@bongos/core 1.19.813 → 1.19.814

package/modules/lifecycle/abandon-authz.js

@@ -0,0 +1,132 @@
+// modules/lifecycle/abandon-authz.js — the PURE authorization decision behind
+// POST /tasks/:id/abandon: may THIS builder retire THIS task, right now?
+//
+// WHY IT IS ITS OWN FILE. Two authorities reach that transition and only one of
+// them is rank-shaped (ADR 0297):
+//
+//   • `task.abandon` (floor metic) — retire ANY task. Triage authority; the
+//     inverse of /promote, re-ranked to match it (ADR 0152).
+//   • `task.abandon.own` (floor xenos) — retire a task you CREATED, while it is
+//     still backlog/ready/blocked. The owner's 2026-07-25 request: "the creator
+//     of that task should be able to abandon that task directly inside of the
+//     UI." A predicate over tasks.created_by, which no rank floor can express —
+//     the ADR 0151 ownership axis.
+//
+// The second one is a rule about a ROW, so it cannot be a middleware and it must
+// not be re-derived at each call site. Carving it out follows the
+// goal-route-authz.js / shouldRefuseSessionClaim precedent: PURE and exported, so
+// every branch is pinned by a DB-free unit test instead of only through a live
+// route, and so the hall's display hint and the server's decision are provably
+// reading the same rule.
+//
+// PURE — no DB, no clock, no I/O. The caller resolves the RANK fact before its
+// transaction opens (request-scoped, uncached, ADR 0016) and supplies the ROW
+// fact from inside its FOR UPDATE lock. Splitting them is what makes the decision
+// both fresh and race-free: reading created_by outside the lock would be a TOCTOU
+// window, and resolving permissions inside it would hold a row lock across a
+// second pool acquire.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway.
+
+'use strict';
+
+// The statuses a CREATOR may retire their own task in. Deliberately the
+// not-yet-started, not-yet-judged window:
+//   • backlog / ready / blocked — the task is still a plan. Retiring it is the
+//     author withdrawing their own proposal, which is what the owner asked for.
+//   • active   — excluded here AND by the active-claim guard in abandonTask: a
+//     live claim means a session still owns the work.
+//   • completed / confirmed — excluded ON PURPOSE. Past the grader a retire is a
+//     correction to the ledger, not an author changing their mind, so it stays
+//     with the cross-owner `task.abandon` authority.
+//   • shipped / abandoned — never reached from here; abandonTask refuses shipped
+//     outright and treats abandoned as an idempotent no-op.
+const CREATOR_ABANDONABLE = Object.freeze(['backlog', 'ready', 'blocked']);
+
+// The permission pair this decision is spelled in, exported so the route, the
+// tests and the denial text all name the same two atoms.
+const ABANDON_ANY_KEY = 'task.abandon';
+const ABANDON_OWN_KEY = 'task.abandon.own';
+
+// Does this builder hold enough to be worth locking the row for? The cheap
+// pre-transaction half: `false` here is a flat 403 and no transaction is opened.
+// Holding only the own-scoped key is NOT an admit — it is permission to be ASKED
+// the ownership question, which is the whole point of the `.own` axis.
+function mayAttemptAbandon({ holdsAny = false, holdsOwn = false } = {}) {
+  return holdsAny === true || holdsOwn === true;
+}
+
+// The row-scoped verdict. ORDERED and FAIL-CLOSED — every path that is not an
+// explicit admit returns { ok: false } with a reason the caller can map to a
+// refusal, and the default at the bottom denies rather than falls through.
+//
+// `sameOwner` is INJECTED rather than hand-rolled: Postgres hands bigints back as
+// strings and JS code carries them as numbers, so 7 and '7' must compare equal
+// while null, '', objects and NaN must match nothing. That normalization already
+// exists once, in the government resolver, and duplicating it here is exactly how
+// an ownership comparison quietly widens. A caller that supplies no comparator
+// gets a strict scalar fallback with the same posture — never a loose `==`.
+function strictSameOwner(a, b) {
+  const norm = (v) => {
+    if (typeof v === 'number') return Number.isFinite(v) ? String(v) : null;
+    if (typeof v === 'bigint') return String(v);
+    if (typeof v === 'string') return v === '' ? null : v;
+    return null;
+  };
+  const left = norm(a);
+  const right = norm(b);
+  return left !== null && right !== null && left === right;
+}
+
+function abandonVerdict({
+  holdsAny = false,
+  holdsOwn = false,
+  builderId = null,
+  createdBy = null,
+  status = null,
+  sameOwner = strictSameOwner,
+} = {}) {
+  // The cross-owner branch: reaches every creator's row, so no predicate applies.
+  // Checked FIRST so a Metic+ is never refused by the creator-only window below —
+  // their authority is wider, not narrower.
+  if (holdsAny === true) return { ok: true, via: ABANDON_ANY_KEY };
+
+  if (holdsOwn !== true) {
+    return {
+      ok: false,
+      reason: 'missing_permission',
+      message: `missing permission: ${ABANDON_ANY_KEY} (floor: metic), or ${ABANDON_OWN_KEY} on a task you created`,
+    };
+  }
+
+  // An own-scoped key is never sufficient on its own — it is half a question, and
+  // this is the other half. A null created_by (every task filed before core_227,
+  // and every system vector) matches nobody, by construction.
+  const compare = typeof sameOwner === 'function' ? sameOwner : strictSameOwner;
+  if (!compare(createdBy, builderId)) {
+    return {
+      ok: false,
+      reason: 'not_task_creator',
+      message: `you did not create this task — retiring someone else's task needs ${ABANDON_ANY_KEY} (floor: metic)`,
+    };
+  }
+
+  if (!CREATOR_ABANDONABLE.includes(String(status))) {
+    return {
+      ok: false,
+      reason: 'creator_status_not_abandonable',
+      message: `this task is '${status}' — a creator can retire their own task only while it is ${CREATOR_ABANDONABLE.join(', ')}; past that it needs ${ABANDON_ANY_KEY} (floor: metic)`,
+    };
+  }
+
+  return { ok: true, via: ABANDON_OWN_KEY };
+}
+
+module.exports = {
+  CREATOR_ABANDONABLE,
+  ABANDON_ANY_KEY,
+  ABANDON_OWN_KEY,
+  mayAttemptAbandon,
+  abandonVerdict,
+  strictSameOwner,
+};

package/modules/lifecycle/db-ship.js

@@ -953,9 +953,39 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
 //                           still owns the work; release it first so the abandon
 //                           can never race a ship in flight.
 // Any other status (backlog/ready/blocked/completed/confirmed) abandons. The
-// route is metic+archon-gated (ADR 0152; archon-only until then), and the abandon
-// + its reason are captured in audit_log by the writing middleware, so the
-// append-only ledger records who retired what. restoreTask (below) is the undo.
+// route carries the authority gate (ADR 0152, and the creator widening of task
+// 1002443), and the abandon + its reason are captured in audit_log by the writing
+// middleware, so the append-only ledger records who retired what. restoreTask
+// (below) is the undo.
+//
+// `authorize` (task 1002443) — the OPTIONAL row-scoped veto, and the reason this
+// function grew a parameter rather than the route growing a pre-flight read.
+//
+// The owner's 2026-07-25 request widened this transition from "a Metic may retire
+// any task" to "...or a builder may retire a task THEY created". That second half
+// is a predicate over a COLUMN OF THIS ROW (tasks.created_by), so a check made
+// before the transaction would be a TOCTOU window: the row can be re-attributed,
+// claimed, or shipped between the read and the write. The callback therefore runs
+// INSIDE the transaction, against the row this function has already locked FOR
+// UPDATE, and its verdict and the UPDATE commit or roll back together.
+//
+// It is deliberately PURE and DB-FREE. The authority question splits in two (the
+// ADR 0151 ownership axis): the RANK fact — does this builder hold the key — is
+// request-scoped and is resolved by the caller BEFORE the transaction opens; only
+// the OWNER fact needs the lock. Resolving permissions in here would acquire a
+// second pool connection while holding a row lock, which under a saturated pool is
+// a deadlock. So the caller closes over its already-resolved grants and hands in a
+// predicate; this function supplies the row.
+//
+// Contract: called with { taskId, createdBy, status }, returns { ok: true } or
+// { ok: false, reason, message }. FAIL-CLOSED — anything that is not an explicit
+// { ok: true } is a refusal, so a caller that returns undefined (or throws) denies
+// rather than admits. Omitting `authorize` entirely preserves the pre-1002443
+// behaviour for every caller whose route already gated the transition.
+//
+// It runs BEFORE the already-abandoned idempotent return, deliberately: a caller
+// with no authority over this row must not be able to read its state back as a
+// 200, and an unauthorized retry is a refusal, not a no-op.
 //
 // NOTE on dependencies: abandoning a task that is listed in another task's
 // dependencies[] does NOT auto-adjust those dependents — they will simply never
@@ -967,14 +997,16 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
 // so a regression test can drive the txn with a SQL-aware fakeClient, same as
 // confirmTask / decideOverrideRequest. Production callers omit deps → module pool.
 
-async function abandonTask({ taskId, reason }, deps = {}) {
+async function abandonTask({ taskId, reason, authorize = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const client = await activePool.connect();
   try {
     await client.query('BEGIN');
 
+    // created_by joins the locked SELECT (task 1002443) so the ownership predicate
+    // below reads the SAME row version the UPDATE will write.
     const { rows: taskRows } = await client.query(
-      `SELECT id, title, status FROM tasks WHERE id = $1 FOR UPDATE`,
+      `SELECT id, title, status, created_by FROM tasks WHERE id = $1 FOR UPDATE`,
       [taskId]
     );
     if (taskRows.length === 0) {
@@ -982,6 +1014,28 @@ async function abandonTask({ taskId, reason }, deps = {}) {
     }
     const task = taskRows[0];
 
+    // The row-scoped veto, under the lock and ahead of every status branch below —
+    // see the header for why both of those orderings are load-bearing. Fail-closed:
+    // only an explicit { ok: true } admits.
+    if (typeof authorize === 'function') {
+      let verdict;
+      try {
+        verdict = await authorize({ taskId, createdBy: task.created_by, status: task.status });
+      } catch (authErr) {
+        throw Object.assign(new Error('abandon authorization could not be established'), {
+          code: 'ABANDON_FORBIDDEN',
+          reason: 'authorize_threw',
+          cause: authErr,
+        });
+      }
+      if (!verdict || verdict.ok !== true) {
+        throw Object.assign(new Error((verdict && verdict.message) || 'not authorized to abandon this task'), {
+          code: 'ABANDON_FORBIDDEN',
+          reason: (verdict && verdict.reason) || 'not_authorized',
+        });
+      }
+    }
+
     if (task.status === 'abandoned') {
       await client.query('COMMIT');
       return { taskId, taskTitle: task.title, taskStatus: 'abandoned', previousStatus: 'abandoned', alreadyAbandoned: true };

package/modules/lifecycle/routes/abandon-handler.js

@@ -0,0 +1,151 @@
+// modules/lifecycle/routes/abandon-handler.js — the HTTP half of
+// POST /tasks/:id/abandon: resolve the caller's authority, compose it with the
+// row-scoped decision, and map every refusal to its status code.
+//
+// WHY IT IS ITS OWN FILE. Two reasons, and the second is the real one:
+//
+//   1. tasks.js sits against the 1,500-line ratchet, and this handler grew when
+//      the route gained a second authority (task 1002443 / ADR 0297) — the same
+//      pressure that carved goal-route-authz.js out of goals.js.
+//   2. COMPOSITION is where this route can go wrong, and composition was the one
+//      layer no test could reach. `abandon-authz.js` pins the decision and
+//      `abandonTask` pins the transaction seam, both in isolation; a mistake in
+//      how the route wires them together — mapping a refusal to the wrong code,
+//      admitting when the government port is absent, reporting a denial that
+//      names the wrong atom — would have passed both. A plain exported function
+//      taking `{ req, res, deps }` is callable from a test with fakes, so that
+//      layer is now pinned too (tests/abandon_route.mjs).
+//
+// Everything it needs is INJECTED rather than imported: the router hands in its
+// own `db`, `governance` port, logger and validators. That is what makes the
+// handler testable without a live Express app or a DB, and it keeps the module
+// boundary intact — this file requires no core internal.
+
+'use strict';
+
+const abandonAuthz = require('../abandon-authz');
+
+// The atoms a denial should name. Both are a genuine way in, so a 403 that listed
+// only the metic-floor key would send a creator after the wrong permission.
+function requiredAtoms(governance) {
+  // The cross-owner escalation path is a DECLARED property of the own-scoped key
+  // (task 1003195), read from the catalog rather than hardcoded, so a change to
+  // that declaration reaches this route instead of silently disagreeing with it.
+  // Falls back to the named atom only when the port cannot answer — a catalog that
+  // has moved on must never be able to WIDEN this gate.
+  const declared = (governance && typeof governance.crossOwnerKeysFor === 'function')
+    ? governance.crossOwnerKeysFor(abandonAuthz.ABANDON_OWN_KEY)
+    : null;
+  const crossOwner = (Array.isArray(declared) && declared.length > 0)
+    ? declared
+    : [abandonAuthz.ABANDON_ANY_KEY];
+  return { crossOwner, required: [...crossOwner, abandonAuthz.ABANDON_OWN_KEY] };
+}
+
+// Floors resolve through the port at deny time, never hardcoded prose — a floor
+// that moves would otherwise leave a lie in the denial.
+function floorsFor(governance, keys) {
+  const out = {};
+  if (!governance || typeof governance.permissionFloor !== 'function') return out;
+  for (const k of keys) {
+    try {
+      const f = governance.permissionFloor(k);
+      if (f) out[k] = f;
+    } catch (_) { /* unknown atom — omit rather than guess */ }
+  }
+  return out;
+}
+
+// deps: { db, seams, log, validateOrRespond, parseId }
+function makeAbandonHandler(deps) {
+  const { db, seams, log, validateOrRespond, parseId } = deps;
+
+  return async function abandonHandler(req, res) {
+    if (validateOrRespond(req, res, {
+      reason: { type: 'string' },  // free-text retire reason (sliced to 2000 below)
+    })) return;
+    const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
+    if (id === null) return;
+    const reason = typeof req.body?.reason === 'string' ? req.body.reason.slice(0, 2000) : '';
+
+    // FAIL-CLOSED on a missing government port, exactly as auth.requirePermission
+    // does: `government` is a core-domain, default:true module, so its absence means
+    // authority cannot be ESTABLISHED — and admitting there would make disabling a
+    // module a privilege escalation, the inversion ADR 0016 exists to prevent.
+    const governance = seams.resolveOptional('government');
+    const { crossOwner, required } = requiredAtoms(governance);
+    const denyUnestablished = () => res.fail('permission_forbidden', {
+      status: 403,
+      message: 'authority could not be established — denied fail-closed (ADR 0016); this route requires '
+        + `${crossOwner.join(', ')}, or ${abandonAuthz.ABANDON_OWN_KEY} on a task you created`,
+      details: { required, held: null, floors: null },
+    });
+    if (!governance || typeof governance.resolveBuilderPermissions !== 'function'
+        || typeof governance.sameOwner !== 'function') {
+      return denyUnestablished();
+    }
+    let held;
+    try {
+      held = new Set(await governance.resolveBuilderPermissions(req.builder.id));
+    } catch (permErr) {
+      log.error('[gds] POST /tasks/:id/abandon — permission resolve', permErr);
+      return denyUnestablished();
+    }
+
+    const holdsAny = crossOwner.some((k) => held.has(k));
+    // Necessary but NEVER sufficient: holding the own-scoped key is permission to be
+    // ASKED the ownership question, answered against the locked row below.
+    const holdsOwn = held.has(abandonAuthz.ABANDON_OWN_KEY);
+    const denyPermission = (message, reasonCode) => res.fail('permission_forbidden', {
+      status: 403,
+      message,
+      details: {
+        required,
+        held: required.filter((k) => held.has(k)),
+        floors: floorsFor(governance, required),
+        ...(reasonCode ? { reason: reasonCode } : {}),
+      },
+    });
+
+    // The cheap half — refuse without opening a transaction at all.
+    if (!abandonAuthz.mayAttemptAbandon({ holdsAny, holdsOwn })) {
+      return denyPermission(abandonAuthz.abandonVerdict({ holdsAny, holdsOwn }).message, null);
+    }
+
+    try {
+      const result = await db.abandonTask({
+        taskId: id,
+        reason,
+        // PURE and DB-free — closes over the grants resolved above and is handed the
+        // row under abandonTask's own lock. See that function's header, and
+        // abandon-authz.js for the decision itself.
+        authorize: ({ createdBy, status }) => abandonAuthz.abandonVerdict({
+          holdsAny,
+          holdsOwn,
+          builderId: req.builder.id,
+          createdBy,
+          status,
+          // The government resolver's own id normalization — never re-implemented
+          // here, because a duplicated owner comparison is how one quietly widens.
+          sameOwner: governance.sameOwner,
+        }),
+      });
+      res.json({ ok: true, ...result });
+    } catch (err) {
+      if (err.code === 'ABANDON_FORBIDDEN') {
+        return denyPermission(err.message, err.reason || null);
+      }
+      if (err.code === 'TASK_NOT_FOUND') return res.fail('task_not_found', 404);
+      if (err.code === 'CANNOT_ABANDON_SHIPPED') {
+        return res.fail('cannot_abandon_shipped', { status: 409, message: 'shipped tasks are immutable history' });
+      }
+      if (err.code === 'TASK_HAS_ACTIVE_CLAIM') {
+        return res.fail('task_has_active_claim', { status: 409, message: 'release the active claim before abandoning' });
+      }
+      log.error('[gds] POST /tasks/:id/abandon', err);
+      res.fail('abandon_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+module.exports = { makeAbandonHandler, requiredAtoms, floorsFor };

package/modules/lifecycle/routes/tasks.js

@@ -32,6 +32,13 @@ const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 // The orphan-task advisory (task 1002539) — pure, fail-open; see goal-advisory.js.
 const { buildGoalAdvisory } = require('../goal-advisory');
+// The PURE abandon decision (task 1002443, ADR 0297) — rank fact + row fact, kept
+// out of this router so every branch is unit-tested without a live route.
+const abandonAuthz = require('../abandon-authz');
+// The abandon route's HTTP half, carved out so its COMPOSITION (authority resolve
+// + the row-scoped decision + refusal mapping) is directly testable — the one
+// layer neither the pure decision nor the db seam could reach.
+const { makeAbandonHandler } = require('./abandon-handler');
 // grading carved to modules/grading/ (BV1.R73 / ADR 0091 §4): the lifecycle no
 // longer imports the grader — it resolves the `grade` kernel PORT at grade time
 // (seams.resolveOptional('grade'), in POST /tasks/:id/grade below).
@@ -668,45 +675,26 @@ module.exports = function buildTasksRouter() {
   // on a task with an active claim (release it first); idempotent on an already-
   // abandoned task. The abandon + its `reason` land in audit_log via the writing
   // middleware, so the ledger keeps a record of who retired what.
-  // rank: metic+archon — scope removal; the inverse of /promote, and re-ranked to
-  // match it (ADR 0152, was archon under ADR 0090). A Metic who may author, shape,
-  // and promote work may also retire it: leaving the kill switch an Archon rung
-  // higher than the create switch only forced the owner to clean up after the
-  // triage they already delegated. Not one-way any more — /promote restores an
-  // abandoned task to backlog at the same rank — and the guards below (shipped
-  // refused, active claim refused) plus the audit_log entry are unchanged.
-  router.post('/tasks/:id/abandon', auth.requireBuilder, auth.requirePermission('task.abandon'), async (req, res) => {
-    if (validateOrRespond(req, res, {
-      reason: { type: 'string' },  // free-text retire reason (sliced to 2000 below)
-    })) return;
-    const id = parseId(req, res, { code: 'bad_task_id', positiveInt: true });
-    if (id === null) return;
-    const reason = typeof req.body?.reason === 'string' ? req.body.reason.slice(0, 2000) : '';
-    try {
-      const result = await db.abandonTask({ taskId: id, reason });
-      res.json({ ok: true, ...result });
-    } catch (err) {
-      if (err.code === 'TASK_NOT_FOUND') return res.fail('task_not_found', 404);
-      if (err.code === 'CANNOT_ABANDON_SHIPPED') {
-        return res.fail('cannot_abandon_shipped', { status: 409, message: 'shipped tasks are immutable history' });
-      }
-      if (err.code === 'TASK_HAS_ACTIVE_CLAIM') {
-        return res.fail('task_has_active_claim', { status: 409, message: 'release the active claim before abandoning' });
-      }
-      log.error('[gds] POST /tasks/:id/abandon', err);
-      res.fail('abandon_failed', { status: 500, message: 'internal error' });
-    }
-  });
+  // rank: any-builder — DELIBERATELY, and the middleware list is not the whole gate
+  // (ADR 0297). Two authorities reach this transition: `task.abandon` (floor metic)
+  // retires ANY task, and `task.abandon.own` (floor xenos) retires one you CREATED
+  // while it is still backlog/ready/blocked. The second is a predicate over
+  // tasks.created_by, which no rank floor can express — the ADR 0151 ownership axis,
+  // and this is its first route. requirePermission structurally cannot carry it: an
+  // own-scoped key has no unconditional answer and that gate refuses one outright
+  // (auth.js, R100), so `.own` can never collapse into `.any`.
+  //
+  // The two facts are resolved in two places ON PURPOSE. The RANK fact is
+  // request-scoped and resolves here, once, uncached (ADR 0016); the OWNER fact is a
+  // column that can change under us, so it is evaluated inside abandonTask's FOR
+  // UPDATE transaction. Reading created_by here would be a TOCTOU window; resolving
+  // permissions in there would hold a row lock across a second pool acquire.
+  //
+  // Existing guards (shipped refused, active claim refused, idempotent re-abandon)
+  // and the audit_log entry are unchanged on both paths.
+  router.post('/tasks/:id/abandon', auth.requireBuilder,
+    makeAbandonHandler({ db, seams, log, validateOrRespond, parseId }));
 
-  // POST /tasks/:id/merge — mark a duplicate task merged into its canonical one
-  // (task 1001478 — the /bug-triage counterpart to idea_inbox's merge verdict).
-  // Implemented as `abandonTask` plus a target (db.mergeTask, db-ship.js) rather
-  // than a new `tasks.status` value — see that function's header for why. Refuses
-  // a self-merge, a shipped task, a task with an active claim, a target that
-  // doesn't exist, and a target that is itself merged elsewhere (no chains);
-  // idempotent when re-merging into the SAME target already recorded.
-  // rank: metic+archon — same floor as task.abandon, which this reuses under the
-  // hood; a Metic who may retire a task may also say which task it duplicates.
   router.post('/tasks/:id/merge', auth.requireBuilder, auth.requirePermission('task.merge'), async (req, res) => {
     if (validateOrRespond(req, res, {
       into_task_id: { required: true, type: 'integer', min: 1 },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.813",
+  "version": "1.19.814",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.813",
+      "version": "1.19.814",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.813",
+  "version": "1.19.814",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -311,7 +311,18 @@ const MODULE_EXPECTED_RANKS = {
     // it; /promote carries the abandoned→backlog undo at the same rank.
     'POST /tasks': 'metic+archon',
     'POST /tasks/:id/promote': 'metic+archon',
-    'POST /tasks/:id/abandon': 'metic+archon',
+    // task 1002443 — DELIBERATELY 'any-builder', widened from 'metic+archon'. Two
+    // authorities reach this route and only one is rank-shaped: `task.abandon`
+    // (floor metic) retires ANY task, and `task.abandon.own` (floor xenos) retires
+    // one you CREATED while it is still backlog/ready/blocked. The second is the
+    // ADR 0151 ownership axis, which requirePermission structurally cannot gate (an
+    // own-scoped key has no unconditional answer), so the wall is requireBuilder +
+    // an in-handler authorizeOwnedOrAny — the POST /goals/:id/members shape.
+    //
+    // Pinning it here keeps catching the accidental TIGHTENING back to a rank floor,
+    // which would lock creators out of retiring their own work and silently revert
+    // the owner's 2026-07-25 request, as loudly as it catches a gate removal.
+    'POST /tasks/:id/abandon': 'any-builder',
     // override-request adjudication (lands credit + ship attribution).
     // ADR 0157: `override_request.decide` lowered archon→metic; pinned by atom.
     'GET /override-requests': 'perm:override_request.decide',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.813'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.814'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');