@bongos/core 1.19.995 → 1.19.997

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.995",
-  "core_contract": "1.19.995",
-  "source_commit": "5289c5d78570e086cd6f6d7ee4c154883c7adb78",
+  "core_version": "1.19.997",
+  "core_contract": "1.19.997",
+  "source_commit": "e3e7048278119785fc3a9a9ca14edefba9ecae54",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T23:25:13.365Z",
+  "built_at": "2026-09-24T00:11:45.316Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 519,
+    "docs_redacted": 520,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2405,
+    "functional_verbatim": 2406,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2950,
-  "tree_sha256": "ca075a6b55f5c4d672bea732dad07148b251ceceabcea4a3823702e708fc28c7",
+  "file_count": 2952,
+  "tree_sha256": "ce61953a922e8482ee9341329d06ba7a71aa4367e0449c4d9a9990de9ff82e23",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2157,7 +2157,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "8b1f2a53680ae8b68be5d54a82664413fa29186fb580825f5a1b0e3ce3677525"
+      "sha256": "734016d0505821010e06c197ea1987e3eb4e9700d45ad32d982a5b9cd9da5aed"
     },
     {
       "path": "docs/architecture.md",
@@ -2717,7 +2717,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "42c93e21972b2c4cf9e69574fbd72957a80d03ce51f5a86e6d28579981de11df"
+      "sha256": "1b16fcc54d5a5c01d44d93ff307eef44ddec9a993bd81db0d41db4b71f4e5654"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2924,6 +2924,11 @@
       "mode": "0000644",
       "sha256": "f6d2bb1da53f03f54080b8e0aec9f63390d3343c32917b64225ac47ae4ba7b42"
     },
+    {
+      "path": "docs/recipes/render-pilot.md",
+      "mode": "0000644",
+      "sha256": "7b5f391285931a5f5e1bd31683702d534e9876d55ce5a0794e7d8eeec52fc2f3"
+    },
     {
       "path": "docs/recipes/reranking-a-goals-board.md",
       "mode": "0000644",
@@ -6082,12 +6087,12 @@
     {
       "path": "modules/lifecycle/routes/goal-route-authz.js",
       "mode": "0000644",
-      "sha256": "3b4fb0168b29fb0df1260c23c5b14d96576f00f587dd5c188fe17a712e3dffaa"
+      "sha256": "89d282e6c5110ae698484ddab698a72f27c6fe509fc97ff628326fe42e79483d"
     },
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "91039df9ca263ad34bda8e230b8e52f2099e6114a2a9eb4bae2b6b21210994c8"
+      "sha256": "8bd3b013fa96d062f15386e53f43dcdb918baf619c2beb5cf5333ef7052475f3"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -8182,12 +8187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1b91fb64b2d18219b4433b0ef6589de4488e9d7d78db9a1af45268a1f2a51944"
+      "sha256": "93a81b5f6bc16e21a3ad6abd52490ccfbefe0f2d11af8dfd6273f03dd0c91ca0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6b994df4ca85e51d032ee640a4aa4b6dfb57d82581a840eb5de5f05a0b831ee3"
+      "sha256": "fe2540636dec8118f88d3c037c991fb3f9f784a72edec9569ecce1f09ec4ab97"
     },
     {
       "path": "public-docs/index.html",
@@ -9122,7 +9127,7 @@
     {
       "path": "scripts/gds/prove-strict-versioning.js",
       "mode": "0000644",
-      "sha256": "b0e2c14720e8258eba4d4ef7f69cc2bcbb26c3be312deb891383dce7a1dbf71e"
+      "sha256": "65bb758becd002ae830a8338ec6ba0bc21ec5ef91ad564c85a2a94b7ab6ffbbc"
     },
     {
       "path": "scripts/gds/provision-byo-host.js",
@@ -10232,7 +10237,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "34e569846f695b7f3b69061619a97ab92cda5a4262a67f6c016f31edaf984714"
+      "sha256": "aa4d373556efe35c070f90b0ff308b302fbb9887f06cd3655d0fb9df8b157faa"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11657,7 +11662,7 @@
     {
       "path": "tests/goal_archive_disposition.mjs",
       "mode": "0000644",
-      "sha256": "bf0baad459ee2e103079a53570ca4998bb3ba66451ad0257478dd236118c8ce6"
+      "sha256": "de5b561ffe78ead5f6a1ad08066aaa2672627f441f8602fd46e1fdac453512e0"
     },
     {
       "path": "tests/goal_archive_hall.mjs",
@@ -11764,6 +11769,11 @@
       "mode": "0000644",
       "sha256": "c93422d76ff7f0107190c6de1954f110e92a18913fabbcdea2b4f67693d538e6"
     },
+    {
+      "path": "tests/goal_owner_manager_powers.mjs",
+      "mode": "0000644",
+      "sha256": "9853fe32906b842e6c78dd024e33bee5c00649ed2de2f6b593d736d0155e7832"
+    },
     {
       "path": "tests/goal_routes.mjs",
       "mode": "0000644",

package/docs/api/openapi.json

@@ -6127,7 +6127,7 @@
           "goals"
         ],
         "summary": "POST /goals/:id/archive",
-        "description": "POST /goals/:id/archive — retire a goal (open|achieved → archived). Archived goals are re-openable (below). This is the lifecycle disposition the /goal-review skill reaches for once a goal is achieved (ADR 0086 §6 / BV1.R64). rank: metic+archon — a goal member (Metic+) or an Archon dispositions the goal.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.archive` (all required).",
+        "description": "POST /goals/:id/archive — retire a goal (open|achieved → archived). Archived goals are re-openable (below). This is the lifecycle disposition the /goal-review skill reaches for once a goal is achieved (ADR 0086 §6 / BV1.R64). rank: metic+archon + owner|manager|Archon (task 1001739); archive is reversible, so a manager may.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.archive` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/goals.js",
         "x-permissions": [
@@ -7134,7 +7134,7 @@
           "goals"
         ],
         "summary": "POST /goals/:id/scope",
-        "description": "POST /goals/:id/scope — \"ask to widen\": add module(s) to a goal's scope_modules (ADR 0086 §4 / BV1.R64). Scope is NEVER self-granted, so this is the gated approve-and-apply: requireRank('metic','archon') + the caller must be a member (or Archon), and a PROTECTED module can only be added by an Archon (mirrors the POST /goals create gate). A sub-Metic member therefore cannot widen at all — they ask a Metic+/Archon out-of-band, exactly as joining a protected goal works (R57). The goal must be open. Body: { add: [\"module-key\", ...] }; idempotent (set-union). rank: metic+archon — widens the module wall; pinned in route-rank-check.EXPECTED_RANKS.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.scope.widen` (all required).",
+        "description": "POST /goals/:id/scope — \"ask to widen\": add module(s) to a goal's scope_modules (ADR 0086 §4 / BV1.R64). Scope is NEVER self-granted, so this is the gated approve-and-apply: the goal.scope.widen permission + the caller must be the goal's owner or a manager (or Archon), and a PROTECTED module can only be added by an Archon (mirrors the POST /goals create gate). A plain member therefore cannot widen at all — they ask a Metic+/Archon out-of-band, exactly as joining a protected goal works (R57). The goal must be open. Body: { add: [\"module-key\", ...] }; idempotent (set-union). rank: metic+archon + owner|manager|Archon (task 1001739) — widens the module wall; pinned in route-rank-check.EXPECTED_RANKS.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.scope.widen` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/goals.js",
         "x-permissions": [

package/docs/module-api-changelog.md

@@ -2464,5 +2464,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.993 with no explicit bump. run 35929622479. (task 1002620)
   1.19.995 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.994 with no explicit bump. run 35933457545. (task 1002620)
+  1.19.996 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.995 with no explicit bump. run 35934673169. (task 1002620)
+  1.19.997 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.996 with no explicit bump. run 35937246865. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/render-pilot.md

@@ -0,0 +1,218 @@
+# Recipe — the Render pilot, on a throwaway `mercury` clone
+
+The executable half of [task 1004142](https://cloudbongos.com/builders#/task/1004142): stand one Bongos instance up on Render, end to end, and answer the questions [task 1004183](https://cloudbongos.com/builders#/task/1004183) (the standup leg) will be written against. Governed by [ADR 0327](../adr/0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md); platform choice from [ADR 0323](../adr/0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md).
+
+**Who runs this.** Whoever holds the Render key — under ADR 0327 that is the *project owner*, and for the pilot it is the platform owner. An agent session cannot run it unless someone has put a key in front of it, and a key must never be pasted into a chat.
+
+**The API shape below was read from Render's own reference on 2026-09-23** (`api-docs.render.com`), not inferred. Where this recipe and a live response disagree, the response wins and this file is the bug.
+
+---
+
+## 0. Before you start — three things worth knowing
+
+**The pilot costs money, and the free tier cannot prove it.** Done-when clause 4 is "its database is backed up by Render rather than by our timer". Render's **free Postgres has no backups of any kind** — no logical backups, no PITR. Only paid databases are continually backed up (3 days of recovery window on Hobby, 7 on Pro). So the pilot must run a **paid** Postgres or clause 4 is unprovable. Budget `0.1c-256mb` ($6/mo) + `0.5c-512mb` web ($7/mo), prorated for the hours the pilot is up, and tear it down when finished.
+
+**The key is account-wide, not workspace-wide.** `GET /owners` returns every workspace the key's *user* can reach, including other people's teams. This is the finding that produced ADR 0327, and step 1 exists to confirm it on live responses before anything is created.
+
+**Do not touch live `mercury`.** Row 31 is a real owner's project, serving from our box today. Clone its *repo* to a scratch repo under an account we control, and stand the clone up under a scratch slug. Nothing in this recipe writes to row 31, to `willHermesLines/mercury_bongos`, or to that owner's Render account.
+
+Set up once:
+
+```bash
+export RENDER_TOKEN=...   # in your shell, not in a file, not in chat
+export R="curl -sS -H \"Authorization: Bearer $RENDER_TOKEN\" -H 'Content-Type: application/json'"
+```
+
+Base URL is `https://api.render.com/v1`; auth is `Authorization: Bearer <key>`.
+
+---
+
+## 1. The `ownerId` guard — confirm the finding BEFORE creating anything
+
+This is the pilot's most important output, because every call the standup leg later writes depends on it.
+
+```bash
+curl -sS -H "Authorization: Bearer $RENDER_TOKEN" https://api.render.com/v1/owners | jq
+```
+
+Each element is `{ owner: { id, name, email, type }, cursor }`, where `type` is `user` or `team`.
+
+**Record:** how many workspaces come back, which are not ours, and their ids. Then pick the Bongos workspace's `id` and pin it:
+
+```bash
+export RENDER_OWNER_ID=...
+```
+
+**Then prove the hazard rather than assuming it.** List a resource *without* `ownerId` and check whether another workspace's resources appear:
+
+```bash
+curl -sS -H "Authorization: Bearer $RENDER_TOKEN" 'https://api.render.com/v1/services?limit=100' \
+  | jq '[.[].service | {id, name, ownerId}] | group_by(.ownerId) | map({ownerId: .[0].ownerId, n: length})'
+```
+
+If more than one `ownerId` comes back from a key that was only ever meant for one workspace, the finding is confirmed and the guard is mandatory. **Record the actual output either way** — a negative result is just as useful and would narrow ADR 0327's §"required guard".
+
+**The rule the standup leg must implement, whatever this shows:**
+
+- Send an explicit `ownerId` on every call. It is *required* on `POST /services` and `POST /postgres`, and it is *optional* on the list calls — which is exactly where the hazard lives.
+- Assert `ownerId` on the **response**, not the request. A request you got right tells you nothing about a response that came from elsewhere.
+- Treat missing or mismatched as a hard error. Never default it, and never derive the workspace by taking the first element of `/owners`.
+
+---
+
+## 2. Clone the repo
+
+`mercury`'s instance row carries `target_ref=willHermesLines/mercury_bongos` and `onboard_mode=adopt`. Clone it to a scratch repo you own — this is the pilot's subject and it is disposable.
+
+```bash
+git clone https://github.com/willHermesLines/mercury_bongos /tmp/mercury-clone
+cd /tmp/mercury-clone && git remote remove origin
+gh repo create <you>/render-pilot --private --source=. --push
+```
+
+**Record:** whether the repo is public or private, and under which account. That feeds the open question in step 5.
+
+---
+
+## 3. Create the Postgres
+
+```bash
+curl -sS -X POST -H "Authorization: Bearer $RENDER_TOKEN" -H 'Content-Type: application/json' \
+  https://api.render.com/v1/postgres -d '{
+    "name": "render-pilot-db",
+    "ownerId": "'"$RENDER_OWNER_ID"'",
+    "plan": "basic_256mb",
+    "region": "virginia",
+    "version": "16"
+  }' | jq
+```
+
+`plan`, `ownerId`, `name` and `version` are all required. `databaseName` and `databaseUser` are generated if omitted. **`plan` must not be `free`** — see §0. Region `virginia` is the closest US region to the current droplet (`PROVISION_REGION=nyc3`).
+
+Then read the connection string:
+
+```bash
+curl -sS -H "Authorization: Bearer $RENDER_TOKEN" \
+  https://api.render.com/v1/postgres/<postgresId>/connection-info | jq
+```
+
+Returns `password`, `internalConnectionString`, `externalConnectionString`, `psqlCommand`, and optionally the pooled variants. **Assert the `ownerId` on the create response before going further.**
+
+---
+
+## 4. Create the web service
+
+Bongos reads `DATABASE_URL` first and falls back to the `PG*` family (`src/bongos/pool.js:56`), so Render's connection string wires in directly — **none of the `PGHOST`/`PGDATABASE`/`PGUSER`/`PGPASSWORD` lines `webEnvBody` writes on the box are needed here.** That is the single biggest simplification Render buys, and it is worth stating in the standup leg's comments.
+
+The env prefix is **`BONGOS`** (`config/branding.neutral.json` → `envPrefix`). The variables below are the Render translation of `webEnvBody` in `scripts/gds/provision-units.js:192` — read that function, not this list, if the two ever disagree.
+
+```bash
+curl -sS -X POST -H "Authorization: Bearer $RENDER_TOKEN" -H 'Content-Type: application/json' \
+  https://api.render.com/v1/services -d '{
+    "type": "web_service",
+    "name": "render-pilot",
+    "ownerId": "'"$RENDER_OWNER_ID"'",
+    "repo": "https://github.com/<you>/render-pilot",
+    "branch": "main",
+    "autoDeploy": "yes",
+    "serviceDetails": {
+      "runtime": "node",
+      "plan": "0.5c-512mb",
+      "region": "virginia",
+      "healthCheckPath": "/healthz",
+      "envSpecificDetails": {
+        "buildCommand": "npm ci",
+        "startCommand": "npm start"
+      }
+    },
+    "envVars": [
+      { "key": "DATABASE_URL",            "value": "<internalConnectionString>" },
+      { "key": "BONGOS_GITHUB_CLIENT_ID", "value": "" },
+      { "key": "BONGOS_GITHUB_CLIENT_SECRET", "value": "" },
+      { "key": "BONGOS_FIRST_ADMIN",      "value": "<your-github-login>" },
+      { "key": "BONGOS_PUBLIC_ORIGIN",    "value": "https://render-pilot.onrender.com" },
+      { "key": "BONGOS_BUILDERS_ORIGIN",  "value": "https://render-pilot.onrender.com" },
+      { "key": "BONGOS_STATUS_ORIGIN",    "value": "https://render-pilot.onrender.com" },
+      { "key": "BONGOS_OAUTH_ORIGIN",     "value": "https://render-pilot.onrender.com" }
+    ]
+  }' | jq
+```
+
+Notes that matter:
+
+- **`PORT` is not set by us.** Render injects it; `webEnvBody` writes it because the box allocates ports itself. One more line the standup leg drops.
+- **The four origin overrides are load-bearing, not cosmetic.** Without them `src/branding.js` stays on neutral localhost and the hall never loads (task 1972). They must be the Render hostname, and they must all four be the same host — a single-host instance has no separate `builders.`/`status.` subdomain.
+- **`BONGOS_FIRST_ADMIN` is what seats you as Archon** on first sign-in. Omit it and the instance has no owner and you can never claim it (the 2026-07-07 `demo` regression).
+- **OAuth creds start blank** and are filled after the app exists — see step 5.
+- `PGPOOL_MAX` is read bare and still applies. On `basic_256mb` the connection ceiling is low; if the app struggles to connect, set it small (the box uses `PROVISION_INSTANCE_PGPOOL_MAX`).
+- Do **not** send a `secretFiles` entry for the GitHub App PEM until you know whether the App path is in scope for the pilot; blank OAuth is enough to prove boot.
+
+---
+
+## 5. Sign-in, and the open question the pilot exists to answer
+
+Create a GitHub OAuth app (or App) whose callback is the Render hostname, then set `BONGOS_GITHUB_CLIENT_ID` / `_SECRET` via `PATCH /services/{id}/env-vars/{key}` and redeploy.
+
+**The question ADR 0327 left for this pilot:** can Render's GitHub App reach a repo under a **personal** account rather than an org, and what does that mean for a project whose repo we do not own? Record:
+
+- Which GitHub account/org the pilot repo sits under, and whether Render's GitHub App installed onto it without friction.
+- Whether a *private* repo under someone else's personal account is reachable at all.
+- What the owner has to click, since under ADR 0327 the repo and the Render account are both theirs.
+
+This is the answer that decides whether `cloud-host` standup is one API sequence or a sequence plus a human step — and therefore how much friction `cloud-host` actually removes over `byo-host`.
+
+---
+
+## 6. Migrations
+
+Run `migrate.sh` against the Render database. Prefer a Render **job** or the service's own shell over your laptop, so the run happens from inside Render's network on the `internalConnectionString`; the `externalConnectionString` works from outside but is not what production will use.
+
+Then confirm no schema lag:
+
+```bash
+curl -sS https://render-pilot.onrender.com/version | jq
+```
+
+---
+
+## 7. Custom domain (optional for the pilot, required for the model)
+
+ADR 0323 keeps **Cloudflare DNS as the front door** and drops the Caddy site block, because Render terminates TLS. Prove the chain end to end at least once:
+
+```bash
+curl -sS -X POST -H "Authorization: Bearer $RENDER_TOKEN" -H 'Content-Type: application/json' \
+  https://api.render.com/v1/services/<serviceId>/custom-domains -d '{"name": "render-pilot.cloudbongos.com"}' | jq
+```
+
+Then point the Cloudflare record at Render and confirm the response header is **no longer `via: 1.1 Caddy`** — that header is precisely how we established the live `mercury` instance is still on our box, and its absence is the cleanest proof the front door moved.
+
+---
+
+## 8. Capture the evidence — the five done-when clauses
+
+Record each in the session log, with the actual output, not a claim that it worked:
+
+| # | Clause | Evidence |
+|---|---|---|
+| 1 | Boots | `GET /healthz` → 200, and the header does **not** say `via: 1.1 Caddy` |
+| 2 | Signs in | the OAuth round trip completes and seats you as Archon |
+| 3 | Migrations run | `migrate.sh` completes; `/version` reports no schema lag |
+| 4 | **Render backs up the DB** | a backup exists in Render's dashboard/API that we did not create — this is the clause that retires `provision-units.js`'s backup service + timer, and it needs a **paid** database |
+| 5 | GitHub App reach | written answer to §5 |
+
+Plus the three the standup leg is written from: the **exact call sequence** above with real request/response shapes, the **`ownerId` guard's live behaviour** from §1, and whether the **default plan sizes** held or mercury's larger choice was right.
+
+---
+
+## 9. Tear the clone down
+
+The pilot is disposable and it is costing money. Delete the web service, delete the Postgres, delete the scratch repo, and remove the Cloudflare record if you made one.
+
+**Note the asymmetry deliberately:** you are deleting resources in *your own* account, by hand. ADR 0327 decision 3 says the platform must never hold the ability to destroy infrastructure it does not own — `provision-teardown.js` retargets to *forgetting*, not to a Render delete call ([task 1004183](https://cloudbongos.com/builders#/task/1004183)). The fact that this step is manual is the design working, not a gap in it.
+
+---
+
+## Sources
+
+- [Render API reference](https://api-docs.render.com/reference/introduction) — endpoints, required fields, plan and region enums, read 2026-09-23
+- [Render Postgres Recovery and Backups](https://render.com/docs/postgresql-backups) — free plans have no backups; paid plans get PITR with 3-day (Hobby) / 7-day (Pro) windows

package/modules/lifecycle/routes/goal-route-authz.js

@@ -14,10 +14,23 @@ const api = require('../../../src/module-api');
 const db = require('../db');
 const { isModuleKey, scopeIncludesProtected, moduleKeys } = api.moduleScopeMap;
 const goalScopeCheck = api.goalScopeCheck;
-const { isGoalOwner, authorizeGoalManagement } = require('../goal-authz');
+const { isGoalOwner, isGoalOwnerOrManager, authorizeGoalManagement } = require('../goal-authz');
 const { versionAcceptsNewWork } = require('../db-tasks.js');
 const METIC_PLUS = ['metic', 'archon'];
 
+// isOwnerManagerOrArchon — a goal's OWN authority (task 1001739): owner (created_by),
+// manager ('lead' membership) or Archon. Gates archive / reopen / scope-widen; a plain
+// member holds none of these, and no route deletes a goal. An OWNERLESS goal
+// (created_by NULL — the migration-160 system goals) has no owner or manager to
+// ask, so any member keeps the power they had before; only Archons would otherwise
+// be left able to disposition it.
+async function isOwnerManagerOrArchon(builder, goal) {
+  if (builder.rank === 'archon') return true;
+  if (goal.created_by == null) return db.isGoalMember({ goalId: goal.id, builderId: builder.id });
+  const actorMembership = await db.getGoalMember({ goalId: goal.id, builderId: builder.id });
+  return isGoalOwnerOrManager({ goal, actorId: builder.id, actorRank: builder.rank, actorMembership });
+}
+
 async function isMemberOrArchon(builder, goalId) {
   if (builder.rank === 'archon') return true;
   return db.isGoalMember({ goalId, builderId: builder.id });
@@ -666,6 +679,7 @@ module.exports = {
   decorateGoalScope,
   goalNotOpenRefusal,
   isMemberOrArchon,
+  isOwnerManagerOrArchon,
   planGoalArchiveDispositions,
   protectedScopeAdmissionBlock,
 };

package/modules/lifecycle/routes/goals.js

@@ -73,7 +73,7 @@ const JOIN_REQUEST_RESPONSE_ACTIONS = ['approve', 'deny']; // an owner/manager/A
 // proceed; a false result means "not a member" → the route should 403. This is the
 // membership half of the wall; the protected-module rank check is enforced per-route
 // (scope is never self-granted).
-const { authorizeCreateJoinRequest, authorizeGoalCreate, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, goalNotOpenRefusal, isMemberOrArchon, planGoalArchiveDispositions, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
+const { authorizeCreateJoinRequest, authorizeGoalCreate, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, goalNotOpenRefusal, isMemberOrArchon, isOwnerManagerOrArchon, planGoalArchiveDispositions, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 module.exports = function buildGoalsRouter() {
@@ -1099,7 +1099,7 @@ module.exports = function buildGoalsRouter() {
   // POST /goals/:id/archive — retire a goal (open|achieved → archived). Archived
   // goals are re-openable (below). This is the lifecycle disposition the /goal-review
   // skill reaches for once a goal is achieved (ADR 0086 §6 / BV1.R64).
-  // rank: metic+archon — a goal member (Metic+) or an Archon dispositions the goal.
+  // rank: metic+archon + owner|manager|Archon (task 1001739); archive is reversible, so a manager may.
   router.post('/goals/:id/archive', auth.requireBuilder, auth.requirePermission('goal.archive'), async (req, res) => {
     // ADR 0118 / R12: every write route that reads a body declares it, so an
     // unknown field is REJECTED rather than silently ignored — a typo'd
@@ -1117,8 +1117,8 @@ module.exports = function buildGoalsRouter() {
     try {
       const goal = await db.getGoal(id);
       if (!goal) return res.fail('goal_not_found', 404);
-      if (!(await isMemberOrArchon(req.builder, id))) {
-        return res.fail('not_a_member', { status: 403, message: 'Join the goal (or be an Archon) to disposition it.' });
+      if (!(await isOwnerManagerOrArchon(req.builder, goal))) {
+        return res.fail('not_owner_or_manager', { status: 403, message: 'Only the goal owner or a manager (or an Archon) may archive it.' });
       }
       if (goal.status === 'archived') {
         return res.fail('already_archived', 409);
@@ -1241,8 +1241,8 @@ module.exports = function buildGoalsRouter() {
     try {
       const goal = await db.getGoal(id);
       if (!goal) return res.fail('goal_not_found', 404);
-      if (!(await isMemberOrArchon(req.builder, id))) {
-        return res.fail('not_a_member', { status: 403, message: 'Join the goal (or be an Archon) to reopen it.' });
+      if (!(await isOwnerManagerOrArchon(req.builder, goal))) {
+        return res.fail('not_owner_or_manager', { status: 403, message: 'Only the goal owner or a manager (or an Archon) may reopen it.' });
       }
       if (goal.status !== 'archived') {
         return res.fail('not_archived', 409, { status: goal.status });
@@ -1257,12 +1257,12 @@ module.exports = function buildGoalsRouter() {
 
   // POST /goals/:id/scope — "ask to widen": add module(s) to a goal's scope_modules
   // (ADR 0086 §4 / BV1.R64). Scope is NEVER self-granted, so this is the gated
-  // approve-and-apply: requireRank('metic','archon') + the caller must be a member
-  // (or Archon), and a PROTECTED module can only be added by an Archon (mirrors the
-  // POST /goals create gate). A sub-Metic member therefore cannot widen at all — they
+  // approve-and-apply: the goal.scope.widen permission + the caller must be the goal's
+  // owner or a manager (or Archon), and a PROTECTED module can only be added by an Archon (mirrors the
+  // POST /goals create gate). A plain member therefore cannot widen at all — they
   // ask a Metic+/Archon out-of-band, exactly as joining a protected goal works (R57).
   // The goal must be open. Body: { add: ["module-key", ...] }; idempotent (set-union).
-  // rank: metic+archon — widens the module wall; pinned in route-rank-check.EXPECTED_RANKS.
+  // rank: metic+archon + owner|manager|Archon (task 1001739) — widens the module wall; pinned in route-rank-check.EXPECTED_RANKS.
   router.post('/goals/:id/scope', auth.requireBuilder, auth.requirePermission('goal.scope.widen'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_goal_id' });
     if (id === null) return;
@@ -1288,8 +1288,8 @@ module.exports = function buildGoalsRouter() {
       if (goal.status !== 'open') {
         return res.fail('goal_not_open', 409, { status: goal.status });
       }
-      if (!(await isMemberOrArchon(req.builder, id))) {
-        return res.fail('not_a_member', { status: 403, message: 'Join the goal (or be an Archon) to widen its scope.' });
+      if (!(await isOwnerManagerOrArchon(req.builder, goal))) {
+        return res.fail('not_owner_or_manager', { status: 403, message: 'Only the goal owner or a manager (or an Archon) may widen its scope.' });
       }
       const updated = await db.addGoalScopeModules({ goalId: id, modules: add });
       return res.json({ ok: true, goal: updated });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.995",
+  "version": "1.19.997",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.995",
+      "version": "1.19.997",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.995",
+  "version": "1.19.997",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/prove-strict-versioning.js

@@ -216,7 +216,7 @@ async function runProbes(ctx) {
     const r = await probePost(`/goals/${target.id}/archive`, {});
     const after = (await get(`/goals/${target.id}`)).goal;
     out.push({ absent: r.status === 404, id: 'P2', rule: `R10 — bare archive of goal ${target.id} (holds ${held.get(String(target.id))})`,
-      status: r.status, refused: r.status === 409, error: r.why, mutated: after.status !== 'open' });
+      status: r.status, refused: r.status === 409 || r.status === 403, error: r.why, mutated: after.status !== 'open' });
   }
 
   // P3 — R12: a version holding open goals refuses a close with no dispositions.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.995'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.997'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_archive_disposition.mjs

@@ -109,12 +109,12 @@ test('the refusal RETURNS the tasks, so the caller can decide without a second f
 });
 
 test('the check runs AFTER identity/authorization and BEFORE the status write', () => {
-  const auth = ARCHIVE.indexOf('isMemberOrArchon');
+  const auth = ARCHIVE.indexOf('isOwnerManagerOrArchon');
   const already = ARCHIVE.indexOf("'already_archived'");
   const gate = ARCHIVE.indexOf('openTasksInGoal');
   const write = ARCHIVE.indexOf('db.setGoalStatus');
   assert.ok(auth !== -1 && already !== -1 && gate !== -1 && write !== -1, 'all four landmarks present');
-  assert.ok(auth < gate, 'a non-member must not learn what a goal is holding');
+  assert.ok(auth < gate, 'a non-owner must not learn what a goal is holding');
   assert.ok(already < gate, 're-archiving an archived goal keeps its own answer');
   assert.ok(gate < write, 'a refusal after the write is not a refusal');
 });

package/tests/goal_owner_manager_powers.mjs

@@ -0,0 +1,90 @@
+// tests/goal_owner_manager_powers.mjs — archive / reopen / scope-widen belong to a
+// goal's own authority (task 1001739): the owner (created_by), a manager (a 'lead'
+// membership) or an Archon. A plain member — who used to pass — is refused 403
+// not_owner_or_manager. Drives the REAL router with the db layer stubbed.
+//
+// Run:  node tests/goal_owner_manager_powers.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+process.env.NODE_ENV = 'test';
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const db = require('../modules/lifecycle/db.js');
+
+let WHO = { id: '10', rank: 'metic' };
+api.requireBuilder = (req, _res, next) => { req.builder = WHO; next(); };
+api.requirePermission = () => (req, _res, next) => next();
+
+const OWNER = '10', MANAGER = '11', MEMBER = '12';
+const GOALS = {
+  1: { id: 1, status: 'open', title: 'g', version_id: 'V', created_by: OWNER, scope_modules: [] },
+  3: { id: 3, status: 'open', title: 'system', version_id: 'V', created_by: null, scope_modules: [] },
+  2: { id: 2, status: 'archived', title: 'a', version_id: 'V', created_by: OWNER, scope_modules: [] },
+};
+const KINDS = { [MANAGER]: 'lead', [MEMBER]: 'member' };
+db.getGoal = async (id) => GOALS[Number(id)] ?? null;
+db.getGoalMember = async ({ builderId }) => (KINDS[builderId] ? { builder_id: builderId, membership_kind: KINDS[builderId] } : null);
+db.isGoalMember = async ({ builderId }) => !!KINDS[builderId] || builderId === OWNER;
+db.getVersion = async () => null;
+db.openTasksInGoal = async () => ({ total: 0, tasks: [] });
+db.archiveGoalWithDispositions = async ({ goalId }) => ({ goal: { ...GOALS[goalId], status: 'archived' }, applied: [] });
+db.setGoalStatus = async ({ goalId, status }) => ({ ...GOALS[goalId], status });
+db.addGoalScopeModules = async ({ goalId }) => GOALS[goalId];
+
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => {
+  res.fail = (code, o, d) => { const x = typeof o === 'number' ? { status: o } : (o || {}); return res.status(x.status || 400).json({ error: code, details: x.details ?? d }); };
+  next();
+});
+app.use('/api/gds', require('../modules/lifecycle/routes/goals.js')());
+const server = app.listen(0);
+await new Promise(r => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/gds`;
+const post = async (p, body) => {
+  const r = await fetch(base + p, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body ?? {}) });
+  return { status: r.status, body: await r.json().catch(() => null) };
+};
+const calls = [
+  ['/goals/1/archive', {}],
+  ['/goals/2/reopen', {}],
+  ['/goals/1/scope', { add: ['hall-ui'] }],
+];
+let n = 0;
+for (const [who, label, expectOk] of [
+  [{ id: OWNER, rank: 'metic' }, 'owner', true],
+  [{ id: MANAGER, rank: 'metic' }, 'manager', true],
+  [{ id: '99', rank: 'archon' }, 'archon', true],
+  [{ id: MEMBER, rank: 'metic' }, 'plain member', false],
+  [{ id: '77', rank: 'metic' }, 'non-member', false],
+]) {
+  WHO = who;
+  for (const [path, body] of calls) {
+    const r = await post(path, body);
+    if (expectOk) assert.equal(r.status, 200, `${label} ${path} → ${r.status} ${JSON.stringify(r.body)}`);
+    else { assert.equal(r.status, 403, `${label} ${path}`); assert.equal(r.body.error, 'not_owner_or_manager'); }
+    n++;
+  }
+}
+// An OWNERLESS goal (created_by NULL, the system catch-alls): a member keeps the
+// power, a non-member has none — otherwise only an Archon could ever disposition it.
+WHO = { id: MEMBER, rank: 'metic' };
+assert.equal((await post('/goals/3/archive')).status, 200); n++;
+WHO = { id: '77', rank: 'metic' };
+assert.equal((await post('/goals/3/archive')).status, 403); n++;
+
+// POST /goals creation gate: a protected-module scope is Archon-only.
+WHO = { id: OWNER, rank: 'metic' };
+let c = await post('/goals', { version_id: 'V', title: 't', scope_modules: ['kernel'] });
+assert.equal(c.status, 403); assert.equal(c.body.error, 'archon_required_for_protected_scope'); n++;
+c = await post('/goals', { version_id: 'V', title: 't', scope_modules: ['hall-ui'], admit_reason: 'because reasons' });
+assert.equal(c.body.error, 'archon_required_for_admission'); n++;
+WHO = { id: '99', rank: 'archon' };
+c = await post('/goals', { version_id: 'V', title: 't', scope_modules: ['kernel'] });
+assert.notEqual(c.body && c.body.error, 'archon_required_for_protected_scope'); n++;
+
+console.log(`${n} owner/manager/member checks passed against the real router.`);
+server.close();