@bongos/core 1.19.996 → 1.19.997

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.996",
-  "core_contract": "1.19.996",
-  "source_commit": "5929da0385a4022562ebd43a5a71d81400e45836",
+  "core_version": "1.19.997",
+  "core_contract": "1.19.997",
+  "source_commit": "e3e7048278119785fc3a9a9ca14edefba9ecae54",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T23:40:05.075Z",
+  "built_at": "2026-09-24T00:11:45.316Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 520,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2405,
+    "functional_verbatim": 2406,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2951,
-  "tree_sha256": "cd26f1916edf3136e53591dc18c37ed45254dd805880bf4b25bc1af1c59baf93",
+  "file_count": 2952,
+  "tree_sha256": "ce61953a922e8482ee9341329d06ba7a71aa4367e0449c4d9a9990de9ff82e23",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2157,7 +2157,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "8b1f2a53680ae8b68be5d54a82664413fa29186fb580825f5a1b0e3ce3677525"
+      "sha256": "734016d0505821010e06c197ea1987e3eb4e9700d45ad32d982a5b9cd9da5aed"
     },
     {
       "path": "docs/architecture.md",
@@ -2717,7 +2717,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "950ea34b2bb315e54fc02aa22753b3370ee009ab06727238002aa3a54e78782e"
+      "sha256": "1b16fcc54d5a5c01d44d93ff307eef44ddec9a993bd81db0d41db4b71f4e5654"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6087,12 +6087,12 @@
     {
       "path": "modules/lifecycle/routes/goal-route-authz.js",
       "mode": "0000644",
-      "sha256": "3b4fb0168b29fb0df1260c23c5b14d96576f00f587dd5c188fe17a712e3dffaa"
+      "sha256": "89d282e6c5110ae698484ddab698a72f27c6fe509fc97ff628326fe42e79483d"
     },
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "91039df9ca263ad34bda8e230b8e52f2099e6114a2a9eb4bae2b6b21210994c8"
+      "sha256": "8bd3b013fa96d062f15386e53f43dcdb918baf619c2beb5cf5333ef7052475f3"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -8187,12 +8187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6d4291f9e503ac170998451d6607d15f831d39cd43aaa2443ada021e10386f13"
+      "sha256": "93a81b5f6bc16e21a3ad6abd52490ccfbefe0f2d11af8dfd6273f03dd0c91ca0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "50946900cdbd241bfe7a8ac94d4b50b65a9adb622f2debdd2048354a2ead38e4"
+      "sha256": "fe2540636dec8118f88d3c037c991fb3f9f784a72edec9569ecce1f09ec4ab97"
     },
     {
       "path": "public-docs/index.html",
@@ -9127,7 +9127,7 @@
     {
       "path": "scripts/gds/prove-strict-versioning.js",
       "mode": "0000644",
-      "sha256": "b0e2c14720e8258eba4d4ef7f69cc2bcbb26c3be312deb891383dce7a1dbf71e"
+      "sha256": "65bb758becd002ae830a8338ec6ba0bc21ec5ef91ad564c85a2a94b7ab6ffbbc"
     },
     {
       "path": "scripts/gds/provision-byo-host.js",
@@ -10237,7 +10237,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "899926ec43a4f0087125deada1bf430aa5f34bd1b3f32ab65ff2ffea981431a3"
+      "sha256": "aa4d373556efe35c070f90b0ff308b302fbb9887f06cd3655d0fb9df8b157faa"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11662,7 +11662,7 @@
     {
       "path": "tests/goal_archive_disposition.mjs",
       "mode": "0000644",
-      "sha256": "bf0baad459ee2e103079a53570ca4998bb3ba66451ad0257478dd236118c8ce6"
+      "sha256": "de5b561ffe78ead5f6a1ad08066aaa2672627f441f8602fd46e1fdac453512e0"
     },
     {
       "path": "tests/goal_archive_hall.mjs",
@@ -11769,6 +11769,11 @@
       "mode": "0000644",
       "sha256": "c93422d76ff7f0107190c6de1954f110e92a18913fabbcdea2b4f67693d538e6"
     },
+    {
+      "path": "tests/goal_owner_manager_powers.mjs",
+      "mode": "0000644",
+      "sha256": "9853fe32906b842e6c78dd024e33bee5c00649ed2de2f6b593d736d0155e7832"
+    },
     {
       "path": "tests/goal_routes.mjs",
       "mode": "0000644",

package/docs/api/openapi.json

@@ -6127,7 +6127,7 @@
           "goals"
         ],
         "summary": "POST /goals/:id/archive",
-        "description": "POST /goals/:id/archive — retire a goal (open|achieved → archived). Archived goals are re-openable (below). This is the lifecycle disposition the /goal-review skill reaches for once a goal is achieved (ADR 0086 §6 / BV1.R64). rank: metic+archon — a goal member (Metic+) or an Archon dispositions the goal.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.archive` (all required).",
+        "description": "POST /goals/:id/archive — retire a goal (open|achieved → archived). Archived goals are re-openable (below). This is the lifecycle disposition the /goal-review skill reaches for once a goal is achieved (ADR 0086 §6 / BV1.R64). rank: metic+archon + owner|manager|Archon (task 1001739); archive is reversible, so a manager may.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.archive` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/goals.js",
         "x-permissions": [
@@ -7134,7 +7134,7 @@
           "goals"
         ],
         "summary": "POST /goals/:id/scope",
-        "description": "POST /goals/:id/scope — \"ask to widen\": add module(s) to a goal's scope_modules (ADR 0086 §4 / BV1.R64). Scope is NEVER self-granted, so this is the gated approve-and-apply: requireRank('metic','archon') + the caller must be a member (or Archon), and a PROTECTED module can only be added by an Archon (mirrors the POST /goals create gate). A sub-Metic member therefore cannot widen at all — they ask a Metic+/Archon out-of-band, exactly as joining a protected goal works (R57). The goal must be open. Body: { add: [\"module-key\", ...] }; idempotent (set-union). rank: metic+archon — widens the module wall; pinned in route-rank-check.EXPECTED_RANKS.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.scope.widen` (all required).",
+        "description": "POST /goals/:id/scope — \"ask to widen\": add module(s) to a goal's scope_modules (ADR 0086 §4 / BV1.R64). Scope is NEVER self-granted, so this is the gated approve-and-apply: the goal.scope.widen permission + the caller must be the goal's owner or a manager (or Archon), and a PROTECTED module can only be added by an Archon (mirrors the POST /goals create gate). A plain member therefore cannot widen at all — they ask a Metic+/Archon out-of-band, exactly as joining a protected goal works (R57). The goal must be open. Body: { add: [\"module-key\", ...] }; idempotent (set-union). rank: metic+archon + owner|manager|Archon (task 1001739) — widens the module wall; pinned in route-rank-check.EXPECTED_RANKS.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.scope.widen` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/goals.js",
         "x-permissions": [

package/docs/module-api-changelog.md

@@ -2466,5 +2466,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.994 with no explicit bump. run 35933457545. (task 1002620)
   1.19.996 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.995 with no explicit bump. run 35934673169. (task 1002620)
+  1.19.997 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.996 with no explicit bump. run 35937246865. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/routes/goal-route-authz.js

@@ -14,10 +14,23 @@ const api = require('../../../src/module-api');
 const db = require('../db');
 const { isModuleKey, scopeIncludesProtected, moduleKeys } = api.moduleScopeMap;
 const goalScopeCheck = api.goalScopeCheck;
-const { isGoalOwner, authorizeGoalManagement } = require('../goal-authz');
+const { isGoalOwner, isGoalOwnerOrManager, authorizeGoalManagement } = require('../goal-authz');
 const { versionAcceptsNewWork } = require('../db-tasks.js');
 const METIC_PLUS = ['metic', 'archon'];
 
+// isOwnerManagerOrArchon — a goal's OWN authority (task 1001739): owner (created_by),
+// manager ('lead' membership) or Archon. Gates archive / reopen / scope-widen; a plain
+// member holds none of these, and no route deletes a goal. An OWNERLESS goal
+// (created_by NULL — the migration-160 system goals) has no owner or manager to
+// ask, so any member keeps the power they had before; only Archons would otherwise
+// be left able to disposition it.
+async function isOwnerManagerOrArchon(builder, goal) {
+  if (builder.rank === 'archon') return true;
+  if (goal.created_by == null) return db.isGoalMember({ goalId: goal.id, builderId: builder.id });
+  const actorMembership = await db.getGoalMember({ goalId: goal.id, builderId: builder.id });
+  return isGoalOwnerOrManager({ goal, actorId: builder.id, actorRank: builder.rank, actorMembership });
+}
+
 async function isMemberOrArchon(builder, goalId) {
   if (builder.rank === 'archon') return true;
   return db.isGoalMember({ goalId, builderId: builder.id });
@@ -666,6 +679,7 @@ module.exports = {
   decorateGoalScope,
   goalNotOpenRefusal,
   isMemberOrArchon,
+  isOwnerManagerOrArchon,
   planGoalArchiveDispositions,
   protectedScopeAdmissionBlock,
 };

package/modules/lifecycle/routes/goals.js

@@ -73,7 +73,7 @@ const JOIN_REQUEST_RESPONSE_ACTIONS = ['approve', 'deny']; // an owner/manager/A
 // proceed; a false result means "not a member" → the route should 403. This is the
 // membership half of the wall; the protected-module rank check is enforced per-route
 // (scope is never self-granted).
-const { authorizeCreateJoinRequest, authorizeGoalCreate, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, goalNotOpenRefusal, isMemberOrArchon, planGoalArchiveDispositions, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
+const { authorizeCreateJoinRequest, authorizeGoalCreate, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, goalNotOpenRefusal, isMemberOrArchon, isOwnerManagerOrArchon, planGoalArchiveDispositions, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 module.exports = function buildGoalsRouter() {
@@ -1099,7 +1099,7 @@ module.exports = function buildGoalsRouter() {
   // POST /goals/:id/archive — retire a goal (open|achieved → archived). Archived
   // goals are re-openable (below). This is the lifecycle disposition the /goal-review
   // skill reaches for once a goal is achieved (ADR 0086 §6 / BV1.R64).
-  // rank: metic+archon — a goal member (Metic+) or an Archon dispositions the goal.
+  // rank: metic+archon + owner|manager|Archon (task 1001739); archive is reversible, so a manager may.
   router.post('/goals/:id/archive', auth.requireBuilder, auth.requirePermission('goal.archive'), async (req, res) => {
     // ADR 0118 / R12: every write route that reads a body declares it, so an
     // unknown field is REJECTED rather than silently ignored — a typo'd
@@ -1117,8 +1117,8 @@ module.exports = function buildGoalsRouter() {
     try {
       const goal = await db.getGoal(id);
       if (!goal) return res.fail('goal_not_found', 404);
-      if (!(await isMemberOrArchon(req.builder, id))) {
-        return res.fail('not_a_member', { status: 403, message: 'Join the goal (or be an Archon) to disposition it.' });
+      if (!(await isOwnerManagerOrArchon(req.builder, goal))) {
+        return res.fail('not_owner_or_manager', { status: 403, message: 'Only the goal owner or a manager (or an Archon) may archive it.' });
       }
       if (goal.status === 'archived') {
         return res.fail('already_archived', 409);
@@ -1241,8 +1241,8 @@ module.exports = function buildGoalsRouter() {
     try {
       const goal = await db.getGoal(id);
       if (!goal) return res.fail('goal_not_found', 404);
-      if (!(await isMemberOrArchon(req.builder, id))) {
-        return res.fail('not_a_member', { status: 403, message: 'Join the goal (or be an Archon) to reopen it.' });
+      if (!(await isOwnerManagerOrArchon(req.builder, goal))) {
+        return res.fail('not_owner_or_manager', { status: 403, message: 'Only the goal owner or a manager (or an Archon) may reopen it.' });
       }
       if (goal.status !== 'archived') {
         return res.fail('not_archived', 409, { status: goal.status });
@@ -1257,12 +1257,12 @@ module.exports = function buildGoalsRouter() {
 
   // POST /goals/:id/scope — "ask to widen": add module(s) to a goal's scope_modules
   // (ADR 0086 §4 / BV1.R64). Scope is NEVER self-granted, so this is the gated
-  // approve-and-apply: requireRank('metic','archon') + the caller must be a member
-  // (or Archon), and a PROTECTED module can only be added by an Archon (mirrors the
-  // POST /goals create gate). A sub-Metic member therefore cannot widen at all — they
+  // approve-and-apply: the goal.scope.widen permission + the caller must be the goal's
+  // owner or a manager (or Archon), and a PROTECTED module can only be added by an Archon (mirrors the
+  // POST /goals create gate). A plain member therefore cannot widen at all — they
   // ask a Metic+/Archon out-of-band, exactly as joining a protected goal works (R57).
   // The goal must be open. Body: { add: ["module-key", ...] }; idempotent (set-union).
-  // rank: metic+archon — widens the module wall; pinned in route-rank-check.EXPECTED_RANKS.
+  // rank: metic+archon + owner|manager|Archon (task 1001739) — widens the module wall; pinned in route-rank-check.EXPECTED_RANKS.
   router.post('/goals/:id/scope', auth.requireBuilder, auth.requirePermission('goal.scope.widen'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_goal_id' });
     if (id === null) return;
@@ -1288,8 +1288,8 @@ module.exports = function buildGoalsRouter() {
       if (goal.status !== 'open') {
         return res.fail('goal_not_open', 409, { status: goal.status });
       }
-      if (!(await isMemberOrArchon(req.builder, id))) {
-        return res.fail('not_a_member', { status: 403, message: 'Join the goal (or be an Archon) to widen its scope.' });
+      if (!(await isOwnerManagerOrArchon(req.builder, goal))) {
+        return res.fail('not_owner_or_manager', { status: 403, message: 'Only the goal owner or a manager (or an Archon) may widen its scope.' });
       }
       const updated = await db.addGoalScopeModules({ goalId: id, modules: add });
       return res.json({ ok: true, goal: updated });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.996",
+  "version": "1.19.997",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.996",
+      "version": "1.19.997",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.996",
+  "version": "1.19.997",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/prove-strict-versioning.js

@@ -216,7 +216,7 @@ async function runProbes(ctx) {
     const r = await probePost(`/goals/${target.id}/archive`, {});
     const after = (await get(`/goals/${target.id}`)).goal;
     out.push({ absent: r.status === 404, id: 'P2', rule: `R10 — bare archive of goal ${target.id} (holds ${held.get(String(target.id))})`,
-      status: r.status, refused: r.status === 409, error: r.why, mutated: after.status !== 'open' });
+      status: r.status, refused: r.status === 409 || r.status === 403, error: r.why, mutated: after.status !== 'open' });
   }
 
   // P3 — R12: a version holding open goals refuses a close with no dispositions.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.996'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.997'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_archive_disposition.mjs

@@ -109,12 +109,12 @@ test('the refusal RETURNS the tasks, so the caller can decide without a second f
 });
 
 test('the check runs AFTER identity/authorization and BEFORE the status write', () => {
-  const auth = ARCHIVE.indexOf('isMemberOrArchon');
+  const auth = ARCHIVE.indexOf('isOwnerManagerOrArchon');
   const already = ARCHIVE.indexOf("'already_archived'");
   const gate = ARCHIVE.indexOf('openTasksInGoal');
   const write = ARCHIVE.indexOf('db.setGoalStatus');
   assert.ok(auth !== -1 && already !== -1 && gate !== -1 && write !== -1, 'all four landmarks present');
-  assert.ok(auth < gate, 'a non-member must not learn what a goal is holding');
+  assert.ok(auth < gate, 'a non-owner must not learn what a goal is holding');
   assert.ok(already < gate, 're-archiving an archived goal keeps its own answer');
   assert.ok(gate < write, 'a refusal after the write is not a refusal');
 });

package/tests/goal_owner_manager_powers.mjs

@@ -0,0 +1,90 @@
+// tests/goal_owner_manager_powers.mjs — archive / reopen / scope-widen belong to a
+// goal's own authority (task 1001739): the owner (created_by), a manager (a 'lead'
+// membership) or an Archon. A plain member — who used to pass — is refused 403
+// not_owner_or_manager. Drives the REAL router with the db layer stubbed.
+//
+// Run:  node tests/goal_owner_manager_powers.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+process.env.NODE_ENV = 'test';
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const db = require('../modules/lifecycle/db.js');
+
+let WHO = { id: '10', rank: 'metic' };
+api.requireBuilder = (req, _res, next) => { req.builder = WHO; next(); };
+api.requirePermission = () => (req, _res, next) => next();
+
+const OWNER = '10', MANAGER = '11', MEMBER = '12';
+const GOALS = {
+  1: { id: 1, status: 'open', title: 'g', version_id: 'V', created_by: OWNER, scope_modules: [] },
+  3: { id: 3, status: 'open', title: 'system', version_id: 'V', created_by: null, scope_modules: [] },
+  2: { id: 2, status: 'archived', title: 'a', version_id: 'V', created_by: OWNER, scope_modules: [] },
+};
+const KINDS = { [MANAGER]: 'lead', [MEMBER]: 'member' };
+db.getGoal = async (id) => GOALS[Number(id)] ?? null;
+db.getGoalMember = async ({ builderId }) => (KINDS[builderId] ? { builder_id: builderId, membership_kind: KINDS[builderId] } : null);
+db.isGoalMember = async ({ builderId }) => !!KINDS[builderId] || builderId === OWNER;
+db.getVersion = async () => null;
+db.openTasksInGoal = async () => ({ total: 0, tasks: [] });
+db.archiveGoalWithDispositions = async ({ goalId }) => ({ goal: { ...GOALS[goalId], status: 'archived' }, applied: [] });
+db.setGoalStatus = async ({ goalId, status }) => ({ ...GOALS[goalId], status });
+db.addGoalScopeModules = async ({ goalId }) => GOALS[goalId];
+
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => {
+  res.fail = (code, o, d) => { const x = typeof o === 'number' ? { status: o } : (o || {}); return res.status(x.status || 400).json({ error: code, details: x.details ?? d }); };
+  next();
+});
+app.use('/api/gds', require('../modules/lifecycle/routes/goals.js')());
+const server = app.listen(0);
+await new Promise(r => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/gds`;
+const post = async (p, body) => {
+  const r = await fetch(base + p, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body ?? {}) });
+  return { status: r.status, body: await r.json().catch(() => null) };
+};
+const calls = [
+  ['/goals/1/archive', {}],
+  ['/goals/2/reopen', {}],
+  ['/goals/1/scope', { add: ['hall-ui'] }],
+];
+let n = 0;
+for (const [who, label, expectOk] of [
+  [{ id: OWNER, rank: 'metic' }, 'owner', true],
+  [{ id: MANAGER, rank: 'metic' }, 'manager', true],
+  [{ id: '99', rank: 'archon' }, 'archon', true],
+  [{ id: MEMBER, rank: 'metic' }, 'plain member', false],
+  [{ id: '77', rank: 'metic' }, 'non-member', false],
+]) {
+  WHO = who;
+  for (const [path, body] of calls) {
+    const r = await post(path, body);
+    if (expectOk) assert.equal(r.status, 200, `${label} ${path} → ${r.status} ${JSON.stringify(r.body)}`);
+    else { assert.equal(r.status, 403, `${label} ${path}`); assert.equal(r.body.error, 'not_owner_or_manager'); }
+    n++;
+  }
+}
+// An OWNERLESS goal (created_by NULL, the system catch-alls): a member keeps the
+// power, a non-member has none — otherwise only an Archon could ever disposition it.
+WHO = { id: MEMBER, rank: 'metic' };
+assert.equal((await post('/goals/3/archive')).status, 200); n++;
+WHO = { id: '77', rank: 'metic' };
+assert.equal((await post('/goals/3/archive')).status, 403); n++;
+
+// POST /goals creation gate: a protected-module scope is Archon-only.
+WHO = { id: OWNER, rank: 'metic' };
+let c = await post('/goals', { version_id: 'V', title: 't', scope_modules: ['kernel'] });
+assert.equal(c.status, 403); assert.equal(c.body.error, 'archon_required_for_protected_scope'); n++;
+c = await post('/goals', { version_id: 'V', title: 't', scope_modules: ['hall-ui'], admit_reason: 'because reasons' });
+assert.equal(c.body.error, 'archon_required_for_admission'); n++;
+WHO = { id: '99', rank: 'archon' };
+c = await post('/goals', { version_id: 'V', title: 't', scope_modules: ['kernel'] });
+assert.notEqual(c.body && c.body.error, 'archon_required_for_protected_scope'); n++;
+
+console.log(`${n} owner/manager/member checks passed against the real router.`);
+server.close();