@bongos/core 1.19.798 → 1.19.799

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.798",
-  "core_contract": "1.19.798",
-  "source_commit": "004852105d6e6651ca15c7405fb3aafb859b89d3",
+  "core_version": "1.19.799",
+  "core_contract": "1.19.799",
+  "source_commit": "85b2cf74b5fa2c392c59c47b0b877e9b912503ac",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T01:22:01.549Z",
+  "built_at": "2026-09-17T01:33:26.348Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 487,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2185,
+    "functional_verbatim": 2187,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2697,
-  "tree_sha256": "87cf75447f225dc7cc6c23dbe927a64293ba4c290bc3aaee0b87fabbfabd7b9f",
+  "file_count": 2699,
+  "tree_sha256": "6435ea324232356a39b076f0f83fad40beaa96485c1f9e9b3a38fea29feda830",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2532,7 +2532,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "90e23bd74c05c075cab7d2d7220a4ece60c0cd99d78925b317567c1ada6c0ecd"
+      "sha256": "4ad2853bc510a9ce3bfa2264734afb42eb41f75a28c0a51f639d48038e62e440"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3507,7 +3507,7 @@
     {
       "path": "migrations/core_223_blocker_resolve_respects_other_open_blockers.sql",
       "mode": "0000644",
-      "sha256": "8fc38c0353811699e19d861321d4fca8fe8fd5cca1f66ff96312d7f44fb0290e"
+      "sha256": "54eab3a0de0a3471649bd18a1cf3208e4857ef2d819811944843e89db3456ddf"
     },
     {
       "path": "migrations/core_223_task_visual.sql",
@@ -3624,6 +3624,11 @@
       "mode": "0000644",
       "sha256": "e298a5b2e9ffade95fae0e68910a25396fab560e6e54dd745cfc122c0dfdf403"
     },
+    {
+      "path": "migrations/core_245_restore_open_blocker_clause.sql",
+      "mode": "0000644",
+      "sha256": "b51a03436ede7269f32f6b1e9400070dcbe3895ab64088ca27da5406cbcf5eea"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5507,7 +5512,7 @@
     {
       "path": "modules/lifecycle/db-claims.js",
       "mode": "0000644",
-      "sha256": "e641947ffb069b6d0fe870a3867fec93998c754ec95aaefda9a695530973b2d9"
+      "sha256": "e2b9e236090bc1936bed98a2487e0db9ab10e3c543597ababd68e664a396d8f3"
     },
     {
       "path": "modules/lifecycle/db-deps-criteria.js",
@@ -7707,12 +7712,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "17535d90fc6adb0a8c78b659584b58869bf2d47da14fabb22defb1f73b303976"
+      "sha256": "1b8fa8ffcdeac7490e95f849daa69ef5580ffce9da1eed6d3434990e29dc957d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f1a0a4d4fe697be8633c635210d733e0e2b60f263b0e6ecb9925532145e30b4e"
+      "sha256": "4dd1a1bfaad4b7ff8382bd13fdd0331f54536a84fdc928f7f9b97ad2b88e60ac"
     },
     {
       "path": "public-docs/index.html",
@@ -9597,7 +9602,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a4af4ddf0f8f8cc92c41fcebbd1193af19b432de585e836eb6d4626a0dc1e033"
+      "sha256": "4ad4e006b2f2916be9183776e9c33d49839b632b6a199180f23f99fb683f8e09"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13229,6 +13234,11 @@
       "mode": "0000644",
       "sha256": "1c5d35d58371cbde290a3e71e023febeebf350b54031d458c2ebe58f25962aa4"
     },
+    {
+      "path": "tests/task_unblocked_open_blocker.mjs",
+      "mode": "0000644",
+      "sha256": "57a776dc56011bfe792a7a30ab29598bfc1b5b52f26ea0ef74faae5fbba26f6d"
+    },
     {
       "path": "tests/task_visual_route_gate.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2070,5 +2070,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.796 with no explicit bump. run 35169694391. (task 1002620)
   1.19.798 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.797 with no explicit bump. run 35170229509. (task 1002620)
+  1.19.799 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.798 with no explicit bump. run 35170980369. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_223_blocker_resolve_respects_other_open_blockers.sql

@@ -18,6 +18,16 @@
 -- release it, not a dep ship". But 009 releases on the first resolve, not the
 -- last. One path fail-closes; the other did not. This aligns them.
 --
+-- CORRECTION (task 1003934, 2026-09-16): when this header was written, 176's
+-- clause was ALREADY GONE from the live predicate, so the sentence above
+-- described a symmetry that did not exist. 177 dropped the clause by whole-body
+-- rewrite and 178 re-dropped it reverting to the pre-176 body; core_245 restores
+-- it. Nothing in THIS migration depended on that premise — the trigger below
+-- deliberately does not call task_is_fully_unblocked (the note further down says
+-- why, and tests/blocker_resolve_guard.mjs pins it) — so this was a stale
+-- comment, not a stale behaviour. Annotated rather than rewritten, because the
+-- original reasoning is why the trigger exists.
+--
 -- Live at the time of writing: task 1000594 was blocked by BOTH blocker 1000065
 -- and blocker 1000093 — duplicates covering the same two owner decisions — so
 -- closing either as a duplicate would have released the task with the decision

package/migrations/core_245_restore_open_blocker_clause.sql

@@ -0,0 +1,97 @@
+-- core_245_restore_open_blocker_clause.sql — put migration 176's open-blocker
+-- clause back into task_is_fully_unblocked (task 1003934).
+--
+-- WHAT WAS LOST, AND BY WHOM. The predicate is CREATE OR REPLACE'd five times
+-- now. Each definition is a WHOLE BODY, not a patch, so a migration drops an
+-- earlier clause simply by not restating it:
+--
+--   163_polymorphic_dependencies.sql   the original deps-doneness predicate
+--   176_promotion_respects_open_blockers.sql   ADDS the open-blocker clause
+--   177_require_reward_before_workable.sql     adds a reward clause — and does
+--                                              NOT restate 176's. This is where
+--                                              the clause died; grep -c
+--                                              task_blockers on 177 returns 0.
+--   178_reward_gate_auto_assign_revert_autopromote.sql   reverts to what its own
+--                                              header calls "byte-identical to
+--                                              the 163 body" — but 163 PREDATES
+--                                              176, so the revert re-dropped the
+--                                              clause a second time and shipped
+--                                              the loss forward.
+--   this one                                   restores it.
+--
+-- Neither 177 nor 178 said it was touching the blocker rule; both believed they
+-- were editing the reward gate. core_223's header still asserts the clause is in
+-- place. Verified on production 2026-09-15: pg_get_functiondef returns the
+-- deps-doneness body only, with no task_blockers reference anywhere in it.
+--
+-- WHAT BREAKS WITHOUT IT. A task whose dependencies all ship auto-promotes
+-- backlog -> ready even while an open blocker is linked to it. The by-id claim
+-- path still refuses (modules/lifecycle/db-claims.js checks b.status = 'open',
+-- task 1002650), so this is NOT a gate bypass — it is the QUEUE LYING. The task
+-- advertises as ready in /builder-start and the claimable feed, and the server
+-- refuses it when someone tries. "ready" stops meaning "workable", which is the
+-- exact failure V4.R15 / task 953 filed migration 176 to fix.
+--
+-- WHY THE INNER JOIN, AND NOT THE LEFT JOIN core_239 USES. These are two
+-- different questions and they are meant to answer the legacy-link case
+-- differently. core_239 governs claimable_tasks — VISIBILITY — and uses
+-- LEFT JOIN ... (b.id IS NULL OR b.status = 'open') so that a legacy
+-- markdown-anchor link (task_blockers.blocker_ref with no blockers row) keeps a
+-- task hidden, fail-closed. This predicate governs PROMOTION, where 176 decided
+-- the opposite on purpose: its header records that legacy anchor links "are not
+-- tracked here and behave exactly as before", so an unresolvable link must not
+-- freeze a task in backlog forever with nothing able to release it. The
+-- promotion sweep's PROMOTABLE_BACKLOG_WHERE (modules/lifecycle/db-tasks.js)
+-- already made the same choice for the same reason. Restoring 176's INNER join
+-- verbatim keeps the three consistent; "tidying" it to the LEFT form here would
+-- silently change which tasks can ever be promoted.
+--
+-- SCOPE. This is 176's body exactly — 176 predates 177, so it never carried the
+-- reward clause that 178 correctly removed. Nothing about the reward gate is
+-- reinstated. Pure CREATE OR REPLACE, so it is idempotent; the migration-163
+-- auto-promotion triggers resolve the function by name and pick up the new body
+-- on their next fire. No data backfill and no demotion: rows already in 'ready'
+-- are never re-evaluated, so this migration moves nothing by itself. The one
+-- live row currently at 'ready' with an open blocker is reconciled separately,
+-- deliberately, by a human looking at that row — not bulk-updated here.
+
+BEGIN;
+
+CREATE OR REPLACE FUNCTION task_is_fully_unblocked(p_task_id bigint)
+RETURNS boolean AS $$
+  SELECT
+    -- (1) no gating dependency edge points at an un-done node. An orphaned `to`
+    -- yields no EXISTS match -> counts as un-done -> task stays blocked
+    -- (fail-closed). Unchanged from 163/178.
+    NOT EXISTS (
+      WITH gating AS (
+        SELECT d.to_kind, d.to_id
+          FROM dependencies d
+          JOIN tasks t ON t.id = p_task_id
+         WHERE (d.from_kind = 'task'      AND d.from_id = t.id)
+            OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+            OR (d.from_kind = 'criterion' AND d.from_id IN (
+                  SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id))
+      )
+      SELECT 1
+        FROM gating g
+       WHERE NOT (
+            (g.to_kind = 'task'      AND EXISTS (SELECT 1 FROM tasks              x WHERE x.id = g.to_id AND x.status = 'shipped'))
+         OR (g.to_kind = 'criterion' AND EXISTS (SELECT 1 FROM done_when_criteria x WHERE x.id = g.to_id AND x.satisfied))
+         OR (g.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = g.to_id AND x.status = 'achieved'))
+       )
+    )
+    -- (2) … AND the task has no OPEN blocker linked via task_blockers (V4.R15 /
+    -- task 953). Restored from migration 176, verbatim. "Open" means
+    -- blockers.status = 'open', the same spelling core_223's resolve trigger and
+    -- db-claims.js use, so every gate agrees on the word.
+    AND NOT EXISTS (
+      SELECT 1
+        FROM task_blockers tb
+        JOIN blockers b ON b.id = tb.blocker_id
+       WHERE tb.task_id = p_task_id
+         AND b.status = 'open'
+    );
+$$ LANGUAGE sql STABLE;
+
+COMMIT;

package/modules/lifecycle/db-claims.js

@@ -126,8 +126,11 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
 
     // task 1002650 (idea 1000644): the claimable FEED filters out ready tasks
     // with an open blocker link, but the direct claim-by-id path never checked —
-    // the feed hid the trap and this path walked into it. Mirror migration 176's
+    // the feed hid the trap and this path walked into it. Mirrors the
     // task_is_fully_unblocked clause so both gates enforce the same rule.
+    // Redundant since core_245 (task 1003934) and kept anyway: the predicate lost
+    // that clause from 177 until core_245, and this query was the only gate still
+    // refusing. It is why a reverted predicate cost a lying queue, not a bypass.
     const { rows: openBlockers } = await client.query(
       `SELECT b.id, b.title
          FROM task_blockers tb

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.798",
+  "version": "1.19.799",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.798",
+      "version": "1.19.799",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.798",
+  "version": "1.19.799",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.798'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.799'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/task_unblocked_open_blocker.mjs

@@ -0,0 +1,123 @@
+// tests/task_unblocked_open_blocker.mjs
+//
+// Task 1003934 — task_is_fully_unblocked must exclude a task with an OPEN
+// blocker. Static shape guard for core_245, in the style of
+// claimable_blocker_status.mjs (task 1003863): no live DB, assert the SQL TEXT,
+// so a future whole-body rewrite cannot silently drop the clause again.
+//
+// THE BUG THIS PINS, AND WHY NOTHING CAUGHT IT FOR TWO MIGRATIONS. The predicate
+// is CREATE OR REPLACE'd as a WHOLE BODY every time, so an earlier clause dies by
+// not being restated. 177 added a reward clause and did not restate 176's blocker
+// clause; 178 then reverted to what it called the "byte-identical" 163 body,
+// which PREDATES 176, re-dropping it. Neither migration mentioned blockers.
+//
+// The existing coverage could not see any of that, and this is the lesson worth
+// keeping: tests/dependencies_polymorphic.mjs asserts the clause against
+// migrations/176's FILE, which still sits on disk unchanged and still contains
+// it. That test passed green for the entire life of the outage. A test pinned to
+// a historical artifact proves history, not the current state — hence the
+// LAST-definition assertion below, which is the only shape that would have
+// failed on the day 177 landed.
+//
+// Run:  node tests/task_unblocked_open_blocker.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+
+const MIG = 'core_245_restore_open_blocker_clause.sql';
+const DEFINES = /CREATE OR REPLACE FUNCTION task_is_fully_unblocked/;
+// Comments carry the rationale; strip them before asserting on the executable
+// body so prose can never stand in for the real SQL.
+const body = read('migrations', MIG).replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
+
+const { test, summary } = makeRunner();
+
+await test('core_245 redefines the predicate', () => {
+  assert.match(body, DEFINES);
+  assert.match(body, /\$\$ LANGUAGE sql STABLE;/, 'same kind of function as every prior definition');
+});
+
+await test('the blocker clause is back, and filters on the blocker being OPEN', () => {
+  assert.match(body, /FROM task_blockers tb/, 'it looks at the link table');
+  assert.match(body, /JOIN blockers b ON b\.id = tb\.blocker_id/, 'and resolves the blocker itself');
+  assert.match(body, /tb\.task_id = p_task_id/, 'for THIS task');
+  assert.match(body, /b\.status = 'open'/, 'so a RESOLVED blocker stops blocking promotion');
+});
+
+await test('the join is the INNER form 176 chose, NOT core_239-s LEFT form', () => {
+  // These two answer the legacy-link case differently ON PURPOSE, so "tidying"
+  // one into the other silently changes behaviour with no error anywhere.
+  // core_239 governs claimable_tasks (VISIBILITY) and fails closed on a legacy
+  // markdown-anchor link. This predicate governs PROMOTION, where 176's header
+  // records that such links "are not tracked here and behave exactly as before"
+  // — an unresolvable link must not freeze a task in backlog with nothing able
+  // to release it. PROMOTABLE_BACKLOG_WHERE made the same call for the same
+  // reason; all three must agree.
+  assert.doesNotMatch(body, /LEFT JOIN blockers b/,
+    'a LEFT join here would let a legacy anchor link freeze a task in backlog forever');
+  assert.doesNotMatch(body, /b\.id IS NULL/, 'the fail-closed arm belongs to the VIEW, not the predicate');
+});
+
+await test('the deps-doneness clause SURVIVED the rewrite — the hazard runs both ways', () => {
+  // This migration could drop the dependency gate exactly as 177 dropped the
+  // blocker gate, and nothing would error. Both clauses, asserted together.
+  assert.match(body, /WITH gating AS/, 'the gating CTE is intact');
+  assert.match(body, /d\.from_kind = 'task' AND d\.from_id = t\.id/, 'own edges');
+  assert.match(body, /d\.from_kind = 'goal' AND d\.from_id = t\.goal_id/, 'goal-inherited edges');
+  assert.match(body, /d\.from_kind = 'criterion'/, 'criterion-inherited edges');
+  assert.match(body, /x\.status = 'shipped'/, 'a task dep is done when shipped');
+  assert.match(body, /x\.satisfied/, 'a criterion dep when satisfied');
+  assert.match(body, /x\.status = 'achieved'/, 'a goal dep when achieved');
+});
+
+await test('both clauses are ANDed — one without the other is half a predicate', () => {
+  // 177 kept a NOT EXISTS and still shipped the bug, so the presence of each
+  // clause is not enough; they have to be joined into one condition.
+  assert.match(body, /NOT EXISTS \(.*WITH gating AS.*\) AND NOT EXISTS \(.*FROM task_blockers tb/,
+    'deps-doneness AND no-open-blocker, in one predicate');
+});
+
+await test('core_245 is the LAST definition of task_is_fully_unblocked in migrations/', () => {
+  // THE ASSERTION THAT WOULD HAVE CAUGHT 177 ON THE DAY IT LANDED. A later
+  // whole-body redefinition inherits only what it restates, which is exactly how
+  // this clause was lost twice. Catch the next one at the source.
+  const defs = readdirSync(join(repoRoot, 'migrations'))
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => DEFINES.test(read('migrations', f)))
+    .sort();
+  assert.ok(defs.includes(MIG), 'this migration defines the predicate');
+  assert.equal(defs[defs.length - 1], MIG,
+    `a later migration redefines task_is_fully_unblocked and must restate the open-blocker clause: ${defs.join(', ')}`);
+});
+
+await test('every OTHER gate still spells "open" the same way', () => {
+  // The whole bug class is gates disagreeing. The predicate governs promotion,
+  // db-claims.js governs claim-by-id, and the sweep promotes in bulk; if they
+  // drift on what "open" means, one of them lies.
+  const code = (...p) => read(...p)
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/^\s*\/\/.*$/gm, ' ')
+    .replace(/\s+/g, ' ');
+
+  assert.match(code('modules', 'lifecycle', 'db-claims.js'), /b\.status = 'open'/,
+    'the by-id claim path checks blocker STATUS');
+
+  // The sweep keeps its OWN guard deliberately (task 1003932). Now that the
+  // predicate is fixed that guard is belt-and-braces — and it stays, because a
+  // sweep that mass-promotes must not inherit a single point of failure from a
+  // predicate that has already been reverted twice.
+  assert.match(
+    code('modules', 'lifecycle', 'db-tasks.js'),
+    /PROMOTABLE_BACKLOG_WHERE = ` WHERE t\.status = 'backlog' AND task_is_fully_unblocked\(t\.id\) AND NOT EXISTS \( SELECT 1 FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id WHERE tb\.task_id = t\.id AND b\.status = 'open'\)`/,
+    'the sweep still calls the predicate AND keeps its own open-blocker guard'
+  );
+});
+
+summary();