@bongos/core 1.19.824 → 1.19.825

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.824",
-  "core_contract": "1.19.824",
-  "source_commit": "95554434b3e9a6349986ebd50fb547858e7c0fbd",
+  "core_version": "1.19.825",
+  "core_contract": "1.19.825",
+  "source_commit": "cb729764661db914505acde16e83bf6db16e47fb",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T12:15:41.626Z",
+  "built_at": "2026-09-17T13:27:19.562Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 490,
+    "docs_redacted": 491,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2234,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2750,
-  "tree_sha256": "5eaa31427b8c53ddb2d3aa0a10a2e851968649d578993ab3c4412fc279e1014a",
+  "file_count": 2751,
+  "tree_sha256": "d080ea1d5501cd02f6af8cde89d25b58442a1abf7d282379bbf683df5b00ee33",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1979,10 +1979,15 @@
       "mode": "0000644",
       "sha256": "8fcac086f276e57b59ba635cdf34600bf78bfb69d80177d43065dfc6776b0611"
     },
+    {
+      "path": "docs/adr/0299-the-nod-queue-stays-scoped-to-routed-filings.md",
+      "mode": "0000644",
+      "sha256": "f52bf2568d02d5cf8589dc394dc76cbf0ea3a7ba193275f300e320c2ab64a51c"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "14c4e2e04bba4a0438375364a88e41eca44983ab0fb2c3ecd13bf0190f0ad151"
+      "sha256": "0b4e0cd78a8bd6ae3d41c0d010634dfdc29ecd4dca1f8b49127791d1b4cd7450"
     },
     {
       "path": "docs/api-reference.md",
@@ -2547,7 +2552,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a921ec8fff3a0bb3664431ff5f567e3660cb26dbc55a24012edcc7a1c52de4bd"
+      "sha256": "bc4fb1f646f00a5ac5870be4468a5bcb94c1bc19d6c69eea48c54d63f5d0eb70"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5422,7 +5427,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "36481a27a5921e3eb930268bf96bccd178259d3f7cce67b19b0dc4246f7d9bf1"
+      "sha256": "683e2234893c9814c2ecec490099c140e273e764e993707bb1cc4c5c9d1baed3"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -7812,12 +7817,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "aa5cbab9d550e88355a4d19269ef77f0b414394f53d0a745dba09417158d42ae"
+      "sha256": "2a7a81e9c97e32cc83b22d74eef060a6829d4e6847dfabaa9a851ebff576b151"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "50285f0725d1e9c6da37f0b47e3a64ad5f2084a81539eb2902ff9f75b7635ce0"
+      "sha256": "67e42f1c6c167a0857846b43f877395adc67ce48ae72c31cc4709240906e6432"
     },
     {
       "path": "public-docs/index.html",
@@ -9737,7 +9742,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7bd07a13ff08f341820d14bfa056a4fff9715b0a63fbfb7f392e4d04b5336a15"
+      "sha256": "8f04e8b51652109c0e95424fbc9801ed170b2bc899f91793ac827152e653c07a"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0299-the-nod-queue-stays-scoped-to-routed-filings.md

@@ -0,0 +1,65 @@
+# ADR 0299 — The nod queue stays scoped to routed filings; the backlog walk is the widening
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1003748](https://cloudbongos.com/builders#/task/1003748) (goal 1000089)
+
+## Context
+
+`listRoutedAwaitingNod` (`modules/ideas/inbox.js`) feeds the "Reported work awaiting a
+nod" slice of the Home attention card, and it filters `WHERE l.origin = 'route'`. On
+2026-09-08 that read returned 11 rows while 232 tasks sat at `backlog`. The task asked
+whether a queue that omits ~95% of the un-nodded backlog is honestly named, or should
+grow a second slice for un-routed rows. It noted two things that bound any widening:
+dep-gated rows wait on a trigger (migration 163), not a person, so they must not be
+shown as needing a nod; and [task 1003746](https://cloudbongos.com/builders#/task/1003746)
+(`/backlog-review`) might make the question moot, so decide after that exists.
+
+It exists now. Live numbers on 2026-09-17, from `node scripts/gds/backlog-review.js`:
+
+| Bucket | Rows |
+|---|---|
+| waiting on a dependency (auto-promotes on ship) | 109 |
+| spikes (backlog by convention, migration 020) | 2 |
+| stranded (dep abandoned — trigger can never fire) | 1 |
+| awaiting a nod (only a human gates it) | 3 |
+| **total backlog** | **115** |
+
+`GET /inbox/awaiting-nod` returned `count: 0`. `GET /inbox/rotting` returns 200 (the
+route-shadowing bug the task mentioned no longer reproduces), with no rows past the
+30-day timer.
+
+## Decision
+
+**Do not widen the nod queue or the card.** `origin='route'` stays the predicate.
+
+1. **The premise that ~220 rows had no path to a human is gone.** Of the rows the card
+   omits, 111 are correctly *not* a person's decision (109 dep-gated, 2 spikes). The
+   remaining 4 (3 nod + 1 stranded) are exactly what `/backlog-review` walks, goal by
+   goal, with the dependency predicate the task said any widening would need
+   (`include=deps` → per-edge `satisfied`). The widening the task asked for already
+   shipped — as a cadence skill, not a card slice.
+2. **The name is honest.** The card says *"Reported work awaiting a nod"* — reported
+   is the routed population. It never claimed to be the whole backlog.
+3. **A second slice would duplicate a partition.** The four-bucket split lives in
+   `backlog-review.js`; a card slice would need a second copy of the
+   stranded/dep-gated/spike rules in SQL, free to disagree with the walk. The rot
+   card already carries the same kind of warning about its verb list duplicated there.
+4. **The card is a push surface for filers.** A routed filing is someone waiting on an
+   answer; a planning-seeded backlog row is not. Mixing them dilutes the one signal
+   the card exists to carry (task 1003066, owner interview Q3).
+
+## Revisit when
+
+- The *awaiting a nod* bucket of `/backlog-review` (not dep-gated, not spike, not routed)
+  grows past what one daily walk clears — then a Home count linking to the walk earns
+  its place. Show a **count and link**, not rows, and derive it from the same partition
+  the walk uses.
+- `/backlog-review` stops being run — then the rot timer is again the only pull, and
+  this decision's first reason no longer holds.
+
+## Rejected
+
+- A second "un-routed backlog" slice on the card (duplicates the partition; dilutes the
+  filer signal).
+- Renaming the queue (the current copy already says *reported*).
+- Dropping the origin filter and relying on `has_unshipped_dep` (would pull planning rows
+  and spikes into a surface built for filers).

package/docs/adr/README.md

@@ -390,3 +390,4 @@ This keeps the decision history honest and traceable.
 | 0296 | [**A role speciality is data over three existing surfaces, not a fourth mechanism** ([task 1003855](https://cloudbongos.com/builders#/task/1003855), goal 1000095). A craft says HOW you work; nothing said what you work ON. A speciality is a named bundle of knowledge, skills and an interaction contract sitting under a craft — an ideator with an Economics speciality. **Decision: it is DATA, not an ADR 0083 code module** — a subject-matter expert authors one, and requiring them to ship a package puts the mechanism out of reach of exactly the person it exists for. It layers over three surfaces that already exist (discipline-modes.json, the `behavior_prefs.interaction` contract path, the manifest contribution seam); only the knowledge bundle is new. The contract **rides the existing GET /me -> Conductor injection path rather than adding a second one**, and is CRAFT-SCOPED: the hook injects only the contract matching the claim in hand (which needed `t.discipline` on the active-claims read), and with no claim there is no craft and **nothing is injected** — silence beats guessing which expertise applies. Training is two-fold per the owner's 2026-09-17 ruling: documents they supplied, plus learnings captured from sessions worked in it (pointing at existing `learnings` rows, never a second corpus). The corpus is **inventoried, never inlined** — a document may run to 100k chars — so `speciality_documents` joins the recall ingester, because otherwise the contract's "search it with /recall" is a lie whose failure is silent. **`sellable` is recorded with no storefront behind it**: ADR 0107 defers the marketplace and explicitly rejected building one, so the flag captures the owner's decision when they make it and grants nothing — a deliberate partial implementation, recorded rather than silently made. Index scoping errs toward UNDER-sharing: only a public speciality's documents are corpus-wide, because `project` names a set the index cannot express.](0296-a-role-speciality-is-data-over-three-existing-surfaces.md) | roles / modules |
 | 0297 | [**A task’s creator may retire it, and that is the ownership axis’s first route** ([task 1002443](https://cloudbongos.com/builders#/task/1002443), goal 1000095 — owner request 2026-07-25: *"the creator of that task should be able to abandon that task directly inside of the UI"*). Attribution itself shipped earlier and elsewhere (`core_227`, [task 1003278](https://cloudbongos.com/builders#/task/1003278)); what had not moved is that **retiring a task was a rank power and nothing else** — `task.abandon` floors at `metic` (ADR 0152), so a sub-Metic builder could file a task and then could not withdraw their own proposal. The model already had the vocabulary and had never used it: ADR 0151 §3 defines an **ownership axis** where a `scope:'own'` key authorizes nothing until a handler supplies the row's owner, R100 made `requirePermission` refuse such a key outright so `.own` can never degrade into `.any`, and it recorded that **zero call sites passed one**. This is that axis’s first real consumer. **Decision: two authorities, only one rank-shaped** — `task.abandon` (metic, any task) OR new `task.abandon.own` (xenos, a task you created, while it is still backlog/ready/blocked). Route becomes `requireBuilder` + an in-handler decision (the `POST /goals/:id/members` shape), pin `metic+archon`→`any-builder` so it now catches an accidental **tightening** as loudly as a gate removal. **The two facts resolve in two places on purpose:** the RANK fact is request-scoped and resolves before the transaction (uncached, ADR 0016); the OWNER fact is a column that can change under us, so `created_by` joins `abandonTask`’s existing `FOR UPDATE` SELECT and a new optional `authorize` callback decides under that lock. Reading `created_by` in the route would be a TOCTOU window; resolving permissions inside the transaction would hold a row lock across a second pool acquire. The decision is a PURE module (`abandon-authz.js`, the `goal-route-authz.js` precedent) so every branch is pinned DB-free and the hall hint and server verdict provably read one rule. **A creator’s window stops at the grader** — completed/confirmed stay cross-owner, because past the grader a retire is a ledger correction, not an author changing their mind; nothing is subtracted from `task.abandon`, pinned by a test. `counterpart: ['task.abandon']` is declared not derived, verb `act` not `manage` — `manage` would silently dominate every future narrower `task.*.own` key (the verb-blind escalation task 1003195 closed). **A null creator belongs to nobody and that is load-bearing:** ~1,357 pre-`core_227` tasks plus seed/restock/discord vectors are unattributed, so the owner comparison is the government resolver’s own — injected, never re-implemented, since a duplicated ownership comparison is how one quietly widens — and one slip would open every historical task to a xenos grant at once. Fail-closed throughout: a missing `government` port, a throwing resolver, and anything but an explicit `{ok:true}` all deny, and `authorize` runs BEFORE the idempotent already-abandoned return and the shipped/active-claim guards so an unauthorized caller cannot probe a row through a 200. No guard removed. Does NOT widen edit/promote/dependency (still Metic), does not touch `task.merge`, and does not backfill attribution — the control simply does not appear on tasks predating `core_227`.](0297-a-tasks-creator-may-retire-it.md) | authority / lifecycle / ownership |
 | 0298 | [**The grader gets a reader lens: advisory, scoped to copy-bearing diffs, and it waits on a written voice** ([task 1003937](https://cloudbongos.com/builders#/task/1003937), goal 1000095 — Working area 6; owner decision 2026-09-17). Every artist review the cascade files opened with *“REVIEW THE GRADER … coach it”*, and it could not be followed: the v4 panel runs narc, quality, hacker and efficiency — completion, code quality, security, runtime cost — and not one of them reads a sentence for whether it is true, clear, in the project’s voice or worth a person’s attention. Four consecutive reviews hit the same wall and all four graded ships deservedly PASSED on the axes that were measured; the gate is not lenient, it is not pointed at this. `grader-prompt.js` already injects the craft’s written responsibility, but only when `discipline === ‘artist’`, so the unjudged case is copy shipped by someone whose craft is not the copy. **Decision: a fifth ADVISORY `reader` worker, on three settled terms.** It runs only where `modules/lifecycle/cascade.js`’s existing `hasCopyOrVisualWork` says the ship is copy-bearing — the same predicate the after-the-fact review uses, so the two can never disagree about coverage, and every other ship costs exactly what it costs today. It records `issues[]` and a `copy_score` and can never verdict `fail` or drag the panel to `concerns`, because [ADR 0241](0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md) put the artist’s judgement on the DEPLOY and off the ship path; gating would need that ADR amended first. And it is NOT BUILT until the instance writes a voice guide — today the whole written standard is one dash rule in `DESIGN.md`, a tagline, a registry of which 1,860 strings exist, and one responsibility sentence, so a lens built now would record taste and call it a finding. Until the reader exists, STEP 1 asks the artist to WRITE DOWN what the grade could not see rather than to coach a lens that is not listening — followable today, and the corpus both the guide and the lens get written from. Nothing in the rubric, the active panel or any existing worker changes.](0298-the-reader-lens-is-advisory-and-waits-on-a-voice-guide.md) | grading / the artist’s loop / voice |
+| 0299 | [**The nod queue stays scoped to routed filings; the backlog walk is the widening** ([task 1003748](https://cloudbongos.com/builders#/task/1003748), goal 1000089). `listRoutedAwaitingNod` filters `origin='route'`, and on 2026-09-08 showed 11 of 232 backlog rows. Re-measured after `/backlog-review` (task 1003746) shipped: 115 backlog rows = 109 dep-gated + 2 spikes (not a person's decision) + 1 stranded + 3 awaiting a nod, all four walked by `/backlog-review`. **Decision: do not widen the card.** The omitted population already has a walkable review with the dependency predicate any widening needed; the copy says *reported* work, so the name is honest; a card slice would be a second copy of the walk's four-bucket partition. Revisit if the un-routed nod bucket outgrows a daily walk (then a count + link, derived from the same partition) or if the walk stops being run.](0299-the-nod-queue-stays-scoped-to-routed-filings.md) | ideas / backlog / attention |

package/docs/module-api-changelog.md

@@ -2122,5 +2122,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.822 with no explicit bump. run 35218585239. (task 1002620)
   1.19.824 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.823 with no explicit bump. run 35220051893. (task 1002620)
+  1.19.825 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.824 with no explicit bump. run 35227106979. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/inbox.js

@@ -891,7 +891,9 @@ async function sourceIdeaForTask(taskId) {
 //
 // Scoped by the lineage row (origin='route'), not by status alone — a task can be
 // at backlog for a dozen unrelated reasons, and this queue is specifically "a
-// person reported this and the system is waiting on a human". It reads the FILER
+// person reported this and the system is waiting on a human". Widening it to the
+// rest of the backlog was weighed and declined (ADR 0299): /backlog-review walks
+// that population with the dependency split this read lacks. It reads the FILER
 // too (captured_by), because Q3's copy calls the pending state "awaiting a nod"
 // and shows kind + who filed it.
 //

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.824",
+  "version": "1.19.825",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.824",
+      "version": "1.19.825",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.824",
+  "version": "1.19.825",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.824'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.825'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');