@bongos/core 1.21.131 → 1.21.133

package/modules/hall-ui/public/goal-author.js

@@ -0,0 +1,197 @@
+// goal-author.js — the Goals page's "author a goal / add a done-when criterion"
+// panel (task 1003463, goal 1000089; ADR 0366 D1.2/D1.3 + D3). The hall could
+// SATISFY a criterion and never AUTHOR one, and had no POST /goals call at all.
+//
+// Two forms, nothing else:
+//   · GOAL — a name, a one-line subtitle, an optional longer description, the
+//     version, an optional category. NO scope field: the goal is created with
+//     spec_task:true, so it arrives with a "Spec goal N" task that gates its other
+//     work, and the scope is set when that task is done. Before submit, the
+//     suggester's matching open goals are shown so reuse is a click.
+//   · CRITERION — the outcome in a sentence; the slug is derived from it.
+//
+// The authority walls stay on the SERVER and this file lets them speak: it sends
+// what was typed and renders the refusal. It never hides the version a Metic
+// "cannot" use or the goal a non-member "cannot" add to — pre-filtering would turn
+// a clear refusal into a form that quietly lacks the option (ADR 0086, ADR 0154).
+//
+// Steps that are interviews — planning a version, inferring scope, drafting
+// criteria or seed tasks, judging reuse, carrying forward — are deliberately
+// absent (ADR 0366 D2). The pure half (bodies, slug, refusal copy) is
+// goal-author-lib.js; this file is the DOM and the two calls.
+(function () {
+  'use strict';
+  const lib = window.OTBGoalAuthor;
+  const { escapeHtml } = window.OTB;
+
+  // mount({ root, api, API, toast, getGoals }) — `api` is the page's typed client
+  // (api.request(method, path, { body }) → { status, ok, data }), `getGoals` the
+  // page's loaded goal rows (so the criterion form lists the goals already on the
+  // board without a second fetch).
+  function mount(opts) {
+    const { root, api, API, toast, getGoals } = opts;
+    if (!root || !lib) return;
+    let loaded = false;
+    let timer = null;
+    let seq = 0;
+
+    root.innerHTML = `
+      <button type="button" class="btn goal-author__open" id="ga-open" aria-expanded="false" aria-controls="ga-panel">New goal</button>
+      <section class="scroll goal-author" id="ga-panel" aria-labelledby="ga-h" hidden>
+        <h2 class="scroll__h" id="ga-h">Author a goal</h2>
+        <form id="ga-goal" class="goal-author__form" novalidate>
+          <label class="goal-author__field">Name
+            <input id="ga-title" type="text" maxlength="${lib.TITLE_MAX}" autocomplete="off" required>
+          </label>
+          <label class="goal-author__field">What it is for <span class="goal-author__hint">One line, under the name</span>
+            <input id="ga-subtitle" type="text" maxlength="${lib.TITLE_MAX}" autocomplete="off">
+          </label>
+          <label class="goal-author__field">Description <span class="goal-author__hint">optional</span>
+            <textarea id="ga-description" rows="3"></textarea>
+          </label>
+          <div class="goal-author__row">
+            <label class="goal-author__field">Version
+              <select id="ga-version" required><option value="">Loading…</option></select>
+            </label>
+            <label class="goal-author__field">Category <span class="goal-author__hint">optional</span>
+              <select id="ga-category"><option value="">— none —</option></select>
+            </label>
+          </div>
+          <div id="ga-suggest" class="goal-author__suggest" aria-live="polite" hidden></div>
+          <p class="goal-author__note">Scope is not asked for here: the goal gets a “Spec goal” task, and the scope is set when that task is done.</p>
+          <p class="goal-author__err" id="ga-goal-err" role="alert" hidden></p>
+          <button type="submit" class="btn btn--primary" id="ga-goal-go">Create goal</button>
+        </form>
+
+        <h2 class="scroll__h goal-author__h2" id="ga-crit-h">Add a done-when criterion</h2>
+        <form id="ga-crit" class="goal-author__form" novalidate aria-labelledby="ga-crit-h">
+          <label class="goal-author__field">Goal
+            <select id="ga-crit-goal" required><option value="">— pick a goal —</option></select>
+          </label>
+          <label class="goal-author__field">What will be true when it is done
+            <textarea id="ga-crit-text" rows="2"></textarea>
+          </label>
+          <p class="goal-author__note" id="ga-crit-slug" aria-live="polite"></p>
+          <p class="goal-author__err" id="ga-crit-err" role="alert" hidden></p>
+          <button type="submit" class="btn btn--primary" id="ga-crit-go">Add criterion</button>
+        </form>
+      </section>`;
+
+    const $q = (id) => root.querySelector(`#${id}`);
+    const panel = $q('ga-panel');
+    const openBtn = $q('ga-open');
+
+    const showErr = (id, text) => { const el = $q(id); el.textContent = text || ''; el.hidden = !text; };
+
+    async function get(path) {
+      try { return await api.request('GET', path, {}); } catch (_) { return { ok: false, status: 0, data: {} }; }
+    }
+
+    function fillGoalChoices() {
+      const sel = $q('ga-crit-goal');
+      const keep = sel.value;
+      const goals = (getGoals() || []).filter((g) => g && g.status === 'open');
+      sel.innerHTML = '<option value="">— pick a goal —</option>' + goals.map((g) =>
+        `<option value="${escapeHtml(String(g.id))}" data-version="${escapeHtml(String(g.version_id || ''))}">${escapeHtml(`${g.version_id || ''} · ${g.title}`)}</option>`).join('');
+      sel.value = keep;
+    }
+
+    async function loadChoices() {
+      if (loaded) return;
+      const [v, c] = await Promise.all([get(`${API}/versions`), get(`${API}/work-categories`)]);
+      if (!v.ok) { showErr('ga-goal-err', 'Could not load the versions. Close and reopen this panel to try again.'); return; }
+      loaded = true;
+      const versions = lib.openVersions(v.data && v.data.versions);
+      const vsel = $q('ga-version');
+      vsel.innerHTML = '<option value="">— pick a version —</option>' + versions.map((x) =>
+        `<option value="${escapeHtml(x.id)}">${escapeHtml(x.label)}</option>`).join('');
+      const cats = (c.data && c.data.categories) || [];
+      $q('ga-category').innerHTML = '<option value="">— none —</option>' + cats.map((x) =>
+        `<option value="${escapeHtml(String(x.id))}">${escapeHtml(x.label)}</option>`).join('');
+    }
+
+    // Reuse is a click: the suggester's open goals for this draft, linked to their
+    // detail view. Best-effort — a failed or empty read just hides the strip.
+    async function suggest() {
+      const box = $q('ga-suggest');
+      const version = $q('ga-version').value;
+      const title = $q('ga-title').value.trim();
+      const mine = ++seq;
+      if (!version || !title) { box.hidden = true; return; }
+      const r = await get(`${API}/goals/suggestions?version=${encodeURIComponent(version)}&title=${encodeURIComponent(title)}&kind=feature&limit=5`);
+      if (mine !== seq) return;
+      const rows = (r.ok && r.data && Array.isArray(r.data.suggestions)) ? r.data.suggestions : [];
+      if (!rows.length) { box.hidden = true; box.innerHTML = ''; return; }
+      box.innerHTML = '<p class="goal-author__hint">These open goals look related — use one instead?</p><ul>' + rows.map((g) =>
+        `<li><a href="#/goal/${encodeURIComponent(String(g.id))}">${escapeHtml(g.title || `Goal ${g.id}`)}</a></li>`).join('') + '</ul>';
+      box.hidden = false;
+    }
+    const suggestSoon = () => { clearTimeout(timer); timer = setTimeout(suggest, 350); };
+
+    function setOpen(open) {
+      panel.hidden = !open;
+      openBtn.setAttribute('aria-expanded', String(open));
+      if (open) { loadChoices(); fillGoalChoices(); $q('ga-title').focus(); }
+    }
+    openBtn.addEventListener('click', () => setOpen(panel.hidden));
+
+    $q('ga-title').addEventListener('input', suggestSoon);
+    $q('ga-version').addEventListener('change', suggestSoon);
+
+    $q('ga-goal').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      showErr('ga-goal-err', '');
+      const fields = {
+        version_id: $q('ga-version').value, title: $q('ga-title').value,
+        subtitle: $q('ga-subtitle').value, description: $q('ga-description').value,
+        category_id: $q('ga-category').value,
+      };
+      const problem = lib.goalFormProblem(fields);
+      if (problem) return showErr('ga-goal-err', problem);
+      const btn = $q('ga-goal-go');
+      btn.disabled = true;
+      try {
+        const res = await api.request('POST', `${API}/goals`, { body: lib.buildGoalBody(fields) });
+        if (!res.ok) return showErr('ga-goal-err', lib.refusalText(res.status, res.data));
+        const goal = (res.data && res.data.goal) || {};
+        // The board derives everything from one boot read, so reload onto the new
+        // goal (a toast would be destroyed on the same tick).
+        if (goal.id != null) window.location.hash = `#/goal/${goal.id}`;
+        window.location.reload();
+      } catch (_) {
+        showErr('ga-goal-err', 'Could not reach the server. Try again in a moment.');
+      } finally { btn.disabled = false; }
+    });
+
+    const slugNote = () => {
+      const slug = lib.criterionSlug($q('ga-crit-text').value);
+      $q('ga-crit-slug').textContent = slug ? `Filed as: ${slug}` : '';
+    };
+    $q('ga-crit-text').addEventListener('input', slugNote);
+
+    $q('ga-crit').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      showErr('ga-crit-err', '');
+      const sel = $q('ga-crit-goal');
+      const opt = sel.options[sel.selectedIndex];
+      const fields = {
+        goal_id: sel.value, version_id: opt ? opt.getAttribute('data-version') : '',
+        outcome: $q('ga-crit-text').value,
+      };
+      const problem = lib.criterionFormProblem(fields);
+      if (problem) return showErr('ga-crit-err', problem);
+      const req = lib.buildCriterionRequest(fields);
+      const btn = $q('ga-crit-go');
+      btn.disabled = true;
+      try {
+        const res = await api.request('POST', `${API}${req.path}`, { body: req.body });
+        if (!res.ok) return showErr('ga-crit-err', lib.refusalText(res.status, res.data));
+        window.location.reload();
+      } catch (_) {
+        showErr('ga-crit-err', 'Could not reach the server. Try again in a moment.');
+      } finally { btn.disabled = false; }
+    });
+  }
+
+  window.OTBGoalAuthorUI = { mount };
+})();

package/modules/hall-ui/public/goals-page.js

@@ -842,6 +842,9 @@
   }
 
   async function boot() {
+    // task 1003463 — authoring a goal / criterion. Optional-called: a stale cached
+    // page without goal-author.js loses the button, never the board.
+    window.OTBGoalAuthorUI?.mount({ root: $('#goal-author-mount'), api, API, toast, getGoals: () => state.goals });
     // Kit shimmer placeholders while the goal list loads (was one "…" div).
     const grid = $('#goal-grid');
     if (grid) {

package/modules/hall-ui/public/goals.css

@@ -563,3 +563,16 @@
 .gf-brief__n { flex-shrink: 0; font-size: 12px; color: var(--ink-faint); }
 .gf-brief__conflicts { margin: 10px 0 0; font-size: 13px; color: var(--ink-soft); }
 .gf-brief__conflicts--live { color: var(--warn); font-weight: 600; }
+
+/* task 1003463 — the author-a-goal / add-a-criterion panel (goal-author.js). */
+.goal-author { margin-top: 12px; }
+.goal-author__form { display: grid; gap: 12px; max-width: 640px; }
+.goal-author__h2 { margin-top: 20px; }
+.goal-author__field { display: grid; gap: 4px; }
+.goal-author__field input, .goal-author__field select, .goal-author__field textarea { width: 100%; box-sizing: border-box; }
+.goal-author__row { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 12px; }
+.goal-author__hint, .goal-author__note { color: var(--ink-soft); font-size: 12.5px; margin: 0; }
+.goal-author__suggest ul { margin: 4px 0 0; padding-left: 18px; }
+.goal-author__suggest li a { display: inline-block; min-height: 24px; line-height: 24px; }
+.goal-author__err { color: var(--danger); margin: 0; }
+.goal-author__open { margin-top: 8px; }

package/modules/hall-ui/public/goals.html

@@ -37,6 +37,8 @@
         <!-- task 1003479: the goal map has no nav slot of its own (the sky's rule —
              a map that is reachable but not load-bearing), so this is its door. -->
         <p class="page-head__sub"><a href="/builders/goal-map">See which goals wait on each other →</a></p>
+        <!-- task 1003463: author a goal / a done-when criterion (goal-author.js). -->
+        <div id="goal-author-mount"></div>
       </div>
 
       <main id="hall-main">
@@ -260,6 +262,8 @@
 <!-- task 1004402: the criterion UAT pills, panel and sign-off (ADR 0351). Loaded
      BEFORE goals-render.js, which reads window.OTBCriterionUat at factory time. -->
 <script src="/builders/criterion-uat-ui.js?v=2026-09-30-uat2"></script>
+<script src="/builders/goal-author-lib.js"></script>
+<script src="/builders/goal-author.js"></script>
 <script src="/builders/goals-render.js?v=2026-09-30-uat2"></script>
 <script src="/builders/goals-page.js?v=2026-09-30-uat2"></script>
 </body>

package/modules/hall-ui/public/goals.states.json

@@ -14,7 +14,8 @@
     "/api/(gds|bongos)/tasks",
     "/api/(gds|bongos)/versions",
     "/api/(gds|bongos)/inbox/",
-    "/api/(gds|bongos)/work-categories"
+    "/api/(gds|bongos)/work-categories",
+    "/api/(gds|bongos)/goals/suggestions"
   ],
   "ignoreConsole": [
     "/api/(gds|bongos)/",
@@ -184,6 +185,38 @@
           "#goal-completion-full .uat-form"
         ]
       }
+    },
+    "author": {
+      "auth": true,
+      "actions": [
+        [
+          "wait",
+          600
+        ],
+        [
+          "click",
+          "#ga-open"
+        ],
+        [
+          "wait",
+          300
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#ga-panel",
+          "#ga-title",
+          "#ga-version",
+          "#ga-crit-goal"
+        ],
+        "attr": [
+          [
+            "#ga-open",
+            "aria-expanded",
+            "true"
+          ]
+        ]
+      }
     }
   },
   "reducedMotion": {

package/modules/hall-ui/records/goal-authoring.md

@@ -0,0 +1,10 @@
+# Authoring a goal and a done-when criterion — on the Goals page (task 1003463)
+
+**The Goals page can AUTHOR now, not only satisfy (task 1003463, goal 1000089; ADR 0366 D1.2/D1.3/D2/D3).** A "New goal" button under the page head opens one panel with two forms. Pure half `goal-author-lib.js` (`window.OTBGoalAuthor`), DOM half `goal-author.js` (`window.OTBGoalAuthorUI`, mounted from `goals-page.js` behind an optional call so a stale cached page loses the button, never the board).
+
+- **Goal form = name + subtitle + description + version + category, and NO scope field.** It always sends `spec_task: true` (task 1004585): the goal arrives with a "Spec goal N" task that gates its other work and the scope is set when that task is done. The name and subtitle are separate boxes — the goal board's convention (goal 1000072) is that a title does not carry its own explanation.
+- **Reuse is a click.** As the name is typed (350ms debounce, stale answers dropped) the suggester's open goals for that version (`GET /goals/suggestions`) are linked to their detail view above the submit button. Best-effort: a failed read hides the strip.
+- **Criterion form = outcome text; the slug is derived from it** and shown ("Filed as: …"). A slug shaped like a position (C1…) is prefixed, because the server refuses those. The goal's own version rides in the path (`POST /versions/:id/done-when`).
+- **The two authority walls are the server's and the form does not soften them.** It offers every open version and every open goal, sends what was typed, and prints the server's own refusal sentence (`refusalText` only fills in a bare code). Pre-filtering "versions a Metic cannot use" or "goals you do not manage" would turn a clear refusal into a form that quietly lacks the option — the reason ADR 0154's mask was removed in task 1002614. `tests/goal_author_ui.mjs` drives the form's own request through the real goals and done-when routers: a Metic's protected-scope goal is still 403 `archon_required_for_protected_scope`, a non-member's criterion is still 403 `goal_not_yours`, a manager's succeeds.
+- **Deliberately absent (ADR 0366 D2, interview-shaped):** version planning, scope inference, drafting criteria or seed tasks, reuse judgement, carry-forward, and the Archon admission into a building version. The test asserts the UI source names none of `scope_modules`, `succeeds_goal_id`, `admit_reason`.
+- A successful create reloads the page (to `#/goal/N` for a goal) rather than patching `state.goals` by hand: the board's rollups, rings and filters all derive from one boot read.

package/modules/provisioning/github-setup.js

@@ -47,8 +47,8 @@ const SETUP_EVENTS = Object.freeze({
   // the founder pressed "Pick up where it stopped" or "Check again" (task 1004652). Like an
   // install report it re-opens the runner's checking window; it claims nothing itself.
   checkRequested: 'github-app-check-requested',
-  // the liveness sweep saw the project's own /healthz answer auth_configured: true (task
-  // 1004410). Recorded once per attempt (recordSignInSeen); no detail.
+  // the liveness sweep saw the project's own /api/bongos/healthz answer auth_configured: true
+  // (task 1004410). Recorded once per attempt (recordSignInSeen); no detail.
   signInSeen: 'github-sign-in-seen',
 });
 

package/modules/provisioning/pollers/liveness-sweep.js

@@ -164,13 +164,20 @@ function probeReason(err) {
   return err.message ? String(err.message).slice(0, 40) : 'error';
 }
 
-// The /healthz answer is tiny; read no more than this of a body a builder's host chose.
+// The health answer is tiny; read no more than this of a body a builder's host chose.
 const BODY_CAP_BYTES = 4096;
 
+// auth_configured lives on the JSON health answer; the root /healthz says a plain "ok" and
+// stays the up/down read, so a core without this route never reads as down (task 1004743).
+const AUTH_HEALTHZ_PATH = '/api/bongos/healthz';
+
+const is2xx = (res) => res.status >= 200 && res.status < 300;
+
 // Did the answer say auth_configured: true (task 1004410)? Reads at most BODY_CAP_BYTES
-// and answers false for anything else — a big, slow or non-JSON body is never "configured".
+// and answers false for anything else — a non-2xx, big, slow or non-JSON body is never "configured".
 async function readAuthConfigured(res) {
   try {
+    if (!is2xx(res)) return false;
     if (!res.body || typeof res.body.getReader !== 'function') {
       return typeof res.json === 'function' ? (await res.json()).auth_configured === true : false;
     }
@@ -192,22 +199,30 @@ async function readAuthConfigured(res) {
 
 // Knock once. Any 2xx = up; everything else (non-2xx, refused, DNS, TLS, timeout)
 // = down with a reason. Never throws — a probe result is the whole point. An up answer
-// also carries whether the project says its sign-in is configured (task 1004410).
+// also carries whether the project says its sign-in is configured (task 1004410), asked
+// on the same origin through the same pin and time budget; that read failing is only "no".
 async function probeHealthz(url, { timeoutMs = PROBE_TIMEOUT_MS, fetchImpl, pin } = {}) {
   const doFetch = fetchImpl || globalThis.fetch;
   const dispatcher = pin && !fetchImpl ? pinnedDispatcher(pin, timeoutMs) : null;
+  const signal = AbortSignal.timeout(timeoutMs);
+  const get = async (target) => doFetch(target, {
+    method: 'GET',
+    // manual: a redirect must never re-aim the probe (SSRF pivot) — and a
+    // healthz that redirects isn't answering anyway.
+    redirect: 'manual',
+    signal,
+    headers: { accept: 'application/json, text/plain;q=0.9, */*;q=0.8' },
+    ...(dispatcher ? { dispatcher } : {}),
+  });
   try {
-    const res = await doFetch(url, {
-      method: 'GET',
-      // manual: a redirect must never re-aim the probe (SSRF pivot) — and a
-      // healthz that redirects isn't answering anyway.
-      redirect: 'manual',
-      signal: AbortSignal.timeout(timeoutMs),
-      headers: { accept: 'application/json, text/plain;q=0.9, */*;q=0.8' },
-      ...(dispatcher ? { dispatcher } : {}),
-    });
-    if (res.status >= 200 && res.status < 300) return { up: true, authConfigured: await readAuthConfigured(res) };
-    return { up: false, reason: `http ${res.status}` };
+    const res = await get(url);
+    if (!is2xx(res)) return { up: false, reason: `http ${res.status}` };
+    if (res.body && typeof res.body.cancel === 'function') res.body.cancel().catch(() => {});
+    // An https answer with no pin reached an address the gate never vetted; ask it nothing more.
+    const askAuth = !!pin || !url.startsWith('https://');
+    const authConfigured = askAuth
+      && await get(new URL(AUTH_HEALTHZ_PATH, url).href).then(readAuthConfigured, () => false);
+    return { up: true, authConfigured };
   } catch (e) {
     return { up: false, reason: probeReason(e) };
   } finally {

package/modules/provisioning/tests/liveness.mjs

@@ -115,7 +115,7 @@ console.log('\nsweepOnce (real loopback probes, recording fake db):');
 
 await ta('an answering instance is UP and a refusing one is DOWN — both columns written, status never touched', async () => {
   const server = http.createServer((req, res) => {
-    if (req.url === '/healthz') { res.writeHead(200, { 'content-type': 'application/json' }); res.end('{"ok":true}'); return; }
+    if (req.url === '/healthz') { res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' }); res.end('ok'); return; }
     res.writeHead(404); res.end();
   });
   await listen(server);
@@ -322,15 +322,17 @@ await ta('a rebinding nameserver cannot re-aim the probe — the pinned address
 
 await ta('the pin is load-bearing on the REAL client: same URL, the pinned address decides where it lands', async () => {
   const server = http.createServer((req, res) => {
-    if (req.url === '/healthz') { res.writeHead(200); res.end('{"ok":true}'); return; }
+    if (req.url === '/healthz') { res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' }); res.end('ok'); return; }
+    if (req.url === '/api/bongos/healthz') { res.writeHead(200, { 'content-type': 'application/json' }); res.end('{"ok":true,"auth_configured":true}'); return; }
     res.writeHead(404); res.end();
   });
   await listen(server);
   const url = `http://pinned.invalid:${server.address().port}/healthz`;
   try {
-    // 'pinned.invalid' resolves nowhere; only the pin can make this connect.
+    // 'pinned.invalid' resolves nowhere; only the pin can make this connect — for the sign-in
+    // read (task 1004743) as much as for the up/down one.
     const hit = await liveness.probeHealthz(url, { timeoutMs: 3000, pin: { address: '127.0.0.1', family: 4 } });
-    assert.deepEqual(hit, { up: true, authConfigured: false }, 'the pinned address is what gets connected');
+    assert.deepEqual(hit, { up: true, authConfigured: true }, 'the pinned address is what both reads connect to');
     const miss = await liveness.probeHealthz(url, { timeoutMs: 3000, pin: { address: '127.0.0.2', family: 4 } });
     assert.equal(miss.up, false, 'a different pin cannot reach the same server — the pin, not DNS, decides');
   } finally {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.131",
+  "version": "1.21.133",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.131",
+      "version": "1.21.133",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.131",
+  "version": "1.21.133",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9788,5 +9788,17 @@
       "id": "1004577",
       "text": "Two projects whose GitHub sign-in actually worked no longer show it as failed; their setup checklists now point at the real next step."
     }
+  ],
+  "1.21.132": [
+    {
+      "id": "1004743",
+      "text": "A project whose GitHub sign-in already works now gets that step ticked on its setup checklist automatically, within about five minutes."
+    }
+  ],
+  "1.21.133": [
+    {
+      "id": "1003463",
+      "text": "The Goals page can now create a goal and add a done-when criterion to it."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.131'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.133'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');