@bongos/core 1.19.805 → 1.19.807

package/modules/hall-ui/public/goals-render.js

@@ -883,7 +883,7 @@
     // this client gate deliberately doesn't re-derive the protected-module list
     // (that roster lives server-side only, module-scope-map.js) — a non-Archon
     // owner/manager sees the control on a protected-scope goal and gets a clear
-    // toast if the server 403s (see inviteMember's error handling below).
+    // toast if the server 403s (see sendInvitation's error handling below).
     const isOwner = sameId(g.created_by, selfId());
     const canManage = g.status === 'open' && (isArchon() || isOwner || iAmLead);
     renderActions(g, { joined, canManage });
@@ -1122,6 +1122,49 @@
     }
     return state.directory;
   }
+  // WHO IS STILL INVITABLE. Two exclusions, both of which exist to stop the page
+  // offering a name that can only fail:
+  //   - members, which POST /invitations 409s as `already_a_member`;
+  //   - anyone holding a PENDING row, which it 409s as `invite_pending`.
+  // The second is the one that matters, because a pending invitation is INVISIBLE
+  // from the member list — it is not a membership — so without this the user picks
+  // a perfectly ordinary-looking name and is handed an error they had no way to
+  // predict. `state.pendingRequests` carries BOTH kinds (invites the goal sent and
+  // join-requests it received) and the server refuses on either, so neither is
+  // filtered out here.
+  function invitableBuilders(members) {
+    const excluded = new Set((members || []).map((m) => String(m.builder_id)));
+    for (const r of state.pendingRequests || []) excluded.add(String(r.builder_id));
+    return (state.directory || []).filter((b) => !excluded.has(String(b.id)));
+  }
+  function builderOptionsHtml(list, selectedId) {
+    return list.map((b) => {
+      const id = String(b.id);
+      const sel = selectedId && id === String(selectedId) ? ' selected' : '';
+      return `<option value="${escapeHtml(id)}"${sel}>${escapeHtml(b.display_name || ('@' + b.github_login))}</option>`;
+    }).join('');
+  }
+  // THE INVITE BOX SENDS AN INVITATION; IT DOES NOT ADD ANYONE (task 1002886).
+  //
+  // This control used to POST /goals/:id/members — the immediate force-add — and
+  // then toast 'Invited.', which was simply untrue: the person was already in the
+  // goal and had never been asked. Meanwhile the consented flow ADR 0112 is built
+  // around (POST /goals/:id/invitations -> a pending row -> the invitee accepts)
+  // had its receiving half fully wired in goal-inbox.js and NO sender anywhere in
+  // the hall, so nothing in the product ever created an invitation.
+  //
+  // Now: the primary control invites, and the force-add survives as its own
+  // explicitly-labelled affordance (owner ruling, 2026-09-16) so nobody loses a
+  // capability they had — seeding a goal with a team who already agreed offline is
+  // a real thing people do. The rule the owner set is that BOTH paths say what
+  // they actually do; relocating the lie would have been worse than leaving it.
+  //
+  // NO MEMBERSHIP-KIND PICKER ON THE INVITE HALF, and that is not an oversight:
+  // `goal_membership_requests` has no membership_kind column, so an accepted
+  // invitation lands through addGoalMember's default 'member'. A picker here would
+  // be a choice silently dropped on the floor — the same class of defect as the
+  // toast it replaces. The form says so instead, and the picker stays on the
+  // add-directly path, where it IS honoured.
   function renderInviteBox(goalId, canInvite, members) {
     const box = $('#goal-invite');
     if (!box) return;
@@ -1129,6 +1172,7 @@
       box.hidden = true;
       box.innerHTML = '';
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       return;
     }
     box.hidden = false;
@@ -1141,42 +1185,111 @@
       });
       return;
     }
-    const memberIds = new Set((members || []).map((m) => String(m.builder_id)));
-    const invitable = (state.directory || []).filter((b) => !memberIds.has(String(b.id)));
-    const options = invitable
-      .map((b) => `<option value="${escapeHtml(String(b.id))}">${escapeHtml(b.display_name || ('@' + b.github_login))}</option>`)
-      .join('');
+    // This function rebuilds the box from scratch on every call, and it is called
+    // again when the pending-request list lands (see loadGoalMembership). Carry the
+    // half-filled form across that redraw, or a note someone is part-way through
+    // typing vanishes under them.
+    const keep = {
+      builder: $('#goal-invite-builder')?.value || '',
+      note: $('#goal-invite-note')?.value || '',
+      direct: $('#goal-direct-builder')?.value || '',
+      kind: $('#goal-direct-kind')?.value || 'member',
+    };
+    const invitable = invitableBuilders(members);
+    const none = !invitable.length;
+    const emptyLabel = 'Nobody left to invite';
     box.innerHTML = `
       <form class="goal-invite__form" id="goal-invite-form">
-        <select id="goal-invite-builder" required ${invitable.length ? '' : 'disabled'}>
-          ${invitable.length ? `<option value="" disabled selected>Choose a builder…</option>${options}`
-            : '<option value="">Everyone is already a member</option>'}
-        </select>
-        <select id="goal-invite-kind">
-          <option value="member">Member</option>
-          <option value="lead">Manager</option>
+        <select id="goal-invite-builder" required ${none ? 'disabled' : ''}>
+          ${none ? `<option value="">${emptyLabel}</option>`
+            : `<option value="" disabled${keep.builder ? '' : ' selected'}>Choose a builder…</option>${builderOptionsHtml(invitable, keep.builder)}`}
         </select>
-        <button class="landing__btn" type="submit" ${invitable.length ? '' : 'disabled'}>Invite</button>
+        <input id="goal-invite-note" type="text" maxlength="500" placeholder="Note (optional) — why you're asking" value="${escapeHtml(keep.note)}" ${none ? 'disabled' : ''}>
+        <button class="landing__btn" type="submit" ${none ? 'disabled' : ''}>Send invitation</button>
         <button class="btn-ghost" id="goal-invite-cancel" type="button">Cancel</button>
-      </form>`;
+      </form>
+      <p class="goal-invite__hint">They join as a member once they accept — you can change that afterwards. Nobody is added until they do.</p>
+      ${state.addDirectOpen ? `
+        <form class="goal-invite__form goal-invite__direct" id="goal-direct-form">
+          <select id="goal-direct-builder" required ${none ? 'disabled' : ''}>
+            ${none ? `<option value="">${emptyLabel}</option>`
+              : `<option value="" disabled${keep.direct ? '' : ' selected'}>Choose a builder…</option>${builderOptionsHtml(invitable, keep.direct)}`}
+          </select>
+          <select id="goal-direct-kind" ${none ? 'disabled' : ''}>
+            <option value="member"${keep.kind === 'member' ? ' selected' : ''}>Member</option>
+            <option value="lead"${keep.kind === 'lead' ? ' selected' : ''}>Manager</option>
+          </select>
+          <button class="btn-ghost" type="submit" ${none ? 'disabled' : ''}>Add without asking</button>
+          <button class="btn-ghost" id="goal-direct-cancel" type="button">Cancel</button>
+        </form>
+        <p class="goal-invite__hint">They are added straight away and never asked. Use this only for someone who has already agreed.</p>`
+      : '<button class="goal-invite__more" id="goal-direct-open" type="button">Or add someone without asking…</button>'}`;
     $('#goal-invite-cancel')?.addEventListener('click', () => {
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       renderInviteBox(goalId, canInvite, members);
     });
     $('#goal-invite-form')?.addEventListener('submit', (ev) => {
       ev.preventDefault();
       const builderId = $('#goal-invite-builder')?.value;
-      const membershipKind = $('#goal-invite-kind')?.value || 'member';
-      if (builderId) inviteMember(goalId, builderId, membershipKind);
+      const note = $('#goal-invite-note')?.value || '';
+      if (builderId) sendInvitation(goalId, builderId, note);
+    });
+    $('#goal-direct-open')?.addEventListener('click', () => {
+      state.addDirectOpen = true;
+      renderInviteBox(goalId, canInvite, members);
+    });
+    $('#goal-direct-cancel')?.addEventListener('click', () => {
+      state.addDirectOpen = false;
+      renderInviteBox(goalId, canInvite, members);
+    });
+    $('#goal-direct-form')?.addEventListener('submit', (ev) => {
+      ev.preventDefault();
+      const builderId = $('#goal-direct-builder')?.value;
+      const membershipKind = $('#goal-direct-kind')?.value || 'member';
+      if (builderId) addMemberDirectly(goalId, builderId, membershipKind);
     });
   }
-  async function inviteMember(goalId, builderId, membershipKind) {
+  // The ADR 0112 sender. 201 means a PENDING row exists — not a membership — so
+  // the toast may not claim the person is in the goal.
+  async function sendInvitation(goalId, builderId, note) {
+    try {
+      const body = { builder_id: Number(builderId) };
+      const trimmed = String(note || '').trim();
+      if (trimmed) body.note = trimmed;
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/invitations`, body);
+      toast('Invitation sent — they join once they accept.');
+      state.inviteOpen = false;
+      state.addDirectOpen = false;
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+      renderList();
+    } catch (err) {
+      const code = err?.data?.error;
+      // `invite_pending` and `already_a_member` are both filtered out of the
+      // dropdown above, so reaching either means the goal changed under this form
+      // — say what happened rather than a generic failure, because the name really
+      // was offered a moment ago.
+      if (code === 'invite_pending') toast('They already have an invitation or a join-request pending on this goal.');
+      else if (code === 'already_a_member') toast('They joined this goal already.');
+      else if (code === 'builder_not_found') toast('That builder no longer exists.');
+      else if (code === 'archon_required_for_protected_scope') toast('This goal is scoped to a protected module — only an Archon may bring someone in.');
+      else if (code === 'metic_required_for_protected_scope') toast('A protected-scope goal requires a Metic+ member.');
+      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may invite.');
+      else if (code === 'goal_not_open') toast('This goal is not open.');
+      else toast('Could not send that invitation just now.');
+    }
+  }
+  // The force-add, kept on purpose and labelled for what it is. Same endpoint the
+  // '+ Invite' button used to call behind the word 'Invited.'
+  async function addMemberDirectly(goalId, builderId, membershipKind) {
     try {
       // `membership_kind`, not `role` — ADR 0174 reserves that word for the three
       // crafts (task 1003013).
       await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/members`, { builder_id: Number(builderId), membership_kind: membershipKind });
-      toast('Invited.');
+      toast('Added — they are in the goal now, without being asked.');
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       await loadDetail(goalId, { force: true });
       renderDetail(goalId);
       renderList();
@@ -1184,9 +1297,9 @@
       const code = err?.data?.error;
       if (code === 'archon_required_for_protected_scope') toast('This goal is scoped to a protected module — only an Archon may add members.');
       else if (code === 'metic_required_for_protected_scope') toast('A protected-scope goal requires a Metic+ member.');
-      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may invite.');
+      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may add members.');
       else if (code === 'goal_not_open') toast('This goal is not open.');
-      else toast('Could not invite that builder just now.');
+      else toast('Could not add that builder just now.');
     }
   }
   async function joinLeave(goalId, action) {
@@ -1324,7 +1437,16 @@
     if (!sameId(state.current, goalId)) return;
     renderPendingRequests();
     const d = currentDetail();
-    if (d) renderActions(d.goal, { joined: (d.members || []).some((m) => sameId(m.builder_id, selfId())), canManage });
+    if (d) {
+      renderActions(d.goal, { joined: (d.members || []).some((m) => sameId(m.builder_id, selfId())), canManage });
+      // The invite dropdown's exclusion set reads state.pendingRequests, which
+      // lands HERE — after renderDetail has already drawn the box. Without this
+      // redraw a form opened before this resolved keeps offering a builder whose
+      // invitation is already pending, which is the exact invisible 409 the
+      // filter exists to prevent. renderInviteBox carries the half-filled form
+      // across the redraw.
+      if (state.inviteOpen) renderInviteBox(goalId, canManage, d.members || []);
+    }
   }
   async function loadDetail(goalId, { force = false } = {}) {
     if (!force && state.details.has(String(goalId))) return state.details.get(String(goalId));

package/modules/hall-ui/public/goals.css

@@ -200,7 +200,22 @@
    collapsed behind "+ Invite" (disclosure, closed by default — task 2171). */
 .goal-invite { margin: 4px 0 10px; }
 .goal-invite__form { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
-.goal-invite__form select#goal-invite-builder { flex: 1; min-width: 180px; }
+.goal-invite__form select#goal-invite-builder,
+.goal-invite__form select#goal-direct-builder { flex: 1; min-width: 180px; }
+.goal-invite__form input#goal-invite-note { flex: 1; min-width: 180px; }
+
+/* task 1002886 — BOTH admission paths now say what they do, so both carry a
+   line of their own: the invite half promises nobody is added until they
+   accept, the force-add half admits nobody is asked. Muted, because this is
+   the consequence of the button beside it, not a warning. */
+.goal-invite__hint { margin: 4px 0 8px; font-size: 12.5px; color: var(--ink-faint); max-width: var(--measure); }
+/* The force-add is deliberately QUIETER than the invite it sits under — same
+   authority, but it is the path that skips consent, so it does not get equal
+   visual weight. It stays one click away, never hidden. */
+.goal-invite__more { background: none; border: 0; padding: 0; margin: 0 0 8px; cursor: pointer;
+  font: inherit; font-size: 12.5px; color: var(--ink-soft); text-decoration: underline; }
+.goal-invite__more:hover { color: var(--ink); }
+.goal-invite__direct { padding-top: 8px; border-top: var(--line) solid var(--rule-soft); }
 
 /* task 1953 — private goals: the lock badge (meta line) + the goal's own
    pending invite/join-request queue (manager view, next to the invite box). */

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.805",
+  "version": "1.19.807",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.805",
+      "version": "1.19.807",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.805",
+  "version": "1.19.807",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/routine-schedule.js

@@ -52,11 +52,49 @@ const WORKFLOWS_DIR = path.join(ROOT, '.github', 'workflows');
 
 const { parseRoutineFrontmatter } = require('./run-routine.js');
 
-// The cadences a routine may declare. The value is the period a cron expression
-// must resolve to for the two to agree. Add a name here and cronCadence() below
-// must be able to produce it, or the pair can never match.
+// The NAMED cadences a routine may declare. The value is the period a cron
+// expression must resolve to for the two to agree. Add a name here and
+// cronCadence() below must be able to produce it, or the pair can never match.
 const CADENCES = new Set(['hourly', 'daily', 'weekly', 'monthly']);
 
+// Sub-hourly cadences are open-ended rather than enumerated: '15min', '5min',
+// '30min'. Task 1003674 found the vocabulary topped out at `hourly`, so a
+// routine an operator wants to fire every 15 minutes could not SAY so — the
+// step cron that realizes it classified as unclassifiable and hard-failed the
+// check, which left "declare nothing and stay dormant" as the only green
+// option. That is the exact failure mode this file exists to refuse.
+//
+// N MUST DIVIDE 60. A cron step restarts each hour, so only a divisor of 60
+// yields a genuinely uniform period: `*/15` fires at :00 :15 :30 :45 (every 15
+// minutes, always), but `*/7` fires at :00 …:56 and then waits 4 — a "7min"
+// cadence that is not one. Refusing the non-divisors keeps the declared period
+// and the realized period the same claim.
+const SUBHOURLY_RE = /^([1-9]\d*)min$/;
+
+// The one definition of "is N a real sub-hourly period" — both the cadence NAME
+// ('15min') and the cron STEP (*/15) are validated through here, so the two can
+// never drift apart and disagree about the same number.
+function isUniformDivisor(n) {
+  return Number.isInteger(n) && n > 0 && n < 60 && 60 % n === 0;
+}
+
+function subhourlyMinutes(name) {
+  const m = SUBHOURLY_RE.exec(String(name == null ? '' : name));
+  if (!m) return null;
+  const n = Number(m[1]);
+  return isUniformDivisor(n) ? n : null;
+}
+
+// The validity predicate the check asks. Kept separate from CADENCES so the
+// named set stays a plain enumerable list for the error message.
+function isCadence(name) {
+  return CADENCES.has(name) || subhourlyMinutes(name) !== null;
+}
+
+// The minute-field step spelling, hoisted so it is compiled once rather than per
+// classified cron: `*/15` and the equivalent `0/15`.
+const STEP_RE = /^(?:\*|0)\/([1-9]\d*)$/;
+
 // Pure: classify a 5-field cron expression into the cadence it actually realizes.
 // Returns null for anything this vocabulary cannot describe (step values, lists,
 // ranges) — a cadence can then never "match" it, which is the safe direction: an
@@ -67,12 +105,25 @@ const CADENCES = new Set(['hourly', 'daily', 'weekly', 'monthly']);
 //   17   6    *   *   *   → daily    (a specific hour, every day)
 //   17   6    3   *   *   → monthly  (a specific day-of-month)
 //   17   *    *   *   *   → hourly   (a specific minute, every hour)
+//   */15 *    *   *   *   → 15min    (a uniform sub-hourly step)
 function cronCadence(expr) {
   const f = String(expr == null ? '' : expr).trim().split(/\s+/);
   if (f.length !== 5) return null;
   const [min, hour, dom, mon, dow] = f;
   const fixed = (v) => /^\d+$/.test(v);
   const any = (v) => v === '*';
+
+  // Sub-hourly: a step in the minute field with every coarser field wide open.
+  // (STEP_RE is module-scope — see above.)
+  // Anything narrower (a step confined to one hour, or to weekdays) is NOT the
+  // period it looks like, so it stays unclassifiable.
+  const step = STEP_RE.exec(min);
+  if (step) {
+    if (!(any(hour) && any(dom) && any(mon) && any(dow))) return null;
+    const n = Number(step[1]);
+    return isUniformDivisor(n) ? `${n}min` : null;
+  }
+
   if (!fixed(min)) return null;          // every cadence below pins the minute
   if (!any(mon)) return null;            // a specific month is a yearly shape
   if (any(hour)) return any(dom) && any(dow) ? 'hourly' : null;
@@ -145,8 +196,8 @@ function evaluate({ withCadence, withoutCadence }, workflows) {
   const wf = workflows || [];
 
   for (const r of withCadence) {
-    if (!CADENCES.has(r.cadence)) {
-      violations.push(`routine '${r.name}': unknown cadence "${r.cadence}" (want ${[...CADENCES].join('|')})`);
+    if (!isCadence(r.cadence)) {
+      violations.push(`routine '${r.name}': unknown cadence "${r.cadence}" (want ${[...CADENCES].join('|')}, or <N>min where N divides 60)`);
       continue;
     }
     const firing = wf.filter((w) => invokesRoutine(w.text, r.name, r.steps));
@@ -228,4 +279,5 @@ if (require.main === module) main();
 module.exports = {
   checkRoutineCadencesScheduled, evaluate, cronCadence, workflowCrons,
   invokesRoutine, readRoutines, readWorkflows, CADENCES,
+  isCadence, subhourlyMinutes, isUniformDivisor,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.805'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.807'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');