@bongos/core 1.20.64 → 1.20.66

package/modules/lifecycle/goal-move.js

@@ -0,0 +1,182 @@
+'use strict';
+
+// modules/lifecycle/goal-move.js — move a goal, with everything it holds, to
+// another version (task 1004485).
+//
+// WHY. A goal's version was write-once. PATCH /goals/:id edits prose, never
+// version_id, and PATCH /tasks/:id refuses `goal_version_mismatch` — so the only
+// way to re-home a goal that did not make its version (the 2026-10-01 case:
+// goals 1000122 and 1000123 deferred from BONGOS-V2 to BONGOS-V3) was to recreate
+// it and its tasks under new ids, or a hand-written prod UPDATE.
+//
+// THE GOAL MOVES WHOLE. The goal row, every done-when criterion parented to it,
+// and every task in it — terminal ones included — change version in ONE
+// transaction. Two half-moves are the failure shapes this exists to avoid:
+//   • tasks left behind would sit in a goal of another version, which PATCH
+//     /tasks/:id refuses for exactly that reason (a task joins a goal in its own
+//     version only);
+//   • a task moved by goal_id but not version_id is the carryBugsForward lesson
+//     (db-goals.js, BV1.R18c): `version_progress` joins on tasks.version_id, so a
+//     half-moved task keeps counting against the version it left.
+//
+// WHAT IS REFUSED, and why:
+//   • a maintenance goal — only carryBugsForward moves those, at version close;
+//   • a goal that is not open — achieved/archived goals are history;
+//   • a goal on a SHIPPED version — moving it would rewrite closed scope-truth;
+//   • the same version — a no-op dressed as a write;
+//   • a target that would refuse a new goal — the SAME gate POST /goals uses
+//     (authorizeGoalCreate), so "may this version take this goal" has one answer.
+//     A building target therefore needs the Archon `admit_reason` override, and
+//     the admission is recorded exactly as a create's is;
+//   • a criterion link that crosses the goal's edge (a task inside linked to a
+//     criterion outside, or the reverse) — after the move it would join two
+//     versions, and /status would count it against the wrong one. The caller
+//     unlinks it first; the refusal names every pair.
+// An ACTIVE CLAIM is not a refusal: re-pointing the version takes no work from
+// anyone (the claim references the task, untouched) — carryBugsForward's
+// reasoning, for the same act.
+//
+// Lives in its own file because routes/goals.js sits at the fitness oversize
+// line (1,500) and db-goals.js near it; a move is a cohesive slice, the
+// goal-edits.js precedent.
+
+const api = require('../../src/module-api');
+const { executorFor } = require('./db-executor.js');
+const { authorizeGoalCreate } = require('./routes/goal-route-authz.js');
+const { pool } = api;
+
+// authorizeGoalMove — PURE, FAIL-CLOSED. May this goal move to this version?
+// The route gathers the facts; this decides; the route renders the verdict.
+function authorizeGoalMove({ goal, source, target, admitReason = null }) {
+  if (!goal) {
+    return { ok: false, status: 404, body: { error: 'goal_not_found', message: 'No such goal.' } };
+  }
+  if (goal.is_maintenance) {
+    return { ok: false, status: 409, body: {
+      error: 'maintenance_goal',
+      message: `Goal #${goal.id} is its version's maintenance goal — it moves only with the version close (carry-forward), never by hand.`,
+    } };
+  }
+  if (goal.status !== 'open') {
+    return { ok: false, status: 409, body: {
+      error: 'goal_not_open', goal_status: goal.status,
+      message: `Goal #${goal.id} is '${goal.status}' — only an open goal can move to another version.`,
+    } };
+  }
+  if (source && source.status === 'shipped') {
+    return { ok: false, status: 409, body: {
+      error: 'source_version_shipped',
+      message: `Goal #${goal.id} belongs to '${source.id}', which has shipped — its goals are closed history.`,
+    } };
+  }
+  if (target && String(target.id) === String(goal.version_id)) {
+    return { ok: false, status: 409, body: {
+      error: 'same_version', message: `Goal #${goal.id} is already on '${target.id}'.`,
+    } };
+  }
+  const decision = authorizeGoalCreate({ version: target, override: admitReason !== null });
+  if (!decision.ok) return decision;
+  return { ok: true, overrideApplied: decision.overrideApplied };
+}
+
+// moveGoalToVersion — the write, in ONE transaction. Returns
+// { fromVersionId, toVersionId, taskIds, criterionIds }. Throws a coded error the
+// route translates:
+//   GOAL_NOT_FOUND, GOAL_CHANGED (status/version moved since the route checked),
+//   TARGET_CHANGED (the target's status moved since the route checked),
+//   CRITERION_LINKS_CROSS_GOAL (with .links), CRITERION_ID_COLLISION (a criterion
+//   slug the target version already uses — UNIQUE (version_id, criterion_id)).
+async function moveGoalToVersion({ goalId, fromVersionId, toVersionId, targetStatus, admission = null }, deps = {}) {
+  const client = await executorFor(deps, pool).connect();
+  try {
+    await client.query('BEGIN');
+
+    const { rows: g } = await client.query(
+      `SELECT id, version_id, status FROM goals WHERE id = $1 FOR UPDATE`, [goalId]
+    );
+    if (!g[0]) throw Object.assign(new Error('goal not found'), { code: 'GOAL_NOT_FOUND' });
+    if (String(g[0].version_id) !== String(fromVersionId) || g[0].status !== 'open') {
+      throw Object.assign(new Error('goal changed'), { code: 'GOAL_CHANGED' });
+    }
+    // The target's status was what the gate judged; a close or promotion in
+    // between would let a goal into a version that now refuses it.
+    const { rows: v } = await client.query(
+      `SELECT status FROM versions WHERE id = $1 FOR SHARE`, [toVersionId]
+    );
+    if (!v[0] || v[0].status !== targetStatus) {
+      throw Object.assign(new Error('target changed'), { code: 'TARGET_CHANGED' });
+    }
+
+    // Exactly one side of the link inside this goal = the link crosses its edge.
+    const { rows: links } = await client.query(
+      `SELECT tc.task_id::text AS task_id, tc.criterion_id::text AS criterion_id
+         FROM task_criteria tc
+         JOIN tasks t ON t.id = tc.task_id
+         JOIN done_when_criteria c ON c.id = tc.criterion_id
+        WHERE (t.goal_id IS NOT DISTINCT FROM $1) <> (c.goal_id IS NOT DISTINCT FROM $1)
+          AND (t.goal_id = $1 OR c.goal_id = $1)
+        ORDER BY tc.task_id, tc.criterion_id
+        LIMIT 50`,
+      [goalId]
+    );
+    if (links.length > 0) {
+      throw Object.assign(new Error('criterion links cross the goal'), { code: 'CRITERION_LINKS_CROSS_GOAL', links });
+    }
+
+    // Appended to the end of the target's goal order rather than keeping a
+    // sort_order that meant something only among the old version's goals.
+    await client.query(
+      `UPDATE goals
+          SET version_id = $2,
+              sort_order = (SELECT COALESCE(MAX(sort_order), 0) + 10 FROM goals WHERE version_id = $2),
+              updated_at = now()
+        WHERE id = $1`,
+      [goalId, toVersionId]
+    );
+    let criterionIds;
+    try {
+      const { rows } = await client.query(
+        `UPDATE done_when_criteria SET version_id = $2 WHERE goal_id = $1 RETURNING id::text`,
+        [goalId, toVersionId]
+      );
+      criterionIds = rows.map((r) => r.id);
+    } catch (err) {
+      if (err && err.code === '23505') {
+        throw Object.assign(new Error('criterion id collision'), { code: 'CRITERION_ID_COLLISION' });
+      }
+      throw err;
+    }
+    const { rows: tasks } = await client.query(
+      `UPDATE tasks SET version_id = $2, updated_at = now() WHERE goal_id = $1 RETURNING id::text`,
+      [goalId, toVersionId]
+    );
+    // A building target was opened by the Archon override: recorded like a
+    // create's admission. goal_id is the table's key, so a goal admitted before
+    // carries its LATEST admission — the one that explains where it is now.
+    if (admission) {
+      await client.query(
+        `INSERT INTO lifecycle_goal_version_admissions (goal_id, version_id, admitted_by, reason)
+         VALUES ($1, $2, $3, $4)
+         ON CONFLICT (goal_id) DO UPDATE
+           SET version_id = EXCLUDED.version_id, admitted_by = EXCLUDED.admitted_by,
+               reason = EXCLUDED.reason, created_at = now()`,
+        [goalId, toVersionId, admission.admittedBy, admission.reason]
+      );
+    }
+
+    await client.query('COMMIT');
+    return {
+      fromVersionId: String(fromVersionId),
+      toVersionId: String(toVersionId),
+      taskIds: tasks.map((r) => r.id).sort((a, b) => Number(a) - Number(b)),
+      criterionIds: criterionIds.sort((a, b) => Number(a) - Number(b)),
+    };
+  } catch (err) {
+    await client.query('ROLLBACK').catch(() => {});
+    throw err;
+  } finally {
+    if (typeof client.release === 'function') client.release();
+  }
+}
+
+module.exports = { authorizeGoalMove, moveGoalToVersion };

package/modules/lifecycle/module.json

@@ -16,6 +16,7 @@
       "done-when",
       "criterion-uat",
       "goals",
+      "goal-move",
       "dependencies",
       "gate-approvals",
       "analytics",

package/modules/lifecycle/routes/goal-move.js

@@ -0,0 +1,92 @@
+'use strict';
+
+// modules/lifecycle/routes/goal-move.js — POST /goals/:id/move (task 1004485).
+//
+// Moves an open goal — its criteria and every task in it — to another version.
+// The rules and the write live in ../goal-move.js; this file is the doorway and
+// must never grow a query (the rot.js precedent).
+//
+// GATE: `version.create` (Archon floor). Re-homing a goal changes the scope of
+// TWO versions at once, which is the same authority as authoring a version's
+// scope in the first place — so it reuses that atom rather than minting a new
+// one, and adds no new authority to the system. Pinned in route-rank-check.
+//
+// Body: { version_id, admit_reason? } — `admit_reason` is the Archon override
+// that lets a goal into a version that is already building (the POST /goals R07
+// admission); on a planning target it is accepted and changes nothing.
+//
+// MODULE BOUNDARY: reaches core only through `../../../src/module-api`.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const db = require('../db');
+const goalMove = require('../goal-move');
+const { validateOrRespond, parseId } = api;
+
+const log = api.logger('lifecycle');
+
+module.exports = function buildGoalMoveRouter() {
+  const router = express.Router();
+
+  // rank: archon (perm:version.create) — re-homes a goal and its tasks across versions.
+  router.post('/goals/:id/move', api.requireBuilder, api.requirePermission('version.create'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      version_id: { required: true, type: 'string', minLength: 1, maxLength: 64 },
+      admit_reason: { type: 'string', maxLength: 2000 },
+    })) return;
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    const admitReason = (req.body.admit_reason || '').trim() || null;
+    try {
+      const goal = await db.getGoal(id);
+      const [source, target] = goal
+        ? await Promise.all([db.getVersion(goal.version_id), db.getVersion(req.body.version_id)])
+        : [null, null];
+      const decision = goalMove.authorizeGoalMove({ goal, source, target, admitReason });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+
+      const moved = await goalMove.moveGoalToVersion({
+        goalId: id,
+        fromVersionId: goal.version_id,
+        toVersionId: target.id,
+        targetStatus: target.status,
+        admission: decision.overrideApplied ? { admittedBy: req.builder.id, reason: admitReason } : null,
+      });
+      const updated = await db.getGoal(id);
+      return res.json({
+        ok: true,
+        goal: updated,
+        from_version_id: moved.fromVersionId,
+        to_version_id: moved.toVersionId,
+        moved_task_ids: moved.taskIds,
+        moved_criterion_ids: moved.criterionIds,
+        admitted: decision.overrideApplied,
+      });
+    } catch (err) {
+      if (err && err.code === 'CRITERION_LINKS_CROSS_GOAL') {
+        return res.fail('criterion_links_cross_goal', {
+          status: 409,
+          message: `Goal #${id} has criterion links that cross its edge — after the move they would join two versions. Unlink them (DELETE /tasks/:id/criteria/:criterionId) or move the task into the goal first. Nothing was changed.`,
+          details: { links: err.links },
+        });
+      }
+      if (err && err.code === 'CRITERION_ID_COLLISION') {
+        return res.fail('criterion_id_collision', {
+          status: 409,
+          message: `A criterion on goal #${id} uses a criterion_id the target version already has. Rename one of them first. Nothing was changed.`,
+        });
+      }
+      if (err && (err.code === 'GOAL_CHANGED' || err.code === 'TARGET_CHANGED')) {
+        return res.fail('changed_during_move', {
+          status: 409,
+          message: 'The goal or the target version changed while the move was running — nothing was changed. Re-read and retry.',
+        });
+      }
+      if (err && err.code === 'GOAL_NOT_FOUND') return res.fail('goal_not_found', 404);
+      log.error(`POST /goals/:id/move: ${err && err.message}`);
+      return res.fail('move_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/npm-release/preview/env.js

@@ -13,6 +13,8 @@
 // is pointed at an empty scratch directory so a config file in the real home (the
 // Discord webhook file among them) is not found.
 
+const os = require('node:os');
+
 // The only names carried over from the live process.
 //   PATH            so node, and the child's own tooling, resolve
 //   NODE_ENV        production behaviour, as the live hall runs it
@@ -61,9 +63,10 @@ const MODULES_OFF = Object.freeze(PREFIXES.flatMap((pfx) => MODULE_KEYS.map((k)
  * @param {string} [o.envPrefix]   the env prefix of the copied instance's branding pack, if any
  * @param {string} [o.instanceRoot]  the scratch directory shaped like an instance root (config/,
  *                                   migrations/instance/); the child reads its host content from it
+ * @param {Function} [o.osUser]    () => the OS login name; PGUSER when none is carried
  * @returns {Record<string,string>} a fresh object, never `env` itself
  */
-function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, envPrefix } = {}) {
+function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, envPrefix, osUser = () => os.userInfo().username } = {}) {
   if (!port) throw new TypeError('buildPreviewEnv: port is required');
   if (!scratchHome) throw new TypeError('buildPreviewEnv: scratchHome is required');
   const out = {};
@@ -71,6 +74,12 @@ function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, e
     if (env[name] !== undefined && env[name] !== '') out[name] = String(env[name]);
   }
   if (!out.NODE_ENV) out.NODE_ENV = 'production';
+  // THE LOGIN NAME IS STATED (task 1004388). With no PGUSER the database driver takes it from
+  // USER, which an environment built from nothing does not have, and every query fails with
+  // "no PostgreSQL user name specified". The OS user is exactly who peer auth checks.
+  if (!out.PGUSER) {
+    try { const u = osUser(); if (u) out.PGUSER = String(u); } catch { /* left unset: the driver's own default */ }
+  }
   out.PORT = String(port);
   out.HOST = '127.0.0.1';
   out.HOME = scratchHome;

package/modules/npm-release/preview/supervisor.js

@@ -217,6 +217,10 @@ function createSupervisor({
       await step('create-copy', cmds.createDbCommand());
       await step('dump', cmds.dumpCommand({ liveDb, dumpFile }));
       await step('restore', cmds.restoreCommand({ dumpFile }));
+      // The dump is a full copy of the live database, sessions included, and is not needed
+      // once restored. A restart of the live service cannot finish the stop that would have
+      // removed it, so it goes now (task 1004388).
+      try { fsImpl.rmSync(dumpFile, { force: true }); } catch { /* the stop's cleanup still removes workDir */ }
       await step('migrate', cmds.migrateCommand({ cacheRoot, version, env: childEnv, instanceDir }));
 
       set({ stage: 'launch' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.64",
+  "version": "1.20.66",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.64",
+      "version": "1.20.66",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.64",
+  "version": "1.20.66",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8513,5 +8513,17 @@
       "id": "1004390",
       "text": "When someone adds a prerequisite to a job that was already waiting in the \"available work\" list, the job used to stay on that list — a builder would pick it up, and only then be told they couldn't start it yet. The listing was"
     }
+  ],
+  "1.20.65": [
+    {
+      "id": "1004486",
+      "text": "Previewing an older version from the deploy page now works on the real server: the preview could not log in to its copy of the database, so every page in it failed. It also no longer leaves a full copy of the live database lyi"
+    }
+  ],
+  "1.20.66": [
+    {
+      "id": "1004485",
+      "text": "Goals can now be moved from one version to another, taking their tasks and done-when criteria with them and keeping every task number. Used first to move the two goals that did not make V2 into V3."
+    }
   ]
 }

package/scripts/gds/goal.js

@@ -4,8 +4,11 @@
 // Usage:
 //   node scripts/gds/goal.js list [--version V] [--status open|achieved|archived|all]
 //   node scripts/gds/goal.js show <id>
+//   node scripts/gds/goal.js move <id> --to <version> [--admit-reason "..."]
 //
-// Read-only. Default list filter is --status open.
+// list/show are read-only; default list filter is --status open. `move` re-homes an
+// open goal — its criteria and every task in it — on another version (Archon;
+// POST /goals/:id/move, task 1004485).
 
 const { cliClient, requireSession, arg } = require('./cli-lib');
 
@@ -16,6 +19,7 @@ const LIST_STATUSES = ['open', 'achieved', 'archived', 'all'];
 function usageExit() {
   console.error('usage: node scripts/gds/goal.js list [--version V] [--status open|achieved|archived|all]');
   console.error('       node scripts/gds/goal.js show <id>');
+  console.error('       node scripts/gds/goal.js move <id> --to <version> [--admit-reason "..."]');
   process.exit(2);
 }
 
@@ -208,6 +212,38 @@ async function printTaskBuckets(api, tasks) {
   }
 }
 
+// parseMoveArgs — the argv after `move`: `<id> --to <version> [--admit-reason "..."]`.
+// Returns { id, body } or null (usage error). Pure, so the CLI's own validation
+// is tested rather than trusted (task 1004485).
+function parseMoveArgs(args) {
+  const id = args[0];
+  if (!/^\d+$/.test(id || '')) return null;
+  const rest = args.slice(1);
+  const to = arg('--to', rest);
+  if (!to || !/^[\w.-]+$/.test(to)) return null;
+  const body = { version_id: to };
+  const reason = arg('--admit-reason', rest);
+  if (reason) body.admit_reason = reason;
+  return { id: Number(id), body };
+}
+
+async function move(api, args) {
+  const parsed = parseMoveArgs(args);
+  if (!parsed) usageExit();
+  const { id, body } = parsed;
+  const r = await api.goals.postGoalsIdMove({ id, body });
+  if (!r.ok) {
+    console.error(`move refused (${r.status}):`, (r.data && (r.data.message || r.data.error)) || JSON.stringify(r.data));
+    if (r.data && r.data.details && r.data.details.links) console.error('  crossing links:', JSON.stringify(r.data.details.links));
+    process.exitCode = 1;
+    return;
+  }
+  const d = r.data;
+  console.log(`Goal #${d.goal.id} "${d.goal.title}" moved ${d.from_version_id} → ${d.to_version_id}${d.admitted ? ' (admitted into a building version)' : ''}.`);
+  console.log(`  tasks moved: ${d.moved_task_ids.length}${d.moved_task_ids.length ? ' (' + d.moved_task_ids.join(', ') + ')' : ''}`);
+  console.log(`  criteria moved: ${d.moved_criterion_ids.length}`);
+}
+
 async function main() {
   await requireSession();
   const args = process.argv.slice(2);
@@ -219,6 +255,8 @@ async function main() {
   } else if (cmd === 'show') {
     if (!/^\d+$/.test(args[1] || '')) usageExit();
     await show(api, Number(args[1]));
+  } else if (cmd === 'move') {
+    await move(api, args.slice(1));
   } else {
     usageExit();
   }
@@ -231,4 +269,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { rollup, criterionGlyph, criterionState, bucketTasks, liveTasks };
+module.exports = { rollup, criterionGlyph, criterionState, bucketTasks, liveTasks, parseMoveArgs };

package/src/bongos/route-rank-check.js

@@ -346,6 +346,9 @@ const MODULE_EXPECTED_RANKS = {
     // builder archive/resurrect a shared workspace out from under its members.
     'POST /goals/:id/archive': 'metic+archon',
     'POST /goals/:id/reopen': 'metic+archon',
+    // goal re-home across versions (task 1004485) — changes two versions' scope at
+    // once, so it carries the version-authoring atom (Archon floor), not a goal one.
+    'POST /goals/:id/move': 'perm:version.create',
     // The bounded task-authoring KEYSTONE + self-service membership (ADR 0086 §3,
     // BV1.R60/R61). These are DELIBERATELY 'any-builder': the wall is the IN-HANDLER
     // scope/protected/rank-floor gate (authorizeGoalTaskCreate + goal-scope-check),

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.64'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.66'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');