@bongos/core 1.19.946 → 1.19.948

package/modules/hall-ui/public/goal-map.js

@@ -0,0 +1,209 @@
+// goal-map.js — the goal map page (task 1003479, goal 1000089; ADR 0227 §6 item 3
+// and its §10.4 amendment). One read, GET /goals/graph, three surfaces from it:
+//   1. the map — the goals tied to another goal by a dependency, drawn in layers;
+//   2. the stand-alone list — the goals that have no edge, which §10.4 says belong
+//      in a list and not as dots on a canvas that has nothing to say about them;
+//   3. the table — EVERY goal, with both directions of each dependency by name.
+//
+// THE TABLE IS THE PAGE AND THE MAP IS THE ENHANCEMENT (ADR 0227 §5). Every fact
+// the picture carries is a cell in the table, on screen by default and not behind
+// a "view as table" toggle. The picture is therefore a `role="img"` figure with a
+// caption that says where the same facts are, and its nodes are NOT links or
+// focus stops — a keyboard or screen-reader reader gets each goal, once, from the
+// table, rather than thirty-six hidden interactive elements from a drawing.
+//
+// THERE IS NO CONTROL that changes what is drawn (ADR 0227 §7): no "show every
+// task", no "densify". The only input is the aggregate the endpoint returns,
+// which carries no task identity, so views A and D are unreachable by
+// construction and not by a flag that happens to be off.
+//
+// The layout is goal-map-lib.js (pure, run by tests/goal_map_lib.mjs). This file
+// draws what it returns, with createElementNS and textContent — the atlas's
+// idiom — so a goal title (builder-authored text) never becomes markup.
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const SVGNS = 'http://www.w3.org/2000/svg';
+  const kit = window.OTBKit;
+  const lib = window.OTBGoalMapLib;
+  const { escapeHtml } = window.OTB;
+  const $ = (id) => document.getElementById(id);
+
+  const hallBase = () => (location.hostname.startsWith('builders.') ? '' : '/builders');
+  const goalHref = (id) => `${hallBase()}/goals#/goal/${encodeURIComponent(id)}`;
+
+  function svgEl(tag, attrs, parent) {
+    const el = document.createElementNS(SVGNS, tag);
+    Object.keys(attrs || {}).forEach((k) => el.setAttribute(k, attrs[k]));
+    if (parent) parent.appendChild(el);
+    return el;
+  }
+  function text(parent, cls, x, y, content) {
+    const t = svgEl('text', { class: cls, x, y }, parent);
+    t.textContent = content;
+    return t;
+  }
+
+  // ---- the map -----------------------------------------------------------------
+
+  function drawGraph(a, lay, cats) {
+    const svg = svgEl('svg', {
+      class: 'gm-svg', viewBox: `0 0 ${lay.width} ${lay.height}`, width: lay.width, height: lay.height,
+      role: 'img', 'aria-labelledby': 'gm-cap', focusable: 'false',
+    });
+    const defs = svgEl('defs', {}, svg);
+    const marker = svgEl('marker', { id: 'gm-arrow', viewBox: '0 0 10 10', refX: 9, refY: 5, markerWidth: 7, markerHeight: 7, orient: 'auto' }, defs);
+    svgEl('path', { class: 'gm-arrowhead', d: 'M0 0 L10 5 L0 10 z' }, marker);
+
+    const edges = svgEl('g', { class: 'gm-edges' }, svg);
+    lay.edges.forEach((e) => {
+      const path = svgEl('path', { class: 'gm-edge', d: e.d, 'stroke-width': e.width, 'marker-end': 'url(#gm-arrow)' }, edges);
+      const dependent = lib.displayTitle(a.byId[e.from]);
+      const dependency = lib.displayTitle(a.byId[e.to]);
+      svgEl('title', {}, path).textContent = `${dependent} waits on ${dependency} — ${lib.plural(e.count, 'task')}`;
+    });
+
+    // The node's WEIGHT (ADR 0227 §6 item 3: "node weight = task count"), as a
+    // fraction of the busiest goal ACTUALLY DRAWN — a scale that means something
+    // on this map, not on the whole corpus most of which never appears here.
+    const maxTotal = lay.nodes.reduce((m, p) => Math.max(m, a.byId[p.id].task_total || 0), 0);
+
+    const nodes = svgEl('g', { class: 'gm-nodes' }, svg);
+    lay.nodes.forEach((p) => {
+      const n = a.byId[p.id];
+      const g = svgEl('g', { class: `gm-node gm-c${lib.colourOf(n, cats)}`, transform: `translate(${p.x} ${p.y})` }, nodes);
+      const cat = n.category ? n.category.label : 'No category';
+      svgEl('title', {}, g).textContent = `${lib.displayTitle(n)} — ${cat} — ${n.task_done} of ${n.task_total} tasks done`
+        + ` — waits on ${lib.plural(n.depends_on || 0, 'goal')}, needed by ${lib.plural(n.depended_on_by || 0, 'goal')}`;
+      svgEl('rect', { class: 'gm-card', width: p.w, height: p.h, rx: 8 }, g);
+      svgEl('rect', { class: 'gm-stripe', width: 6, height: p.h, rx: 3 }, g);
+      text(g, 'gm-name', 16, 22, lib.clip(lib.displayTitle(n), lib.TITLE_CHARS));
+      text(g, 'gm-cat', 16, 38, lib.clip(cat, lib.SUB_CHARS));
+      text(g, 'gm-tasks', 16, 53, `${n.task_done} of ${lib.plural(n.task_total, 'task')} done`);
+      const trackW = p.w - 32;
+      svgEl('rect', { class: 'gm-weight-track', x: 16, y: 60, width: trackW, height: 3, rx: 1.5 }, g);
+      const frac = lib.weightOf(n.task_total, maxTotal);
+      if (frac > 0) svgEl('rect', { class: 'gm-weight-fill', x: 16, y: 60, width: Math.max(3, trackW * frac), height: 3, rx: 1.5 }, g);
+    });
+    return svg;
+  }
+
+  function renderGraph(a, cats, described) {
+    const host = $('gm-graph');
+    if (!a.connected) {
+      host.innerHTML = `<p class="scroll__lede">${escapeHtml(described.graph || described.summary)}</p>`;
+      return;
+    }
+    host.innerHTML = `
+      <figure class="gm-figure">
+        <figcaption id="gm-cap" class="scroll__lede">
+          An arrow runs from the goal that has to ship first to the goal that waits on it, and a thicker line means more
+          tasks are waiting. Every goal in this map, and every dependency, is also in the table below.
+        </figcaption>
+        <div class="gm-scroll" id="gm-scroll" tabindex="0" role="region" aria-label="Goal map — scrolls sideways inside this box"></div>
+      </figure>`;
+    $('gm-scroll').appendChild(drawGraph(a, lib.layout(a), cats));
+  }
+
+  function renderLegend(cats) {
+    const host = $('gm-legend');
+    if (!cats.list.length && !cats.uncategorised) { host.hidden = true; return; }
+    const swatch = (cls) => `<span class="gm-swatch ${cls}" aria-hidden="true"></span>`;
+    host.innerHTML = cats.list.map((c) => `<li>${swatch(`gm-c${c.colour}`)}${escapeHtml(c.label)} <span class="gm-n">${c.count}</span></li>`).join('')
+      + (cats.uncategorised ? `<li>${swatch('gm-cnone')}No category <span class="gm-n">${cats.uncategorised}</span></li>` : '');
+    host.hidden = false;
+  }
+
+  // ---- the stand-alone goals ------------------------------------------------------
+
+  function renderAlone(a) {
+    const section = $('gm-alone-scroll');
+    if (!a.isolated.length || !a.connected) { section.hidden = true; return; }
+    $('gm-alone-lede').textContent = `${lib.plural(a.isolated.length, 'goal')} ${a.isolated.length === 1 ? 'has' : 'have'} no task that waits on another goal’s work, `
+      + 'and none that another goal waits on, so there is nothing to draw between them and another goal. They are listed here instead of drawn as dots.';
+    $('gm-alone').innerHTML = a.isolated.map((id) => {
+      const n = a.byId[id];
+      const label = lib.displayTitle(n);
+      const facts = (n.category ? `${escapeHtml(n.category.label)} · ` : '') + lib.plural(n.task_total, 'task');
+      const inner = `<span>${escapeHtml(label)}</span><span class="gm-n">${facts}</span>`;
+      return n.title
+        ? `<li><a class="fact-chip gm-chip" href="${goalHref(id)}">${inner}</a></li>`
+        : `<li><span class="fact-chip gm-chip">${inner}</span></li>`;
+    }).join('');
+    section.hidden = false;
+  }
+
+  // ---- the table (primary) ----------------------------------------------------------
+
+  const depList = (list) => (list.length
+    ? `<ul class="gm-deps">${list.map((x) => `<li>${escapeHtml(x.title)} <span class="gm-n">· ${lib.plural(x.count, 'task')}</span></li>`).join('')}</ul>`
+    : '<span class="gm-none">—</span>');
+
+  function rowHtml(r) {
+    const title = r.isPrivate
+      ? `<span class="gm-private">${escapeHtml(r.title)}</span>`
+      : `<a class="lb-name" href="${goalHref(r.id)}">${escapeHtml(r.title)}</a>`;
+    return `<tr>
+      <td>${title}</td>
+      <td>${r.category ? escapeHtml(r.category) : '<span class="gm-none">—</span>'}</td>
+      <td class="ledger__num">${r.done} of ${r.total}</td>
+      <td>${depList(r.waits)}</td>
+      <td>${depList(r.needed)}</td>
+      <td>${escapeHtml(r.clusterLabel)}</td>
+      <td>${escapeHtml(r.version)}</td>
+    </tr>`;
+  }
+
+  function renderTable(a) {
+    const section = $('gm-table-scroll');
+    const rows = lib.tableRows(a);
+    section.hidden = false;
+    const pager = kit.makePager('gm', 'hall-goal-map-per-page', { defaultPerPage: 100 });
+    const ledger = kit.makeLedger({
+      mount: $('gm-table'),
+      columns: ['Goal', 'Category', { label: 'Tasks done', class: 'ledger__num' }, 'Waits on', 'Needed by', 'Cluster', 'Version'],
+      rowHtml,
+      emptyMsg: 'No goal carries any work yet.',
+      pager,
+    });
+    ledger.render(rows);
+    const table = $('gm-table').querySelector('table');
+    if (table) table.setAttribute('aria-label', 'Every goal, with what it waits on and what waits on it');
+  }
+
+  // ---- boot ---------------------------------------------------------------------------
+
+  function notice(msg) {
+    $('gm-sub').textContent = msg;
+    $('gm-graph').innerHTML = `<p class="note">${escapeHtml(msg)}</p>`;
+  }
+
+  async function boot() {
+    let payload;
+    try {
+      const res = await fetch(`${API}/goals/graph`, { credentials: 'same-origin', headers: { Accept: 'application/json' } });
+      if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
+      if (!res.ok) throw new Error(`graph → ${res.status}`);
+      payload = await res.json();
+    } catch (err) {
+      console.error('[goal-map] load failed', err);
+      notice('Couldn’t load the goal map right now.');
+      return;
+    }
+    const a = lib.analyse(payload);
+    const cats = lib.categories(a);
+    const described = lib.describe(a);
+    $('gm-sub').textContent = described.summary;
+    if (!a.order.length) {
+      $('gm-graph').innerHTML = kit.emptyStateHtml(described.summary);
+      return;
+    }
+    renderGraph(a, cats, described);
+    renderLegend(cats);
+    renderAlone(a);
+    renderTable(a);
+  }
+
+  boot();
+})();

package/modules/hall-ui/public/goal-map.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "THE GOAL MAP (task 1003479, goal 1000089; ADR 0227 §6 item 3) through modules/ui-design/kit/render.js. The page reads ONE authenticated aggregate, GET /goals/graph, so against the kit's own stub it renders its signed-out / failed-read state — a state the floors must hold in and is rendered here deliberately. To look at the populated map (the layered picture, the stand-alone chips, the table), run it against the hall-preview harness, whose goals__graph.json fixture carries one large cluster, a triple, pairs, a mutual pair (a loop) and a private goal beside the stand-alone majority:\n\n  node scripts/hall-preview/server.js --port 4620 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/goal-map.states.json --base-in http://localhost:4620 --base-out http://localhost:4620",
+  "page": "/builders/goal-map",
+  "surface": "hall-ui",
+  "stub": { "prefix": "/builders/" },
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
+  "states": {
+    "map": { "auth": true, "actions": [["wait", 1200]], "expect": { "visible": ["#gm-graph"] } },
+    "out": { "auth": false, "actions": [["wait", 600]] }
+  },
+  "reducedMotion": { "auth": true, "actions": [["wait", 1200]] }
+}

package/modules/hall-ui/public/goals.html

@@ -42,6 +42,9 @@
       <div class="page-head page-head--board">
         <h1 class="page-head__h">Goals</h1>
         <p class="page-head__sub" id="goals-sub">Loading goals…</p>
+        <!-- task 1003479: the goal map has no nav slot of its own (the sky's rule —
+             a map that is reachable but not load-bearing), so this is its door. -->
+        <p class="page-head__sub"><a href="/builders/goal-map">See which goals wait on each other →</a></p>
       </div>
 
       <main id="hall-main">

package/modules/lifecycle/goal-graph.js

@@ -0,0 +1,176 @@
+'use strict';
+
+// modules/lifecycle/goal-graph.js — the goal graph's data: one node per goal, one
+// edge per pair of goals whose tasks depend on each other (task 1003479, goal
+// 1000089, ADR 0227 §6 item 3 and its §10.4 amendment).
+//
+// WHY THIS IS AN AGGREGATE AND NOT A TASK LIST. ADR 0227 refused a whole-corpus
+// task map: 3,253 tasks are confetti, and the readable thing is the ~70-goal
+// graph. So the reduction happens in Postgres — task counts per goal (the same
+// buckets goal-rollup.js uses, so the two boards cannot show different numbers)
+// and a COUNT of task-level dependencies that cross a goal boundary — and the
+// payload is a few kilobytes however many tasks exist. Nothing in this file ever
+// returns a task id or a task title.
+//
+// THE EDGE DIRECTION IS "WAITS ON". An edge {from, to, count} says `count` tasks
+// in goal `from` depend on tasks in goal `to`. Only edges between two DIFFERENT
+// goals are kept: a dependency inside one goal is that goal's own business and
+// belongs to the per-goal forest (task 1003480), not to the map of goals.
+//
+// VISIBILITY (ADR 0112's leak rule). A private goal's prose is the secret, not
+// its existence or its counts, so a viewer who is neither a member nor an Archon
+// still gets the node — its task counts and its edges — but `title` and
+// `category` come back null. The client draws that as "a private goal" rather
+// than dropping it, because dropping a node would silently turn its neighbours
+// into isolated dots and misstate the very structure this view exists to show.
+//
+// A CATEGORY IS A LABEL HERE AND NOTHING MORE (ADR 0192): it is decorated onto
+// the node for the reader and no query, filter or edge below reads it.
+
+const api = require('../../src/module-api');
+const { pool } = api;
+const goalCategory = require('./goal-category');
+const { DONE_STATUSES, CUT_STATUSES } = require('./task-status');
+
+// goalGraphRows — the two raw reads. Returns { goals, edges }: `goals` one row per
+// goal that carries at least one task, `edges` one row per ordered pair of goals.
+// deps.pool honours the test seam (NODE_ENV==='test' only), like every helper here.
+async function goalGraphRows({ versionId = null, viewerId = null, viewerIsArchon = false } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  // A repeated ?version= parses as an array; binding that against a ::text
+  // parameter is a driver-level 500, not a clean refusal, so it is flattened to
+  // its first value before it ever reaches the query (GET /goals has the same
+  // gap; fixing it there is a separate task).
+  const version = Array.isArray(versionId) ? (versionId[0] ?? null) : versionId;
+  const [goals, edges] = await Promise.all([
+    activePool.query(
+      // The outer JOIN tasks already requires at least one task per goal, so
+      // there is no separate EXISTS to filter goals with none.
+      `SELECT g.id::text                                          AS goal_id,
+              g.title, g.status, g.version_id, g.category_id,
+              (g.visibility IS DISTINCT FROM 'private'
+                 OR $2::boolean
+                 OR bool_or(gm.builder_id IS NOT NULL)) AS visible,
+              COUNT(*) FILTER (WHERE t.status <> ALL($4::text[]))::int AS task_total,
+              COUNT(*) FILTER (WHERE t.status = ANY($5::text[]))::int  AS task_done
+         FROM goals g
+         JOIN tasks t ON t.goal_id = g.id
+         LEFT JOIN goal_members gm ON gm.goal_id = g.id AND gm.builder_id = $3::bigint
+        WHERE ($1::text IS NULL OR g.version_id = $1)
+        GROUP BY g.id, g.title, g.status, g.version_id, g.category_id
+        ORDER BY g.version_id, g.sort_order, g.id`,
+      [version, viewerIsArchon === true, viewerId, CUT_STATUSES, DONE_STATUSES]
+    ),
+    activePool.query(
+      `SELECT ft.goal_id::text AS from_goal_id,
+              tt.goal_id::text AS to_goal_id,
+              COUNT(*)::int    AS count
+         FROM dependencies d
+         JOIN tasks ft ON d.from_kind = 'task' AND ft.id = d.from_id
+         JOIN tasks tt ON d.to_kind   = 'task' AND tt.id = d.to_id
+         JOIN goals fg ON fg.id = ft.goal_id
+         JOIN goals tg ON tg.id = tt.goal_id
+        WHERE ft.goal_id <> tt.goal_id
+          AND ($1::text IS NULL OR (fg.version_id = $1 AND tg.version_id = $1))
+        GROUP BY ft.goal_id, tt.goal_id
+        ORDER BY ft.goal_id, tt.goal_id`,
+      [version]
+    ),
+  ]);
+  return { goals: goals.rows, edges: edges.rows };
+}
+
+// shapeGraph — the wire shape. Pure, so a test pins it with no database.
+//
+//   nodes: [{ goal_id, title, status, version_id, category, task_total, task_done,
+//             depends_on, depended_on_by }]
+//   edges: [{ from, to, count }]      — `from` waits on `to`
+//   counts: { goals, connected, isolated, edges }
+//
+// `depends_on` / `depended_on_by` are DISTINCT GOAL counts, not task counts: the
+// table this feeds says "waits on 3 goals", and a reader adding up task edges to
+// find out how many goals are involved would get the wrong number.
+//
+// An edge whose endpoint is not among the nodes is DROPPED, not drawn to nowhere.
+// That happens legitimately when a version filter scopes the goals but a stale
+// row lingers, and an edge with a missing end is a line pointing at nothing.
+function shapeGraph({ goals = [], edges = [] } = {}, categoryById = new Map()) {
+  const known = new Set(goals.map((g) => String(g.goal_id)));
+  const kept = [];
+  const seen = new Set();
+  for (const e of edges) {
+    const from = String(e.from_goal_id);
+    const to = String(e.to_goal_id);
+    if (from === to || !known.has(from) || !known.has(to)) continue;
+    const key = `${from}>${to}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    kept.push({ from, to, count: Number(e.count) || 0 });
+  }
+
+  const waitsOn = new Map();
+  const blocks = new Map();
+  for (const e of kept) {
+    if (!waitsOn.has(e.from)) waitsOn.set(e.from, new Set());
+    waitsOn.get(e.from).add(e.to);
+    if (!blocks.has(e.to)) blocks.set(e.to, new Set());
+    blocks.get(e.to).add(e.from);
+  }
+
+  const nodes = goals.map((g) => {
+    const id = String(g.goal_id);
+    const visible = g.visible !== false;
+    const cat = visible && g.category_id != null ? categoryById.get(String(g.category_id)) : null;
+    return {
+      goal_id: id,
+      title: visible ? g.title : null,
+      status: g.status,
+      version_id: g.version_id,
+      category: cat ? { id: String(cat.id), slug: cat.slug, label: cat.label } : null,
+      task_total: Number(g.task_total) || 0,
+      task_done: Number(g.task_done) || 0,
+      depends_on: (waitsOn.get(id) || new Set()).size,
+      depended_on_by: (blocks.get(id) || new Set()).size,
+    };
+  });
+
+  const connected = nodes.filter((n) => n.depends_on + n.depended_on_by > 0).length;
+  return {
+    nodes,
+    edges: kept,
+    counts: { goals: nodes.length, connected, isolated: nodes.length - connected, edges: kept.length },
+  };
+}
+
+// goalGraph — read + shape. `categories` is injectable so the whole path runs in a
+// test with a fake pool and no category table.
+async function goalGraph(opts = {}, deps = {}) {
+  const [rows, byId] = await Promise.all([
+    goalGraphRows(opts, deps),
+    (deps.categoryIndex || goalCategory.categoryIndex)(deps),
+  ]);
+  return shapeGraph(rows, byId);
+}
+
+// goalGraphHandler — GET /goals/graph. A factory, so a test drives it with a stub
+// read and no database (the goal-category.js handler precedent). Identity comes
+// from the authenticated request, never the query: the viewer decides whether a
+// private goal's title comes back, and a caller-supplied id would let anyone ask
+// as somebody else.
+function goalGraphHandler({ read = goalGraph, log = console } = {}) {
+  return async function getGoalGraph(req, res) {
+    try {
+      const graph = await read({
+        versionId: (req.query && req.query.version) || null,
+        viewerId: req.builder.id,
+        viewerIsArchon: req.builder.rank === 'archon',
+      });
+      return res.json(graph);
+    } catch (err) {
+      log.error('[gds] GET /goals/graph', err);
+      return res.fail('graph_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+module.exports = { goalGraph, goalGraphRows, shapeGraph, goalGraphHandler };

package/modules/lifecycle/routes/goals.js

@@ -30,6 +30,7 @@ const goalSuggest = require('../goal-suggest.js'); // task 1003062 — pre-creat
 const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edit handlers
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
 const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
+const goalGraph = require('../goal-graph.js'); // task 1003479 — the goal graph: nodes + cross-goal edges, aggregated in SQL
 const { suggestCriteria } = require('../criterion-suggest');
 const { classifyTaskKind, VALID_KINDS, WRITABLE_DISCIPLINES, resolveWriteDiscipline, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { validateOrRespond, parseId, LIMITS } = api;
@@ -210,6 +211,9 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // rank: any-builder — GET /goals/graph, the goal board's map (task 1003479, ADR 0227); before /goals/:id.
+  router.get('/goals/graph', auth.requireBuilder, goalGraph.goalGraphHandler({ log }));
+
   // GET /goals?version=&status= — list goals (read).
   // rank: any-builder — viewing the goal board.
   router.get('/goals', auth.requireBuilder, async (req, res) => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.946",
+  "version": "1.19.948",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.946",
+      "version": "1.19.948",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.946",
+  "version": "1.19.948",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gen-api-client.js

@@ -374,14 +374,29 @@ function renderPackageJson(spec) {
     },
     files: ['index.mjs', 'index.cjs', 'index.d.ts', 'bongos-client.global.js', 'README.md'],
     license: 'AGPL-3.0-or-later',
+    // `private: true` is the ENFORCEMENT of the paragraph below (task 1004143). Task
+    // 1003742 removed the publishConfig, which stopped the repo CLAIMING this was a
+    // published package — but nothing stopped it BECOMING one again: `npm publish` in
+    // clients/bongos-client/ succeeded and would have recreated @bongos/client@0.0.2,
+    // the exact package the owner deleted from the registry on 2026-09-09. npm now
+    // refuses with EPRIVATE, so that removal cannot be silently undone by anyone who
+    // runs publish in the wrong directory.
+    //
+    // This is not the publish posture the note below calls fiction. That was declaring
+    // HOW it publishes (access: restricted) for something never published; this
+    // declares that it does not publish, which is the same fact the note states in
+    // prose. It does not affect `main`/`types`/`exports`, so the vendored copy and a
+    // workspace link resolve exactly as before.
+    private: true,
     // NO publishConfig — this client is NOT an npm package (task 1003742).
     //
     // It was published once, 2026-07-07 at 0.0.2, under ADR 0134's private-first plan, and never
     // updated while the API it is generated FROM moved 500+ core versions. It had zero consumers
     // the whole time: nothing across the core or any instance repo ever declared it as a
-    // dependency — every consumer VENDORS a copy instead (modules/dev-box/app/src/vendor/, and
-    // build-cli-package.js into @cloudbongos/cli, which could not depend on it anyway). The owner
-    // removed it from the registry on 2026-09-09.
+    // dependency — every consumer VENDORS a copy instead. That was two places when this was
+    // written; task 1003891 deleted the Dev Box Electron app, so build-cli-package.js vendoring
+    // it into @cloudbongos/cli (which could not depend on it anyway) is now the only one. The
+    // owner removed it from the registry on 2026-09-09.
     //
     // The manifest itself stays: `main`/`types`/`exports` are what make the vendored copy and a
     // workspace link resolve. Declaring a publish posture is the part that was fiction.

package/src/bongos/serve-internal.js

@@ -1163,13 +1163,16 @@ function mountInternalSurfaces(app) {
   // because the page reads the VIEWER's own trail and nobody else's — the id it
   // asks for comes from GET /me, never from the URL, so a rank could protect
   // nothing here that the session does not already.
+  // task 1003479 (goal 1000089): `goal-map` — the map of which goals wait on which,
+  // reached from Goals. It reads GET /goals/graph, which is `requireBuilder`, so a
+  // page gated any lower would show a signed-out visitor an empty shell.
   // task 1004105 (BV2.R26): `sky` — THE SKY, the ambient view over the same
   // trail the room lists — joins that tier for exactly the same reasons. It is
   // the SAME read (GET /inbox/by-builder/:id with the id from GET /me), drawn
   // as a map instead of a table, so a floor above sign-in would protect on one
   // page what it admits on the other.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|thinking|sky|collab|task|idea|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|settings|atlas|modules|goals|goal-map|roadmap|copy-desk|studio|ideas|thinking|sky|collab|task|idea|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.946'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.948'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/api_client.mjs

@@ -303,3 +303,40 @@ test('--check reads a CRLF working copy as fresh, and a real edit as stale (task
     fs.rmSync(root, { recursive: true, force: true });
   }
 });
+
+// ── the generated manifest must refuse to become an npm package (task 1004143) ──
+//
+// @bongos/client was published once (2026-07-07, 0.0.2), gathered zero consumers —
+// everyone vendors a copy — and the owner deleted it from the registry on
+// 2026-09-09. Task 1003742 removed the publishConfig so the repo stopped CLAIMING
+// it was published, but nothing stopped it BECOMING published again: `npm publish`
+// in clients/bongos-client/ succeeded and would have recreated it.
+//
+// WHY THIS IS ASSERTED ON THE MANIFEST AND NOT BY RUNNING npm. `npm publish
+// --dry-run` is NOT a test of this and passes with `private: true` set: npm's
+// dry-run path returns in lib/commands/publish.js before it ever calls
+// libnpmpublish, and libnpmpublish/lib/publish.js is where the real guard lives —
+// `if (manifest.private) throw EPRIVATE` as its first statement, unconditional and
+// ahead of any network call. So a real publish IS blocked; a dry-run simply never
+// reaches the check. Asserting the field is the honest test at this layer, and it
+// is the part this repo actually controls.
+test('the generated client manifest is private, so it cannot be republished', () => {
+  const pkg = JSON.parse(fs.readFileSync(
+    path.join(ROOT, 'clients', 'bongos-client', 'package.json'), 'utf8'));
+  assert.equal(pkg.private, true,
+    'clients/bongos-client/package.json lost `private: true` — npm publish in that directory '
+    + 'would recreate @bongos/client, the package the owner removed from the registry.');
+  // The manifest still has to RESOLVE: 1003742 kept these on purpose, because the
+  // vendored copy and a workspace link go through them. `private` must not cost that.
+  for (const field of ['main', 'types', 'exports']) {
+    assert.ok(pkg[field], `the manifest lost \`${field}\` — the vendored copy resolves through it`);
+  }
+});
+
+test('the GENERATOR emits it, not just the committed file', () => {
+  // Fixing only the output is a fix that the next regeneration undoes.
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gen-api-client.js'), 'utf8');
+  assert.match(src, /private:\s*true/,
+    'gen-api-client.js no longer emits `private: true` — the next regeneration would '
+    + 'make clients/bongos-client publishable again.');
+});