@bongos/core 1.19.913 → 1.19.915

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.913",
-  "core_contract": "1.19.913",
-  "source_commit": "e5423d044bfab389c03a2bf60d244f83c015154c",
+  "core_version": "1.19.915",
+  "core_contract": "1.19.915",
+  "source_commit": "34ab0481d787ea0faebe090f349dd6aee3af7411",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T16:36:18.057Z",
+  "built_at": "2026-09-20T16:56:03.819Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 504,
+    "docs_redacted": 505,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2287,
+    "functional_verbatim": 2289,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2817,
-  "tree_sha256": "f335bd0e9dfe731d6a3b535d10eab167f47b4517a03e5ed410bf48e8d607cc4d",
+  "file_count": 2820,
+  "tree_sha256": "0aef60e98f88414bfc2aa5d791a0ebb7726681c98a47f3f2f46cf0ebea06bc6d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2069,10 +2069,15 @@
       "mode": "0000644",
       "sha256": "bc9dde45a33790e4fbce47682a5734a1adaf4fdd7f9347bb0128c6cca6fcf4e5"
     },
+    {
+      "path": "docs/adr/0316-the-ignite-floor-is-not-the-trusted-tier.md",
+      "mode": "0000644",
+      "sha256": "d0597a50d8f9a23c8d6c81a595fe6af73640cf574ae32f64730078ac7e19c7a5"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "a6bf1805ee02ca941a1910d722cfc61e4f0e519aa79c9d102aadfb8bf7d95a5a"
+      "sha256": "005b960dede2131ea0e2f3b81afcb119d7b65ddb6ed81bb246896eff64a69320"
     },
     {
       "path": "docs/api-reference.md",
@@ -2642,7 +2647,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "16f8d72724c91138e8fb17da0723f2901c66dee89a53e44dbc41dd65eb71b161"
+      "sha256": "1c9dcc49caf6106cf21a207da263c449a6c01d05a1647b11c6a1cd41deeeba79"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5334,6 +5339,11 @@
       "mode": "0000644",
       "sha256": "07e5666362c91f92d34388b4f6f4507cc5387866d317970478e6cae417c19975"
     },
+    {
+      "path": "modules/ideas/config.js",
+      "mode": "0000644",
+      "sha256": "70caf7fe901380679ec4a418056e2688efe4afe26d6d5a6058ff64fa36445109"
+    },
     {
       "path": "modules/ideas/descent.js",
       "mode": "0000644",
@@ -5347,12 +5357,12 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "ff6c0346215d1b88309c4c9360cd60c59299b21b45e27cce09c4b748bf3411e1"
+      "sha256": "45e46cbd1b15692e4ba74932986e23c138a5457d96d4d6e72193bb3f690e08af"
     },
     {
       "path": "modules/ideas/landing-preview.js",
       "mode": "0000644",
-      "sha256": "912c7007c534a198adce9c83a56e39da8a1475bfe5b09b2a6fe1ff8914d775c9"
+      "sha256": "735571069c131d0ee9f88b0925b5dc50c0583f295220027ab88e791bc940fe3c"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -5412,7 +5422,7 @@
     {
       "path": "modules/ideas/routing.js",
       "mode": "0000644",
-      "sha256": "da653f475d6c91db8e84bff46c797bb68b61e48d561eacf7bfd228a119ac7266"
+      "sha256": "ec26fc6a2481e1f13d1141f6f1248132ed282f73ddba37c525af5ecae7fd1f0e"
     },
     {
       "path": "modules/ideas/skill-friction.js",
@@ -7797,12 +7807,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "599eeee82f59bc74d6e6e19ebc61bba89421c050ca7444478e13860d6e0276cf"
+      "sha256": "2536cbe6300c83d6010ccf3fdb7a5fe00cdeda0808440da9bb2c2dbc69242f76"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "899fa307dabbae44dd14efe9d121af734c3cdbb9d0027668ff21ba5e2b8e49dd"
+      "sha256": "73a950b0195739ef832e49d57b5e2e9387bab45e5726ceddcaec2411a8a65994"
     },
     {
       "path": "public-docs/index.html",
@@ -9612,7 +9622,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "b82d3257c27689e53b3d491251cc46d474c8f4da944e2e8f73242525df878484"
+      "sha256": "cfcc13ad9d554c4f6f0d8bb4df822a1e2a7f589c2bc3c2829b95b64d00f82cd0"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9802,7 +9812,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5f5e11f8e4ade6fc0642e3051c89a1f3495628cb567c0fa30037b2fd55640170"
+      "sha256": "79f3ff7326a66a71696ead1df0b21d15ca5bb7f5351d0aee03d00ba8207b7b78"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11959,6 +11969,11 @@
       "mode": "0000644",
       "sha256": "c7ba20839a7b33df0eb7e8bfc2f463217e7d3a538d888e89774107d55d34556d"
     },
+    {
+      "path": "tests/ideas_config.mjs",
+      "mode": "0000644",
+      "sha256": "35334314ea15cfa5cd262c18def917bea04f569cfa52a0a86b663710de2bd172"
+    },
     {
       "path": "tests/idp_device_exchange.mjs",
       "mode": "0000644",
@@ -12302,7 +12317,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "fae747eaeea8e9d657de097a72e5f8d244bd2ece6c7e890ff4c9756787721bc5"
+      "sha256": "4d65821ed847d364a80920b29c82cf1ee8ac06b3a8349845902e58e75cf96c7b"
     },
     {
       "path": "tests/module_api.mjs",

package/docs/adr/0316-the-ignite-floor-is-not-the-trusted-tier.md

@@ -0,0 +1,98 @@
+# ADR 0316 — The ignite floor is a scheduling dial, not the trusted tier
+
+- **Status:** Accepted
+- **Date:** 2026-09-20
+- **Task:** 1004084 (BV2.R05) · goal 1000095 · spec `docs/specs/<redacted>.md` decisions 3 and 16
+- **Supersedes nothing.** Narrows how spec decision 3 is to be read.
+
+## Context
+
+BV2 decision 3 makes the **ignite floor** — who may turn a quick idea directly into
+claimable work — a per-instance setting: "a project of one wants every thought
+claimable; a project of fifty wants a nod." Decision 16 adds a second dial, the
+**descent decay rate**, and rules that the two should share one home rather than
+growing separately.
+
+Both the spec and the seeded task described the implementation the same way: the
+ignite floor *is* the `METIC_PLUS` constant in `modules/ideas/routing.js`, so this
+is "a setting, not a refactor."
+
+Tracing the code before building showed that premise is false. `METIC_PLUS` is
+spelled once but **read for four semantically different gates**:
+
+1. `decideLanding`, the homeless-bug branch — land at `ready` or at `backlog`.
+2. `decideLanding`, the goal-carrying bug branch — the same split.
+3. `mayProposeCriterion` (and the 403 in `routes/inbox.js`) — who may file a
+   `kind='criterion-proposal'`, a planning-scope write that reshapes a version's
+   scope-truth.
+4. The protected-scope wall in `authorizeRoutedLanding` — who may route work into
+   the permission / ship-grade / deploy / migration core.
+
+Only (1) and (2) are the ignite floor. Making the *constant* configurable, as
+written, would mean an instance setting its floor to `xenos` — precisely the
+"project of one" case the owner asked for — would **also** grant every Xenos the
+right to file criterion-proposals and to put rows into the protected core's queue.
+
+The codebase already said so, in three places, and none of them had been read into
+the spec:
+
+- `routing.js` at the constant's definition: "It grants nothing — the server-side
+  rank floor and the goal's scope wall are separate, load-bearing gates."
+- The protected-scope branch: "the two are layers, not alternatives."
+- `tests/filing_abuse_matrix.mjs` models the widening as an **attack**, recording
+  in its header that "METIC_PLUS widened to include xenos ... 4 of 23 fail", and
+  pinning the literal.
+
+## Decision
+
+**The ignite floor is a separate dial from the trusted tier, and only the dial is
+configurable.**
+
+- A new per-instance config home, `modules/ideas/config.js` +
+  `config/ideas.neutral.json`, carries both dials. Precedence mirrors
+  `modules/government/config.js`: env override → `config/ideas.json` at the
+  **instance** root → `config/ideas.neutral.json` at the **core** root. The
+  dual-root split matters here for the reason ADR 0268 records.
+- `igniteFloor` defaults to `metic`, which resolves to exactly the `METIC_PLUS`
+  set, so the default is a true no-op. It is threaded into `decideLanding` as a
+  ready-made `trustedRanks` Set by the callers, keeping `routing.js` pure and
+  free of both config and DB.
+- `descentDecayRate` defaults to `0.5`. R11 is its intended consumer and has not
+  landed, so it ships as a contract with no production caller — the same
+  deliberate slice boundary `modules/government/config.js` documents for itself,
+  and what decision 16 asked for when it said the two dials should share one home.
+- **`METIC_PLUS` stays a fixed constant** for gates (3) and (4). Neither takes a
+  floor argument, and `tests/ideas_config.mjs` asserts structurally that
+  `authorizeRoutedLanding`'s signature never grows one.
+
+## Consequences
+
+- An instance may open its ignite floor all the way to `xenos` without opening any
+  authority surface. The worst a wide-open floor can do is put a row at `ready`
+  that a human can move back to `backlog`.
+- The `filing_abuse_matrix` pin on the `METIC_PLUS` literal stays green and is not
+  to be relaxed. A future change that needs to relax it is almost certainly the
+  widening this ADR exists to refuse.
+- `modules/ideas/config.js` derives the rank ladder from `api.LIVE_RANK_LADDER`
+  on the doorway. The first cut restated it as a literal, reasoning that the file
+  must resolve at load with no port wired; `tests/rank_tier_single_source.mjs`
+  rejected that — a ladder array literal in a tracked `src`/`modules`/`scripts`
+  file fails CI unless allowlisted — and it was right to. The doorway value is a
+  lazy getter over the kernel this module's callers already load, so deriving
+  costs nothing and removes the drift risk instead of merely detecting it.
+- Spec decision 3's phrase "spelled in one place, so this is a setting, not a
+  refactor" should be read as describing the *intent*, not the mechanism. The
+  spec was not edited; this ADR is the correction of record, and the task
+  description was amended in-flight to match.
+
+## Alternatives considered
+
+- **Make `METIC_PLUS` itself configurable, as written.** Rejected: it is a
+  security widening wearing a config file's clothes, and the repo's own tests
+  already classify it as an attack.
+- **Split `METIC_PLUS` into four named constants and configure one.** Rejected as
+  more churn than the decision needs — the other three gates want the *same* fixed
+  tier, and giving them separate names invites someone to configure them later.
+- **Have `routing.js` read the config itself.** Rejected: it would make the
+  landing matrix non-pure and file-system-dependent, and would remove the
+  callers' ability to be tested at a different floor.

package/docs/adr/README.md

@@ -406,4 +406,5 @@ This keeps the decision history honest and traceable.
 | 0312 | [**Provenance is a SECOND ideas-owned edge table, written by the seams that already know** ([task 1004080](https://cloudbongos.com/builders#/task/1004080), goal 1000095 — BONGOS-V2). The spike [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: how the descent edges are physically recorded. A descent (`idea → task → rewrite → split → removal`) is four levels deep and crosses a version boundary, and the task hierarchy refuses both — `attachParent` enforces `SELF_PARENT`, `VERSION_MISMATCH`, `PARENT_HAS_PARENT` and `TARGET_HAS_CHILDREN`, all load-bearing for ship rollup and claim safety. The spike was told to CONFIRM `ideas_task_lineage` rather than assume it, and confirmed one half while refuting the other: the table is right as the **idea→task anchor** (bipartite, no depth cap, no version predicate) but CANNOT carry the task→task edge, because a derivation is a property of the task PAIR and [ADR 0236](0236-many-ideas-one-task-the-lineage-key-is-the-pair.md) made co-source ideas both legal and common — a `derived_from_task_id` column would write the same derivation once per co-source idea and let two rows disagree about where a task came from, the same under-keying that silently lost attribution on prod once already. A merge also gives a task SEVERAL parents, so the relation is a **DAG, not a tree**. Decision: a new `ideas_task_descent` (`task_id`, `parent_task_id`, CHECK'd `relation`, PK on the pair, indexed both ways), with NO depth cap and NO version predicate, and **cycles refused at write time** because the payout walks this graph and a cycle is a non-terminating walk rather than a cosmetic error. On who writes it — the question the task actually set, since an edge depending on memory will have holes — **three seams already know and none is telling anyone**: `cascade.js` encodes the originating task id inside `source_ref` as a STRING nothing can join on, `tasks.merged_into_task_id` already records the fold, and `parent_task_id` already records the split. Only `rewrite` and cross-version `merge` stay manual, which is honest — they are editorial acts with no automatic signal, and their absence degrades the picture rather than corrupting it. What it fixes: `sourceIdeaForTask` and `awardIdeaTaskShipCredit` are both one-hop `LIMIT 1` point reads, so a DERIVED task resolves to `no_source_idea` and the origin is not paid at all. Does not decide: the decay rate beyond its default, what counts as removed ([ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md)), or how any of it is drawn.](0312-provenance-is-a-second-ideas-owned-edge-table.md) | ideas / lifecycle |
 | 0313 | [**A removal is derived from the SERVER's own merge diff and confirmed by a person** ([task 1004081](https://cloudbongos.com/builders#/task/1004081), goal 1000095 — BONGOS-V2). The other half [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: what counts as removed, so that brightness can fall at all. Nothing records it today — `shipped` is terminal (`rot.js` says so outright) and `merged_into_task_id` is CHECK'd to `abandoned` rows, describing only work cut BEFORE it landed. Owner decision 13 set the shape (system proposes, person confirms); this settles the detail, and corrects two premises the task was written on. **`cascade.js` is no longer empty** — it carries a production rule and [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md) fixed the contract (append an entry, never touch the runner), so there is a precedent to copy including its anti-recursion guard. **`netNegativeBonusAmount` cannot be the trigger** despite being the named nearest signal: it is an aggregate with NO TARGET (it says deletion happened, never what or whose), it is CLIENT-SUPPLIED via `signals.diff_stats`, and `grader-score.js` already documents the forgery it defends against — and brightness sits beside a payout, so a forgeable target-less counter cannot carry it. **Nothing durable records what any ship touched**: `committed_files` and `diff_stats` are client-supplied at grade time and never persisted, `touches[]` is advisory ([ADR 0049](0049-split-parallel-safety-contract.md)), so a removal cannot be reconstructed from history — only derived as a ship lands. Decision: derive it from the SERVER's own merge diff ([ADR 0055](0055-server-mediated-branch-publish.md) — the server holds the repo and does the merge, so it computes the diff rather than being told one), and attribute the deleted hunks through **`claims.published_head_sha`** (`migrations/171`), NOT by parsing `(task NNNN)` out of commit text — only 7 of `main`'s last 15 commits carry a task id, and a convention that holds most of the time cannot underwrite a payout. An UNATTRIBUTABLE deletion files nothing: a wrong proposal costs attention and dims a real star. A rename, a move and a rewrite-in-place are NOT removals, and a cold body is not a remnant — removal applies only below a task that actually shipped. The proposal is an appended `CASCADES` entry filing a QUESTION; confirmation is Metic+/`task.promote` on the existing awaiting-nod surface; an unanswered one rots on the normal clock. Only a CONFIRMED proposal dims a star. The derivation must be NON-BLOCKING — landing work matters more than dimming a star on time. Brightness can only fall forward from here, so historical sizes need a marker or the number lies.](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md) | ideas / lifecycle |
 | 0314 | [**A module owns a protected path without the whole module becoming protected** ([task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2). Three modules derive `protected` — and so are Archon-only to scope a goal to — because of ONE file that is not their domain: `onboarding` on `scripts/gds/setup.js`, `autonomy` on `scripts/gds/conductor-dispatch.js`, `copy-desk` on `scripts/gds/copy-inventory.js`. The owner chose *narrow what counts as protected*; the task set the fork and required the choice be justified before any glob moved. **Deleting the glob is out**: `MODULE_GLOBS` is also the territory deciding who may AUTHOR a task on a path, and the shared floor is only `tests/`, so an unowned path is authorable by no goal at all. That left reassigning each CLI to an already-protected module — **measured, not reasoned about**, by applying the edit to the source and re-requiring in a fresh process (`MODULE_SCOPE_MAP` is frozen and built from a COPY of `MODULE_GLOBS` at load, so an in-process mutation proves nothing and passes green). The measurement kills it: `copy-desk` and `autonomy` lose the ability to author on their own generator and their own conductor, and — the row that decides it — `devsecops` as the new owner **cannot author the generator together with the two artifacts it writes**, because `docs/copy-registry.json` and `docs/copy-inventory.md` stay `copy-desk`'s. So *change a UI string, regenerate the registry* becomes authorable by no single goal, and that is the ship-check freshness gate every UI task hits. Decision: **protection becomes per-path at the goal-scope wall, as it already is at the other three** — `matchProtected` decides task-authoring, the grader and gate decide ship, the post-push audit decides the dishonest case; only goal-creation asked about the MODULE, and that inconsistency is the whole defect. The derivation stays computed from `PROTECTED_GLOBS` and no flag is hand-set ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §7 / SEC #863), and the Metic floor on those paths does not move. **Corrects the task's own numbers**: 12 of 26 modules derive protected, not 11, and `agents` (protected by `modules/agents/`, itself a protected glob) is absent from its list of seven — which is why the one thing this ADR SHIPS is a test pinning the full protected key set **by name**, a count assertion passing on the wrong twelve being exactly how that drifted. Implementation is deferred to task 1004109, per the task's own instruction to stop after the ADR. Also filed: `builder-settings` (task 1004110), whose overlap rides the blanket `src/bongos/routes/` prefix and so needs either the `me.js` strangler move or its own security ADR; and **nine protected paths owned by no module at all** (task 1004111) — the freshness generators, the merge-driver pair and `cli-lib.js` among them — found while checking whether deletion was viable, a pre-existing hole rather than one this opens. Does not decide: the floor a protected path carries, whether `scripts/gds/` deserves a shared-floor entry the way `tests/` has one, or how the nine unowned paths get a home.](0314-module-protection-is-per-path-not-per-module.md) | modules / permissions |
+| 0316 | [**The ignite floor is a scheduling dial, not the trusted tier** ([task 1004084](https://cloudbongos.com/builders#/task/1004084), goal 1000095 — BONGOS-V2). BV2 decision 3 makes the ignite floor — who may turn a quick idea straight into claimable work — a per-instance setting, and decision 16 adds the descent decay rate beside it, the two to share one home. Both the spec and the seeded task described the mechanism the same way: the floor IS the `METIC_PLUS` constant in `modules/ideas/routing.js`, so this is "a setting, not a refactor". Tracing the code before building refuted that: `METIC_PLUS` is spelled once but READ for four semantically different gates — the two `decideLanding` bug branches (land at `ready` or at `backlog`), `mayProposeCriterion` (who may file a `kind='criterion-proposal'`, a planning-scope write), and the protected-scope wall in `authorizeRoutedLanding` (who may route work into the permission / ship-grade / deploy / migration core). Only the first two are the ignite floor, so making the CONSTANT configurable would mean an instance setting its floor to `xenos` — exactly the "project of one wants every thought claimable" case the owner asked for — ALSO gaining the right to file criterion-proposals and to breach the protected core. The codebase already said so in three places nobody had read into the spec: the constant's own header ("It grants nothing — the server-side rank floor and the goal's scope wall are separate, load-bearing gates"), the protected-scope branch ("the two are layers, not alternatives"), and `tests/filing_abuse_matrix.mjs`, which models the widening as an ATTACK and pins the literal. Decision: a separate dial. `modules/ideas/config.js` + `config/ideas.neutral.json` carry both knobs on the `modules/government/config.js` precedence (env -> instance root `config/ideas.json` -> core root neutral; the ADR 0268 dual-root split matters, since one root reads the host pack out of `node_modules` where `npm ci` erases it). `igniteFloor` defaults to `metic`, resolving to exactly the `METIC_PLUS` set, and is threaded into `decideLanding` as a ready-made `trustedRanks` **Set** by the callers — `routing.js` is TOLD the floor and never reads config, staying pure and DB-free — while `METIC_PLUS` stays a FIXED constant for the other two gates, neither of which takes a floor argument (pinned structurally). `descentDecayRate` defaults to 0.5 and ships with no production caller, because R11 is its intended reader and depends on the unbuilt R08 — the same deliberate slice boundary `modules/government/config.js` documents for itself, and what decision 16 asked for. Everything fails to VANILLA rather than dead: a malformed pack, an unknown rank or an out-of-band rate falls back, and an unrecognised floor yields the DEFAULT set, never an empty one (failing closed would stop every ignition on a typo). Rejected: configuring `METIC_PLUS` as written (a security widening in a config file's clothes); splitting it into four named constants (the other three want the same fixed tier, and naming them invites configuring them); having `routing.js` read the config itself (makes the landing matrix impure and untestable at a different floor). Spec decision 3's "spelled in one place" describes the intent, not the mechanism; the spec was not edited and the task description was amended in flight.](0316-the-ignite-floor-is-not-the-trusted-tier.md) | ideas / permissions |
 | 0315 | [**A plane with no proxy is refused, not given a no-op ingress** ([task 1004017](https://cloudbongos.com/builders#/task/1004017), goal 1000106 — BONGOS-V2). The piece [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) explicitly deferred: the self-host image ships no proxy, so provisioning step 6's `<slug>.caddy` snippet write and `systemctl reload caddy` cannot work there and a child instance gets no front door. **Two failure shapes, only one visible**: a DOMAINED child already half-refused, because `caddy adapt` fails with no binary and [ADR 0303](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md)'s own catch turns that into a gap — but the message told the operator to add a directive to `/etc/caddy/Caddyfile`, a file the container does not have and that ADR 0303 §1 forbids provisioning from creating; a DOMAINLESS child skipped that preflight entirely (it is gated on `inst.domain`), reached step 6 and died on the `sudo` write, an uncaught throw that bypasses the `{ok:false}` pending-retry path and hard-errors the instance on attempt one — a crash recorded where a refusal was the honest answer. Decision: `ingressPlaneGap(exec)` probes the plane with `caddy version` — one cheap unprivileged read, the same posture as `checkCaddyWiring` — and both standup legs refuse with `Ingress preflight failed: …`, deliberately NOT domain-gated, because the domainless child is the one 0303 could not see. **Only a missing binary proves there is no proxy**: under remote exec `boxExec` is `ssh <host> bash -s`, so an unreachable co-hosting box throws here too, and diagnosing a network blip as 'this plane has no proxy, provision elsewhere' would be a confident wrong answer that burns the intent's retry budget — exit 127 is read as proof, anything else answers 'could not confirm a reverse proxy on this plane' with the real cause leading. The three refusals are ordered **capacity → ingress → wiring**, cheapest and most fundamental first and all before any mutation, which moves 0303's preflight behind the ADR 0285 capacity measurement; both still refuse before anything changes, so only the precedence between two refusals moves. **No ingress seam and no no-op backend**, despite the obvious symmetry with 0306: a `none` implementation whose `writeSite`/`reload` are no-ops lets the standup SUCCEED while leaving the child unreachable — neither half of the task's done-when, and exactly the silently-broken instance it exists to prevent. Does not decide: what a child's front door IS on a container plane (a published port, a bundled proxy, an explicit localhost-only shape) — a future ADR that adds one replaces this refusal rather than extending it. Teardown is left alone on purpose: it already reloads `allowFail`, and refusing there would strand a row instead of cleaning it.](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md) | provisioning / ingress |

package/docs/module-api-changelog.md

@@ -2300,5 +2300,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.911 with no explicit bump. run 35522352719. (task 1002620)
   1.19.913 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.912 with no explicit bump. run 35523207325. (task 1002620)
+  1.19.914 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.913 with no explicit bump. run 35523700531. (task 1002620)
+  1.19.915 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.914 with no explicit bump. run 35524223153. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/config.js

@@ -0,0 +1,230 @@
+'use strict';
+
+// modules/ideas/config.js — the two PER-INSTANCE IDEATOR DIALS (BV2.R05, spec
+// decisions 3 and 16).
+//
+// The owner's ruling is that both of these belong to the PROJECT, not to the
+// platform: a project of one wants every thought claimable, a project of fifty
+// wants a nod. They live in ONE home, deliberately, so that the second dial did
+// not grow a separate one — which is the whole point of R05 scoping them
+// together rather than as two tasks.
+//
+// Precedence mirrors modules/government/config.js, which mirrors src/branding.js:
+//
+//   env override  ->  instance config (config/ideas.json)  ->  neutral starter
+//   (config/ideas.neutral.json)
+//
+// A fresh instance with NO config resolves to the neutral starter, and the
+// neutral starter is chosen so that resolving it changes NOTHING about today's
+// behaviour. That is the fail-to-vanilla posture branding and government already
+// take, and it is what lets this land ahead of its consumers.
+//
+// ── WHAT THIS FILE IS NOT ────────────────────────────────────────────────────
+//
+// It is NOT an authority surface, and the ignite floor is NOT the trusted tier.
+//
+// modules/ideas/routing.js spells `METIC_PLUS` once but READS it for four
+// semantically different gates:
+//
+//   1. decideLanding, homeless-bug branch  — ready vs backlog
+//   2. decideLanding, goal-carrying branch — ready vs backlog
+//   3. mayProposeCriterion                 — who may FILE a criterion-proposal
+//   4. the protected-scope wall            — who may route into the
+//                                            permission / ship / deploy core
+//
+// ONLY (1) and (2) are the ignite floor, and only they read this dial. Gates (3)
+// and (4) stay pinned to the fixed Metic+ constant, because an instance lowering
+// its ignite floor to `xenos` — exactly the "project of one" case the owner
+// asked for — must not thereby gain the ability to file criterion-proposals or
+// to put rows into the protected core's queue. routing.js says this itself at
+// the constant's definition ("It grants nothing — the server-side rank floor and
+// the goal's scope wall are separate, load-bearing gates"), the protected-scope
+// branch says "the two are layers, not alternatives", and
+// tests/filing_abuse_matrix.mjs models the widening as an ATTACK: its header
+// records "METIC_PLUS widened to include xenos ... 4 of 23 fail".
+//
+// So the dial below decides one thing only: whether a filed bug lands CLAIMABLE
+// or lands AWAITING A NOD. Both landings create the same row, in the same goal,
+// with the same rank floor derived by createTask; the difference is a status a
+// human can flip either way. That is a scheduling preference, which is why it is
+// safe to configure — and it is why nothing else in this module reads it.
+//
+// ── THE DECAY DIAL'S SLICE BOUNDARY ──────────────────────────────────────────
+//
+// `descentDecayRate` has NO production consumer in this commit. R11 (the ideator
+// payout following the descent) is its intended reader and has not landed — it
+// depends on R08, which is not built. Shipping the contract ahead of the caller
+// is the same deliberate slice boundary modules/government/config.js documents
+// for itself ("deliberately has no production caller yet ... the tests pin the
+// contract until they land"), and it is what decision 16 asked for when it said
+// the two dials should share one home "rather than growing separately".
+//
+// Landing it now is the cheap half. Landing it with R11 would mean R11 either
+// inventing a second home or retrofitting this one mid-build.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const api = require('../../src/module-api');
+
+// THE TWO FILES COME FROM TWO DIFFERENT ROOTS (ADR 0268, task 1003739). Under a
+// PINNED core, __dirname is inside node_modules/@cloudbongos/core, so resolving
+// both from one root reads the INSTANCE pack out of node_modules — a path no
+// host authors and every `npm ci` erases. Core content from resolveCoreRoot(),
+// host content from resolveInstanceRoot(), reached through the module doorway.
+//
+// Resolved at load rather than per call, matching government/config.js: a lazy
+// resolveInstanceRoot() falls back to process.cwd(), so a chdir mid-process
+// would move the config file underneath a running server.
+const CORE_ROOT = api.resolveCoreRoot();
+const INSTANCE_ROOT = api.resolveInstanceRoot();
+const NEUTRAL_PATH = path.join(CORE_ROOT, 'config', 'ideas.neutral.json');
+const INSTANCE_PATH = path.join(INSTANCE_ROOT, 'config', 'ideas.json');
+
+// The rank ladder, lowest authority first, DERIVED from the doorway rather than
+// restated. `api.LIVE_RANK_LADDER` is the single source of truth, and
+// tests/rank_tier_single_source.mjs enforces that: a literal ladder array in any
+// tracked src/modules/scripts file fails CI unless it is allowlisted with a
+// pinning assertion beside it. Deriving is better than restating here anyway —
+// it removes the drift risk instead of merely detecting it, and adding a rank
+// widens this floor's vocabulary automatically.
+//
+// It is a lazy getter on the doorway, so reading it at load costs a require of
+// the kernel this module's callers already load; it opens no connection.
+const RANK_ORDER = Object.freeze([...api.LIVE_RANK_LADDER]);
+
+// The defaults, as code. They are ALSO in config/ideas.neutral.json, and that is
+// not duplication for its own sake: the neutral file is what a host copies and
+// edits, and these are what the resolver falls back to when the neutral file is
+// missing, unreadable or malformed. A core whose config/ directory did not ship
+// must still boot to today's behaviour rather than to zero.
+const DEFAULT_IGNITE_FLOOR = 'metic';
+const DEFAULT_DECAY_RATE = 0.5;
+
+// Read a JSON pack off disk. A MISSING file is not an error — it is the ordinary
+// case for config/ideas.json, which most instances never author. A file that
+// exists but does not parse returns null and is skipped, so a typo in an
+// instance pack falls back to the neutral defaults rather than bricking boot.
+// That is the same "fail to vanilla, do not fail to dead" posture as the rest of
+// the config layer.
+function readPack(file) {
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+// A floor is valid only if it NAMES A RANK. Case is normalised but whitespace is
+// NOT trimmed — 'METIC ' is a hostile shape, not a rank, the same judgment
+// mayProposeCriterion already records. A non-string, an unknown rank or an empty
+// value falls back to the default rather than being coerced, because a floor
+// that silently became `xenos` through a typo is precisely the widening this
+// whole file exists to prevent.
+function normaliseFloor(value) {
+  if (typeof value !== 'string') return null;
+  const lower = value.toLowerCase();
+  return RANK_ORDER.includes(lower) ? lower : null;
+}
+
+// The decay rate is a SHARE, so it lives in [0, 1]. 0 means a descendant's ship
+// pays its origin nothing beyond the first hop; 1 means no decay at all, every
+// hop paying in full. Both ends are legitimate project choices, so both are
+// admitted — what is refused is a value outside the band, a non-finite number
+// (NaN, Infinity) or a non-number, each of which falls back to the default.
+// Refusing rather than clamping is deliberate: a config that asked for 1.5 has
+// asked for something incoherent, and silently paying 100% would be a payout bug
+// wearing a config file's clothes.
+function normaliseDecayRate(value) {
+  if (typeof value !== 'number' || !Number.isFinite(value)) return null;
+  return value >= 0 && value <= 1 ? value : null;
+}
+
+// The env layer. It exists for the co-tenant case branding's AUTH_IDP override
+// exists for — several hosted instances sharing one neutral pack, differentiated
+// only by env, with no config file of their own. Unlike government's, where the
+// env layer is deliberately labels-only because an env var must never widen
+// authority, BOTH dials are exposed here: neither one grants any authority (see
+// the header), so neither is an authority knob.
+function applyEnvOverrides(resolved, env) {
+  const out = { ...resolved };
+
+  const floorRaw = api.resolveEnv('IDEAS_IGNITE_FLOOR', { env });
+  const floor = normaliseFloor(floorRaw);
+  if (floor) out.igniteFloor = floor;
+
+  const rateRaw = api.resolveEnv('IDEAS_DESCENT_DECAY_RATE', { env });
+  if (rateRaw != null && String(rateRaw).trim() !== '') {
+    const rate = normaliseDecayRate(Number(rateRaw));
+    if (rate != null) out.descentDecayRate = rate;
+  }
+
+  return out;
+}
+
+// loadIdeasConfig — resolve the dials. Never throws: every layer that cannot be
+// read or does not validate is skipped in favour of the one beneath it, and the
+// bottom layer is the in-code defaults. Pass `env` and `roots` to test without
+// touching the real filesystem or process.env.
+function loadIdeasConfig({ env = process.env, roots = null } = {}) {
+  const neutralPath = roots && roots.neutralPath ? roots.neutralPath : NEUTRAL_PATH;
+  const instancePath = roots && roots.instancePath ? roots.instancePath : INSTANCE_PATH;
+
+  const neutral = readPack(neutralPath) || {};
+  const instance = readPack(instancePath) || {};
+
+  const resolved = {
+    igniteFloor:
+      normaliseFloor(instance.igniteFloor)
+      || normaliseFloor(neutral.igniteFloor)
+      || DEFAULT_IGNITE_FLOOR,
+    descentDecayRate:
+      normaliseDecayRate(instance.descentDecayRate)
+      ?? normaliseDecayRate(neutral.descentDecayRate)
+      ?? DEFAULT_DECAY_RATE,
+  };
+
+  return Object.freeze(applyEnvOverrides(resolved, env));
+}
+
+// trustedRanksForFloor — turn a floor into the SET decideLanding actually asks.
+//
+// A floor is a point on the ladder and admits everything at or above it, so
+// 'metic' yields {metic, archon} — byte-for-byte the behaviour of the METIC_PLUS
+// constant, which is what makes `igniteFloor: 'metic'` a true no-op default.
+// An unrecognised floor yields the default's set rather than an empty one:
+// failing closed here would mean NOBODY could ignite, turning a config typo into
+// a silent queue stoppage.
+function trustedRanksForFloor(floor) {
+  const at = RANK_ORDER.indexOf(normaliseFloor(floor) || DEFAULT_IGNITE_FLOOR);
+  const from = at === -1 ? RANK_ORDER.indexOf(DEFAULT_IGNITE_FLOOR) : at;
+  return Object.freeze(new Set(RANK_ORDER.slice(from)));
+}
+
+// The resolved dials, read ONCE at load. Config is a file on disk that does not
+// change under a running process; re-reading it per filing would put a
+// synchronous fs call on the capture path for a value that cannot have moved.
+const CONFIG = loadIdeasConfig();
+
+// The set decideLanding's two landing branches consume, derived once from the
+// resolved floor for the same reason.
+const TRUSTED_FILER_RANKS = trustedRanksForFloor(CONFIG.igniteFloor);
+
+module.exports = {
+  loadIdeasConfig,
+  trustedRanksForFloor,
+  igniteFloor: CONFIG.igniteFloor,
+  descentDecayRate: CONFIG.descentDecayRate,
+  TRUSTED_FILER_RANKS,
+  RANK_ORDER,
+  DEFAULT_IGNITE_FLOOR,
+  DEFAULT_DECAY_RATE,
+  NEUTRAL_PATH,
+  INSTANCE_PATH,
+};

package/modules/ideas/inbox.js

@@ -242,8 +242,8 @@ async function captureIdea({
   }
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
 
-  // The decision, before any write. Pure — see ./routing.js.
-  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank, vector });
+  // The decision, before any write. Pure — see ./routing.js. `trustedRanks` is the per-instance ignite floor (BV2.R05; ./config.js says why it is narrow); required inline because this file sits ON the 1500-line ratchet ceiling and require() is cached.
+  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank, vector, trustedRanks: require('./config').TRUSTED_FILER_RANKS });
   if (landing.route) {
     return routeIdeaToGoal({
       title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority,

package/modules/ideas/landing-preview.js

@@ -40,6 +40,7 @@
 const api = require('../../src/module-api');
 const { pool } = api;
 const { decideLanding, authorizeRoutedLanding } = require('./routing');
+const ideasConfig = require('./config');
 
 // The verdict vocabulary the composer renders. Stable machine tokens, never
 // prose: the wording is the UI's business and the copy registry's, and a client
@@ -85,7 +86,14 @@ async function previewLanding(input, deps = {}) {
   const { goalId = null, kind = null, grade = null, filerRank = null, vector = null } = input || {};
   const activePool = ((deps || {}).pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   try {
-    const landing = decideLanding({ goalId, kind, grade, filerRank, vector });
+    // The SAME ignite floor the real filing will use a moment later (BV2.R05).
+    // Reading it from the same place is the whole point of this surface: a
+    // preview that resolved the floor differently from the capture path would be
+    // the exact drift task 1004083 landed this endpoint to prevent.
+    const landing = decideLanding({
+      goalId, kind, grade, filerRank, vector,
+      trustedRanks: ideasConfig.TRUSTED_FILER_RANKS,
+    });
 
     if (!landing.route) {
       // A goal was named and the matrix declined it — the second lie above. The

package/modules/ideas/routing.js

@@ -111,6 +111,23 @@ function decideLanding(input) {
   // decision that CRASHES is the worst of the three outcomes: it takes down the
   // capture that was supposed to fail closed. Normalise first, decide after.
   const { goalId = null, kind = null, grade = null, filerRank = null, vector = null } = input || {};
+  // THE IGNITE FLOOR, as a parameter rather than a constant (BV2.R05, spec
+  // decision 3). The set of ranks whose filed bug lands CLAIMABLE instead of
+  // awaiting a nod is now per-instance, resolved by modules/ideas/config.js and
+  // handed in by the caller. It arrives as a ready-made Set so this file stays
+  // pure and DB-free — it does not read config, it is TOLD the floor.
+  //
+  // Defaulting to METIC_PLUS is what makes every existing caller and test
+  // unchanged: omit it and this function behaves exactly as it did.
+  //
+  // SCOPE, and it is narrow on purpose. This governs ONLY the two landing-status
+  // decisions below. `mayProposeCriterion` and the protected-scope wall in
+  // `authorizeRoutedLanding` keep reading the fixed METIC_PLUS constant, because
+  // an instance lowering its ignite floor must not thereby gain the right to file
+  // criterion-proposals or to route work into the protected core. Those are the
+  // separate load-bearing gates the constant's own header names.
+  const trusted = input && input.trustedRanks instanceof Set ? input.trustedRanks : METIC_PLUS;
+  const isTrustedFiler = trusted.has(String(filerRank || '').toLowerCase());
   // No goal named ⇒ the inbox is exactly right, and this is the DEFAULT PATH.
   // Every capture vector that never learns about goals keeps working unchanged;
   // routing is strictly additive (criterion C1 testable #5).
@@ -145,7 +162,7 @@ function decideLanding(input) {
       // rather than an inferred `goalId == null` so the intent survives into the
       // caller and into the tests, and so a future landing that happens to carry
       // no goal cannot silently inherit the maintenance-goal behaviour.
-      return METIC_PLUS.has(String(filerRank || '').toLowerCase())
+      return isTrustedFiler
         ? { route: true, status: 'ready', homeless: true, reason: 'bug_homeless_trusted_filer' }
         : { route: true, status: 'backlog', homeless: true, reason: 'bug_homeless_awaiting_nod' };
     }
@@ -163,7 +180,7 @@ function decideLanding(input) {
     // The rank split. An absent/unknown rank is NOT treated as trusted — see the
     // fail-closed note above. This is the DECISION only; R05 adds the
     // server-side enforcement (auto-derived requires_rank floor + scope wall).
-    return METIC_PLUS.has(String(filerRank || '').toLowerCase())
+    return isTrustedFiler
       ? { route: true, status: 'ready', reason: 'bug_trusted_filer' }
       : { route: true, status: 'backlog', reason: 'bug_awaiting_nod' };
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.913",
+  "version": "1.19.915",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.913",
+      "version": "1.19.915",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.913",
+  "version": "1.19.915",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -63,6 +63,12 @@ const MODULE_GLOBS = {
     // red-team FEATURE carved to modules/security/ (BV1.R79 / 02-module-map §5).
     'src/bongos/routes/security.js',
     'server.js', 'config/',
+  
+    // ADOPTED (task 1004111): a protected path owned by no module is authorable
+    // by NO goal, because MODULE_GLOBS is the authoring territory and the shared
+    // floor is only tests/. cli-lib.js is the CLI's own argv/session plumbing —
+    // core library surface, so it sits with the rest of the kernel.
+    'scripts/gds/cli-lib.js',
   ],
   // --- the build state machine + ship/grade/deploy orchestration + schema ---
   // Carved into modules/lifecycle/ (BV1.R86 / ADR 0093 §1,§3): the task/claim/
@@ -81,6 +87,12 @@ const MODULE_GLOBS = {
     'scripts/gds/gate-review.js', 'scripts/gds/push-main.js', 'scripts/gds/ci-grade.js',
     'scripts/gds/merge-lock.js', 'scripts/gds/version-close.js',
     'migrations/',
+  
+    // ADOPTED (task 1004111): the deploy half of the ship pipeline lifecycle
+    // already owns end to end — migrate.sh runs the migrations it owns, and
+    // scripts/deploy/ is what a merge to main triggers.
+    'scripts/migrate.sh',
+    'scripts/deploy/',
   ],
   // --- credit-allocation model + ledger + pricing + gamification ---
   economy: [
@@ -316,6 +328,17 @@ const MODULE_GLOBS = {
     'modules/dev-box/', 'devbox-app/',
     'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
     'scripts/gds/smoke-box.sh',
+  
+    // ADOPTED (task 1004111): the box BRING-UP surface. box.js (already here)
+    // orchestrates these five provisioning CLIs, and infra/ is the shell-script
+    // tree it resolves from the instance root — the comment above has described
+    // infra/ as dev-box's since task 1002386 without the glob saying so.
+    'scripts/gds/provision-config.js',
+    'scripts/gds/provision-net.js',
+    'scripts/gds/box-infra.js',
+    'scripts/gds/cf-tunnel.js',
+    'scripts/gds/do-api.js',
+    'infra/',
   ],
   // --- the dev-hygiene enforcement surfaces: CI workflows, the agent permission/
   //     hook files, git hooks, root manifests, and the fitness/entropy tooling
@@ -368,6 +391,20 @@ const MODULE_GLOBS = {
     'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
     'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
     'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js',
+  
+    // ADOPTED (task 1004111): the enforcement surfaces this module already IS.
+    // install-git-hooks.js + scripts/gds/hooks/ are the pre-push hook beside the
+    // .husky/ it owns; git-merge-regen.js + .gitattributes are the merge-driver
+    // PAIR and must not straddle a module boundary; run-unit-tests.js is the CI
+    // runner; gen-api-client.js is the sibling of the gen-api-docs.js above.
+    // CODEOWNERS is review routing, which is this module's job.
+    'scripts/gds/install-git-hooks.js',
+    'scripts/gds/hooks/',
+    'scripts/gds/git-merge-regen.js',
+    '.gitattributes',
+    'scripts/gds/run-unit-tests.js',
+    'scripts/gds/gen-api-client.js',
+    'CODEOWNERS',
   ],
   // --- the METHODOLOGY surfaces: the instruction core an agent session actually
   //     reads — the always-loaded root CLAUDE.md, the docs library it indexes, the
@@ -415,6 +452,13 @@ const MODULE_GLOBS = {
     'docs/',
     '.claude/skills/', '.claude/rules/',
     'scripts/gds/start.js', 'scripts/gds/discipline-modes.json',
+  
+    // ADOPTED (task 1004111): the three freshness generators that write the docs
+    // this module owns — repo-map, file-map and the session index all emit into
+    // docs/ (and CLAUDE.md), so the generator belongs with its output.
+    'scripts/gds/gen-repo-map.js',
+    'scripts/gds/gen-file-map.js',
+    'scripts/gds/gen-session-index.js',
   ],
 };
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.913'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.915'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ideas_config.mjs

@@ -0,0 +1,271 @@
+// tests/ideas_config.mjs — the two per-instance ideator dials (BV2.R05).
+//
+// What this file is actually guarding is not "the config parses". It is the
+// thing the task description originally got wrong: that the ignite floor is a
+// SCHEDULING preference and the trusted tier is an AUTHORITY boundary, and that
+// turning the first dial must not move the second. Most of the assertions below
+// exist to fail loudly if someone later "simplifies" this by making METIC_PLUS
+// itself configurable.
+
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+// fileURLToPath, never URL.pathname — a space becomes %20 and a Windows drive
+// gains a leading slash, so require()/fs throw MODULE_NOT_FOUND at load
+// (task 1002889; both tests/test_path_guard.mjs and fitness.js enforce it).
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+
+const ideasConfig = require(path.join(ROOT, 'modules/ideas/config.js'));
+const routing = require(path.join(ROOT, 'modules/ideas/routing.js'));
+const catalog = require(path.join(ROOT, 'modules/government/catalog.js'));
+const instanceConfig = require(path.join(ROOT, 'src/instance-config.js'));
+const api = require(path.join(ROOT, 'src/module-api.js'));
+
+// Env knobs are read through api.resolveEnv, which PREFIXES the suffix with the
+// instance's own env prefix (OTB_, CLOUDBONGOS_, ...). Resolving it here rather
+// than hard-coding one keeps this test honest on a rebranded instance — and
+// hard-coding the bare suffix is exactly how the first cut of this file passed a
+// name nothing reads.
+const ENV_PREFIX = instanceConfig.envPrefix();
+const envName = (suffix) => `${ENV_PREFIX}_${suffix}`;
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// A scratch pair of config paths, so nothing here touches the real files.
+function withPacks(neutral, instance, fn) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ideas-config-'));
+  const neutralPath = path.join(dir, 'ideas.neutral.json');
+  const instancePath = path.join(dir, 'ideas.json');
+  if (neutral !== null) fs.writeFileSync(neutralPath, typeof neutral === 'string' ? neutral : JSON.stringify(neutral));
+  if (instance !== null) fs.writeFileSync(instancePath, typeof instance === 'string' ? instance : JSON.stringify(instance));
+  try { return fn({ neutralPath, instancePath }); }
+  finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+const load = (neutral, instance, env = {}) =>
+  withPacks(neutral, instance, (roots) => ideasConfig.loadIdeasConfig({ env, roots }));
+
+// --- the defaults change nothing -------------------------------------------
+
+await test('the shipped neutral starter resolves to today\'s behaviour', () => {
+  const shipped = JSON.parse(fs.readFileSync(path.join(ROOT, 'config/ideas.neutral.json'), 'utf8'));
+  assert.equal(shipped.igniteFloor, 'metic', 'the neutral ignite floor must be metic — anything else widens on upgrade');
+  assert.equal(shipped.descentDecayRate, 0.5, 'decision 16 ruled halving');
+});
+
+await test('the default floor yields EXACTLY the METIC_PLUS set', () => {
+  // This is the assertion that makes `igniteFloor: 'metic'` a true no-op. If the
+  // ladder slice is ever off by one, these two sets diverge and every filing
+  // changes landing status silently.
+  const trusted = ideasConfig.trustedRanksForFloor('metic');
+  assert.deepEqual([...trusted].sort(), [...routing.METIC_PLUS].sort());
+});
+
+await test('a floor admits everything at or above it, and nothing below', () => {
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor('xenos')].sort(), ['archon', 'metic', 'thetes', 'xenos']);
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor('archon')].sort(), ['archon']);
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor('thetes')].sort(), ['archon', 'metic', 'thetes']);
+});
+
+// --- the drift pin ----------------------------------------------------------
+
+await test('the rank ladder is DERIVED from the doorway, not restated', () => {
+  // tests/rank_tier_single_source.mjs forbids a ladder literal outside its
+  // allowlist; this is the behavioural half of that rule. Deriving means a rank
+  // added to the kernel widens this floor's vocabulary with no edit here.
+  assert.deepEqual([...ideasConfig.RANK_ORDER], [...api.LIVE_RANK_LADDER]);
+  // The government catalog is a third statement of the same ladder (allowlisted
+  // there). If the two sources ever disagree, the ignite floor and the rank
+  // gates would be reading different vocabularies, so pin them together.
+  assert.deepEqual([...api.LIVE_RANK_LADDER], [...catalog.RANK_ORDER],
+    'the kernel ladder and modules/government/catalog.js have drifted');
+});
+
+// --- precedence -------------------------------------------------------------
+
+await test('an instance pack overrides the neutral starter', () => {
+  const c = load({ igniteFloor: 'metic', descentDecayRate: 0.5 }, { igniteFloor: 'xenos', descentDecayRate: 0.25 });
+  assert.equal(c.igniteFloor, 'xenos');
+  assert.equal(c.descentDecayRate, 0.25);
+});
+
+await test('an instance pack may set one dial without restating the other', () => {
+  const c = load({ igniteFloor: 'metic', descentDecayRate: 0.5 }, { igniteFloor: 'thetes' });
+  assert.equal(c.igniteFloor, 'thetes');
+  assert.equal(c.descentDecayRate, 0.5, 'the unnamed dial must fall through to neutral, not to zero');
+});
+
+await test('env overrides both dials, above the instance pack', () => {
+  const c = load({ igniteFloor: 'metic' }, { igniteFloor: 'thetes' },
+    { [envName('IDEAS_IGNITE_FLOOR')]: 'archon', [envName('IDEAS_DESCENT_DECAY_RATE')]: '0.75' });
+  assert.equal(c.igniteFloor, 'archon');
+  assert.equal(c.descentDecayRate, 0.75);
+});
+
+await test('an UNPREFIXED env name is inert, not a second doorway', () => {
+  // resolveEnv only reads <PREFIX>_<SUFFIX>. A bare name must change nothing —
+  // otherwise any process with a generic IDEAS_IGNITE_FLOOR in its environment
+  // would silently move another instance's floor.
+  const c = load({ igniteFloor: 'metic' }, null,
+    { IDEAS_IGNITE_FLOOR: 'xenos', IDEAS_DESCENT_DECAY_RATE: '1' });
+  assert.equal(c.igniteFloor, 'metic');
+  assert.equal(c.descentDecayRate, 0.5);
+});
+
+await test('an invalid env value falls through to the pack, not to nothing', () => {
+  const c = load({ igniteFloor: 'metic', descentDecayRate: 0.5 }, { igniteFloor: 'thetes' },
+    { [envName('IDEAS_IGNITE_FLOOR')]: 'everyone', [envName('IDEAS_DESCENT_DECAY_RATE')]: 'soon' });
+  assert.equal(c.igniteFloor, 'thetes');
+  assert.equal(c.descentDecayRate, 0.5);
+});
+
+await test('no config at all still resolves to the in-code defaults', () => {
+  // The core whose config/ directory did not ship. It must boot to today's
+  // behaviour, not to an empty floor or a zero rate.
+  const c = load(null, null);
+  assert.equal(c.igniteFloor, 'metic');
+  assert.equal(c.descentDecayRate, 0.5);
+});
+
+// --- fail to vanilla, never to dead ----------------------------------------
+
+await test('a malformed instance pack falls back rather than bricking boot', () => {
+  const c = load({ igniteFloor: 'thetes', descentDecayRate: 0.25 }, '{ this is not json');
+  assert.equal(c.igniteFloor, 'thetes');
+  assert.equal(c.descentDecayRate, 0.25);
+});
+
+await test('an unknown rank name is refused, not coerced', () => {
+  // The dangerous direction. A typo must not silently become the widest floor.
+  for (const bad of ['everyone', 'METIC ', '', 'admin', 'Xeno', null, 7, {}]) {
+    const c = load({ igniteFloor: 'metic' }, { igniteFloor: bad });
+    assert.equal(c.igniteFloor, 'metic', `floor "${String(bad)}" should have been refused`);
+  }
+});
+
+await test('a rank name is case-normalised but NOT trimmed', () => {
+  assert.equal(load({ igniteFloor: 'metic' }, { igniteFloor: 'ARCHON' }).igniteFloor, 'archon');
+  assert.equal(load({ igniteFloor: 'metic' }, { igniteFloor: ' archon' }).igniteFloor, 'metic',
+    'a padded rank is a hostile shape, not a rank');
+});
+
+await test('a decay rate outside [0,1] is refused rather than clamped', () => {
+  for (const bad of [1.5, -0.1, NaN, Infinity, -Infinity, '0.5', null, {}]) {
+    const c = load({ descentDecayRate: 0.5 }, { descentDecayRate: bad });
+    assert.equal(c.descentDecayRate, 0.5, `rate ${String(bad)} should have been refused`);
+  }
+});
+
+await test('both ends of the decay band are legitimate choices', () => {
+  assert.equal(load({ descentDecayRate: 0.5 }, { descentDecayRate: 0 }).descentDecayRate, 0);
+  assert.equal(load({ descentDecayRate: 0.5 }, { descentDecayRate: 1 }).descentDecayRate, 1);
+});
+
+await test('an unrecognised floor yields the DEFAULT set, never an empty one', () => {
+  // Failing closed here would stop every ignition on a config typo. The floor is
+  // a scheduling preference; a stopped queue is a worse failure than a default.
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor('nonsense')].sort(), [...routing.METIC_PLUS].sort());
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor(null)].sort(), [...routing.METIC_PLUS].sort());
+});
+
+// --- the dial actually moves the landing ------------------------------------
+
+await test('lowering the floor makes a sub-Metic bug land claimable', () => {
+  const trusted = ideasConfig.trustedRanksForFloor('xenos');
+  const d = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: 'xenos', trustedRanks: trusted });
+  assert.equal(d.status, 'ready');
+  assert.equal(d.reason, 'bug_trusted_filer');
+});
+
+await test('lowering the floor also moves the HOMELESS bug branch', () => {
+  // Two call sites read the floor. A fix that threaded only one of them would
+  // leave the dial half-connected and this is what catches it.
+  const trusted = ideasConfig.trustedRanksForFloor('xenos');
+  const d = routing.decideLanding({ goalId: null, kind: 'bug', filerRank: 'xenos', vector: 'api', trustedRanks: trusted });
+  assert.equal(d.status, 'ready');
+  assert.equal(d.reason, 'bug_homeless_trusted_filer');
+});
+
+await test('raising the floor makes a Metic bug await a nod', () => {
+  const trusted = ideasConfig.trustedRanksForFloor('archon');
+  const d = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: 'metic', trustedRanks: trusted });
+  assert.equal(d.status, 'backlog');
+  assert.equal(d.reason, 'bug_awaiting_nod');
+});
+
+await test('omitting trustedRanks reproduces the constant exactly', () => {
+  // Every pre-R05 caller and test omits it. If this ever diverges, the whole
+  // "defaults preserve today's behaviour" claim is false.
+  for (const rank of ['xenos', 'thetes', 'metic', 'archon', null, 'nonsense']) {
+    const before = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: rank });
+    const after = routing.decideLanding({
+      goalId: 5, kind: 'bug', filerRank: rank,
+      trustedRanks: ideasConfig.trustedRanksForFloor('metic'),
+    });
+    assert.deepEqual(after, before, `rank ${String(rank)} diverged`);
+  }
+});
+
+await test('a non-Set trustedRanks is ignored, not trusted', () => {
+  // A caller handing an array, a string or an object must not accidentally widen
+  // anything — the guard is `instanceof Set`, and this pins it.
+  for (const bad of [['xenos'], 'xenos', { has: () => true }, true]) {
+    const d = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: 'xenos', trustedRanks: bad });
+    assert.equal(d.status, 'backlog', `trustedRanks ${JSON.stringify(bad)} was honoured and should not have been`);
+  }
+});
+
+// --- THE WALL: the floor is not the trusted tier ----------------------------
+
+await test('lowering the ignite floor does NOT let a sub-Metic propose a criterion', () => {
+  // The security claim the amended description turns on. mayProposeCriterion
+  // reads the fixed constant and takes no floor, so there is no argument this
+  // test could pass that would widen it.
+  assert.equal(ideasConfig.trustedRanksForFloor('xenos').has('xenos'), true, 'precondition: floor is wide open');
+  for (const rank of ['xenos', 'thetes']) {
+    assert.equal(routing.mayProposeCriterion(rank), false, `${rank} may not propose a criterion at any floor`);
+  }
+  assert.equal(routing.mayProposeCriterion('metic'), true);
+  assert.equal(routing.mayProposeCriterion('archon'), true);
+});
+
+await test('lowering the ignite floor does NOT breach the protected-scope wall', () => {
+  const trusted = ideasConfig.trustedRanksForFloor('xenos');
+  const landing = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: 'xenos', trustedRanks: trusted });
+  assert.equal(landing.status, 'ready', 'precondition: the dial is turned all the way down');
+
+  const verdict = routing.authorizeRoutedLanding({
+    landing, filerRank: 'xenos', scopeProtected: true,
+  });
+  assert.equal(verdict.ok, false, 'a wide-open ignite floor must not open the protected core');
+  assert.equal(verdict.code, 'protected_scope');
+});
+
+await test('authorizeRoutedLanding takes no floor argument at all', () => {
+  // Structural, not behavioural: if someone later adds one, this reds and makes
+  // them read the header rather than discovering the widening in production.
+  const src = fs.readFileSync(path.join(ROOT, 'modules/ideas/routing.js'), 'utf8');
+  const fn = src.slice(src.indexOf('function authorizeRoutedLanding'));
+  const sig = fn.slice(0, fn.indexOf(')') + 1);
+  assert.ok(!/trustedRanks|igniteFloor/.test(sig), `the scope wall grew a floor argument: ${sig}`);
+});
+
+await test('METIC_PLUS is still a hard-coded constant', () => {
+  // filing_abuse_matrix.mjs holds the same line. Keeping a copy here means the
+  // R05 test file itself refuses the shortcut it exists to prevent.
+  const src = fs.readFileSync(path.join(ROOT, 'modules/ideas/routing.js'), 'utf8');
+  assert.match(src, /METIC_PLUS = new Set\(\['metic', 'archon'\]\)/,
+    'METIC_PLUS must stay a constant — it is the trusted tier, not the ignite floor');
+});
+
+console.log(`\nideas_config: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/module-scope-map.mjs

@@ -14,7 +14,7 @@ const { PROTECTED_GLOBS } = require(path.join(ROOT, 'src', 'bongos', 'permission
 const gsc = require(path.join(ROOT, 'src', 'bongos', 'goal-scope-check.js'));
 // the OLD protection rule, recomputed in-test so the shrink-only property below
 // is proved against real globs rather than a copied literal (ADR 0314).
-const { touchesOverlap } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
+const { touchesOverlap, matchOne } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
 
 test('roster covers the decided ~16 modules + kernel, each with non-empty globs', () => {
   const keys = scope.moduleKeys();
@@ -550,3 +550,104 @@ test('moduleDriftFiles degrades safely on junk input', () => {
   assert.deepEqual(scope.moduleDriftFiles('lifecycle', null), []);
   assert.deepEqual(scope.moduleDriftFiles(null, ['modules/dev-box/app.js']), []);
 });
+
+// EVERY PROTECTED PATH HAS AN OWNING MODULE (task 1004111).
+//
+// MODULE_GLOBS is the territory deciding who may AUTHOR a task touching a path,
+// and the shared floor is only tests/. So a protected path owned by no module is
+// authorable by NO goal at all — scopeSubset returns out_of_scope whatever the
+// goal is scoped to. Nineteen paths were in that state, including infra/,
+// scripts/deploy/, scripts/migrate.sh, CODEOWNERS and the merge-driver pair.
+//
+// This is a TRIPWIRE, not a snapshot: it is computed over PROTECTED_GLOBS, so a
+// path added to the protected roster without an owner reds the build on the spot.
+//
+// THE PROBE TRAP (ADR 0314's own measurement nearly got this wrong in both
+// directions): matchOne(file, touches) takes an ARRAY as its second argument.
+// Passing a joined string iterates its characters and reports everything
+// unowned. The guard test below pins that, so this one cannot rot into a
+// vacuous pass.
+// Ownership is DIRECTIONAL, deliberately. touchesOverlap is symmetric, so a
+// module owning ONE file inside a protected directory would "own" the whole
+// directory and this tripwire would pass on a path no goal can actually author —
+// which is exactly what it caught: kernel owns src/bongos/routes/security.js,
+// and under symmetric overlap that looked like ownership of src/bongos/routes/.
+// matchOne(p, globs) asks the question the wall asks: does some module's
+// territory COVER this path?
+function ownersOf(p) {
+  return scope.moduleKeys().filter((k) => matchOne(p, scope.scopeForModule(k).globs) !== null);
+}
+
+// The one PROTECTED_GLOBS entry still owned by nobody, exempted BY NAME so the
+// tripwire stays true rather than being weakened to accommodate it.
+// src/bongos/routes/ is a blanket directory: protection covers all 18 files under
+// it, authoring covers 2 (me.js -> builder-settings, security.js -> kernel).
+// Closing it means deciding who owns the other sixteen live route files, which is
+// an ownership call and not a missing glob — filed as task 1004116. Removing this
+// entry is that task's first step.
+const UNOWNED_EXEMPT = ['src/bongos/routes/'];
+
+test('every PROTECTED_GLOBS entry is owned by at least one module', () => {
+  const unowned = PROTECTED_GLOBS
+    .filter((p) => !UNOWNED_EXEMPT.includes(p))
+    .filter((p) => ownersOf(p).length === 0);
+  assert.deepEqual(
+    unowned, [],
+    'these protected paths are authorable by NO goal — give each an owning module in MODULE_GLOBS (task 1004111)',
+  );
+});
+
+test('the exemption list is not a place to hide a new hole', () => {
+  // An exemption that silently stops applying is worse than none: it would sit
+  // in the file implying a known gap that no longer exists, and the next unowned
+  // path could be parked beside it. So assert the exemption is still REQUIRED.
+  for (const p of UNOWNED_EXEMPT) {
+    assert.ok(PROTECTED_GLOBS.includes(p), `${p} is exempted but is no longer a protected glob — drop it`);
+    assert.equal(
+      ownersOf(p).length, 0,
+      `${p} now HAS an owning module — delete it from UNOWNED_EXEMPT (task 1004116 is done)`,
+    );
+  }
+});
+
+test('...and the owner is a real module whose goal can actually author the path', () => {
+  // Ownership on paper is not ownership: assert through the REAL wall, so a glob
+  // that resolves but does not cover cannot pass. Metic is used deliberately —
+  // these are protected paths, so a sub-Metic is refused by the path wall and
+  // would prove nothing about scope.
+  for (const p of PROTECTED_GLOBS.filter((x) => !UNOWNED_EXEMPT.includes(x))) {
+    const [owner] = ownersOf(p);
+    assert.ok(owner, `${p} has no owning module`);
+    assert.equal(
+      gsc.scopeSubset([owner], [p]).ok, true,
+      `${p} resolves to owner "${owner}" but that goal's territory does not cover it`,
+    );
+  }
+});
+
+test('adopting the unowned paths did NOT change which modules are protected', () => {
+  // The property that made assignment safe rather than a re-coupling: every
+  // receiving module was ALREADY protected, so no goal became Archon-only that
+  // was not before. If this fails, an adoption widened the trust boundary.
+  for (const k of ['kernel', 'lifecycle', 'dev-box', 'devsecops', 'methodology']) {
+    assert.equal(scope.scopeForModule(k).protected, true, `${k} was already protected and must stay so`);
+  }
+  // and the ADR 0314 nine are still exactly the nine — PROTECTED_MODULES above
+  // is the by-name pin; this states the intent of THIS task against it.
+  assert.equal(scope.protectedModules().length, 9, 'adoption must not change the size of the protected set');
+});
+
+test('the probe trap: matchOne takes an ARRAY, and a string reports everything unowned', () => {
+  // Pinned because it is how this hole was nearly mis-measured twice. If a future
+  // edit passes a joined string, the tripwire above would silently "find" the
+  // whole roster unowned — or, inverted, find nothing. Prove the array form is
+  // the one with the real answer.
+  const p = '.gitattributes';
+  assert.ok(PROTECTED_GLOBS.includes(p), 'fixture assumption: .gitattributes is protected');
+  assert.ok(ownersOf(p).length > 0, 'the ARRAY form finds the real owner');
+  assert.ok(touchesOverlap([p], scope.scopeForModule('devsecops').globs), 'and the symmetric form agrees for an exactly-owned path');
+  assert.equal(
+    matchOne(p, scope.scopeForModule('devsecops').globs.join(',')), null,
+    'a STRING second argument must not be mistaken for a working query',
+  );
+});