@bongos/core 1.21.175 → 1.21.176

package/scripts/bongos/seed-bongos-v1-idea-routing-tasks.js

@@ -0,0 +1,152 @@
+// DO NOT COPY THE `crit:` TOKENS FROM THIS FILE (task 1003108) — copy its
+// verifySeedCriteriaLinks tail instead, which is what this script is cited for.
+// Its positional "Cn" refs rank over the whole VERSION's criteria, so on a
+// multi-goal version they resolve to another goal's criterion silently (learning
+// 1000188). POST /tasks now refuses a positional ref there (400
+// ambiguous_criterion_ref). A new seed uses criterion_id SLUGS.
+//
+// Seed the tasks for goal 1000071 "Idea routing — work that has a home lands in it" (BONGOS-V1).
+// Source of truth: docs/specs/bongos-v1-idea-routing.md (status: final).
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+// Reference implementation (task 1003076) for the seeding contract's self-check:
+// ends by tallying the criterion_ids it actually POSTed and diffing that plan
+// against GET /goals/<id>'s real linked_tasks — see seed-verify-criteria.js.
+//
+// Run: node scripts/bongos/seed-bongos-v1-idea-routing-tasks.js
+const os = require('os');
+const { expectedCriterionCounts, verifySeedCriteriaLinks } = require('./seed-verify-criteria');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = sess.api_base.replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V1';
+const GOAL = 1000071;
+const SRC = 'planning-session';
+const META_TASK = 1003059;      // this planning session's meta task — moved into the goal
+const DISCORD_BUGS_IDEA = 1000771; // subsumed by R11; marked promoted against it
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(400); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/bongos${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// Landing matrix (interview-decided): bugs hard-land (Metic+ filer → ready; sub-Metic → backlog);
+// every other goal-bound kind soft-lands (backlog, one Metic+ promote away); homeless → inbox.
+//
+// crit uses the goal's criterion SLUGS via CRIT — positional "Cn" tokens resolve against the
+// whole VERSION's criterion order (and even matched an old criterion literally slugged "C1"),
+// which mislinked the first seed run; slugs are position-independent.
+const CRIT = {
+  C1: 'bug-lands-in-its-goal', C2: 'inbox-holds-only-homeless', C3: 'no-route-loses-the-author',
+  C4: 'filing-cannot-outrun-rank', C5: 'system-offers-the-home', C6: 'triage-shrinks-to-judgment',
+};
+const TASKS = [
+  // T1 — zero-dep layer — P5
+  { ref:'R02', kind:'infra',    disc:'engineer', prio:5, est:90,  crit:['C1','C3'], deps:[],                title:'R02 · Schema: idea_inbox.suggested_goal_id + lineage origin \'route\'', desc:'Core migration: nullable suggested_goal_id FK on idea_inbox (routing hint for soft-landed/Discord/homeless ideas). Module migration (ideas_*): extend ideas_task_lineage.origin CHECK with \'route\'. See docs/specs/bongos-v1-idea-routing.md.' },
+  { ref:'R03', kind:'bug',      disc:'engineer', prio:5, est:90,  crit:['C1'],      deps:[],                title:'R03 · Catch-all fallback never resolves to a non-building version', desc:'generalGoalIdForVersion (modules/lifecycle/db.js:1343) + the null-goal fallback (:1414): a task create must never land in a shipped/frozen version\'s catch-all goal (the 1000771 failure shape). Routed creates with no goal go to the inbox instead. Done-when: test proves a create against a shipped version cannot resolve a catch-all.' },
+  { ref:'R07', kind:'feature',  disc:'engineer', prio:5, est:120, crit:['C5'],      deps:[],                title:'R07 · Capture-time goal suggester (advisory consulted BEFORE creation)', desc:'Expose candidate goals for a draft capture — reuse buildGoalAdvisory\'s candidate logic (modules/lifecycle/goal-advisory.js:89) as a pre-creation read (e.g. GET /inbox/goal-suggestions?title=&kind=&version=). Feeds the hall picker (R08), CLI (R09), and Discord suggestion (R11). Done-when: candidates returned for a draft title/kind without creating anything.' },
+  { ref:'R10', kind:'feature',  disc:'ui',       prio:5, est:120, crit:['C5'],      deps:[],                title:'R10 · Hall move-a-task-to-goal affordance', desc:'PATCH /tasks/:id {goal_id} (task 1763) exists but has no hall UI. Add move-to-goal on the task overlay (Metic+, task.edit) so a wrong routing pick is one reassignment, never a re-file. Done-when: a Metic+ moves a task between same-version goals from the hall.' },
+  { ref:'R14', kind:'decision', disc:'engineer', prio:5, est:60,  crit:['C2'],      deps:[],                title:'R14 · ADR: idea routing — capture-time promotion, the landing matrix, the homeless-only inbox', desc:'Write the ADR recording: routing mechanism is capture-time promotion (never inbox bypass — the Discord #bugs lesson), the landing matrix (bugs hard-land by rank; other kinds soft-land; Full Ideas/criterion-proposals/decisions never auto-route), and the inbox\'s new identity (holds only work without a home). Source: docs/specs/bongos-v1-idea-routing.md interview decisions.' },
+
+  // T2 — the core mechanism — P5
+  { ref:'R01', kind:'feature',  disc:'engineer', prio:5, est:240, crit:['C1','C3'], deps:['R02'],           title:'R01 · Capture-time routing core: POST /inbox accepts goal_id and converts in one transaction', desc:'Extend inbox.captureIdea/route: when goal_id present and the landing matrix says route, one transaction writes the idea row (status=promoted, promoted_to_task_id), the task (in the goal, matrix-decided status), and ideas_task_lineage (origin=route). Validations: goal open + belongs to a building version; Full-grade and criterion-proposal/decision kinds never auto-route; goal-less capture behaves exactly as today. Deps R02.' },
+
+  // T3 — enforcement + surfaces — P4
+  { ref:'R05', kind:'feature',  disc:'engineer', prio:4, est:150, crit:['C4'],      deps:['R01'],           title:'R05 · Rank-aware landing: matrix enforcement server-side', desc:'Metic+ filer\'s bug → status=ready; sub-Metic filer / any non-bug kind → backlog (awaiting any Metic+ promote via the existing task.promote, surfaced in the Needs-your-attention slice). Auto-derived requires_rank floors (ADR 0084) and the goal scope wall run on routed tasks exactly as on authored ones. Deps R01.' },
+  { ref:'R11', kind:'feature',  disc:'engineer', prio:4, est:180, crit:['C1','C3'], deps:['R01'],           title:'R11 · Discord #bugs retired onto the routing path', desc:'Replace discord-bugs.js\'s direct createTask bypass (hardcoded GDS-V3 → goal 1000002 catch-all; destroys attribution) with capture-time routing: idea row + classifier-suggested goal (suggested_goal_id), soft-landing into the pending queue for a one-click Metic+ route. Unlinked authors still yield an attributable idea row (captured_by null). Closes inbox idea 1000771. Deps R01.' },
+  { ref:'R12', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C5'],      deps:['R02'],           title:'R12 · Discord #ideas carries routing hints', desc:'The #ideas inbound (discord-inbound.js) files with no suggested_version at all today. Add: default suggested_version (most-recent building), classifier-suggested suggested_goal_id. Deps R02.' },
+  { ref:'R08', kind:'feature',  disc:'ui',       prio:4, est:240, crit:['C1','C5'], deps:['R01','R07'],     title:'R08 · Hall filing surface: file a bug/idea with a goal picker', desc:'The hall has NO capture surface today (triage only). Add file-a-bug/idea: title, body, kind, goal picker fed by the suggester (R07); submits to POST /inbox with goal_id so goal-bound work routes at filing time. Grade capture untouched. Deps R01,R07.' },
+  { ref:'R09', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C1','C5'], deps:['R01','R07'],     title:'R09 · CLI capture routing: --goal, suggester prompt, active-claim default', desc:'capture.js gains --goal; when the builder holds a claim the suggested goal defaults to the claim\'s goal (interview decision 4); suggester candidates offered otherwise. Deps R01,R07.' },
+  { ref:'R13', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C2','C6'], deps:['R07'],           title:'R13 · Promote path passes goal_id; /idea-triage goes homeless-only', desc:'task-detail.js (:320) and triage.js (:160) finally send goal_id (suggester-fed default) so even triaged promotions land in a real goal; the /idea-triage skill doc is updated to the homeless-only contract. Deps R07.' },
+
+  // T4 — proofs — P3
+  { ref:'R04', kind:'verify',   disc:'engineer', prio:3, est:90,  crit:['C3'],      deps:['R01'],           title:'R04 · PROOF: attribution survives the route end-to-end', desc:'A routed bug\'s task ships; sourceIdeaForTask returns the filer; ideas_task_lineage (origin=route) + captured_by intact — the trail goal 1000067\'s ideator credit will pay against (test). Deps R01.' },
+  { ref:'R06', kind:'verify',   disc:'engineer', prio:3, est:120, crit:['C4'],      deps:['R05'],           title:'R06 · PROOF: abuse matrix — filing cannot escalate', desc:'A Xenos mass-filing bugs never lands claimable work, never reaches protected scope, rate limits hold; a sub-Metic cannot reach ready via any capture vector (test suite). Deps R05.' },
+
+  // T5 — the measured close — P2
+  { ref:'R15', kind:'verify',   disc:'engineer', prio:2, est:120, crit:['C2','C6'], deps:['R01','R05','R13'], title:'R15 · PROOF: reclassification sweep of the open inbox', desc:'Walk the open idea_inbox (~50 rows at planning time; 14 bugs) under the new rules: every goal-bound bug homed in a real goal; residual inbox is homeless-only; before/after counts recorded in this task\'s notes as the goal\'s measured evidence. Deps R01,R05,R13.' },
+];
+
+const ROOTS = ['R02', 'R03', 'R07', 'R10', 'R14']; // zero-dep, non-spike → open for claiming
+
+(async () => {
+  const idByRef = {};
+  let created = 0, existing = 0;
+  // Resolved (post-CRIT-mapping) criterion_ids per task — the plan the final
+  // self-check diffs against, kept in lockstep with what's actually POSTed
+  // below rather than re-derived from the raw "Cn" tokens.
+  const criterionIdListsPerTask = [];
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const criterionIds = t.crit.map((c) => CRIT[c]);
+    const r = await api('POST', '/tasks', {
+      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc,
+      kind: t.kind, discipline: t.disc, priority: t.prio, est_minutes: t.est,
+      criterion_ids: criterionIds, source: SRC, source_ref: `bongos-v1-idea-routing-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    // Only a task that actually landed contributes to the self-check's plan —
+    // a failed POST is already reported above as FAILED, not as a criterion
+    // mismatch (task 1003076 grade finding: counting it here regardless of
+    // r.ok blamed a real create failure on the wrong cause).
+    criterionIdListsPerTask.push(criterionIds);
+    const task = r.json.task || r.json;
+    idByRef[t.ref] = task.id;
+    if (r.json.idempotent || r.json.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    const depIds = t.deps.map((d) => idByRef[d]).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) { console.log(`  ${t.ref}: dep resolve gap, skipping`); continue; }
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) { console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    edges += (r.json.added || depIds.length);
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting the zero-dep layer to ready…');
+  for (const ref of ROOTS) {
+    const id = idByRef[ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.json).slice(0, 120)}`);
+  }
+
+  console.log('Linking provenance…');
+  if (idByRef.R11) {
+    const r = await api('PATCH', `/inbox/${DISCORD_BUGS_IDEA}`, { status: 'promoted', promoted_to_task_id: Number(idByRef.R11) });
+    console.log(`  idea ${DISCORD_BUGS_IDEA} → ${r.ok ? `promoted against R11 (task ${idByRef.R11})` : 'PATCH note ' + JSON.stringify(r.json).slice(0, 160)}`);
+  }
+  const meta = await api('PATCH', `/tasks/${META_TASK}`, { goal_id: GOAL });
+  console.log(`  meta task ${META_TASK} → ${meta.ok ? `goal ${GOAL}` : 'PATCH note ' + JSON.stringify(meta.json).slice(0, 160)}`);
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}. Roots opened: ${ROOTS.join(', ')}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+
+  // Self-check (task 1003076): fetch the goal back and confirm every
+  // criterion's linked_tasks matches what was actually POSTed — exits 1 loudly
+  // on any mismatch instead of a seed that mislinks and reports success.
+  console.log('Verifying criterion links against the plan…');
+  await verifySeedCriteriaLinks({
+    goalId: GOAL,
+    expectedCounts: expectedCriterionCounts(criterionIdListsPerTask),
+    fetchGoal: (id) => api('GET', `/goals/${id}`),
+  });
+})();

package/scripts/bongos/seed-bongos-v1-seo-tasks.js

@@ -0,0 +1,104 @@
+// Seed the tasks for goal 1000048 "SEO & public discoverability — rankable per-project
+// profiles" (BONGOS-V1, internal). Source of truth:
+// docs/specs/bongos-v1-seo-public-discoverability.md (status: final).
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+//
+// Run: node scripts/bongos/seed-bongos-v1-seo-tasks.js
+const os = require('os');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = (sess.api_base || 'https://cloudbongos.com').replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V1';
+const GOAL = 1000048;
+const SRC = 'planning-session';
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(400); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/bongos${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// criterion slugs (position-independent — the goal's done_when_criteria.criterion_id)
+const PP = 'seo-project-profile-page', NS = 'seo-toplevel-namespace', PC = 'seo-project-content',
+  PM = 'seo-page-metadata', CC = 'seo-canonical-consolidation', SR = 'seo-sitemap-robots',
+  VG = 'seo-visibility-gated', SB = 'seo-site-baseline';
+
+// disc: engineer (backend/API/spike) | ui (page/markup/meta). kind: spike | feature | refactor | infra | verify (proofs).
+// deps: 'R##' resolve to the just-created id; a NUMBER is a real cross-goal task id, passed through.
+const TASKS = [
+  { ref:'R01', kind:'spike',   disc:'engineer', prio:5, est:180, crit:[PP,NS,PM,CC], deps:[],           title:'R01 · SEO + namespace architecture ADR', desc:'Needs-exploration: profile-page rendering (server-rendered HTML from the Node/Express hub), routing precedence (/<slug> vs /bongos/* vs /api/*), the owner-picked slug model + reserved-word list, the cross-instance canonical mechanism, and how the profile reads goal-1000046 setup content. Output an ADR + confirmed sub-tasks. See docs/specs/bongos-v1-seo-public-discoverability.md.' },
+  { ref:'R02', kind:'feature', disc:'engineer', prio:5, est:240, crit:[PP,NS],       deps:['R01'],      title:'R02 · Owner-picked slug at creation + reserved-name validation + backfill', desc:'Projects get a unique owner-chosen vanity slug at creation (username-style), validated vs a reserved list (bongos, api, sso, gate, create, explore, builders, status, assets, sitemap.xml, robots.txt, ...). Auto-derive + backfill a default slug for existing projects (owner can change). Adds a step to the creation flow — coordinate with goals 1000035/1000046. Deps R01.' },
+  { ref:'R03', kind:'refactor',disc:'engineer', prio:5, est:240, crit:[NS],          deps:['R01'],      title:'R03 · Move platform pages under /bongos/… ; top-level /<slug> resolves to a project', desc:'Serve hall/status/create/explore/gate under /bongos/… with 301 redirects from old paths; never move /api, /sso, /auth, /.well-known. Top-level /<slug> resolves to a project profile after the reserved-word check. Deps R01.' },
+  { ref:'R04', kind:'feature', disc:'ui',       prio:5, est:240, crit:[PP,PM],       deps:['R02','R03'],title:'R04 · Server-rendered project profile page at /<slug>', desc:'Crawlable server-rendered HTML: project name, description, cover art, builders, tech/modules, and a prominent "Open the live app" CTA. This page is the primary shareable destination. Deps R02,R03.' },
+  { ref:'R05', kind:'feature', disc:'ui',       prio:4, est:180, crit:[PC],          deps:['R04'],      title:'R05 · Render goal-1000046 setup content on the profile + auto-derive SEO copy', desc:'Read the project\'s setup content (goal 1000046) and render it on the profile; auto-derive SEO title/description from it. No separate editor (per interview). Coordinate with 1000046 — needs a real description + tags; render current fields (name/tagline) meanwhile and enrich as 1000046 lands. Deps R04.' },
+  { ref:'R06', kind:'feature', disc:'ui',       prio:4, est:150, crit:[PM,CC],       deps:['R04'],      title:'R06 · Per-page SEO metadata (title/description/OG/Twitter/self-canonical)', desc:'Dynamic <title>, meta description, Open Graph + Twitter card tags, and a self-referencing canonical on each profile. Deps R04.' },
+  { ref:'R07', kind:'feature', disc:'ui',       prio:4, est:120, crit:[PM],          deps:['R04'],      title:'R07 · JSON-LD structured data on profiles', desc:'Emit SoftwareApplication/CreativeWork JSON-LD on each profile page. Deps R04.' },
+  { ref:'R08', kind:'feature', disc:'ui',       prio:4, est:150, crit:[PP],          deps:['R04'],      title:'R08 · Route discovery through profiles (orbs + links → /<slug>)', desc:'Make /<slug> the shareable destination: orbs cards and "view project" links point to the profile, which carries the "Open the live app" CTA — maximizing internal links to the ranking page. Deps R04. NOTE: the orbs front door is a separate static site — the orbs-side link change likely lands instance-side.' },
+  { ref:'R09', kind:'feature', disc:'ui',       prio:4, est:180, crit:[PP,SR],       deps:['R04'],      title:'R09 · Crawlable projects directory via the orbs table-view', desc:'Make the orbs page\'s table view a server-rendered, crawlable, indexable HTML index of all Public projects (a plain-link list to each /<slug>), linked from the landing. This IS the directory (no separate directory page, per interview). Deps R04.' },
+  { ref:'R10', kind:'feature', disc:'engineer', prio:4, est:180, crit:[SR],          deps:['R04','R11'],title:'R10 · sitemap.xml (public projects + core pages)', desc:'Auto-generated sitemap.xml at /sitemap.xml listing all Public project profiles + core pages; regenerates on project create/update/visibility-change (cached). Deps R04,R11.' },
+  { ref:'R11', kind:'feature', disc:'engineer', prio:4, est:210, crit:[VG],          deps:['R04'],      title:'R11 · Visibility-gated indexing (visibility metaphor)', desc:'Public→full indexable profile; Private (star)→minimal page + join/request CTA, noindex; Stealth (black hole)→404; Unlisted (dark matter)→no public page until published. HARD conceptual dependency on goal 1000046\'s visibility states (not yet seeded) — coordinate; gate on the state field once it exists. Deps R04.' },
+  { ref:'R12', kind:'feature', disc:'engineer', prio:3, est:120, crit:[SR],          deps:['R10'],      title:'R12 · robots.txt', desc:'Serve robots.txt: allow public pages, disallow /api + internal, reference /sitemap.xml. Deps R10.' },
+  { ref:'R13', kind:'feature', disc:'engineer', prio:3, est:240, crit:[CC],          deps:['R04'],      title:'R13 · Cross-instance canonical (full scope)', desc:'rel=canonical from each live instance back to its hub profile: federated/co-tenant instances emit it; hub-hosted subdomains when that tier lands; publish a documented canonical snippet for self-hosted owners. Touches instance-side core rendering → Metic+ auto-floor. Coordinate with provisioning/federation (goals 1000032/1000041). Deps R04.' },
+  { ref:'R14', kind:'feature', disc:'ui',       prio:3, est:210, crit:[PP,PM],       deps:['R04',1002278], title:'R14 · Public builder-profile SEO page (handle-based path)', desc:'Server-rendered, SEO-optimized public builder profile at a handle path (e.g. /u/<handle>): metadata + Person/ProfilePage JSON-LD, crawlable HTML. Extends goal 1000045\'s builder profiles with a public, rankable rendering. Deps R04 + goal-1000045 profile API (task 1002278).' },
+  { ref:'R15', kind:'feature', disc:'engineer', prio:3, est:150, crit:[SR,VG],       deps:['R14','R10'],title:'R15 · Builder profiles in sitemap, consent-gated', desc:'Add consented/public builder profiles to sitemap.xml; honor goal-1000045\'s hide/opt-out flag (coordinate with 1000045 R03). Non-consented builders excluded/noindex. Deps R14,R10.' },
+  { ref:'R16', kind:'feature', disc:'ui',       prio:2, est:120, crit:[PC],          deps:['R05'],      title:'R16 · SEO content nudges in the setup/edit flow', desc:'Rule-based nudges where owners author content (goal 1000046 setup/edit): description length, tags, cover image — so profiles have enough real text to rank. Coordinate with 1000046. Deps R05.' },
+  { ref:'R17', kind:'feature', disc:'ui',       prio:3, est:150, crit:[SB],          deps:['R01'],      title:'R17 · Landing + Explore SEO metadata', desc:'Give the landing page (goal 1000031) and the Explore page proper title/description/Open Graph/structured data and ensure they are indexable. Coordinate with 1000031. Deps R01.' },
+  { ref:'R18', kind:'infra',   disc:'engineer', prio:2, est:180, crit:[SB],          deps:['R04'],      title:'R18 · Technical-SEO + Core Web Vitals pass', desc:'Audit + fix technical SEO across public pages: mobile-friendly, load speed / Core Web Vitals, indexability. Deps R04.' },
+  { ref:'R19', kind:'verify',  disc:'engineer', prio:2, est:120, crit:[PP,PM,CC,SR,VG,PC], deps:['R04','R06','R07','R10','R11','R14','R15'], title:'R19 · PROOF: a public project + builder profile rank-ready; non-public hidden', desc:'End-to-end proof: a real Public project profile is live at cloudbongos.com/<slug> with correct metadata + JSON-LD, appears in sitemap.xml, passes Google Rich Results + mobile-friendly tests; a public builder profile is likewise rank-ready; and a Private project is noindex + absent from the sitemap (Stealth 404s). Deps R04,R06,R07,R10,R11,R14,R15.' },
+];
+
+const ROOTS = ['R01']; // zero-dep entry task to open for claiming
+
+(async () => {
+  const idByRef = {};
+  let created = 0, existing = 0;
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc,
+      kind: t.kind, discipline: t.disc, priority: t.prio, est_minutes: t.est,
+      criterion_ids: t.crit, source: SRC, source_ref: `bv1-seo-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    const task = r.json.task || r.json;
+    idByRef[t.ref] = task.id;
+    if (r.json.idempotent || r.json.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    const depIds = t.deps.map((d) => (typeof d === 'number' ? d : idByRef[d])).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) { console.log(`  ${t.ref}: dep resolve gap, skipping`); continue; }
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) { console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    edges += (r.json.added || depIds.length);
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting root(s) to ready…');
+  for (const ref of ROOTS) {
+    const id = idByRef[ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.json).slice(0, 120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}. Roots opened: ${ROOTS.join(', ')}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();

package/scripts/bongos/seed-bv1-community-tasks.js

@@ -0,0 +1,131 @@
+// Seed the community-tab build tasks the 1002782 spike scoped, into the
+// community-surface goal (created by the spike; pass --goal <id>).
+//
+// Source of truth: docs/specs/bongos-v1-community-tab.md (owner-signed
+// 2026-08-16: own goal; builder-of-week auto-computed). Idempotent on
+// source_ref bv1-community-CTn; safe to re-run (tasks re-home if --goal moves).
+//
+// Run: node scripts/bongos/seed-bv1-community-tasks.js --goal 1000065
+
+const { apiCall, arg } = require('./cli-lib');
+
+const VER = 'BONGOS-V1';
+const SRC = 'planning-session';
+const SPEC = 'docs/specs/bongos-v1-community-tab.md';
+
+// Cross-goal dependency: the shared privacy predicate (privacy spike PV2).
+const PV2 = 1002967;
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function api(method, path, body, _tries = 0) {
+  await sleep(1500);
+  const r = await apiCall(method, `/api/bongos${path}`, body);
+  if (r.status === 429 && _tries < 8) {
+    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return r;
+}
+
+const NEW_TASKS = [
+  {
+    ref: 'CT1', kind: 'feature', prio: 3, est: 120, crit: ['CS5'], deps: [], ready: true,
+    title: 'Windowed data plane: activity snapshots appended on changed-totals rollup reports',
+    desc: `New table platform_identity_activity_snapshots (client_id, github_id, credits, tasks_shipped, karma, reported_at) — additive platform_identity_* migration — plus one INSERT on the existing rollup-report path, skipped when totals are unchanged. Window value per builder = latest totals minus last snapshot at-or-before window start, summed across projects; missing baseline counts from zero. Reporting-time (not earning-time) semantics — document honestly, options B/C recorded in ${SPEC} D2. Compaction (daily granularity after 90 days) is a later, volume-triggered task: note it in this task's handoff, do not build it.`,
+  },
+  {
+    ref: 'CT2', kind: 'feature', prio: 3, est: 180, crit: ['CS1', 'CS5'], deps: ['CT1', PV2],
+    title: 'Windowed leaderboard API: GET /community/leaderboard',
+    desc: `Public endpoint: ?window=7d|30d|365d|all&discipline=. All-time reads the existing rollup; windowed reads CT1 deltas. Eligibility via the SHARED privacy predicate (task ${PV2} / privacy spike PV2) — active + public + stats shown; no surface-local variant. Columns: credits (rank), tasks_shipped, karma; response identical for every viewer. ${SPEC} D3.`,
+  },
+  {
+    ref: 'CT3', kind: 'feature', prio: 3, est: 120, crit: ['CS2'], deps: [PV2],
+    title: 'Builder search API: name + discipline under public-profile rules',
+    desc: `Public search over active+public accounts: handle/display-name prefix + trigram, discipline filter. Matrix consequences: hide_stats accounts findable by NAME but excluded from discipline-FILTERED results (disciplines are rollup-derived); private + provisional absent. This is not the recruiting search — the discoverable sliver population never appears here. ${SPEC} D4.`,
+  },
+  {
+    ref: 'CT4', kind: 'feature', prio: 3, est: 180, crit: ['CS1', 'CS2'], deps: ['CT2', 'CT3'],
+    title: 'The /community page: leaderboards + search + feature cards',
+    desc: `The public tab on the hub apex (status-ui, beside Explore): leaderboard windows + discipline tabs, search, builder-of-week + rising-builder card slots, server-render-friendly markup (goal 1000048 indexes later; their specifics). 'community' is already in the reserved slug list (edited by spike 1002782). ${SPEC} D1/D3/D4.`,
+  },
+  {
+    ref: 'CT5', kind: 'feature', prio: 3, est: 120, crit: ['CS3'], deps: ['CT2'],
+    title: 'Builder of the Week: crown-at-render + weekly_features table + archive',
+    desc: `Owner-signed formula: top 7d credit delta among leaderboard-eligible builders, floor one shipped work in window, ties by ships then karma. Crowned at first render after Monday 00:00 UTC and recorded to platform_identity_weekly_features (github_id, week_start, credits_delta, ships_delta) so the crown is pinned and the archive section renders from real rows. No cron. Formula shown on the page. ${SPEC} D5.`,
+  },
+  {
+    ref: 'CT6', kind: 'feature', prio: 4, est: 90, crit: ['CS4'], deps: ['CT4'],
+    title: 'Recruit affordance for project.recruit holders',
+    desc: `Leaderboard rows + search results grow a Recruit button rendered only for holders of project.recruit (the console wave's atom — coordinate spike 1002786 R2/R4), linking into the console invite flow. A door to a gated surface, never a data reveal. ${SPEC} D6.`,
+  },
+  {
+    ref: 'CT7', kind: 'feature', prio: 4, est: 90, crit: ['CS1'], deps: ['CT2'],
+    title: 'Rising builder + most-active-projects cards',
+    desc: `Rising builder: biggest relative 30d delta on a small all-time base (same CT1 snapshots). Most-active projects: the snapshots aggregated on the project axis, a strip on the community tab (orb-sizing reuse is goal 1000044 territory — feed it, don't build it here). ${SPEC} D7 items 1-2.`,
+  },
+  {
+    ref: 'CT8', kind: 'infra', prio: 4, est: 90, crit: ['CS3'], deps: ['CT2', 'CT5'],
+    title: 'Weekly Discord community digest',
+    desc: `A scheduled routine posting top movers + builder of the week via the existing postWebhook plumbing (scripts/discord/lib.js channels). Owner-audience copy, no jargon. ${SPEC} D7 item 4.`,
+  },
+  {
+    ref: 'CT9', kind: 'verify', prio: 3, est: 90, crit: ['CS1', 'CS2', 'CS3'], deps: ['CT2', 'CT3', 'CT4', 'CT5'],
+    title: 'PROOF: matrix enforcement + window math on the community surfaces',
+    desc: `Seed fixture accounts in every privacy state and snapshot rows across window boundaries; assert: private/provisional/hidden absent from every board, search result, feature card; name-vs-discipline search asymmetry for hide_stats; window deltas exact against the seeded snapshots; anonymous and signed-in responses identical. ${SPEC} D8.`,
+  },
+];
+
+(async () => {
+  const goalId = Number(arg('--goal'));
+  if (!goalId) {
+    console.error('usage: node scripts/bongos/seed-bv1-community-tasks.js --goal <id>');
+    process.exit(2);
+  }
+  console.log(`Seeding community-tab tasks under goal ${goalId} (${VER})…`);
+  const idByRef = {};
+  let created = 0, existing = 0;
+
+  for (const t of NEW_TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER,
+      goal_id: goalId,
+      title: t.title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: 'engineer',
+      priority: t.prio,
+      est_minutes: t.est,
+      criterion_ids: t.crit,
+      source: SRC,
+      source_ref: `bv1-community-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`); continue; }
+    const task = r.data.task || r.data;
+    idByRef[t.ref] = Number(task.id);
+    if (r.data.idempotent || r.data.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}, P${t.prio})`);
+  }
+
+  console.log('Wiring dependencies…');
+  for (const t of NEW_TASKS.filter((x) => x.deps.length)) {
+    const id = idByRef[t.ref];
+    const deps = t.deps.map((d) => (typeof d === 'number' ? d : idByRef[d])).filter(Boolean);
+    if (!id || !deps.length) continue;
+    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: deps });
+    console.log(`  ${t.ref} (task ${id}) depends on [${deps.join(', ')}]: ${r.ok ? 'ok' : 'FAILED ' + r.status + ' ' + JSON.stringify(r.data).slice(0, 160)}`);
+  }
+
+  console.log('Promoting the zero-dep root…');
+  for (const t of NEW_TASKS.filter((x) => x.ready)) {
+    const id = idByRef[t.ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();

package/scripts/bongos/seed-bv1-privacy-invites-tasks.js

@@ -0,0 +1,133 @@
+// Seed the privacy-model + invite-inbox build tasks the 1002785 spike scoped,
+// under goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
+//
+// Source of truth: docs/specs/bongos-v1-privacy-and-invites.md (owner-signed
+// 2026-08-16 on the sliver + expiry decisions). Idempotent on source_ref
+// bv1-privacy-PVnn; safe to re-run. PV4 stays backlog deliberately — its
+// instance-invite half attaches to the console wave's R2/R6 (spike 1002786),
+// which seeds into its own goal; only PV6 is promoted (fully independent).
+//
+// Run: node scripts/bongos/seed-bv1-privacy-invites-tasks.js
+
+const { apiCall } = require('./cli-lib');
+
+const VER = 'BONGOS-V1';
+const GOAL = 1000045;
+const SRC = 'planning-session';
+const SPEC = 'docs/specs/bongos-v1-privacy-and-invites.md';
+
+// Existing tasks referenced by id (seed-bv1-profiles-tasks.js).
+const R02 = 1002278, R03 = 1002279;
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Throttled + 429-aware wrapper (same shape as the sibling seeders).
+async function api(method, path, body, _tries = 0) {
+  await sleep(1500);
+  const r = await apiCall(method, `/api/bongos${path}`, body);
+  if (r.status === 429 && _tries < 8) {
+    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return r;
+}
+
+const NEW_TASKS = [
+  {
+    ref: 'PV1', kind: 'feature', prio: 3, est: 120, crit: ['C2'], deps: [R03],
+    title: 'Privacy flags: account_visibility + recruiter_discoverable on platform accounts',
+    desc: `Add account_visibility ('public'|'private', default 'public') and recruiter_discoverable (boolean NULL — tri-state; effective = COALESCE(flag, visibility='public')) to platform_identity_accounts via an additive platform_identity_* migration. Extend the own-scoped PATCH write path task ${R03} (R03) establishes for hide_stats to cover both, and add the two settings rows to the profile rail (coordinate P04, task 1002800). The discoverable toggle's copy must state exactly what it grants: the D3 sliver (name, disciplines, active-recently), name-only if stats are hidden. Model + defaults: ${SPEC} D1.`,
+  },
+  {
+    ref: 'PV2', kind: 'feature', prio: 3, est: 180, crit: ['C1', 'C2'], deps: [R02],
+    title: 'Effective-visibility enforcement: one shared predicate across every public read',
+    desc: `One helper (SQL predicate + port function, the ADR 0171 D2 "enforced next to the data" pattern) that every public surface uses: /u/<handle> returns 404 (never 403) for private accounts TO EVERYONE INCLUDING SELF on the public read (the page renders self-view via the own-scope side door instead — D2's viewer-independence reconciliation); private accounts absent from search, leaderboards, sitemap; the rollup predicate extends profile_state='active' AND NOT hide_stats with visibility. No surface writes its own variant — drift here is a privacy leak. Matrix: ${SPEC} D2. Also depends on PV1 (bv1-privacy-PV1).`,
+  },
+  {
+    ref: 'PV3', kind: 'feature', prio: 3, est: 120, crit: ['C2', 'C5'], deps: [],
+    title: 'getRecruiterSliver port + recruiting-surface gating (the pre-accept boundary)',
+    desc: `The owner-signed D3 sliver: handle, display name, avatar, disciplines union, active-in-last-30-days boolean — nothing else, name-only when hide_stats is true, never for provisional accounts, never a profile-page link. Authorization-scoped port getRecruiterSliver(githubId) beside getPublicProfileExtras, whitelist-shaped inside platform-identity, its own planted-sentinel leak test (tests/profile_route.mjs pattern), route-gated by project.recruit (the console wave's atom — coordinate spike 1002786 R3). Depends on PV1+PV2 (bv1-privacy-PV1/PV2). Boundary: ${SPEC} D3.`,
+  },
+  {
+    ref: 'PV4', kind: 'feature', prio: 3, est: 120, crit: ['C3'], deps: [],
+    title: 'Invite lifecycle: 30-day read-time expiry, seen_at, decline closes the door',
+    desc: `Owner-signed: a recruit invite's pre-approved sign-in door expires 30 days after creation, enforced READ-TIME (the sign-in gate's invited-check + every queue view compute created_at + 30 days; no sweeper). seen_at lands on the hub notification row (set on first inbox render) and on goal_membership_requests for parity (goal invites get NO expiry — not an admission door). Decline in the inbox relays a door-close to the instance (invite row → dismissed) so no declined invite leaves a live door. COORDINATION: the invite storage itself is the console wave's R2 (access_requests kind='invite') and rescind-cleans-both-sides is its R6 (spike 1002786) — this task lands the states on whatever R2/R6 ship, which is why it stays backlog until that wave seeds. Lifecycle: ${SPEC} D4.`,
+  },
+  {
+    ref: 'PV5', kind: 'feature', prio: 3, est: 90, crit: ['C3'], deps: [],
+    title: 'Hub inbox project slice: recruit invites in the attention card',
+    desc: `A project slice in the EXISTING attention card (goal-inbox.js slice pattern + window.OTBAttention.refresh()), on the hub hall + apex home, fed by the existing GET /my-projects/invites. Accept = "open <project> — sign in" link (clicking through IS acceptance, console D2); Decline = the PV4 door-close path. No parallel inbox; federated instances' halls link out only (V1). Notification path IS the inbox — SSE/email explicitly deferred. Depends on PV4 (bv1-privacy-PV4). Shape: ${SPEC} D5.`,
+  },
+  {
+    ref: 'PV6', kind: 'feature', prio: 4, est: 90, crit: [], deps: [], ready: true,
+    title: 'Private goals: accepting_requests toggle + owner rescind-pending-invite route',
+    desc: `goals.accepting_requests boolean default true — a private goal with it false refuses join-requests with honest copy ("this goal isn't taking requests right now"); invitations unaffected; UI shows the toggle only on private goals. Plus the missing half of core_188's 'cancelled' state: an owner/manager route to rescind a PENDING invitation (only requester-withdraw exists today — modules/lifecycle/routes/goals.js). Design: ${SPEC} D6.`,
+  },
+  {
+    ref: 'PV7', kind: 'feature', prio: 3, est: 90, crit: ['C4'], deps: [],
+    title: 'Applications carry the applicant profile: note through the relay, live render in the queue',
+    desc: `One rule, no new disclosure class: the reviewer sees what the applicant's profile rules would show them + the applicant's note, evaluated LIVE at review time (never a snapshot — hide takes effect on next render, C2). Public account → public profile view; private account → the D3 sliver (the apply UI states "your application shares: …"). Plumbing: POST /my-projects/join gains an applicant-supplied note (capped ~500 chars, sanitized; replaces the hardcoded 'via platform My Projects'), and the reviewer queue (console R4's page — spike 1002786) resolves the profile from the hub at render. Depends on PV3 (bv1-privacy-PV3). Rule: ${SPEC} D7.`,
+  },
+  {
+    ref: 'PV8', kind: 'verify', prio: 3, est: 60, crit: ['C2'], deps: [],
+    title: 'PROOF: the privacy matrix as a test',
+    desc: `The D2 matrix, asserted: a private account's /u/<handle> public read 404s to a stranger AND to its own authenticated session (the page self-view comes from the own-scope endpoint — assert both halves, this is P10 task 1002806 sharpened); hidden stats never appear in any response (planted sentinels); the recruiter sliver is exactly D3's shape (leak test on the port); an expired invite refuses sign-in; a declined invite's door is closed instance-side. Depends on PV2+PV3+PV4 (bv1-privacy-PV2/PV3/PV4). Matrix: ${SPEC} D2.`,
+  },
+];
+
+(async () => {
+  console.log(`Seeding privacy+invites tasks under goal ${GOAL} (${VER})…`);
+  const idByRef = {};
+  let created = 0, existing = 0;
+
+  for (const t of NEW_TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER,
+      goal_id: GOAL,
+      title: t.title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: 'engineer',
+      priority: t.prio,
+      est_minutes: t.est,
+      criterion_ids: t.crit,
+      source: SRC,
+      source_ref: `bv1-privacy-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`); continue; }
+    const task = r.data.task || r.data;
+    idByRef[t.ref] = Number(task.id);
+    if (r.data.idempotent || r.data.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}, P${t.prio})`);
+  }
+
+  console.log('Wiring dependencies…');
+  const DEP_SETS = [
+    ['PV1', [R03]],
+    ['PV2', [R02, idByRef.PV1]],
+    ['PV3', [idByRef.PV1, idByRef.PV2]],
+    ['PV5', [idByRef.PV4]],
+    ['PV7', [idByRef.PV3]],
+    ['PV8', [idByRef.PV2, idByRef.PV3, idByRef.PV4]],
+  ];
+  for (const [ref, deps] of DEP_SETS) {
+    const id = idByRef[ref];
+    const clean = deps.filter(Boolean);
+    if (!id || !clean.length) continue;
+    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: clean });
+    console.log(`  ${ref} (task ${id}) depends on [${clean.join(', ')}]: ${r.ok ? 'ok' : 'FAILED ' + r.status + ' ' + JSON.stringify(r.data).slice(0, 160)}`);
+  }
+
+  console.log('Promoting the independent root…');
+  for (const t of NEW_TASKS.filter((x) => x.ready)) {
+    const id = idByRef[t.ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();