@bongos/core 1.21.133 → 1.21.135

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.133",
-  "core_contract": "1.21.133",
-  "source_commit": "e3e005eed0218082a8724a9aa638657aced70c56",
+  "core_version": "1.21.135",
+  "core_contract": "1.21.135",
+  "source_commit": "92eebc078b819402dfac89117a1ea3cd6211094e",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T20:42:02.660Z",
+  "built_at": "2026-10-15T21:47:43.041Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 607,
+    "docs_redacted": 608,
     "agent_docs_stubbed": 28,
     "functional_verbatim": 3149,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3785,
-  "tree_sha256": "cf35d4f10854a481a256f0d2cec544ac8af781a48de1b57c1c1d796da2247311",
+  "file_count": 3786,
+  "tree_sha256": "eba8be00953d70046ec4a91b870c28a7382c4a8bee2294650001d9aff411caa2",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2369,10 +2369,15 @@
       "mode": "0000644",
       "sha256": "12602b29d3a701e7ad1e6c411f7cbf6de3c3148b9c08624b6197968de8079c5f"
     },
+    {
+      "path": "docs/adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md",
+      "mode": "0000644",
+      "sha256": "ae20b78283a004ba64d66cd0eec7db2c0d1a6ba211560e37f99d188a94f11668"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "6d2a97e2c7ce557aad5e82dd02c529dc05f0bdf6c014df9a812d3e65c7216763"
+      "sha256": "c5e8e4a27cf07799da677172e50a0c06d9be9bdf31f511416b40e392d268ffc0"
     },
     {
       "path": "docs/api-reference.md",
@@ -2407,12 +2412,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "999f2aebe366e15d3a90e5f5eae8895d083b6bfab971ce5dae5689abf746b148"
+      "sha256": "befe58f901848724fd48c74e38ee396b31d2f523313708dbfe90138b9f86a2b2"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "c2800908ad74f7719dd80dd441bd0720733f3219a45a43aa8e3aecb939bad703"
+      "sha256": "26b2738a40324254a1222b3493eafceb00d77dbe07bfc9a5c882f576901040e0"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2922,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "aea7064cd17fd4d1fc01c0200f2308dd2a86d619c5597a08ec6e48ed0fea84c1"
+      "sha256": "820f5b58bcabe2204f9afdd3b19cc08e487d4cc27b749dedeb5748f3a43e48e0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3012,7 +3017,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "688397e5f326c13764b78b90929ed54213c683df661043d357c37cfc85b8ce35"
+      "sha256": "7fefba487e6aee704f8d23d876d4db7720c9c1231ab61e94f5903f060d96c424"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5922,12 +5927,12 @@
     {
       "path": "modules/hall-ui/public/goal-author-lib.js",
       "mode": "0000644",
-      "sha256": "3d962593e1d29665ba54f4bb356291123e3cccf53178a1eab79838f7e54bd09d"
+      "sha256": "cacce0bf30ff04fbd040783aab51f53393259b537df7537664aedd084412eaef"
     },
     {
       "path": "modules/hall-ui/public/goal-author.js",
       "mode": "0000644",
-      "sha256": "e4d5355eb3d2a9c894cce901c20051f769e4817f85bb3ba0ec7ebe4d67921306"
+      "sha256": "ef1c80876cf921aa03f2eefc4f04efa40d97428d8c1537e070f6b16e1d137602"
     },
     {
       "path": "modules/hall-ui/public/goal-forest-lib.js",
@@ -10517,12 +10522,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1cd22cb8399eb1ee3a2d88e4daa62bf7e297bd5fe8c4b2dff3d479d22424397a"
+      "sha256": "9a1ff520eecca180a4845d8b3485c1d2045d5a04416b264ed007caf8d1903e84"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fab9569c9c6d74288d0600330226824092a5f614cad6dc56fa2aeadc66390562"
+      "sha256": "4f1a3afb1e80fd281507467f3ce7c3c6813882e18afe9225515566ae592dac87"
     },
     {
       "path": "public-docs/index.html",
@@ -10542,7 +10547,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f1ff443de9dc0455809075798cb9d83b321c92432a551e23531cd53487d9aad7"
+      "sha256": "e648eee9b85160b8871a678d78ba4ded897ef4e16b64d51047c796c88ecda2cd"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12897,7 +12902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e23647f9c7de84f53386722f8666995b6e49ee459ff78e037cef956c9d4874eb"
+      "sha256": "0ace35c177cb9560521ce1c86cb354981310dcce49e45ac31f527afb1002ff30"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14687,7 +14692,7 @@
     {
       "path": "tests/goal_author_ui.mjs",
       "mode": "0000644",
-      "sha256": "78d7caca514961f3f21a86de47bad2c76408434bbb887d302f9b688fb46387bf"
+      "sha256": "fe81fe8835244f6e98aad16fd46b304ac23bc0d755b74481b9d720f19af6c3d2"
     },
     {
       "path": "tests/goal_category.mjs",

package/docs/adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md

@@ -0,0 +1,64 @@
+# 0382 — A hardware security card is a passkey step-up check, switched on per builder by an Archon
+
+- **Status:** Proposed (research draft — nothing is built by this ADR)
+- **Date:** 2026-10-15
+- **Task:** task 1004676 (from idea 1001144)
+- **Decided by:** pending owner review
+- **Related:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (trust boundary: the server enforces)
+
+## Context
+
+A builder should be able to tap an NFC card on a reader to prove who they are before reaching sensitive features. The owner has an NFC biometric card with FIDO on it and wants to test it.
+
+Findings from the code (2026-10-15):
+
+1. **No passkey / WebAuthn support exists.** `grep` over `src/` and `package.json` finds nothing. Sign-in is GitHub OAuth (`src/bongos/auth-github.js`) or, for hosted projects, the hub as identity provider (`auth-idp.js`). Both end in the same `builder_sessions` row (`auth.js`), and rank is read fresh from the DB on every request.
+2. **A step-up check fits the existing gates.** `requireBuilder` / `requireRank` / `requirePermission` in `auth.js` already run per request, so one more gate can ask "has this session proven a card recently?".
+3. **A plain RFID / PC-SC reader is not needed.** A FIDO2 card is a standard WebAuthn authenticator: the browser talks to it over NFC (or USB). No driver or PC/SC middleware is required for this path.
+
+## Decision
+
+**D1 — Use WebAuthn (FIDO2) via a vetted library** (`@simplewebauthn/server` + `@simplewebauthn/browser`). No hand-rolled CBOR/COSE parsing.
+
+**D2 — The card is a second factor, never the first.** GitHub (or hub) sign-in stays. The card adds a *step-up*: a session that has done a card check in the last **10 minutes** may reach the protected actions. The proof is a timestamp column on the server-side `builder_sessions` row, set only by the verify route; nothing the client sends counts as proof.
+
+**D3 — Register first.** A builder registers a card while signed in the normal way. The requirement can only be switched on for a builder who has at least one registered credential, so nobody is locked out by a switch. The Archon route refuses (409) when the builder has no credential.
+
+**D4 — An Archon switches the requirement on or off per builder.** Default is off for everyone. The switch is a server-side flag on the builder, set through an Archon-ranked route (rank checked fresh, per ADR 0016). Local file edits cannot flip it.
+
+**D5 — What the card guards (first cut, owner to confirm):** rank changes, deploy / go-live, session revocation, and any payout or treasury action. Chosen as the actions where a stolen session does the most damage.
+
+**D6 — Challenge and credential hygiene.** Random single-use challenges, server-stored, short-lived; verify origin and RP ID; `userVerification: 'required'` (the card's biometric is the second proof); credentials table with `credential_id`, `public_key`, `sign_count`, `transports`, `aaguid`, `nickname`, `created_at`, `last_used_at`; an opaque random user handle, never the email. A `sign_count` that goes backwards (when the card reports a counter) fails the check and is logged as a possible clone. Indexes on `credential_id` and `builder_id`. Challenges carry a TTL and are swept.
+
+**D7 — RP ID.** The RP ID is the registrable domain. Changing it later invalidates every credential, so it is set once, by the owner. Hosted projects on other subdomains need their own decision (one RP ID per host, or the hub as the sole place a card is checked).
+
+**D8 — Recovery is its own decision, not part of this ADR.** The owner will define the lost-card protocol. Until then the Archon off-switch (D4) is the recovery path, and a builder may register more than one card.
+
+## Alternatives considered
+
+- **PC/SC reader middleware** reading the card's UID: rejected. A UID is a copyable identifier, not a cryptographic proof, and it needs drivers on every machine.
+- **Card as the only login:** rejected. It removes the fallback and makes a lost card a lockout.
+
+## Testing and rollout
+
+- **Local:** passkeys work on `http://localhost`. Chrome DevTools' virtual authenticator tests without hardware; the real card is tested on the owner's machine.
+- **Rollout:** ship with the switch off for everyone (safe to land); the owner turns it on for their own account and tries the real card on the live site; then an Archon enables it builder by builder as cards are handed out.
+
+## Hardware and cost
+
+One FIDO2 NFC card (owner already has one), plus an NFC reader only if the computer has no NFC (a FIDO-compatible USB NFC reader is roughly $20–40). Phones with NFC need nothing extra.
+
+## Follow-up tasks
+
+Filed from this research: tasks 1004746 (registration page), 1004747 (step-up gate), 1004748 (Archon switch), 1004749 (lost-card recovery), and idea 1001246 (WebAuthn foundation). Sizing: one dependency, one table, roughly five small tasks, about a working week in total.
+
+1. WebAuthn foundation: library, credentials table, challenge store.
+2. Card registration page for a signed-in builder (+ list / rename / remove).
+3. The step-up gate and the protected actions of D5.
+4. The Archon per-builder switch (D4) and its audit-log entry.
+5. Lost-card recovery (waits on the owner's protocol).
+
+## Consequences
+
+- One new dependency and one new table; no change to how anyone signs in until the switch is turned on.
+- The protected-action list must be kept in step with new sensitive routes (a fitness check is a worthwhile follow-up).

package/docs/adr/README.md

@@ -500,3 +500,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0379 | [**The treasury is pots per goal, a reserve, and borrowing, over real spend** ([task 1004712](https://cloudbongos.com/builders#/task/1004712), goal 1000111). **D1:** spend is cost_log through each task's goal, this month, read every time. **D2:** a pot is a budget the Treasury's holder gives a goal (`government_pots`, government_031). **D3:** the reserve is last month's spend no pot was given, less loans; it may be overdrawn. **D4:** a dry pot files a borrow (poller), its ask stored on `treasury_spending:<id>` and routed to the Treasury. **D5:** answered once (lend, half, no) by its seat. **D6:** the spend cap is a project setting, off by default. **D7:** the docket source and the hall's pots, reserve, beacon and book are real.](0379-the-treasury-is-pots-per-goal-a-reserve-and-borrowing-over-real-spend.md) | government / treasury / city |
 | 0380 | [**A strictness preset is a bundle of laws, switched by one laws vote and read from the laws in force** ([task 1004715](https://cloudbongos.com/builders#/task/1004715), goal 1000111). **D1:** Open workshop, Guild, Factory are catalogues of laws in `presets.js`; every lock names a stored personal setting. **D2:** a switch is ONE laws amendment through `board.proposeLaws` (`POST /government/board/presets`); only its passing writes. **D3:** the preset in force is read from the laws in force, never stored; nothing is seeded. **D4:** `GET /government/presets` says what each would lock; My agents and the Charter are real.](0380-a-strictness-preset-is-a-bundle-of-laws-switched-by-one-laws-vote.md) | government / laws / my agents |
 | 0381 | [**The hub moves each hosted project's core on its own, by that project's update rule** ([task 1004729](https://cloudbongos.com/builders#/task/1004729), goal 1000090). Amends ADR 0293's "not automatic" for hosted projects. **D1:** after each snapshot the runner queues a preflight for `recommended`, then the move once that preflight passed. **D2:** through `enqueueIntent` as `runner:auto-upgrade`; never the control-plane row. **D3:** one automatic intent per tick. **D4:** a target that already failed or was refused is held (read from existing rows; task 1004730 is the richer hold). **D5:** `BONGOS_AUTO_CORE_UPGRADE=off` stops it platform-wide; default on; `pinned` is the per-project switch.](0381-the-hub-moves-each-hosted-project-by-its-update-rule.md) | provisioning / core upgrade / automation |
+| 0382 | [**A hardware card is a passkey step-up check, switched on per builder by an Archon** ([task 1004676](https://cloudbongos.com/builders#/task/1004676), proposed). No WebAuthn exists today; sign-in is GitHub OAuth or the hub IdP. **D1:** WebAuthn via a vetted library. **D2:** the card is a second factor, a server-recorded step-up, never the first. **D3:** register first; the requirement needs a registered card. **D4:** an Archon switches it on per builder, default off. **D5:** guards rank changes, deploy, session revoke, payouts. No PC/SC reader needed. Rejected: PC/SC middleware, card as sole login.](0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md) | auth / security |

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2739 strings** across 3 surfaces · 2317 distinct pieces of copy · 2739 certain, 0 heuristic · 242 shown in more than one place.
+**2742 strings** across 3 surfaces · 2320 distinct pieces of copy · 2742 certain, 0 heuristic · 242 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 145 | 1931 |
+| `builders-hall` | `modules/hall-ui/public` | 145 | 1934 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 9 | 708 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8226c979db4d` | 3x | Not now | modules/hall-ui/public/collab.js:668, modules/hall-ui/public/paintbrush.js:119, modules/hall-ui/public/paintbrush.js:183 |
 | … | | _202 more in the JSON registry_ | |
 
-## `builders-hall` — 1931 strings
+## `builders-hall` — 1934 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -151,10 +151,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `524188fe0078` | certain | Active sessions | `modules/hall-ui/public/settings.html:159` |
 | `d628b36ec58e` | certain | Activity, by role | `modules/hall-ui/public/profile.html:138` |
 | `32509514479f` | certain | Add a done-when criterion | `modules/hall-ui/public/goal-author.js:38` |
+| `83beba462b20` | certain | Add a task | `modules/hall-ui/public/goal-author.js:38` |
 | `f4c5a03f715c` | certain | Add criterion | `modules/hall-ui/public/goal-author.js:38` |
 | `2b94171ce525` | certain | Add dependency | `modules/hall-ui/public/task.js:592` |
 | `a70b72ec4dcc` | certain | Add images | `modules/hall-ui/public/page-notes.js:120` |
 | `da8659b0099b` | certain | Add something you wrote — notes, a standard, a worked example. It is indexed for recall, not pasted into every | `modules/hall-ui/public/settings-specialities.js:354` |
+| `8b51e2e70cfb` | certain | Add task | `modules/hall-ui/public/goal-author.js:38` |
 | `82a8bd77d374` | certain | Add these ranks | `modules/hall-ui/public/government.js:929` |
 | `eded707fab69` | certain | Add to what it knows | `modules/hall-ui/public/settings-specialities.js:354` |
 | `cc4125ca7cff` | certain | Added to this version after it started building — an Archon override of the scope gate. Open the goal to see w | `modules/hall-ui/public/goals-render.js:194` |
@@ -641,6 +643,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ef224c9de7c8` | certain | Ideas — {{worldName}} | `modules/hall-ui/public/ideas.html:6` |
 | `9e9f8a44276b` | certain | Identity vouched | `modules/hall-ui/public/watch.js:396` |
 | `3c24eedc9f2d` | certain | If that page does not let you in, ask {…} to install it for you.{…} | `modules/hall-ui/public/settings-software-update.js:101` |
+| `65977bbcda48` | certain | If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finishe | `modules/hall-ui/public/goal-author.js:38` |
 | `7d6a7de7a69e` | certain | If the {…} has invited you, sign in with GitHub and you're in. If not, ask them for an invite — this project d | `modules/hall-ui/public/hall-render.js:292` |
 | `4ef9f2a4df3b` | certain | If you own this project, | `modules/hall-ui/public/deploy.js:424` |
 | `b6c47d4ee42c` | certain | Image key removed. | `modules/hall-ui/public/settings.js:1012` |
@@ -1365,7 +1368,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bcdbded93d4e` | certain | The work board failed to load. Reload to try again. | `modules/hall-ui/public/work.js:1214` |
 | `996d2aa0e2f0` | certain | Then copy the project onto your machine, install its dependencies, and sign in: | `modules/hall-ui/public/hall-render.js:837` |
 | `383018c7df70` | certain | There is no transcript you can read for this session. | `modules/hall-ui/public/sessions.js:234` |
-| `9f09494abfa1` | certain | These open goals look related — use one instead? | `modules/hall-ui/public/goal-author.js:125` |
+| `9f09494abfa1` | certain | These open goals look related — use one instead? | `modules/hall-ui/public/goal-author.js:144` |
 | `d6b9826f1bd3` | certain | These words are the studio page itself. Take the page, type over them here, and submit it from the editor when | `modules/hall-ui/public/studio.html:106` |
 | `775a73b066e3` | certain | These words come from the skill’s own description, which was written for Claude to recognise rather than for y | `modules/hall-ui/public/settings-specialities.js:128` |
 | `a0140098c0e0` | certain | They already have an invitation or a join-request pending on this goal. | `modules/hall-ui/public/goals-render.js:1302` |
@@ -1970,11 +1973,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e31a588bb9e1` | certain | — moved {…}, and the box confirmed it. | `modules/hall-ui/public/deploy.js:400` |
 | `417adabd1a00` | certain | — no goal suggested — open the goal board and pick one — | `modules/hall-ui/public/task-detail.js:412` |
 | `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:38` |
-| `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:109` |
+| `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:128` |
 | `da9962dc1729` | certain | — or open any diagram fullscreen. | `modules/hall-ui/public/diagrams.html:33` |
 | `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:38` |
-| `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:94` |
-| `825930577f01` | certain | — pick a version — | `modules/hall-ui/public/goal-author.js:106` |
+| `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:112` |
+| `825930577f01` | certain | — pick a version — | `modules/hall-ui/public/goal-author.js:125` |
 | `61ebc5d684fd` | certain | — stops the project and its nightly backups but keeps everything: its database, its backups and your repositor | `modules/hall-ui/public/project-settings.html:60` |
 | `e5c5e94152b3` | certain | — that's all the tooling you need up front. | `modules/hall-ui/public/hall-render.js:837` |
 | `85f1dd2ee732` | certain | — the whole project | `modules/hall-ui/public/goal-map.html:69` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2739,
-    "unique_ids": 2317,
-    "certain": 2739,
+    "strings": 2742,
+    "unique_ids": 2320,
+    "certain": 2742,
     "heuristic": 0,
     "duplicate_ids": 242
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 145,
-      "strings": 1931
+      "strings": 1934
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -2615,7 +2615,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goal-author.js:38",
-        "modules/hall-ui/public/goal-author.js:109"
+        "modules/hall-ui/public/goal-author.js:128"
       ]
     },
     {
@@ -2625,7 +2625,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goal-author.js:38",
-        "modules/hall-ui/public/goal-author.js:94"
+        "modules/hall-ui/public/goal-author.js:112"
       ]
     },
     {
@@ -3261,6 +3261,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "83beba462b20",
+      "surface": "builders-hall",
+      "text": "Add a task",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "f4c5a03f715c",
       "surface": "builders-hall",
@@ -3297,6 +3306,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "8b51e2e70cfb",
+      "surface": "builders-hall",
+      "text": "Add task",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "82a8bd77d374",
       "surface": "builders-hall",
@@ -7671,6 +7689,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "65977bbcda48",
+      "surface": "builders-hall",
+      "text": "If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finished.",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "7d6a7de7a69e",
       "surface": "builders-hall",
@@ -14192,7 +14219,7 @@
       "surface": "builders-hall",
       "text": "These open goals look related — use one instead?",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 125,
+      "line": 144,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19637,7 +19664,7 @@
       "surface": "builders-hall",
       "text": "— none —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 109,
+      "line": 128,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19664,7 +19691,7 @@
       "surface": "builders-hall",
       "text": "— pick a goal —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 94,
+      "line": 112,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19673,7 +19700,7 @@
       "surface": "builders-hall",
       "text": "— pick a version —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 106,
+      "line": 125,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3103,5 +3103,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.131 with no explicit bump. run 38783817499. (task 1002620)
   1.21.133 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.132 with no explicit bump. run 38803950047. (task 1002620)
+  1.21.134 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.133 with no explicit bump. run 38810062389. (task 1002620)
+  1.21.135 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.134 with no explicit bump. run 38812449926. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -1201,7 +1201,7 @@
       "surface": "builders",
       "title": "Goals",
       "states_read": ["list","filters","cards","detail","dependencies","out","uat","uat-panel","author"],
-      "files_hash": "f7f8e781b83d7c32",
+      "files_hash": "3f07bbb487b850ec",
       "reading_hash": "7aa1a6e1946dc077",
       "counts": {"lines":156,"placed":52,"shared":8,"unplaced":96},
       "omitted": {"data":268},

package/modules/hall-ui/public/goal-author-lib.js

@@ -89,6 +89,29 @@
     return null;
   }
 
+  // POST /tasks body (task 1003462). The goal and its version are the whole of
+  // what places a task; the server validates goal-belongs-to-version, the open
+  // goal, the rank floor and the kind/discipline inference, so none of those are
+  // sent or pre-checked here.
+  function buildTaskBody(f) {
+    const body = {
+      version_id: clean(f.version_id),
+      goal_id: Number(f.goal_id),
+      title: clean(f.title),
+    };
+    const description = clean(f.description);
+    if (description) body.description = description;
+    return body;
+  }
+
+  function taskFormProblem(f) {
+    if (!(Number(f.goal_id) > 0)) return 'Pick the goal this task belongs to.';
+    const t = clean(f.title);
+    if (!t) return 'Give the task a name.';
+    if (t.length > TITLE_MAX) return `Keep the name under ${TITLE_MAX} characters.`;
+    return null;
+  }
+
   // The refusal, in words. The server's envelope is { error: { code, message } };
   // an older route may send { error: 'code' } or { message }. A refusal the server
   // phrased keeps its own sentence — this only supplies one where the server sent
@@ -99,6 +122,7 @@
     criterion_exists: 'A criterion with that name already exists on this version. Reword the outcome slightly.',
     reserved_criterion_slug: 'That name looks like a position (C1, C2…). Reword the outcome.',
     bad_goal_id: 'That goal is not on this version.',
+    goal_id_required: 'Pick the goal this task belongs to.',
     goal_not_yours: 'Only a goal’s owner or manager (or an Archon) can add criteria to it.',
     version_not_found: 'That version no longer exists.',
   };
@@ -124,6 +148,6 @@
 
   window.OTBGoalAuthor = {
     TITLE_MAX, criterionSlug, buildGoalBody, goalFormProblem,
-    buildCriterionRequest, criterionFormProblem, refusalText, openVersions,
+    buildCriterionRequest, criterionFormProblem, buildTaskBody, taskFormProblem, refusalText, openVersions,
   };
 })();

package/modules/hall-ui/public/goal-author.js

@@ -2,7 +2,7 @@
 // panel (task 1003463, goal 1000089; ADR 0366 D1.2/D1.3 + D3). The hall could
 // SATISFY a criterion and never AUTHOR one, and had no POST /goals call at all.
 //
-// Two forms, nothing else:
+// Three forms, nothing else (the third, a task against a goal, is task 1003462):
 //   · GOAL — a name, a one-line subtitle, an optional longer description, the
 //     version, an optional category. NO scope field: the goal is created with
 //     spec_task:true, so it arrives with a "Spec goal N" task that gates its other
@@ -75,6 +75,23 @@
           <p class="goal-author__err" id="ga-crit-err" role="alert" hidden></p>
           <button type="submit" class="btn btn--primary" id="ga-crit-go">Add criterion</button>
         </form>
+
+        <h2 class="scroll__h goal-author__h2" id="ga-task-h">Add a task</h2>
+        <form id="ga-task" class="goal-author__form" novalidate aria-labelledby="ga-task-h">
+          <label class="goal-author__field">Goal
+            <select id="ga-task-goal" required><option value="">— pick a goal —</option></select>
+          </label>
+          <label class="goal-author__field">Name
+            <input id="ga-task-title" type="text" maxlength="${lib.TITLE_MAX}" autocomplete="off" required>
+          </label>
+          <label class="goal-author__field">Description <span class="goal-author__hint">optional</span>
+            <textarea id="ga-task-desc" rows="3"></textarea>
+          </label>
+          <p class="goal-author__note">If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finished.</p>
+          <p class="goal-author__note" id="ga-task-ok" role="status" aria-live="polite" hidden></p>
+          <p class="goal-author__err" id="ga-task-err" role="alert" hidden></p>
+          <button type="submit" class="btn btn--primary" id="ga-task-go">Add task</button>
+        </form>
       </section>`;
 
     const $q = (id) => root.querySelector(`#${id}`);
@@ -88,12 +105,14 @@
     }
 
     function fillGoalChoices() {
-      const sel = $q('ga-crit-goal');
-      const keep = sel.value;
       const goals = (getGoals() || []).filter((g) => g && g.status === 'open');
-      sel.innerHTML = '<option value="">— pick a goal —</option>' + goals.map((g) =>
-        `<option value="${escapeHtml(String(g.id))}" data-version="${escapeHtml(String(g.version_id || ''))}">${escapeHtml(`${g.version_id || ''} · ${g.title}`)}</option>`).join('');
-      sel.value = keep;
+      for (const id of ['ga-crit-goal', 'ga-task-goal']) {
+        const sel = $q(id);
+        const keep = sel.value;
+        sel.innerHTML = '<option value="">— pick a goal —</option>' + goals.map((g) =>
+          `<option value="${escapeHtml(String(g.id))}" data-version="${escapeHtml(String(g.version_id || ''))}">${escapeHtml(`${g.version_id || ''} · ${g.title}`)}</option>`).join('');
+        sel.value = keep;
+      }
     }
 
     async function loadChoices() {
@@ -191,6 +210,36 @@
         showErr('ga-crit-err', 'Could not reach the server. Try again in a moment.');
       } finally { btn.disabled = false; }
     });
+
+    // task 1003462 — a task against a goal. Sends what was typed to POST /tasks and
+    // lets the server's refusals (floor, goal/version, closed goal) speak.
+    $q('ga-task').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      showErr('ga-task-err', '');
+      const ok = $q('ga-task-ok');
+      ok.hidden = true;
+      const sel = $q('ga-task-goal');
+      const opt = sel.options[sel.selectedIndex];
+      const fields = {
+        goal_id: sel.value, version_id: opt ? opt.getAttribute('data-version') : '',
+        title: $q('ga-task-title').value, description: $q('ga-task-desc').value,
+      };
+      const problem = lib.taskFormProblem(fields);
+      if (problem) return showErr('ga-task-err', problem);
+      const btn = $q('ga-task-go');
+      btn.disabled = true;
+      try {
+        const res = await api.request('POST', `${API}/tasks`, { body: lib.buildTaskBody(fields) });
+        if (!res.ok) return showErr('ga-task-err', lib.refusalText(res.status, res.data));
+        const task = (res.data && res.data.task) || {};
+        $q('ga-task-title').value = '';
+        $q('ga-task-desc').value = '';
+        ok.textContent = task.id != null ? `Task ${task.id} added to the goal. It waits behind the goal’s spec task if that is not done yet.` : 'Task added.';
+        ok.hidden = false;
+      } catch (_) {
+        showErr('ga-task-err', 'Could not reach the server. Try again in a moment.');
+      } finally { btn.disabled = false; }
+    });
   }
 
   window.OTBGoalAuthorUI = { mount };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.133",
+  "version": "1.21.135",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.133",
+      "version": "1.21.135",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.133",
+  "version": "1.21.135",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9800,5 +9800,17 @@
       "id": "1003463",
       "text": "The Goals page can now create a goal and add a done-when criterion to it."
     }
+  ],
+  "1.21.134": [
+    {
+      "id": "1004676",
+      "text": "Researched adding a tap-your-security-card check to Bongos. Plan written up and follow-up build work filed."
+    }
+  ],
+  "1.21.135": [
+    {
+      "id": "1003462",
+      "text": "Adds an Add-a-task form to the Goals page: pick an open goal, name the task, optional description. Sends POST /tasks unchanged; the server's rank floor, goal/version and closed-goal refusals render as sentences. States that a"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.133'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.135'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/goal_author_ui.mjs

@@ -208,3 +208,30 @@ test('wall: both routes still sit behind their permission atoms', () => {
   assert.match(g, /router\.post\('\/goals', auth\.requireBuilder, auth\.requirePermission\('goal\.create'\)/);
   assert.match(d, /router\.post\('\/versions\/:id\/done-when', auth\.requireBuilder, auth\.requirePermission\('criterion\.create'\)/);
 });
+
+// ── 4. creating a task against a goal (task 1003462) ─────────────────────────
+
+test('the task body names the goal and its version and nothing the server owns', () => {
+  const body = lib.buildTaskBody({
+    version_id: ' V9 ', goal_id: '12', title: '  Write it down ', description: ' more ',
+    status: 'ready', requires_rank: 'xenos', credits_reward: 5, created_by: 'x',
+  });
+  assert.deepEqual(plain(body), { version_id: 'V9', goal_id: 12, title: 'Write it down', description: 'more' });
+});
+
+test('an empty description is omitted; the form asks only for goal and name', () => {
+  assert.deepEqual(plain(lib.buildTaskBody({ version_id: 'V9', goal_id: 3, title: 'x', description: '  ' })), { version_id: 'V9', goal_id: 3, title: 'x' });
+  assert.match(lib.taskFormProblem({ goal_id: '', title: 'x' }), /goal/i);
+  assert.match(lib.taskFormProblem({ goal_id: '3', title: ' ' }), /name/i);
+  assert.match(lib.taskFormProblem({ goal_id: '3', title: 'x'.repeat(lib.TITLE_MAX + 1) }), /under/);
+  assert.equal(lib.taskFormProblem({ goal_id: '3', title: 'x' }), null);
+});
+
+test('the task form is wired, reuses the suggester, and states the spec-task wait', () => {
+  const src = read('goal-author.js');
+  assert.match(src, /ga-task/);
+  assert.match(src, /buildTaskBody/);
+  assert.match(src, /\$\{API\}\/tasks`/);
+  assert.match(src, /waits behind/i);
+  assert.ok(!/requires_rank|task\.create/.test(src), 'no client-side authority pre-filter');
+});