecycle field, not a PATCH-able column — it moves only
     // through the dedicated transition routes. The #506 session tried
     // `PATCH status=ready`, got the generic no_supported_fields error, and had
@@ -365,8 +374,8 @@ module.exports = function registerTaskWriteRoutes(router) {
     if (Object.prototype.hasOwnProperty.call(body, 'status')) {
       return res.fail('status_not_patchable', { status: 400, message: STATUS_HINT });
     }
-    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription && !hasTitle && !hasPriority) {
-      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, title, description, priority, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
+    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription && !hasTitle && !hasPriority && !hasValueSummary) {
+      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, title, description, value_summary, priority, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
     // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
     // ---- FIRST write. The previous shape validated-and-wrote per field in ----
@@ -393,6 +402,14 @@ module.exports = function registerTaskWriteRoutes(router) {
         return res.fail('bad_priority', { status: 400, message: `priority must be an integer ${TASK_FIELD_BOUNDS.priority.min}-${TASK_FIELD_BOUNDS.priority.max} (1 = most urgent), or null to clear` });
       }
     }
+    // task 1003817: minLength 1 refuses "" but not "   ", and the write trims —
+    // so without this a whitespace-only body would blank the shipped-value
+    // record through the one field whose whole point is that it survives. An
+    // omitted field writes nothing at all (hasValueSummary is false), which is
+    // this route's form of the COALESCE/NULLIF posture db-ship.js keeps.
+    if (hasValueSummary && body.value_summary.trim() === '') {
+      return res.fail('bad_value_summary', { status: 400, message: 'value_summary must be a non-empty sentence — the shipped-value record can be rewritten, never blanked. Omit the field to leave it unchanged.' });
+    }
     if (hasSecuritySensitive) {
       // task 990: explicit Archon-only-broadcast flag. Boolean only (no null) —
       // it gates whether ship.js routes the broadcast to the Archon-only
@@ -556,6 +573,15 @@ module.exports = function registerTaskWriteRoutes(router) {
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
       }
     }
+    if (hasValueSummary) {
+      try {
+        updated = await db.updateTaskValueSummary(id, body.value_summary.trim());
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        log.error('[gds] PATCH /tasks/:id value_summary', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
     if (hasGoalId) {
       try {
         updated = await db.updateTaskGoal(id, body.goal_id);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.646",
+  "version": "1.19.648",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.646",
+      "version": "1.19.648",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.646",
+  "version": "1.19.648",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",