@bongos/core 1.20.82 → 1.21.1

package/modules/sessions/db.js

@@ -658,6 +658,62 @@ async function getSessionById(id) {
   return rows[0] || null;
 }
 
+const TRANSCRIPT_PAGE_DEFAULT = 500; // turns per read; the reader pages with offset=
+const TRANSCRIPT_PAGE_MAX = 2000;
+
+// upsertSessionTranscript — store/refresh one session's FULL scrubbed transcript
+// (ADR 0051, task 1001004). Keyed on session_id like session_records, and the same
+// ownership guard applies: a row can only be rewritten by the builder who owns it,
+// so guessing another builder's session_id cannot overwrite their transcript. The
+// content arrives already scrubbed (the uploader's box is the scrub point); this
+// layer stores it and never inspects it. `turnsJson` is the ALREADY-serialized
+// array (the route serializes once to measure it; re-stringifying 12 MB here would
+// block the event loop a second time). The row is only ever created FROM the
+// caller's own session_records row, so a transcript cannot exist for a session the
+// builder did not upload a digest for (and a stranger cannot squat a session_id
+// ahead of its owner). Returns { session_id, turn_count, byte_size, truncated } or
+// null when there is no such owned session.
+async function upsertSessionTranscript({ sessionId, builderId, turnsJson, turnCount = 0, truncated = false, byteSize = 0 }) {
+  const { rows } = await pool.query(
+    `INSERT INTO session_transcripts (session_id, builder_id, turn_count, byte_size, truncated, turns)
+     SELECT sr.session_id, sr.builder_id, $3, $4, $5, $6::jsonb
+       FROM session_records sr
+      WHERE sr.session_id = $1 AND sr.builder_id = $2
+     ON CONFLICT (session_id) DO UPDATE SET
+       turn_count  = EXCLUDED.turn_count,
+       byte_size   = EXCLUDED.byte_size,
+       truncated   = EXCLUDED.truncated,
+       turns       = EXCLUDED.turns,
+       uploaded_at = now()
+     WHERE session_transcripts.builder_id = EXCLUDED.builder_id
+     RETURNING session_id, turn_count, byte_size, truncated`,
+    [sessionId, builderId, Math.max(0, Math.trunc(Number(turnCount) || 0)), Math.max(0, Math.trunc(Number(byteSize) || 0)), !!truncated, turnsJson]
+  );
+  return rows[0] || null;
+}
+
+// getSessionTranscript — one PAGE of the full transcript for one session_records row (by its
+// numeric id, the same id /sessions/:id uses), with the owner so the route can
+// apply the own-vs-Archon rule. null when the session or its transcript is absent.
+async function getSessionTranscript(id, { offset = 0, limit = TRANSCRIPT_PAGE_DEFAULT } = {}) {
+  const off = Math.max(0, Math.trunc(Number(offset) || 0));
+  const lim = Math.min(TRANSCRIPT_PAGE_MAX, Math.max(1, Math.trunc(Number(limit) || TRANSCRIPT_PAGE_DEFAULT)));
+  // The slice happens in Postgres so a page read never ships the whole MB-scale
+  // jsonb to Node just to throw most of it away.
+  const { rows } = await pool.query(
+    `SELECT sr.id, sr.session_id, sr.builder_id, st.turn_count, st.byte_size,
+            st.truncated, st.uploaded_at,
+            COALESCE((SELECT jsonb_agg(e.v ORDER BY e.n)
+                        FROM jsonb_array_elements(st.turns) WITH ORDINALITY AS e(v, n)
+                       WHERE e.n > $2 AND e.n <= $2 + $3), '[]'::jsonb) AS turns
+       FROM session_records sr
+       JOIN session_transcripts st ON st.session_id = sr.session_id
+      WHERE sr.id = $1`,
+    [Number(id), off, lim]
+  );
+  return rows[0] ? { ...rows[0], offset: off, limit: lim } : null;
+}
+
 // listSessionsByBuilder — a builder's OWN sessions (self-serve summary list).
 async function listSessionsByBuilder(builderId, limit = 25) {
   const { rows } = await pool.query(
@@ -865,6 +921,8 @@ async function sessionTypeCounts() {
 module.exports = {
   // write side (6D.1)
   upsertSessionRecord,
+  upsertSessionTranscript, // ADR 0051 — full scrubbed transcript (separate table)
+  getSessionTranscript,
   upsertSessionRecordWithReward, // route entry point — upsert + token reward (task 1005)
   awardDeferredSessionRewardForTask, // ADR 0120 land-side trigger — task.shipped listener calls it
   reconcileUnbookedSessionRewards, // ADR 0120 state-based safety net — books rewards for out-of-band ships

package/modules/sessions/routes/sessions.js

@@ -16,6 +16,11 @@
 //                             audited (the BFG principal posture until 6C.1).
 //   GET  /sessions/:id       — one session's full detail for deep-dive. Owner
 //                             self-serve; cross-builder requires Archon + audit.
+//   PUT  /sessions/:sid/transcript
+//                           — upload the FULL scrubbed transcript of your OWN
+//                             session (ADR 0051). Own 16 MB parser.
+//   GET  /sessions/:id/transcript
+//                           — read it. Owner, or Archon + audit written first.
 //
 // Cross-builder reads are GETs, which the global audit middleware does NOT
 // instrument — so each writes its own audit_log row (fail-closed: logged BEFORE
@@ -54,6 +59,16 @@ const seams = api; // resolveOptional('reward' | 'builder-settings') — kernel-
 const { validateOrRespond, parseId } = api;
 
 const UPLOAD_BODY_LIMIT = '4mb';
+// ADR 0051 — the full transcript is MB-scale. The client's own ceiling is 12 MB of
+// content (scripts/gds/session-transcript-build.js); 16 MB leaves JSON overhead.
+const TRANSCRIPT_BODY_LIMIT = '16mb';
+const MAX_TRANSCRIPT_TURNS = 20000;
+// SR-17 for the transcript (the sibling POST bounds detail[] to 2 MB; this row is
+// deliberately ~6x that because a full transcript IS the product, but it is still
+// bounded IN the handler, not just by the parser): a per-turn ceiling stops one
+// absurd turn, and the serialized total matches the client's own ceiling.
+const MAX_TRANSCRIPT_TURN_BYTES = 256 * 1024;
+const MAX_TRANSCRIPT_TOTAL_BYTES = 12 * 1024 * 1024;
 const MAX_DETAIL_TURNS = 5000; // a hard ceiling; ship.js bounds well under this
 
 // Disk-fill defense (SR-17 / task 997). The 4 MB body limit + maxItems=5000 cap
@@ -189,6 +204,7 @@ module.exports = function buildSessionsRouter() {
   registerSeams();
   const router = express.Router();
   const uploadJson = express.json({ limit: UPLOAD_BODY_LIMIT });
+  const transcriptJson = express.json({ limit: TRANSCRIPT_BODY_LIMIT });
 
   // rank: any-builder — upload your OWN session digest. Owner is forced to the
   // authenticated caller; the body cannot attribute a record to another builder.
@@ -315,6 +331,59 @@ module.exports = function buildSessionsRouter() {
     }
   });
 
+  // rank: any-builder — upload the FULL scrubbed transcript of your OWN session
+  // (ADR 0051, task 1001004). Separate from POST /sessions on purpose: the digest
+  // is KB and carries the reward/evaluator path under a 4 MB parser; the transcript
+  // is MB and gets its own larger parser, so a transcript failure can never block a
+  // digest. The row is created only FROM the caller's own session_records row (no
+  // digest → 404, someone else's session_id → 404, never a confirmation it exists).
+  // The content is scrubbed on the uploader's box; the server bounds SHAPE, not
+  // secrets — every turn must be a plain object and the whole body is capped.
+  router.put('/sessions/:sid/transcript', auth.requireBuilder, transcriptJson, async (req, res) => {
+    const sid = String(req.params.sid || '');
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(sid)) return res.fail('bad_session_id', 400);
+    if (validateOrRespond(req, res, {
+      turns: { required: true, type: 'array', maxItems: MAX_TRANSCRIPT_TURNS },
+      truncated: { type: 'boolean' },
+    })) return;
+    const body = req.body || {};
+    const turns = body.turns;
+    // Serialize each turn ONCE: the same strings are measured, then joined into the
+    // jsonb text the db stores, so a 12 MB transcript is not stringified twice.
+    const parts = new Array(turns.length);
+    let totalBytes = 2;
+    for (let idx = 0; idx < turns.length; idx++) {
+      const t = turns[idx];
+      if (!t || typeof t !== 'object' || Array.isArray(t)) {
+        return res.fail('bad_transcript_turn', { status: 400, message: `turns[${idx}] must be an object` });
+      }
+      parts[idx] = JSON.stringify(t);
+      const turnBytes = Buffer.byteLength(parts[idx], 'utf8');
+      if (turnBytes > MAX_TRANSCRIPT_TURN_BYTES) {
+        return res.fail('transcript_turn_too_large', { status: 413, message: `turns[${idx}] is ${turnBytes} bytes; the per-turn cap is ${MAX_TRANSCRIPT_TURN_BYTES} bytes` });
+      }
+      totalBytes += turnBytes + 1;
+      if (totalBytes > MAX_TRANSCRIPT_TOTAL_BYTES) {
+        return res.fail('transcript_too_large', { status: 413, message: `transcript exceeds the ${MAX_TRANSCRIPT_TOTAL_BYTES}-byte total cap` });
+      }
+    }
+    try {
+      const stored = await db.upsertSessionTranscript({
+        sessionId: sid,
+        builderId: req.builder.id, // owner = caller, never the body
+        turnsJson: `[${parts.join(',')}]`,
+        turnCount: turns.length,
+        truncated: body.truncated === true,
+        byteSize: totalBytes,
+      });
+      if (!stored) return res.fail('not_found', 404);
+      res.status(201).json({ transcript: stored });
+    } catch (err) {
+      api.logger('sessions').error(err, 'PUT /sessions/:sid/transcript failed');
+      res.fail('upload_failed', 500);
+    }
+  });
+
   // GET /sessions/search + /sessions/mine are declared BEFORE /sessions/:id so
   // Express matches the literal paths first (the numeric :id never swallows them).
 
@@ -458,5 +527,33 @@ module.exports = function buildSessionsRouter() {
     }
   });
 
+  // rank: any-builder — the FULL transcript of one session (ADR 0051). Same rule as
+  // GET /sessions/:id: the owner reads their own; a cross-builder read is
+  // Archon-only, 404 (never 403) for everyone else, and the fail-closed audit row
+  // is written BEFORE any transcript content is served — transcripts are the most
+  // sensitive thing this module holds. Paged (?offset=&limit=, default 500 turns,
+  // max 2000): a transcript is MB-scale and the response carries turn_count so the
+  // reader knows how far to go.
+  router.get('/sessions/:id/transcript', auth.requireBuilder, readRateLimit, async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_session_id', positiveInt: true });
+    if (id === null) return;
+    try {
+      const t = await db.getSessionTranscript(id, { offset: req.query.offset, limit: req.query.limit });
+      if (!t) return res.fail('not_found', 404);
+      if (String(t.builder_id) !== String(req.builder.id)) {
+        if (req.builder.rank !== 'archon') return res.fail('not_found', 404);
+        await recordSessionRead(req, {
+          route: '/api/bongos/sessions/:id/transcript',
+          targetBuilderId: t.builder_id,
+          target: `transcript:${id}`,
+        });
+      }
+      res.json({ transcript: t });
+    } catch (err) {
+      api.logger('sessions').error(err, 'GET /sessions/:id/transcript failed');
+      res.fail('fetch_failed', 500);
+    }
+  });
+
   return router;
 };

package/modules/ui-design/kit/fixtures/founding-genesis-demo.json

@@ -0,0 +1,176 @@
+{
+  "_": "A demo born into genesis (task 1004506): 3 people, 4 hours each. The plan was settled at birth from the demo (Monarchy / BDFL, one pass, no advisors), so decide is behind and scope is in progress, each stage minutes long. Built from the real server shaper (genesis-home.js demoPlan + shapeGenesis).",
+  "genesis": {
+    "stage": "scope",
+    "stage_number": 1,
+    "stage_count": 5,
+    "day": 1,
+    "deciding": false,
+    "plan": {
+      "days": {
+        "scope": 1,
+        "strategize": 1,
+        "charter": 1,
+        "legalize": 1,
+        "legislation": 1
+      },
+      "passes": 1,
+      "advisors": "none",
+      "government": "monarchy",
+      "expected_builders": 3,
+      "existing": false,
+      "demo": {
+        "people": 3,
+        "hours_each": 4
+      },
+      "minutes": {
+        "scope": 14,
+        "strategize": 10,
+        "charter": 10,
+        "legalize": 5,
+        "legislation": 10
+      }
+    },
+    "demo": {
+      "people": 3,
+      "hours_each": 4
+    },
+    "stages": [
+      {
+        "key": "scope",
+        "number": 1,
+        "label": "Scope",
+        "life": "primordial sea",
+        "plate": "r5-life-1-primordial-sea",
+        "done_when": "The scope is written: what you are making, for whom, and what is left out.",
+        "wakes": [
+          "roadmap",
+          "goals",
+          "goal-map"
+        ],
+        "days": 1,
+        "minutes": 14,
+        "due": "2026-10-01T09:14:00.000Z",
+        "state": "now",
+        "tasks": [
+          {
+            "id": "101",
+            "title": "Write the project scope: what we are making, for whom, and what is out of scope",
+            "status": "active",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      },
+      {
+        "key": "strategize",
+        "number": 2,
+        "label": "Strategize",
+        "life": "first cells",
+        "plate": "r5-life-2-first-cells",
+        "done_when": "The strategy is written out, or the one you have is linked.",
+        "wakes": [
+          "work"
+        ],
+        "days": 1,
+        "minutes": 10,
+        "due": null,
+        "state": "later",
+        "tasks": [
+          {
+            "id": "102",
+            "title": "Write out the strategy, or link the one you already have",
+            "status": "ready",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      },
+      {
+        "key": "charter",
+        "number": 3,
+        "label": "Charter",
+        "life": "the genome",
+        "plate": "r5-life-3-genome",
+        "done_when": "The starting government is chosen and the bylaws are written.",
+        "wakes": [
+          "board-room"
+        ],
+        "days": 1,
+        "minutes": 10,
+        "due": null,
+        "state": "later",
+        "tasks": [
+          {
+            "id": "103",
+            "title": "Choose the starting government and write the bylaws",
+            "status": "ready",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      },
+      {
+        "key": "legalize",
+        "number": 4,
+        "label": "Legalize",
+        "life": "the membrane",
+        "plate": "r5-life-4-membrane",
+        "done_when": "Rewards are decided, and who can be paid.",
+        "wakes": [
+          "economy"
+        ],
+        "days": 1,
+        "minutes": 5,
+        "due": null,
+        "state": "later",
+        "tasks": [
+          {
+            "id": "104",
+            "title": "Decide how contributors are rewarded and who can be paid",
+            "status": "ready",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      },
+      {
+        "key": "legislation",
+        "number": 5,
+        "label": "Legislation",
+        "life": "the nervous system",
+        "plate": "r5-life-5-nervous-system",
+        "done_when": "The voting rules are set: who votes, and how many must agree.",
+        "wakes": [
+          "ranks"
+        ],
+        "days": 1,
+        "minutes": 10,
+        "due": null,
+        "state": "later",
+        "tasks": [
+          {
+            "id": "105",
+            "title": "Set the voting rules: who votes and how many must agree",
+            "status": "ready",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      }
+    ],
+    "can_close": false,
+    "can_come_alive": false
+  },
+  "viewer_id": "1"
+}

package/modules/ui-design/kit/fixtures/me-founding-demo.json

@@ -0,0 +1,27 @@
+{
+  "builder": {
+    "id": "1",
+    "github_login": "builder",
+    "display_name": "A Builder",
+    "avatar_url": "/__kit/avatar.svg",
+    "rank": "archon"
+  },
+  "founding_mode": {
+    "active": true,
+    "stage": "scope",
+    "stage_number": 1,
+    "stage_count": 5,
+    "day": 1,
+    "asleep": {
+      "roadmap": "scope",
+      "goals": "scope",
+      "goal-map": "scope",
+      "work": "strategize",
+      "board-room": "charter",
+      "economy": "legalize",
+      "ranks": "legislation",
+      "collab": "alive",
+      "roster": "alive"
+    }
+  }
+}

package/modules/ui-design/kit/fixtures/provisioning-instances-demo.json

@@ -16,6 +16,7 @@
       "last_verified_up": true,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": null,
       "open_intent": null,
       "demo": {
@@ -89,6 +90,7 @@
       "last_verified_up": true,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": "2026-08-15T12:00:00.000Z",
       "open_intent": null
     },
@@ -107,6 +109,7 @@
       "last_verified_up": false,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": null,
       "open_intent": null
     }

package/modules/ui-design/kit/fixtures/provisioning-instances-dns-pending.json

@@ -0,0 +1,49 @@
+{
+  "_": "Two projects whose address the platform's own lookup has not seen answer yet (task 1004505): beacon is active a minute after its standup, lumen is still standing up. The hub must link neither and name neither until dns_resolves is true. Only projects-dns-pending.states.json points at this.",
+  "instances": [
+    {
+      "id": 106,
+      "slug": "beacon",
+      "status": "active",
+      "domain": "beacon.cloudbongos.com",
+      "target_ref": "builder/beacon",
+      "hosting_shape": "cloud-host",
+      "owner_monthly_usd": null,
+      "onboard_mode": "scaffold",
+      "created_at": "$now-5m",
+      "provisioned_at": "$now-1m",
+      "updated_at": "$now-1m",
+      "last_verified_at": null,
+      "last_verified_up": null,
+      "error_note": null,
+      "dns_note": null,
+      "dns_resolves": false,
+      "torn_down_at": null,
+      "open_intent": null
+    },
+    {
+      "id": 107,
+      "slug": "lumen",
+      "status": "provisioning",
+      "domain": "lumen.cloudbongos.com",
+      "target_ref": "builder/lumen",
+      "hosting_shape": "cloud-host",
+      "owner_monthly_usd": null,
+      "onboard_mode": "scaffold",
+      "created_at": "$now-3m",
+      "provisioned_at": null,
+      "updated_at": "$now-2m",
+      "last_verified_at": null,
+      "last_verified_up": null,
+      "error_note": null,
+      "dns_note": null,
+      "dns_resolves": false,
+      "torn_down_at": null,
+      "open_intent": {
+        "action": "provision",
+        "state": "running",
+        "created_at": "$now-3m"
+      }
+    }
+  ]
+}

package/modules/ui-design/kit/fixtures/provisioning-instances.json

@@ -16,6 +16,7 @@
       "last_verified_up": true,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": null,
       "open_intent": null
     },
@@ -75,6 +76,7 @@
       "last_verified_up": true,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": "2026-08-15T12:00:00.000Z",
       "open_intent": null
     },
@@ -93,6 +95,7 @@
       "last_verified_up": false,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": null,
       "open_intent": null
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.82",
+  "version": "1.21.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.82",
+      "version": "1.21.1",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.82",
+  "version": "1.21.1",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8653,5 +8653,46 @@
       "id": "1004509",
       "text": "The Autobongos runner panel on the Gate page is now much lighter to read. While anything is missing it shows a short checklist saying what to do next; once everything is ready it shrinks to one status line with an on/off switc"
     }
+  ],
+  "1.20.83": [
+    {
+      "id": "1004513",
+      "text": "A goal now finishes by itself when its last task ships. Before, if someone ticked off all of a goal's done-when criteria while one task was still being worked on, the goal stayed open forever once that task landed — it took ti"
+    }
+  ],
+  "1.21.0": [],
+  "1.21.1": [
+    {
+      "id": "1004522",
+      "text": "The Governor City design now lives in the project itself, not only in a private design canvas. This is the design where a governor's home is a small animated city and each part of the government is a building. All six design f"
+    },
+    {
+      "id": "1004518",
+      "text": "If GitHub refuses a Release for lack of permission, the deploy page now names the exact thing to fix: the server's access token or its GitHub App, whichever it uses."
+    },
+    {
+      "id": "1004506",
+      "text": "New projects now open their hall already in genesis. When a project is created through the startup flow, the platform marks it, and on the founder's first visit the hall switches into founding mode, once and safely. Projects m"
+    },
+    {
+      "id": "1004521",
+      "text": "Releases Bongos 1.21.0, the first bigger-step update, so we can watch cloudbongos.com take it on its own."
+    },
+    {
+      "id": "1004515",
+      "text": "The new way to start a project is now agreed. It is one short flow of six screens with no progress bar, plain words, and a calm night-time look. Before anything is created, you confirm every setting we filled in for you."
+    },
+    {
+      "id": "1001004",
+      "text": "Every session's complete conversation, with secrets removed, is now saved on the server so the review team can read what was actually asked and answered. Only the owner or an administrator can read it, and each administrator r"
+    },
+    {
+      "id": "1004514",
+      "text": "When a project is updated from the deploy page, the update now always saves its new version, even on projects whose history has no author name set. Before, those projects quietly kept the update unsaved, so the next update tri"
+    },
+    {
+      "id": "1004505",
+      "text": "A new project's address now works the first time you open it. The platform creates the address before anything else, and the hub only links it once the platform has seen it answer. Before, an early click could leave your home"
+    }
   ]
 }