@bongos/core 1.21.134 → 1.21.135

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.134",
-  "core_contract": "1.21.134",
-  "source_commit": "7f0bb837924e95ccff5e553a687b228eef70ce30",
+  "core_version": "1.21.135",
+  "core_contract": "1.21.135",
+  "source_commit": "92eebc078b819402dfac89117a1ea3cd6211094e",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T21:28:31.615Z",
+  "built_at": "2026-10-15T21:47:43.041Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3786,
-  "tree_sha256": "f5dfa49c3f439d7d10d733cc5f9c0940cf30172fa438d8757a49b7a6cd636fc8",
+  "tree_sha256": "eba8be00953d70046ec4a91b870c28a7382c4a8bee2294650001d9aff411caa2",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2412,12 +2412,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "999f2aebe366e15d3a90e5f5eae8895d083b6bfab971ce5dae5689abf746b148"
+      "sha256": "befe58f901848724fd48c74e38ee396b31d2f523313708dbfe90138b9f86a2b2"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "c2800908ad74f7719dd80dd441bd0720733f3219a45a43aa8e3aecb939bad703"
+      "sha256": "26b2738a40324254a1222b3493eafceb00d77dbe07bfc9a5c882f576901040e0"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e77d3f864bca9f90cc1dbf2cfedd61dc315a27bb37084bbc8873ed144e7afa64"
+      "sha256": "820f5b58bcabe2204f9afdd3b19cc08e487d4cc27b749dedeb5748f3a43e48e0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3017,7 +3017,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "688397e5f326c13764b78b90929ed54213c683df661043d357c37cfc85b8ce35"
+      "sha256": "7fefba487e6aee704f8d23d876d4db7720c9c1231ab61e94f5903f060d96c424"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5927,12 +5927,12 @@
     {
       "path": "modules/hall-ui/public/goal-author-lib.js",
       "mode": "0000644",
-      "sha256": "3d962593e1d29665ba54f4bb356291123e3cccf53178a1eab79838f7e54bd09d"
+      "sha256": "cacce0bf30ff04fbd040783aab51f53393259b537df7537664aedd084412eaef"
     },
     {
       "path": "modules/hall-ui/public/goal-author.js",
       "mode": "0000644",
-      "sha256": "e4d5355eb3d2a9c894cce901c20051f769e4817f85bb3ba0ec7ebe4d67921306"
+      "sha256": "ef1c80876cf921aa03f2eefc4f04efa40d97428d8c1537e070f6b16e1d137602"
     },
     {
       "path": "modules/hall-ui/public/goal-forest-lib.js",
@@ -10522,12 +10522,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "16a65f4d7586e27be39c10448d7a39a0782725e1c050655e08ed930e3dc50ed5"
+      "sha256": "9a1ff520eecca180a4845d8b3485c1d2045d5a04416b264ed007caf8d1903e84"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f6a3dfa7fb0820113d9448f1b011a6e2edaeb3f06656d9530e2dbea160e112f0"
+      "sha256": "4f1a3afb1e80fd281507467f3ce7c3c6813882e18afe9225515566ae592dac87"
     },
     {
       "path": "public-docs/index.html",
@@ -10547,7 +10547,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "0a7de5fe356b571a5dcaf748c830d457a365165d17b0d733594b6bfc89ef6267"
+      "sha256": "e648eee9b85160b8871a678d78ba4ded897ef4e16b64d51047c796c88ecda2cd"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12902,7 +12902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d253382a583b4d8ad6289d41cf1e5db7ebe264ed7bf54ab93b5b0b44f46b5135"
+      "sha256": "0ace35c177cb9560521ce1c86cb354981310dcce49e45ac31f527afb1002ff30"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14692,7 +14692,7 @@
     {
       "path": "tests/goal_author_ui.mjs",
       "mode": "0000644",
-      "sha256": "78d7caca514961f3f21a86de47bad2c76408434bbb887d302f9b688fb46387bf"
+      "sha256": "fe81fe8835244f6e98aad16fd46b304ac23bc0d755b74481b9d720f19af6c3d2"
     },
     {
       "path": "tests/goal_category.mjs",

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2739 strings** across 3 surfaces · 2317 distinct pieces of copy · 2739 certain, 0 heuristic · 242 shown in more than one place.
+**2742 strings** across 3 surfaces · 2320 distinct pieces of copy · 2742 certain, 0 heuristic · 242 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 145 | 1931 |
+| `builders-hall` | `modules/hall-ui/public` | 145 | 1934 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 9 | 708 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8226c979db4d` | 3x | Not now | modules/hall-ui/public/collab.js:668, modules/hall-ui/public/paintbrush.js:119, modules/hall-ui/public/paintbrush.js:183 |
 | … | | _202 more in the JSON registry_ | |
 
-## `builders-hall` — 1931 strings
+## `builders-hall` — 1934 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -151,10 +151,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `524188fe0078` | certain | Active sessions | `modules/hall-ui/public/settings.html:159` |
 | `d628b36ec58e` | certain | Activity, by role | `modules/hall-ui/public/profile.html:138` |
 | `32509514479f` | certain | Add a done-when criterion | `modules/hall-ui/public/goal-author.js:38` |
+| `83beba462b20` | certain | Add a task | `modules/hall-ui/public/goal-author.js:38` |
 | `f4c5a03f715c` | certain | Add criterion | `modules/hall-ui/public/goal-author.js:38` |
 | `2b94171ce525` | certain | Add dependency | `modules/hall-ui/public/task.js:592` |
 | `a70b72ec4dcc` | certain | Add images | `modules/hall-ui/public/page-notes.js:120` |
 | `da8659b0099b` | certain | Add something you wrote — notes, a standard, a worked example. It is indexed for recall, not pasted into every | `modules/hall-ui/public/settings-specialities.js:354` |
+| `8b51e2e70cfb` | certain | Add task | `modules/hall-ui/public/goal-author.js:38` |
 | `82a8bd77d374` | certain | Add these ranks | `modules/hall-ui/public/government.js:929` |
 | `eded707fab69` | certain | Add to what it knows | `modules/hall-ui/public/settings-specialities.js:354` |
 | `cc4125ca7cff` | certain | Added to this version after it started building — an Archon override of the scope gate. Open the goal to see w | `modules/hall-ui/public/goals-render.js:194` |
@@ -641,6 +643,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ef224c9de7c8` | certain | Ideas — {{worldName}} | `modules/hall-ui/public/ideas.html:6` |
 | `9e9f8a44276b` | certain | Identity vouched | `modules/hall-ui/public/watch.js:396` |
 | `3c24eedc9f2d` | certain | If that page does not let you in, ask {…} to install it for you.{…} | `modules/hall-ui/public/settings-software-update.js:101` |
+| `65977bbcda48` | certain | If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finishe | `modules/hall-ui/public/goal-author.js:38` |
 | `7d6a7de7a69e` | certain | If the {…} has invited you, sign in with GitHub and you're in. If not, ask them for an invite — this project d | `modules/hall-ui/public/hall-render.js:292` |
 | `4ef9f2a4df3b` | certain | If you own this project, | `modules/hall-ui/public/deploy.js:424` |
 | `b6c47d4ee42c` | certain | Image key removed. | `modules/hall-ui/public/settings.js:1012` |
@@ -1365,7 +1368,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bcdbded93d4e` | certain | The work board failed to load. Reload to try again. | `modules/hall-ui/public/work.js:1214` |
 | `996d2aa0e2f0` | certain | Then copy the project onto your machine, install its dependencies, and sign in: | `modules/hall-ui/public/hall-render.js:837` |
 | `383018c7df70` | certain | There is no transcript you can read for this session. | `modules/hall-ui/public/sessions.js:234` |
-| `9f09494abfa1` | certain | These open goals look related — use one instead? | `modules/hall-ui/public/goal-author.js:125` |
+| `9f09494abfa1` | certain | These open goals look related — use one instead? | `modules/hall-ui/public/goal-author.js:144` |
 | `d6b9826f1bd3` | certain | These words are the studio page itself. Take the page, type over them here, and submit it from the editor when | `modules/hall-ui/public/studio.html:106` |
 | `775a73b066e3` | certain | These words come from the skill’s own description, which was written for Claude to recognise rather than for y | `modules/hall-ui/public/settings-specialities.js:128` |
 | `a0140098c0e0` | certain | They already have an invitation or a join-request pending on this goal. | `modules/hall-ui/public/goals-render.js:1302` |
@@ -1970,11 +1973,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e31a588bb9e1` | certain | — moved {…}, and the box confirmed it. | `modules/hall-ui/public/deploy.js:400` |
 | `417adabd1a00` | certain | — no goal suggested — open the goal board and pick one — | `modules/hall-ui/public/task-detail.js:412` |
 | `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:38` |
-| `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:109` |
+| `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:128` |
 | `da9962dc1729` | certain | — or open any diagram fullscreen. | `modules/hall-ui/public/diagrams.html:33` |
 | `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:38` |
-| `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:94` |
-| `825930577f01` | certain | — pick a version — | `modules/hall-ui/public/goal-author.js:106` |
+| `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:112` |
+| `825930577f01` | certain | — pick a version — | `modules/hall-ui/public/goal-author.js:125` |
 | `61ebc5d684fd` | certain | — stops the project and its nightly backups but keeps everything: its database, its backups and your repositor | `modules/hall-ui/public/project-settings.html:60` |
 | `e5c5e94152b3` | certain | — that's all the tooling you need up front. | `modules/hall-ui/public/hall-render.js:837` |
 | `85f1dd2ee732` | certain | — the whole project | `modules/hall-ui/public/goal-map.html:69` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2739,
-    "unique_ids": 2317,
-    "certain": 2739,
+    "strings": 2742,
+    "unique_ids": 2320,
+    "certain": 2742,
     "heuristic": 0,
     "duplicate_ids": 242
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 145,
-      "strings": 1931
+      "strings": 1934
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -2615,7 +2615,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goal-author.js:38",
-        "modules/hall-ui/public/goal-author.js:109"
+        "modules/hall-ui/public/goal-author.js:128"
       ]
     },
     {
@@ -2625,7 +2625,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goal-author.js:38",
-        "modules/hall-ui/public/goal-author.js:94"
+        "modules/hall-ui/public/goal-author.js:112"
       ]
     },
     {
@@ -3261,6 +3261,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "83beba462b20",
+      "surface": "builders-hall",
+      "text": "Add a task",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "f4c5a03f715c",
       "surface": "builders-hall",
@@ -3297,6 +3306,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "8b51e2e70cfb",
+      "surface": "builders-hall",
+      "text": "Add task",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "82a8bd77d374",
       "surface": "builders-hall",
@@ -7671,6 +7689,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "65977bbcda48",
+      "surface": "builders-hall",
+      "text": "If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finished.",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "7d6a7de7a69e",
       "surface": "builders-hall",
@@ -14192,7 +14219,7 @@
       "surface": "builders-hall",
       "text": "These open goals look related — use one instead?",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 125,
+      "line": 144,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19637,7 +19664,7 @@
       "surface": "builders-hall",
       "text": "— none —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 109,
+      "line": 128,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19664,7 +19691,7 @@
       "surface": "builders-hall",
       "text": "— pick a goal —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 94,
+      "line": 112,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19673,7 +19700,7 @@
       "surface": "builders-hall",
       "text": "— pick a version —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 106,
+      "line": 125,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3105,5 +3105,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.132 with no explicit bump. run 38803950047. (task 1002620)
   1.21.134 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.133 with no explicit bump. run 38810062389. (task 1002620)
+  1.21.135 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.134 with no explicit bump. run 38812449926. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -1201,7 +1201,7 @@
       "surface": "builders",
       "title": "Goals",
       "states_read": ["list","filters","cards","detail","dependencies","out","uat","uat-panel","author"],
-      "files_hash": "f7f8e781b83d7c32",
+      "files_hash": "3f07bbb487b850ec",
       "reading_hash": "7aa1a6e1946dc077",
       "counts": {"lines":156,"placed":52,"shared":8,"unplaced":96},
       "omitted": {"data":268},

package/modules/hall-ui/public/goal-author-lib.js

@@ -89,6 +89,29 @@
     return null;
   }
 
+  // POST /tasks body (task 1003462). The goal and its version are the whole of
+  // what places a task; the server validates goal-belongs-to-version, the open
+  // goal, the rank floor and the kind/discipline inference, so none of those are
+  // sent or pre-checked here.
+  function buildTaskBody(f) {
+    const body = {
+      version_id: clean(f.version_id),
+      goal_id: Number(f.goal_id),
+      title: clean(f.title),
+    };
+    const description = clean(f.description);
+    if (description) body.description = description;
+    return body;
+  }
+
+  function taskFormProblem(f) {
+    if (!(Number(f.goal_id) > 0)) return 'Pick the goal this task belongs to.';
+    const t = clean(f.title);
+    if (!t) return 'Give the task a name.';
+    if (t.length > TITLE_MAX) return `Keep the name under ${TITLE_MAX} characters.`;
+    return null;
+  }
+
   // The refusal, in words. The server's envelope is { error: { code, message } };
   // an older route may send { error: 'code' } or { message }. A refusal the server
   // phrased keeps its own sentence — this only supplies one where the server sent
@@ -99,6 +122,7 @@
     criterion_exists: 'A criterion with that name already exists on this version. Reword the outcome slightly.',
     reserved_criterion_slug: 'That name looks like a position (C1, C2…). Reword the outcome.',
     bad_goal_id: 'That goal is not on this version.',
+    goal_id_required: 'Pick the goal this task belongs to.',
     goal_not_yours: 'Only a goal’s owner or manager (or an Archon) can add criteria to it.',
     version_not_found: 'That version no longer exists.',
   };
@@ -124,6 +148,6 @@
 
   window.OTBGoalAuthor = {
     TITLE_MAX, criterionSlug, buildGoalBody, goalFormProblem,
-    buildCriterionRequest, criterionFormProblem, refusalText, openVersions,
+    buildCriterionRequest, criterionFormProblem, buildTaskBody, taskFormProblem, refusalText, openVersions,
   };
 })();

package/modules/hall-ui/public/goal-author.js

@@ -2,7 +2,7 @@
 // panel (task 1003463, goal 1000089; ADR 0366 D1.2/D1.3 + D3). The hall could
 // SATISFY a criterion and never AUTHOR one, and had no POST /goals call at all.
 //
-// Two forms, nothing else:
+// Three forms, nothing else (the third, a task against a goal, is task 1003462):
 //   · GOAL — a name, a one-line subtitle, an optional longer description, the
 //     version, an optional category. NO scope field: the goal is created with
 //     spec_task:true, so it arrives with a "Spec goal N" task that gates its other
@@ -75,6 +75,23 @@
           <p class="goal-author__err" id="ga-crit-err" role="alert" hidden></p>
           <button type="submit" class="btn btn--primary" id="ga-crit-go">Add criterion</button>
         </form>
+
+        <h2 class="scroll__h goal-author__h2" id="ga-task-h">Add a task</h2>
+        <form id="ga-task" class="goal-author__form" novalidate aria-labelledby="ga-task-h">
+          <label class="goal-author__field">Goal
+            <select id="ga-task-goal" required><option value="">— pick a goal —</option></select>
+          </label>
+          <label class="goal-author__field">Name
+            <input id="ga-task-title" type="text" maxlength="${lib.TITLE_MAX}" autocomplete="off" required>
+          </label>
+          <label class="goal-author__field">Description <span class="goal-author__hint">optional</span>
+            <textarea id="ga-task-desc" rows="3"></textarea>
+          </label>
+          <p class="goal-author__note">If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finished.</p>
+          <p class="goal-author__note" id="ga-task-ok" role="status" aria-live="polite" hidden></p>
+          <p class="goal-author__err" id="ga-task-err" role="alert" hidden></p>
+          <button type="submit" class="btn btn--primary" id="ga-task-go">Add task</button>
+        </form>
       </section>`;
 
     const $q = (id) => root.querySelector(`#${id}`);
@@ -88,12 +105,14 @@
     }
 
     function fillGoalChoices() {
-      const sel = $q('ga-crit-goal');
-      const keep = sel.value;
       const goals = (getGoals() || []).filter((g) => g && g.status === 'open');
-      sel.innerHTML = '<option value="">— pick a goal —</option>' + goals.map((g) =>
-        `<option value="${escapeHtml(String(g.id))}" data-version="${escapeHtml(String(g.version_id || ''))}">${escapeHtml(`${g.version_id || ''} · ${g.title}`)}</option>`).join('');
-      sel.value = keep;
+      for (const id of ['ga-crit-goal', 'ga-task-goal']) {
+        const sel = $q(id);
+        const keep = sel.value;
+        sel.innerHTML = '<option value="">— pick a goal —</option>' + goals.map((g) =>
+          `<option value="${escapeHtml(String(g.id))}" data-version="${escapeHtml(String(g.version_id || ''))}">${escapeHtml(`${g.version_id || ''} · ${g.title}`)}</option>`).join('');
+        sel.value = keep;
+      }
     }
 
     async function loadChoices() {
@@ -191,6 +210,36 @@
         showErr('ga-crit-err', 'Could not reach the server. Try again in a moment.');
       } finally { btn.disabled = false; }
     });
+
+    // task 1003462 — a task against a goal. Sends what was typed to POST /tasks and
+    // lets the server's refusals (floor, goal/version, closed goal) speak.
+    $q('ga-task').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      showErr('ga-task-err', '');
+      const ok = $q('ga-task-ok');
+      ok.hidden = true;
+      const sel = $q('ga-task-goal');
+      const opt = sel.options[sel.selectedIndex];
+      const fields = {
+        goal_id: sel.value, version_id: opt ? opt.getAttribute('data-version') : '',
+        title: $q('ga-task-title').value, description: $q('ga-task-desc').value,
+      };
+      const problem = lib.taskFormProblem(fields);
+      if (problem) return showErr('ga-task-err', problem);
+      const btn = $q('ga-task-go');
+      btn.disabled = true;
+      try {
+        const res = await api.request('POST', `${API}/tasks`, { body: lib.buildTaskBody(fields) });
+        if (!res.ok) return showErr('ga-task-err', lib.refusalText(res.status, res.data));
+        const task = (res.data && res.data.task) || {};
+        $q('ga-task-title').value = '';
+        $q('ga-task-desc').value = '';
+        ok.textContent = task.id != null ? `Task ${task.id} added to the goal. It waits behind the goal’s spec task if that is not done yet.` : 'Task added.';
+        ok.hidden = false;
+      } catch (_) {
+        showErr('ga-task-err', 'Could not reach the server. Try again in a moment.');
+      } finally { btn.disabled = false; }
+    });
   }
 
   window.OTBGoalAuthorUI = { mount };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.134",
+  "version": "1.21.135",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.134",
+      "version": "1.21.135",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.134",
+  "version": "1.21.135",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9806,5 +9806,11 @@
       "id": "1004676",
       "text": "Researched adding a tap-your-security-card check to Bongos. Plan written up and follow-up build work filed."
     }
+  ],
+  "1.21.135": [
+    {
+      "id": "1003462",
+      "text": "Adds an Add-a-task form to the Goals page: pick an open goal, name the task, optional description. Sends POST /tasks unchanged; the server's rank floor, goal/version and closed-goal refusals render as sentences. States that a"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.134'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.135'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/goal_author_ui.mjs

@@ -208,3 +208,30 @@ test('wall: both routes still sit behind their permission atoms', () => {
   assert.match(g, /router\.post\('\/goals', auth\.requireBuilder, auth\.requirePermission\('goal\.create'\)/);
   assert.match(d, /router\.post\('\/versions\/:id\/done-when', auth\.requireBuilder, auth\.requirePermission\('criterion\.create'\)/);
 });
+
+// ── 4. creating a task against a goal (task 1003462) ─────────────────────────
+
+test('the task body names the goal and its version and nothing the server owns', () => {
+  const body = lib.buildTaskBody({
+    version_id: ' V9 ', goal_id: '12', title: '  Write it down ', description: ' more ',
+    status: 'ready', requires_rank: 'xenos', credits_reward: 5, created_by: 'x',
+  });
+  assert.deepEqual(plain(body), { version_id: 'V9', goal_id: 12, title: 'Write it down', description: 'more' });
+});
+
+test('an empty description is omitted; the form asks only for goal and name', () => {
+  assert.deepEqual(plain(lib.buildTaskBody({ version_id: 'V9', goal_id: 3, title: 'x', description: '  ' })), { version_id: 'V9', goal_id: 3, title: 'x' });
+  assert.match(lib.taskFormProblem({ goal_id: '', title: 'x' }), /goal/i);
+  assert.match(lib.taskFormProblem({ goal_id: '3', title: ' ' }), /name/i);
+  assert.match(lib.taskFormProblem({ goal_id: '3', title: 'x'.repeat(lib.TITLE_MAX + 1) }), /under/);
+  assert.equal(lib.taskFormProblem({ goal_id: '3', title: 'x' }), null);
+});
+
+test('the task form is wired, reuses the suggester, and states the spec-task wait', () => {
+  const src = read('goal-author.js');
+  assert.match(src, /ga-task/);
+  assert.match(src, /buildTaskBody/);
+  assert.match(src, /\$\{API\}\/tasks`/);
+  assert.match(src, /waits behind/i);
+  assert.ok(!/requires_rank|task\.create/.test(src), 'no client-side authority pre-filter');
+});