@bongos/core 1.19.673 → 1.19.675

package/modules/discord/routes/discord.js

@@ -14,6 +14,9 @@
 
 const express = require('express');
 const api = require('../../../src/module-api');
+// Structured + attributable, and the console ratchet counts raw console calls —
+// the api.logger(<module key>) precedent every other module's routes follow.
+const log = api.logger('discord');
 const auth = require('../auth');
 const db = require('../db');
 const shipBroadcast = require('../ship-broadcast');
@@ -93,7 +96,28 @@ module.exports = function buildDiscordRouter() {
       }
       return res.json({ ok: true, guild_id: plan.guildId, op_count: plan.ops.length, ops: plan.ops, warnings: plan.warnings });
     } catch (err) {
-      console.error('[gds] GET /discord/channels/plan', err);
+      log.error({ err: err && err.message }, 'GET /discord/channels/plan failed');
+      return res.fail('internal_error', 500);
+    }
+  });
+
+  // GET /api/bongos/discord/channels/snapshot — what docs/discord/channels.json
+  // WOULD say if it described the guild exactly as it is right now (task 1003510).
+  // Read-only in both directions: it writes nothing to Discord and nothing to the
+  // repo — the operator reviews the output and commits it, so the layout stays
+  // Archon-gated by merge, which is the property ADR 0037 §1 rests on.
+  // 503 when the bot is disabled / not connected to a guild.
+  // rank: archon — channel administration command.
+  router.get('/discord/channels/snapshot', auth.requireBuilder, auth.requirePermission('discord.channels.manage'), async (req, res) => {
+    try {
+      const channels = require('../discord-channels');
+      const snap = channels.computeSnapshotConfig();
+      if (!snap.ok) {
+        return res.fail('bot_unavailable', 503, { reason: snap.reason });
+      }
+      return res.json({ ok: true, guild_id: snap.guildId, config: snap.config, warnings: snap.warnings });
+    } catch (err) {
+      log.error({ err: err && err.message }, 'GET /discord/channels/snapshot failed');
       return res.fail('internal_error', 500);
     }
   });
@@ -111,7 +135,7 @@ module.exports = function buildDiscordRouter() {
       }
       return res.json({ ok: true, applied: result.applied, failed: result.failed, total: result.total, warnings: result.warnings });
     } catch (err) {
-      console.error('[gds] POST /discord/channels/reconcile', err);
+      log.error({ err: err && err.message }, 'POST /discord/channels/reconcile failed');
       return res.fail('internal_error', 500);
     }
   });

package/modules/lifecycle/db-tasks.js

@@ -352,6 +352,27 @@ async function createCriterion({ versionId, criterionId, criterionMd, goalId = n
   return rows[0];
 }
 
+// updateCriterionGoal — move an EXISTING criterion into a goal, or out of one
+// (task 1003509). Criteria used to be born linked and stay that way: goal_id was
+// writable only in createCriterion's INSERT, so the runner-seeded V1 criterion a
+// fresh instance starts with could never join the goal it obviously belongs to,
+// and /progress showed it "(ungrouped)" forever beside a goal reporting
+// criteria: []. Amending it needed SQL, which a hub-provisioned owner has no
+// access to at all (walk finding W5).
+//
+// goalId null DETACHES (back to a version-level criterion). The caller owns every
+// question this raises — that the goal exists and sits on the criterion's own
+// version, who may write it, and whether the move completes the goal; this is the
+// UPDATE and nothing else, exactly as updateTaskGoal below is for tasks.
+async function updateCriterionGoal(id, goalId) {
+  const { rows } = await pool.query(
+    `UPDATE done_when_criteria SET goal_id = $1 WHERE id = $2
+     RETURNING id, version_id, criterion_id, criterion_md, goal_id, sort_order, satisfied`,
+    [goalId, id]
+  );
+  return rows[0] ?? null;
+}
+
 async function updateTaskGoal(id, goalId) {
   const { rows } = await pool.query(
     `UPDATE tasks SET goal_id = $1, updated_at = now() WHERE id = $2 RETURNING *`,
@@ -1034,6 +1055,7 @@ module.exports = {
   setCreditsReward,
   suggestCreditsReward,
   taskTouchesProtectedPath,
+  updateCriterionGoal,
   updateTaskAutomationTag,
   updateTaskDescription,
   updateTaskTitle,

package/modules/lifecycle/goal-edits.js

@@ -187,6 +187,39 @@ async function recordProseEdit(kind, id, req, deltas, deps = {}) {
   }
 }
 
+// recordCriterionGoalMove — the audit row for moving a criterion between goals
+// (task 1003509). Same reason recordProseEdit exists: the global write-audit
+// middleware records the request body, which carries the DESTINATION and nothing
+// else, so on its own the trail cannot say which goal the criterion left. For a
+// regrouping that is the half that matters — "criterion 12 joined goal 5" is not
+// recoverable without "…and left goal 3".
+//
+// A no-op move (same goal_id in and out) writes nothing, mirroring the empty-delta
+// short-circuit above. And an audit failure is logged, never thrown: the move has
+// already committed, so throwing here would report a failure that did not happen.
+async function recordCriterionGoalMove({ criterionId, fromGoalId, toGoalId }, req, deps = {}) {
+  const log = deps.log || ((m) => proseLog().info(m));
+  const from = fromGoalId ?? null;
+  const to = toGoalId ?? null;
+  if (from === to) return;
+  const builderId = req.builder && req.builder.id;
+  log(`criterion ${criterionId} moved by builder ${builderId}: goal ${from ?? '(none)'} -> ${to ?? '(none)'}`);
+  const insert = deps.insertAuditLog || api.insertAuditLog;
+  try {
+    await insert({
+      builderId,
+      route: `criterion:${criterionId}:goal-move`,
+      method: 'PATCH',
+      requestBodyRedacted: JSON.stringify({ from_goal_id: from, to_goal_id: to }),
+      responseStatus: 200,
+      ip: req.ip || null,
+      userAgent: (req.get && req.get('user-agent')) || null,
+    });
+  } catch (e) {
+    log(`[gds] AUDIT GAP: criterion ${criterionId} goal move landed but its audit row failed: ${e && e.message}`);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // WHY PATCH /goals/:id looks the way it does (kept here, not in the route:
 // routes/goals.js is over the fitness oversize threshold, so prose there is
@@ -332,6 +365,7 @@ module.exports = {
   criterionProseRefusal,
   goalAcceptingRequestsHandler,
   logProseEdit,
+  recordCriterionGoalMove,
   recordProseEdit,
   goalProseHandler,
   goalVisibilityHandler,

package/modules/lifecycle/routes/done-when.js

@@ -224,7 +224,7 @@ module.exports = function buildDoneWhenRouter() {
     });
   }, { errorCode: 'satisfy_failed' }));
 
-  // PATCH /done-when/:criterionId — correct a criterion's TEXT (task 1003102).
+  // PATCH /done-when/:criterionId — amend a criterion's TEXT (task 1003102) and/or MOVE it between goals (task 1003509).
   // Was write-once: this file exposed create, satisfy and unsatisfy and nothing
   // else, so wrong text had no API repair path. The incident that forced it: a
   // shell-quoting error stripped backtick-wrapped literals out of three criteria
@@ -246,31 +246,128 @@ module.exports = function buildDoneWhenRouter() {
   // claim "gated like creation" is true. (Caught by the grader on the first cut of
   // task 1003102: the comment said it, the code did half of it.)
   // rank: metic+archon — matches POST /versions/:id/done-when.
+  //
+  // THE GOAL MOVE (task 1003509 — walk finding W5). `goal_id` used to be writable
+  // only by createCriterion's INSERT, so a criterion was born linked and stayed
+  // that way for life. The runner seeds a fresh instance's V1 criterion with NO
+  // goal — at standup there is no goal yet to name (provision-repo.js
+  // seedFirstVersionCmd) — so the owner's first goal could never adopt it:
+  // /progress showed the criterion "(ungrouped)" forever beside the goal it
+  // obviously belonged to, reporting `criteria: []`. Amending it took SQL, and a
+  // hub-provisioned owner has no SQL access at all.
+  //
+  // BOTH ENDS OF A MOVE ARE GATED, not just the goal it leaves. A move is a
+  // criterion write on the DESTINATION every bit as much as on the source, and
+  // gating only the source would let a goal's own owner push their criterion into
+  // a goal they have no authority over — a criterion being, per the CREATE route
+  // above, a thing that permanently blocks version close and goal auto-achieve
+  // with no delete route to undo it. So authorizeCriterionCreate runs against both
+  // and both must pass. DETACH (`goal_id: null`) has no destination, so it lands
+  // on that gate's goal-less branch and is Archon-only — the same wall that makes
+  // version-level criteria Archon-only at creation (ADR 0154), reached without a
+  // rule of its own.
+  //
+  // A SATISFIED criterion may still MOVE. criterionProseRefusal freezes the text
+  // of a verified claim, and that reasoning is about re-wording: moving one
+  // between goals changes how it is grouped, never what was checked. It is
+  // refused here only when the prose is what is changing.
+  //
+  // WHO CAN ADOPT THE SEEDED CRITERION. Because a goal-LESS criterion is
+  // version-level, the source gate's own goal-less branch makes ANY write to one
+  // Archon-only — which predates this task (a non-Archon could not edit an
+  // ungrouped criterion's prose either). That is not a wall in front of W5: the
+  // founder of a wizard-born instance IS its Archon, so the one criterion this
+  // was filed for is theirs to place. A Metic is unaffected where it matters —
+  // regrouping between two goals they already hold needs no escalation.
   router.patch('/done-when/:criterionId', auth.requireBuilder, auth.requirePermission('criterion.create'), asyncHandler('PATCH /done-when/:criterionId', async (req, res) => {
     if (validateOrRespond(req, res, {
-      criterion_md: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.NOTES },
+      criterion_md: { type: 'string', minLength: 1, maxLength: LIMITS.NOTES },
+      goal_id: { type: 'integer', min: 1 },
     })) return;
+    // `goal_id: null` is a DETACH and has to be told apart from an absent field, so
+    // the presence of the KEY decides, never its value. (The validator treats an
+    // explicit null as absent, which is why it validates at all.)
+    const movingGoal = Object.prototype.hasOwnProperty.call(req.body || {}, 'goal_id');
+    const changingProse = req.body.criterion_md != null;
+    if (!movingGoal && !changingProse) {
+      return res.fail('nothing_to_update', { status: 400, message: 'Send criterion_md, goal_id, or both.' });
+    }
     const id = parseId(req, res, { param: 'criterionId', code: 'bad_criterion_id' });
     if (id === null) return;
     const existing = await doneWhen.getCriterion(id);
     if (!existing) return res.fail('criterion_not_found', 404);
-    // The ownership wall, resolved exactly as the CREATE route resolves it: the
-    // criterion's OWN goal + version, and membership read only for a non-Archon.
-    const goal = existing.goal_id != null ? await db.getGoal(existing.goal_id) : null;
     const version = await db.getVersion(existing.version_id);
-    const actorMembership = (goal && req.builder.rank !== 'archon')
-      ? await db.getGoalMember({ goalId: goal.id, builderId: req.builder.id })
-      : null;
-    const authority = authorizeCriterionCreate({
-      goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
-    });
+    // The ownership wall, resolved exactly as the CREATE route resolves it: the
+    // goal + version, and membership read only for a non-Archon. One closure, so
+    // both ends of a move are decided by the same code rather than a copy.
+    const authorizeFor = async (goal) => {
+      const actorMembership = (goal && req.builder.rank !== 'archon')
+        ? await db.getGoalMember({ goalId: goal.id, builderId: req.builder.id })
+        : null;
+      return authorizeCriterionCreate({
+        goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
+      });
+    };
+    const currentGoal = existing.goal_id != null ? await db.getGoal(existing.goal_id) : null;
+    const authority = await authorizeFor(currentGoal);
     if (!authority.ok) return res.status(authority.status).json(authority.body);
-    const refusal = goalEdits.criterionProseRefusal(existing);
-    if (refusal) return res.fail(refusal.code, refusal.status, refusal.message ? { message: refusal.message } : undefined);
-    const result = await goalEdits.updateCriterionProse({ criterionId: id, criterionMd: req.body.criterion_md });
-    if (!result) return res.fail('criterion_not_found', 404);
-    await goalEdits.recordProseEdit('criterion', id, req, result.deltas);
-    return res.json({ ok: true, criterion: result.criterion, deltas: result.deltas, unchanged: !!result.unchanged });
+
+    const targetGoalId = movingGoal ? (req.body.goal_id ?? null) : null;
+    if (movingGoal) {
+      let targetGoal = null;
+      if (targetGoalId !== null) {
+        targetGoal = await db.getGoal(targetGoalId);
+        // Same refusal the CREATE route gives, for the same reason: a criterion may
+        // never cross versions, which would put it in one version's rollup and the
+        // other's goal at once.
+        if (!targetGoal || String(targetGoal.version_id) !== String(existing.version_id)) {
+          return res.fail('bad_goal_id', { status: 400, message: `goal_id ${targetGoalId} does not exist on version '${existing.version_id}'.` });
+        }
+      }
+      const destination = await authorizeFor(targetGoal);
+      if (!destination.ok) return res.status(destination.status).json(destination.body);
+    }
+
+    let criterion = existing;
+    let deltas = [];
+    let unchanged = false;
+    if (changingProse) {
+      const refusal = goalEdits.criterionProseRefusal(existing);
+      if (refusal) return res.fail(refusal.code, refusal.status, refusal.message ? { message: refusal.message } : undefined);
+      const result = await goalEdits.updateCriterionProse({ criterionId: id, criterionMd: req.body.criterion_md });
+      if (!result) return res.fail('criterion_not_found', 404);
+      await goalEdits.recordProseEdit('criterion', id, req, result.deltas);
+      criterion = result.criterion;
+      deltas = result.deltas;
+      unchanged = !!result.unchanged;
+    }
+    const achievedGoals = [];
+    const fromGoalId = existing.goal_id ?? null;
+    // A move to where it already is writes nothing at all — not the row, not the
+    // audit, not a re-derive. Nothing about the world changed.
+    if (movingGoal && fromGoalId !== targetGoalId) {
+      const moved = await db.updateCriterionGoal(id, targetGoalId);
+      if (!moved) return res.fail('criterion_not_found', 404);
+      criterion = moved;
+      await goalEdits.recordCriterionGoalMove(
+        { criterionId: id, fromGoalId, toGoalId: targetGoalId }, req
+      );
+      // BOTH ENDS are re-derived, because a move changes what each of them still
+      // needs. The destination is the obvious half — adopting an already-satisfied
+      // criterion can be the thing that completes a goal. The SOURCE is the half
+      // that is easy to miss and just as real: taking an UNSATISFIED criterion out
+      // of a goal can leave every criterion that remains satisfied, which is that
+      // goal completing. Skipping it would leave a goal silently open that nothing
+      // will ever close again — no later ship re-checks it, because no task under
+      // it changed. achieveGoalIfComplete is conservative and idempotent (open
+      // goals only, and it never un-achieves), so asking twice is two reads.
+      for (const goalId of [fromGoalId, targetGoalId]) {
+        if (goalId === null) continue;
+        const outcome = await db.achieveGoalIfComplete({ goalId });
+        if (outcome && outcome.achieved) achievedGoals.push(goalId);
+      }
+    }
+    return res.json({ ok: true, criterion, deltas, unchanged, achieved_goals: achievedGoals });
   }, { errorCode: 'criterion_update_failed' }));
 
   // Auth: flip a criterion back to unsatisfied (rare; for corrections).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.673",
+  "version": "1.19.675",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.673",
+      "version": "1.19.675",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.673",
+  "version": "1.19.675",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/discord-channels.js

@@ -10,8 +10,9 @@
 // directly — it asks the deployed bot (via the API) to do the work.
 //
 // Usage:
-//   node scripts/gds/discord-channels.js plan     # dry run: what WOULD change
+//   node scripts/gds/discord-channels.js plan      # dry run: what WOULD change
 //   node scripts/gds/discord-channels.js apply     # apply docs/discord/channels.json to Discord
+//   node scripts/gds/discord-channels.js snapshot  # print the guild AS channels.json (seed the file)
 //
 // The channel layout itself is edited in docs/discord/channels.json and merged
 // (rank-gated) — this command just triggers the reconcile.
@@ -20,8 +21,8 @@ const { cliClient } = require('./cli-lib');
 
 async function main() {
   const cmd = (process.argv[2] || '').toLowerCase();
-  if (cmd !== 'plan' && cmd !== 'apply') {
-    console.error('usage: node scripts/gds/discord-channels.js <plan|apply>');
+  if (cmd !== 'plan' && cmd !== 'apply' && cmd !== 'snapshot') {
+    console.error('usage: node scripts/gds/discord-channels.js <plan|apply|snapshot>');
     process.exit(2);
   }
 
@@ -29,6 +30,8 @@ async function main() {
   let res;
   if (cmd === 'plan') {
     res = await api.discord.getDiscordChannelsPlan();
+  } else if (cmd === 'snapshot') {
+    res = await api.discord.getDiscordChannelsSnapshot();
   } else {
     res = await api.discord.postDiscordChannelsReconcile({ body: {} });
   }
@@ -47,7 +50,15 @@ async function main() {
     process.exit(1);
   }
 
+  // Warnings go to STDERR so `snapshot > channels.json` writes clean JSON.
   for (const w of body.warnings || []) console.warn(`warning: ${w}`);
+  if (cmd === 'snapshot') {
+    // STDOUT is the file body and nothing else — this command exists to be
+    // redirected. Review the diff before committing: it is the guild's real
+    // state, which is not necessarily the state anyone intended.
+    console.log(JSON.stringify(body.config, null, 2));
+    return;
+  }
   if (cmd === 'plan') {
     const ops = body.ops || [];
     if (!ops.length) { console.log('In sync — no channel changes needed.'); return; }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.673'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.675'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');