@bongos/core 1.19.842 → 1.19.844

package/modules/agents/migrations/agents_004_spend_cap.sql

@@ -0,0 +1,53 @@
+-- agents_004_spend_cap.sql — the PER-AGENT monthly spend cap (task 1002499).
+--
+-- agents_002 recorded who PAYS for a fire, and modules/agents/lib/spend-ceiling.js
+-- bounds what a payer may spend in a month. Both ask "how much has this WALLET
+-- spent", and neither can answer "how much has this AGENT spent" — so under a
+-- single project payer one runaway definition consumes the whole instance ceiling
+-- and every other agent is refused for a bill it did not run up. The owner's
+-- decision (2026-07-05, recorded on task 1002499) is ~$5/month per agent, layered
+-- under the ~$30/month global autonomy brake: a per-agent cap bounds the blast
+-- radius of ONE bad definition, and the global brake bounds the fleet.
+--
+-- NULL MEANS "USE THE INSTANCE DEFAULT", NOT "UNCAPPED". The default lives in
+-- lib/spend-ceiling.js (BONGOS_AGENT_SPEND_CAP_USD, default $5) so a definition
+-- that never thought about money still has a ceiling, and an instance can move
+-- every unset agent with one env var. Storing the default on each row instead
+-- would freeze today's number into every definition ever synced — the same trap
+-- agents_002's header names for deriving payer_kind, in the other direction.
+-- Nothing may read this column as "no cap": the CHECK below forbids a zero or a
+-- negative, so the only two states are a positive number and "ask the default".
+--
+-- WHY NO NEW INDEX. The read this backs — SUM(cost_usd) for one agent this month
+-- — is already served by agents_runs_agent_idx (agent_name, created_at DESC),
+-- which agents_001 created with the comment "the read behind a per-agent spend
+-- rollup". This migration is the rollup that index was built for.
+--
+-- Module migrations are ADDITIVE and NAMESPACED (ADR 0083 §Decision #5): every
+-- object is agents_-prefixed, there is no down-migration, and the filename is
+-- agents_-prefixed (ADR 0108 §5). Idempotent: safe to re-run.
+
+BEGIN;
+
+-- The per-agent monthly ceiling in USD. NULL = fall back to the instance default.
+-- numeric(10,4) mirrors agents_runs.cost_usd, so a cap and the spend it bounds are
+-- the same kind of number and a comparison cannot lose a fraction of a cent.
+ALTER TABLE agents_definitions ADD COLUMN IF NOT EXISTS spend_cap_usd numeric(10, 4);
+
+DO $$
+BEGIN
+  -- A stored cap must be a real ceiling. Zero would read as "this agent may never
+  -- fire", which is what `enabled = false` already says and says better; a
+  -- negative is meaningless. Both are refused at the schema rather than left for
+  -- the guard to interpret, because a guard that has to decide what 0 means is a
+  -- guard with two possible answers.
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'agents_definitions_spend_cap_positive_chk') THEN
+    ALTER TABLE agents_definitions ADD CONSTRAINT agents_definitions_spend_cap_positive_chk
+      CHECK (spend_cap_usd IS NULL OR spend_cap_usd > 0);
+  END IF;
+END $$;
+
+COMMENT ON COLUMN agents_definitions.spend_cap_usd IS
+  'Per-agent monthly spend ceiling in USD (task 1002499). NULL = use the instance default from lib/spend-ceiling.js (BONGOS_AGENT_SPEND_CAP_USD, default $5). Never "uncapped" — a positive value is the only storable cap.';
+
+COMMIT;

package/modules/agents/pollers/event-router.js

@@ -113,8 +113,13 @@ const FANOUT_MAX = envInt('BONGOS_AGENTS_EVENT_FANOUT_MAX', DEFAULT_FANOUT_MAX);
 // `enabled = false` by agents_definitions_flagged_not_armed_chk, so the WHERE
 // clause below already excludes it and a second check here would only be a
 // second place to get it wrong.
+// `spend_cap_usd` joins the list for step (g2) — the per-agent ceiling reads the
+// definition's own cap (task 1002499). It has to be selected here or every agent
+// silently takes the instance default, which is the quiet-wrong-answer shape this
+// spelled-out list otherwise protects against: a cap set on a definition would be
+// stored, shown by the API, and ignored by the only code that enforces it.
 const DEF_COLUMNS = `
-  id, name, persona, trigger_type, trigger_spec, model_tier
+  id, name, persona, trigger_type, trigger_spec, model_tier, spend_cap_usd
 `;
 
 // ---------------------------------------------------------------------------
@@ -590,10 +595,32 @@ async function fanOut(payload, deps = {}) {
     return report;
   }
 
+  // (g2) THE PER-AGENT CEILING (task 1002499), once PER AGENT rather than once
+  // for the fan-out. That is the whole difference from (g) above: the payer
+  // ceiling asks a question about the wallet, so one answer covers every agent
+  // sharing it, while this one asks about each definition and so has as many
+  // answers as there are agents. An agent over its share is skipped with its own
+  // ledger row; its siblings still fire, which is the behaviour a per-agent cap
+  // exists to produce — one runaway definition must not silence the fleet.
+  const stillAdmitted = [];
+  for (const a of admitted) {
+    const agentRoom = await ceiling.checkAgent(pool, a.definition);
+    if (agentRoom.ok) { stillAdmitted.push(a); continue; }
+    const reason = agentRoom.reason === 'agent_spend_cap_reached'
+      ? `agent '${a.definition && a.definition.name}' has reached its $${agentRoom.capUsd} monthly cap — the instance still has room, but this agent has spent its share`
+      : `this agent's spend ceiling could not be established (${agentRoom.reason}) — a ceiling that cannot be read must not be assumed`;
+    await ledgerNoGo(deps, { definition: a.definition, taskId, reason, spendPayer });
+    report.skipped += 1;
+  }
+  if (!stillAdmitted.length) {
+    report.reason = 'agent_spend_ceiling';
+    return report;
+  }
+
   // (h) FIRE. Sequentially, so N agents on one ship are N model calls in a row
   // rather than N at once — the spend ceiling's own blind spot is fires already
   // in flight, and serialising is what keeps that blind spot one fire wide.
-  for (const a of admitted) {
+  for (const a of stillAdmitted) {
     const fired = await fireOne(a, { task, taskId, spendPayer }, deps);
     if (fired && fired.ran) report.fired += 1; else report.skipped += 1;
   }

package/modules/agents/routes/agents.js

@@ -122,7 +122,7 @@ const COLUMNS = `
   id, name, title, trigger_type, trigger_spec, model_tier,
   scope_modules, scope_paths, scope_violation,
   source, provenance, author_rank,
-  source_path, last_synced_at, enabled, created_at, updated_at
+  source_path, last_synced_at, enabled, spend_cap_usd, created_at, updated_at
 `;
 
 // PURE. Row → wire shape, so the projection is unit-testable without a database.
@@ -168,6 +168,14 @@ function serializeDefinition(row, { includePersona = false } = {}) {
     // is the one disarm the registry can explain; anything else is simply off.
     disarmed_reason: row.enabled === true ? null : (row.scope_violation ? 'scope_violation' : null),
     last_synced_at: row.last_synced_at || null,
+    // The agent's own monthly ceiling (task 1002499), or null when it takes the
+    // instance default. Served as a NUMBER, not the pg NUMERIC string, so a caller
+    // comparing it against a spend does not silently compare strings. Null here
+    // never means "uncapped" — agents_004's CHECK makes a positive value the only
+    // storable cap, and an unset one resolves to BONGOS_AGENT_SPEND_CAP_USD.
+    spend_cap_usd: row.spend_cap_usd === null || row.spend_cap_usd === undefined
+      ? null
+      : Number(row.spend_cap_usd),
     created_at: row.created_at,
     updated_at: row.updated_at,
   };
@@ -605,6 +613,35 @@ module.exports = function agentsRoutes() {
       );
       if (!rows.length) return res.fail('agent_not_found', 404);
       const definition = rows[0];
+
+      // THE PER-AGENT CEILING (task 1002499), after the payer's and before the
+      // gate. It cannot run any earlier: it needs the definition, both for its own
+      // spend_cap_usd and for the name it sums by.
+      //
+      // A THIRD refusal with a THIRD code, for the same reason the first two are
+      // separate: 429 says "too fast", `spend_cap_reached` says "this wallet's
+      // month is gone", and this one says "this wallet has room, but THIS AGENT
+      // has had its share". Collapsing them would tell an operator staring at a
+      // refused fire to go raise the wrong number — and under a single project
+      // payer the wrong number is the one that refuses every OTHER agent too.
+      const agentRoom = await spendCeiling.checkAgent(api.pool, definition);
+      if (!agentRoom.ok) {
+        return res.fail('agent_spend_cap_reached', {
+          status: 402,
+          message: agentRoom.reason === 'agent_spend_cap_reached'
+            ? `agent '${definition.name}' has reached its $${agentRoom.capUsd} monthly cap — the instance still has room, but this agent has spent its share`
+            : `this fire is refused because the agent's spend ceiling could not be established (${agentRoom.reason}) — a ceiling that cannot be read must not be assumed`,
+          details: {
+            scope: 'agent-spend-per-agent',
+            reason: agentRoom.reason,
+            agent: definition.name,
+            cap_usd: agentRoom.capUsd,
+            // null whenever the refusal was a failure to READ, never a claimed sum.
+            spent_usd: agentRoom.spentUsd,
+          },
+        });
+      }
+
       const gate = gateFor(definition);
       const trigger = { type: 'on-demand', ref: `on-demand:${req.builder.github_login || req.builder.id}` };
 

package/modules/agents/spawn.js

@@ -36,6 +36,11 @@
 const api = require('../../src/module-api');
 const { payerFor } = require('./lib/spend-ceiling');
 
+// Namespaced + structured, like the module's other two log sites (routes/agents.js,
+// pollers/event-router.js). A bare console.warn here would be the module's only
+// unstructured line, and the fitness console ratchet counts it.
+const log = api.logger('agents');
+
 // tier → concrete model id. The mapping is BRANDING, not a constant here: an
 // instance retunes its own tiers, and the DB constraint already limits the
 // vocabulary to these two.
@@ -139,6 +144,68 @@ async function insertRun(pool, row) {
   return r.rows[0].id;
 }
 
+// The cost_log SOURCE TAG for one agent's spend (task 1002499). The `agent:`
+// family is what modules/economy/cost.js's autonomous MTD brake matches on, beside
+// `cron:`, so the prefix is a contract and not a label — see that function's header.
+// The name is already schema-constrained to ^[a-z][a-z0-9-]*$ (agents_001), so
+// nothing here has to sanitise it, but the tag is built in ONE place so a future
+// rename cannot leave the brake matching a prefix nobody writes any more.
+function costSourceTag(agentName) {
+  return `agent:${agentName}`;
+}
+
+// Mirror one completed fire's cost into cost_log, so the project-wide brake can
+// see it (task 1002499).
+//
+// WHY A MIRROR AND NOT A MOVE. agents_runs.cost_usd stays the ACCOUNTING — it is
+// what the per-payer and per-agent ceilings sum, it carries the payer, and it is
+// the row the schema's invariants are written about. cost_log is the project-wide
+// ROLL-UP: the autonomy spend-brake and the cost dashboard's by_source breakdown
+// both read it, and neither knows agents_runs exists. Before this, agent spend
+// appeared in exactly one of those two places, which is why the brake was blind
+// to it. The mirror is a projection of the ledger, never a second ledger: it is
+// written once, after the cost is final, keyed so a retry cannot double-post.
+//
+// IDEMPOTENT BY CONSTRUCTION. logCost is insert-once on (source, source_ref), and
+// source_ref is the run id — the one value that is unique per fire and already
+// exists. A re-run of this function for the same fire is a no-op at the database,
+// not a second row, which matters because the alternative to a stable key here is
+// double-counting money.
+//
+// BEST-EFFORT, DELIBERATELY. A fire that ran and was ledgered in agents_runs has
+// already happened and already cost money; failing it now because the roll-up
+// could not be written would discard a completed fire's result to fix a reporting
+// row. The direction of that trade is the opposite of the ceilings' — they fail
+// CLOSED because they decide whether to spend, this fails OPEN because the spend
+// is already past. What it must never do is stay silent: an unwritten mirror
+// means the brake is under-counting, so the failure is logged with the run id.
+async function mirrorCostToLedger({ runId, definition, costUsd, builderId = null }, deps = {}) {
+  if (!(typeof costUsd === 'number' && costUsd > 0)) return false;
+  const name = definition && definition.name;
+  if (!runId || typeof name !== 'string' || !name) return false;
+  const economy = deps.economy
+    || (typeof api.resolveOptional === 'function' ? api.resolveOptional('reward', null) : null);
+  if (!economy || typeof economy.logCost !== 'function') return false;
+  try {
+    await economy.logCost({
+      amountUsd: costUsd,
+      category: 'api',
+      source: costSourceTag(name),
+      sourceRef: `agent-run-${runId}`,
+      // Who ASKED, when anyone did. Not who PAYS — payer_kind lives on the
+      // agents_runs row and is that question's answer; cost_log's builder_id is
+      // per-builder attribution, and an event fire legitimately has neither.
+      builderId,
+      description: `agent ${name} — fire ${runId}`.slice(0, 1000),
+    });
+    return true;
+  } catch (e) {
+    (deps.log || log).warn({ run_id: runId, agent: name, err: (e && e.message) || String(e) },
+      'cost mirror failed — agents_runs still has the cost, but the autonomous MTD brake is under-counting by it');
+    return false;
+  }
+}
+
 async function finishRun(pool, id, patch) {
   const cols = Object.keys(patch);
   const set = cols.map((c, i) => `${c} = $${i + 2}`).join(', ');
@@ -218,6 +285,11 @@ async function spawnAgent({
       outputRef: ok ? (deps.outputRef || (res && res.output_ref) || null) : null,
     });
     await finishRun(pool, runId, patch);
+    // AFTER the ledger write, never before: the mirror projects a cost that is
+    // already recorded, so a row in cost_log with no agents_runs row behind it
+    // must not be possible. A failed or zero-cost fire mirrors nothing — the
+    // guard is inside mirrorCostToLedger so both call shapes share it.
+    await mirrorCostToLedger({ runId, definition, costUsd, builderId: requestedByBuilderId }, deps);
     return { ok, ran: true, runId, model, cost_usd: costUsd, duration_ms: durationMs };
   } catch (e) {
     const durationMs = Math.max(0, now() - started);
@@ -228,4 +300,4 @@ async function spawnAgent({
   }
 }
 
-module.exports = { spawnAgent, resolveModel, plannedRow, completedRow, composePrompt };
+module.exports = { spawnAgent, resolveModel, plannedRow, completedRow, composePrompt, mirrorCostToLedger, costSourceTag };

package/modules/copy-desk/routes/copy-desk.js

@@ -429,6 +429,12 @@ module.exports = function buildCopyDeskRouter() {
         // opinion mint claimable work.
         status: 'backlog',
         kind: 'feature',
+        // task 1002988: named explicitly rather than inferred. A copy patch is
+        // reader-facing wording, which is artist work — cascade.js already treats
+        // `source: 'copy-proposal'` as an artist surface (hasCopyOrVisualWork), so
+        // inferring it from the patch text would risk the two disagreeing about
+        // the same row.
+        discipline: 'artist',
         priority: 4,
         touches: [patch.file],
         source: 'copy-proposal',

package/modules/economy/cost-classify.js

@@ -46,6 +46,17 @@ const COST_WRITE_SURFACES = [
     file: 'scripts/gds/session-cost.js',
     builder_id: 'the authed builder; category=api, source_ref=<session-id>, task_id=null. Idempotent per session.',
   },
+  {
+    // task 1002499: an agent fire mirrors its cost here so the autonomous MTD
+    // spend-brake can see it. agents_runs.cost_usd stays the accounting; this is
+    // the project-wide roll-up, written once per fire after the cost is final and
+    // keyed source_ref=agent-run-<id> so a retry cannot double-post. It reaches
+    // logCost through the economy PORT (ADR 0083) — still one writer, which is the
+    // property this list exists to state.
+    surface: 'modules/agents/spawn.js (fire mirror) → reward port → db.logCost() (source=agent:<name>)',
+    file: 'modules/agents/spawn.js',
+    builder_id: 'whoever REQUESTED the fire, or null for an event fire, which nobody asked for. Not the PAYER — that is payer_kind on the agents_runs row, a different question.',
+  },
   {
     surface: 'migrations / direct DB',
     file: '—',

package/modules/economy/cost.js

@@ -55,16 +55,34 @@ async function getBuilderCostStatus(builderId) {
   return classifyCostStatus(row.spend_mtd_usd, row.budget_usd);
 }
 
-// System 3 (task 1351): project-wide AUTONOMOUS api spend month-to-date — the
-// `cron:%`-sourced rows (System 1 / task 1344 tags cron-launched sessions). The
+// System 3 (task 1351): project-wide AUTONOMOUS api spend month-to-date. The
 // autonomy precheck's hard spend-brake compares this against a ceiling so a
 // runaway autonomous fleet self-throttles. Returns a plain number (USD).
+//
+// TWO SOURCE FAMILIES, because there are two ways this project spends money with
+// nobody watching (task 1002499):
+//   cron:%   — cron-launched SESSIONS (System 1 / task 1344).
+//   agent:%  — agent fires (modules/agents). Each one is a `claude -p` the server
+//              spawns on its own, and POST /agents/:name/invoke answers 202
+//              without waiting, so the caller is not present for the spend either.
+//
+// The agent family was the hole this closes. Agent fires recorded their cost in
+// `agents_runs.cost_usd` and nowhere else, so the brake — which reads cost_log —
+// could not see a dollar of it: the per-payer and per-agent ceilings in
+// modules/agents/lib/spend-ceiling.js bounded each wallet and each definition,
+// while the fleet-wide brake they sit under was measuring only half the fleet.
+//
+// THE PREFIX MATCH IS THE CONTRACT, not a convenience. `agent:<name>` is written
+// by exactly one place (the mirror in modules/agents/spawn.js) and the shape is
+// asserted there, so widening the brake to a family rather than a list means a
+// new agent is inside the ceiling the day it is authored, with nothing to
+// remember to add here.
 async function autonomousApiSpendMtd() {
   const { rows } = await pool.query(
     `SELECT COALESCE(SUM(amount_usd), 0) AS usd
        FROM cost_log
       WHERE category = 'api'
-        AND source LIKE 'cron:%'
+        AND (source LIKE 'cron:%' OR source LIKE 'agent:%')
         AND recorded_at >= date_trunc('month', now())`
   );
   return Number(rows[0]?.usd) || 0;

package/modules/economy/reward.js

@@ -67,6 +67,13 @@ module.exports = {
   setBuilderMonthlyBudget: (...a) => cost.setBuilderMonthlyBudget(...a),
   reconcileSessionCosts: (...a) => cost.reconcileSessionCosts(...a),
   autonomousApiSpendMtd: (...a) => cost.autonomousApiSpendMtd(...a),
+  // The one WRITE the agents module needs (task 1002499). cost_log is economy's
+  // table and modules may only cross the wall through a port (ADR 0083 / 0093 §2),
+  // so an agent fire mirrors its cost through here rather than by importing cost.js
+  // or writing the INSERT itself. It is the same logCost every other writer uses —
+  // not an agent-shaped variant — so there is still exactly one writer, which is
+  // the property modules/economy/cost-classify.js's COST_WRITE_SURFACES enumerates.
+  logCost: (...a) => cost.logCost(...a),
   leaderboard: (...a) => credits.leaderboard(...a),
   getLeaderboardWithAchievements: (...a) => achievements.getLeaderboardWithAchievements(...a),
   listAchievements: (...a) => achievements.listAchievements(...a),

package/modules/hall-ui/public/goals.states.json

@@ -18,8 +18,8 @@
   ],
   "ignoreConsole": [
     "/api/(gds|bongos)/",
-    "\b401\b",
-    "\b404\b",
+    "\\b401\\b",
+    "\\b404\\b",
     "Unauthorized",
     "Not Found",
     "load failed"

package/modules/hall-ui/public/idea.states.json

@@ -5,7 +5,7 @@
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,
   "ignoreRequests": ["/api/(gds|bongos)/"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
   "states": {
     "record": { "auth": true, "actions": [["wait", 600]], "expect": { "visible": ["#idea-body", "#idea-h"] } },
     "missing": { "auth": true, "url": "/idea/999999", "actions": [["wait", 600]], "expect": { "visible": ["#idea-h"] } }

package/modules/hall-ui/public/ideas.states.json

@@ -6,7 +6,7 @@
   "modeQuery": false,
   "ignoreRequests": ["/api/(gds|bongos)/"],
   "_console": "The 501 is the harness, not the page: the meter re-scores through POST /inbox/score on every keystroke and scripts/hall-preview/server.js answers every write with preview_readonly by design. Declared rather than hidden.",
-  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "\b501\b", "Unauthorized", "Not Found", "Not Implemented", "load failed"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "\\b501\\b", "Unauthorized", "Not Found", "Not Implemented", "load failed"],
   "states": {
     "compose": { "auth": true, "actions": [["wait", 700]], "expect": { "visible": ["#fi-form", "#fi-fields", "#fi-queue"] } },
     "develop": { "auth": true, "url": "/ideas?develop=1000884", "actions": [["wait", 700]], "expect": { "visible": ["#fi-develop"] } }

package/modules/hall-ui/public/index.states.json

@@ -6,7 +6,7 @@
   "modeQuery": false,
   "_feeds": "As work.states.json: the kit's stub is not the hall's feed set, so Home renders its skeletons and empty states here. The populated dashboard is the hall-preview harness.",
   "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/", "/api/(gds|bongos)/tasks", "/api/(gds|bongos)/claims", "/api/(gds|bongos)/goals", "/api/(gds|bongos)/inbox", "/api/(gds|bongos)/live", "/api/(gds|bongos)/analytics/", "/api/(gds|bongos)/achievements", "/api/(gds|bongos)/versions", "/api/(gds|bongos)/leaderboard"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
   "_1003441": "The `leaderboard` state left with the view: the Roll is the /roster page now and #leaderboard REDIRECTS there, so there is no #view-leaderboard on this page to make visible. The redirect is proven in tests/hall_nav.mjs (it asserts location.replace('/roster') fires on the index and nowhere else) rather than by a render state, because a state whose page navigates away measures the destination, not this page. `standing-karma` replaces the coverage: task 2178 made each Standing rail section addressable and none had a measured state.",
   "states": {
     "home": { "auth": true, "expect": { "visible": ["#view-home"], "hidden": ["#view-standing"] } },

package/modules/hall-ui/public/pair.states.json

@@ -5,7 +5,7 @@
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,
   "ignoreRequests": ["/api/(gds|bongos)/"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
   "states": {
     "request": { "auth": true, "url": "/pair?code=K7QD-4M2X", "actions": [["wait", 700]], "expect": { "visible": ["#pair-h1", "#pair-approve-btn"] } },
     "nocode": { "auth": true, "actions": [["wait", 700]], "expect": { "visible": ["#pair-h1", "#pair-scroll .pair-status--err"] } }

package/modules/hall-ui/public/settings.states.json

@@ -5,7 +5,7 @@
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,
   "ignoreRequests": ["/api/(gds|bongos)/", "/downloads/devbox/"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "/downloads/devbox/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed", "Password field"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "/downloads/devbox/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed", "Password field"],
   "states": {
     "account": { "auth": true, "actions": [["wait", 900]], "expect": { "visible": ["#settings-h1", "#display-name-input", "#craft-chips", "#privacy-rows"] } },
     "access": { "auth": true, "url": "/settings#access", "actions": [["wait", 900]], "expect": { "visible": ["#cli-reissue-btn", "#sessions-list", "#artkey-card"] } },

package/modules/hall-ui/public/task.states.json

@@ -5,7 +5,7 @@
   "stub": { "prefix": "/builders/" },
   "modeQuery": false,
   "ignoreRequests": ["/api/(gds|bongos)/"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
   "states": {
     "record": { "auth": true, "actions": [["wait", 600]], "expect": { "visible": ["#task-body", "#task-grade", "#task-sessions", "#copy-prompt-btn"] } },
     "from-goal": { "auth": true, "url": "/task/2166?from=%2Fgoals%23%2Fgoal%2F1000081", "actions": [["wait", 600]], "expect": { "visible": ["#task-back", "#copy-prompt-btn"], "attr": [["#task-back", "href", "/goals#/goal/1000081"]] } },

package/modules/hall-ui/public/work.states.json

@@ -6,7 +6,7 @@
   "modeQuery": false,
   "_feeds": "The kit's stub carries a small fixture set, not the hall's task feeds, so the board renders its EMPTY and SKELETON states here — which is the point: an empty queue is a state the floors must hold in. The feed 404s are declared, never hidden.",
   "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/", "/api/(gds|bongos)/tasks", "/api/(gds|bongos)/claims", "/api/(gds|bongos)/goals", "/api/(gds|bongos)/inbox/", "/api/(gds|bongos)/versions"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "\b401\b", "\b404\b", "Unauthorized", "Not Found", "load failed"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
   "states": {
     "ready": { "auth": true, "expect": { "visible": ["#claim-scroll"], "hidden": ["#wip-scroll", "#backlog-scroll", "#history-scroll"] } },
     "in-progress": { "auth": true, "url": "/builders/work#in-progress", "actions": [["wait", 400]], "expect": { "visible": ["#wip-scroll"] } },

package/modules/ideas/inbox.js

@@ -405,9 +405,11 @@ async function routeIdeaToGoal({
     //    own floor and takes the HIGHER of the two, so this can raise the bar and
     //    never lower it. Deliberately NOT passed at all: `creditsReward` (server
     //    default — createTask auto-assigns the capped suggestion) and
-    //    `discipline` (left 'unclassified', exactly as the other non-authored
-    //    create vectors leave it).
+    //    `discipline` — NO LONGER 'unclassified' (task 1002988). createTask refuses a
+    //    craft it cannot infer; refusing a filer is the wrong trade for an INBOX, so we
+    //    ask the same question and fall back to 'engineer' (free to re-triage; a lost capture is not).
     const task = await lifecycle.createTask({
+      discipline: (lifecycle.resolveWriteDiscipline?.({ title, description: bodyMd, touches: declaredTouches })?.discipline) || 'engineer',
       versionId: goal.version_id,
       title,
       description: bodyMd,

package/modules/lifecycle/db-tasks.js

@@ -18,6 +18,7 @@ const { matchProtected } = api.permissionPathCheck;
 const { decorateGoalMembership, capNewcomerTasks } = require('./claim-feed.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { executorFor } = require('./db-executor.js');
+const { resolveWriteDiscipline, WRITABLE_DISCIPLINES } = require('./task-classifier.js');
 
 // -------------------------------------------------------------------------
 // Tasks
@@ -123,7 +124,13 @@ async function createTask({
   sourceRef = null,
   valueSummary = null,
   kind = 'unclassified',
-  discipline = 'unclassified',
+  // task 1002988 — NOT defaulted to 'unclassified' any more. This is the single
+  // chokepoint every create vector passes through, including the ones that never
+  // touch an HTTP route (idea promotion, copy-desk, newcomer-restock, kickoff-seed,
+  // cascade), so resolving here is what makes "no row is born role-less" true of
+  // the whole path rather than of the two routes. Resolved just below; `undefined`
+  // means "work it out from the text".
+  discipline = undefined,
   parallelSafe = null,
   newcomerFriendly = false,
   needsMigration = false,
@@ -198,6 +205,25 @@ async function createTask({
     }
     goalIdEffective = await generalGoalIdForVersion(versionId);
   }
+
+  // task 1002988 (owner decision 2026-09-17): every row is born with a craft.
+  // An absent or 'unclassified' discipline is INFERRED from title + description +
+  // touches; a task whose text says nothing about its craft is REFUSED rather than
+  // filed under a word that means "nobody looked". Throwing here rather than
+  // silently defaulting is the point — 1,189 role-less rows accumulated precisely
+  // because the default was quiet. A caller that cannot tolerate a refusal passes
+  // an explicit discipline, which is then visible at its call site instead of
+  // hidden in this signature.
+  const resolvedDiscipline = resolveWriteDiscipline({ discipline, title, description, touches });
+  if (resolvedDiscipline.error) {
+    const err = new Error(resolvedDiscipline.unclassifiable
+      ? `Cannot infer a discipline for "${String(title).slice(0, 80)}" from its title and description. Pass discipline explicitly: ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`
+      : `discipline must be one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')} (got ${JSON.stringify(discipline)}).`);
+    err.code = 'BAD_DISCIPLINE';
+    err.unclassifiable = resolvedDiscipline.unclassifiable === true;
+    throw err;
+  }
+  const disciplineEffective = resolvedDiscipline.discipline;
   // task 1498 / ADR 0084: every task carries a deliberate rank floor. Derive it,
   // then let an explicit requiresRank override only UPWARD (highestRank) — a
   // requested rank below the derived floor is clamped up to the floor
@@ -247,7 +273,7 @@ async function createTask({
       sourceRef,
       valueSummary,
       kind,
-      discipline,
+      disciplineEffective,
       parallelSafe,
       newcomerFriendly === true,
       needsMigration === true,

package/modules/lifecycle/lifecycle.js

@@ -37,6 +37,12 @@ module.exports = {
   // (consumer: core cascade-dispatch.js, the dormant System-3 lib).
   get VOTABLE_TASK_STATUSES() { return classifier.VOTABLE_TASK_STATUSES; },
   classifyTaskKind: (...a) => classifier.classifyTaskKind(...a),
+  // task 1002988: createTask now REFUSES a task whose craft it cannot work out, so
+  // a consumer that must not fail (idea capture, copy-desk) needs to ask the same
+  // question first and name its own fallback. Exposed on the port because a module
+  // may not require another module — the boundary rule — and a second copy of this
+  // heuristic living in modules/ideas is exactly the drift this port exists to stop.
+  resolveWriteDiscipline: (...a) => classifier.resolveWriteDiscipline(...a),
   // TASK_KINDS: the kind vocabulary, as an ordered array (consumer: GET /me,
   // which hands it to the hall so a filter can be BUILT from it instead of
   // retyped — task 1003453). VALID_KINDS is a Set and Sets do not survive

package/modules/lifecycle/routes/goals.js

@@ -31,7 +31,7 @@ const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edi
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
 const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
 const { suggestCriteria } = require('../criterion-suggest');
-const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, TASK_FIELD_BOUNDS } = require('../task-classifier');
+const { classifyTaskKind, VALID_KINDS, WRITABLE_DISCIPLINES, resolveWriteDiscipline, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { validateOrRespond, parseId, LIMITS } = api;
 const { isModuleKey, scopeIncludesProtected, moduleKeys } = api.moduleScopeMap;
 // goalScopeCheck — the PURE scope wall (BV1.R59 / ADR 0086 §3), reached through
@@ -1388,10 +1388,23 @@ module.exports = function buildGoalsRouter() {
         const result = classifyTaskKind(body.title, body.description || '');
         kind = result.confidence >= 0.5 ? result.kind : 'unclassified';
       }
-      const discipline = body.discipline ?? 'unclassified';
-      if (!VALID_DISCIPLINES.has(discipline)) {
-        return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
+      // task 1002988 — the SECOND create path. It carried the same
+      // `body.discipline ?? 'unclassified'` line as POST /tasks, so a fix applied
+      // only there would have left this one minting the rows the task exists to
+      // remove. Both now share resolveWriteDiscipline().
+      const resolvedDiscipline = resolveWriteDiscipline({
+        discipline: body.discipline, title: body.title, description: body.description, touches: body.touches,
+      });
+      if (resolvedDiscipline.error) {
+        return res.fail('bad_discipline', {
+          status: 400,
+          message: resolvedDiscipline.unclassifiable
+            ? `discipline was not supplied and could not be inferred from the title and description. Pass one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`
+            : `discipline must be one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`,
+          details: { valid: Array.from(WRITABLE_DISCIPLINES) },
+        });
       }
+      const discipline = resolvedDiscipline.discipline;
 
       // Create. version = the goal's (not client-supplied); status 'ready' so the
       // author can claim it immediately; requiresRank OMITTED → auto-derived

package/modules/lifecycle/routes/task-write-routes.js

@@ -22,7 +22,7 @@ const db = require('../db');
 const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 const { buildGoalAdvisory } = require('../goal-advisory');
-const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, VOTABLE_TASK_STATUSES, TASK_FIELD_BOUNDS } = require('../task-classifier');
+const { classifyTaskKind, VALID_KINDS, WRITABLE_DISCIPLINES, resolveWriteDiscipline, VOTABLE_TASK_STATUSES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
 const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, detectsMigration } = require('./task-route-helpers.js');
@@ -141,10 +141,22 @@ module.exports = function registerTaskWriteRoutes(router) {
       const result = classifyTaskKind(body.title, body.description || '');
       kind = result.confidence >= 0.5 ? result.kind : 'unclassified';
     }
-    const discipline = body.discipline ?? 'unclassified';
-    if (!VALID_DISCIPLINES.has(discipline)) {
-      return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
+    // task 1002988: a create must never mint a role-less row. An omitted (or
+    // explicitly 'unclassified') discipline is INFERRED from the text; only a
+    // genuinely unclassifiable task is refused.
+    const resolved = resolveWriteDiscipline({
+      discipline: body.discipline, title: body.title, description: body.description, touches: body.touches,
+    });
+    if (resolved.error) {
+      return res.fail('bad_discipline', {
+        status: 400,
+        message: resolved.unclassifiable
+          ? `discipline was not supplied and could not be inferred from the title and description. Pass one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`
+          : `discipline must be one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`,
+        details: { valid: Array.from(WRITABLE_DISCIPLINES), inferred: false },
+      });
     }
+    const discipline = resolved.discipline;
     // task 1498 / ADR 0084: an explicit requires_rank must be a live rank. The
     // floor auto-derives from touches + security_sensitive; createTask clamps
     // any explicit value UP to that floor (never below), so this only rejects a
@@ -496,8 +508,15 @@ module.exports = function registerTaskWriteRoutes(router) {
     if (hasKind && !VALID_KINDS.has(body.kind)) {
       return badKind(res);
     }
-    if (hasDiscipline && !VALID_DISCIPLINES.has(body.discipline)) {
-      return res.fail('bad_discipline', 400, { valid: Array.from(VALID_DISCIPLINES) });
+    // task 1002988: a PATCH may not push a row BACK to 'unclassified' — that is a
+    // triage state, not a craft, and letting an edit re-create one would reopen the
+    // hole the create path above just closed.
+    if (hasDiscipline && !WRITABLE_DISCIPLINES.has(body.discipline)) {
+      return res.fail('bad_discipline', {
+        status: 400,
+        message: `discipline must be one of ${Array.from(WRITABLE_DISCIPLINES).join(' | ')}.`,
+        details: { valid: Array.from(WRITABLE_DISCIPLINES) },
+      });
     }
     if (hasNewcomerOrXenos) {
       // V3.R15 #239: prefer newcomer_friendly (canonical); fall back to