@bongos/core 1.21.175 → 1.21.176

package/scripts/bongos/seed-staging.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# seed-staging.sh — rebuild the staging GDS database as an anonymized mirror of
+# production. Run ON THE DROPLET (both DBs are local; peer auth as `lars`).
+#
+#   bash scripts/bongos/seed-staging.sh            # local, on the droplet
+#   ssh lars@<droplet> 'bash -s' < scripts/bongos/seed-staging.sh   # from a laptop
+#
+# What it does (V3.R41 / #262, criterion C9 — unblocks the C6 parallel-load
+# test #272):
+#   1. Takes a FULL pg_dump of prod (schema + data). A full dump adds FK
+#      constraints AFTER loading all rows, so prod's circular/self-referential
+#      FK (tasks.parent_task_id) restores cleanly — and staging gets prod's
+#      exact schema, so no separate migrate step is needed.
+#   2. Drops + recreates the staging `public` schema and restores the dump.
+#   3. Anonymizes: every builder's GitHub identity → builder-N; nulls every
+#      column that referenced a session, then deletes all sessions so NO real
+#      bearer token persists on staging.
+#
+# SAFETY: hard-refuses to target any database not named `*_staging`, so a
+# fat-fingered env can never point the wipe at production. Everything runs at
+# table-owner privilege (no superuser) — the invoking role owns the staging objects.
+#
+# "What's real, what's faked on staging": see docs/recipes/staging-data.md.
+
+set -euo pipefail
+
+# No baked-in database names. A portable core cannot know an instance's DB, and the
+# founder's two were hardcoded here until task 1003869 — including inside the safety
+# check, which meant de-branding the names alone would have quietly disarmed it. So the
+# guard is STRUCTURAL now instead of a name comparison: the target must be named
+# <something>_staging. That keeps the original property ("a fat-fingered env can never
+# point the wipe at production", since no production DB is called *_staging) and extends
+# it to every instance rather than one. Both names must be set explicitly — this script
+# WIPES its target, so there is no default worth guessing.
+PROD_DB="${PROD_DB:-}"
+STAGING_DB="${STAGING_DB:-}"
+
+if [ -z "$STAGING_DB" ] || [ -z "$PROD_DB" ]; then
+  echo "REFUSING: set PROD_DB (the dump source) and STAGING_DB (the wipe target) explicitly." >&2
+  echo "  e.g. PROD_DB=myapp STAGING_DB=myapp_staging $0" >&2
+  exit 2
+fi
+if ! printf '%s' "$STAGING_DB" | grep -qE '^[A-Za-z0-9_]+_staging$'; then
+  echo "REFUSING: STAGING_DB '$STAGING_DB' must be a bare identifier ending in '_staging'. This script wipes its target." >&2
+  exit 2
+fi
+if [ "$PROD_DB" = "$STAGING_DB" ]; then
+  echo "REFUSING: PROD_DB and STAGING_DB are the same DB." >&2
+  exit 2
+fi
+# PROD_DB is the dump SOURCE (read-only), but guard it too so a crafted env
+# can't redirect the snapshot to an unexpected database.
+if ! printf '%s' "$PROD_DB" | grep -qE '^[A-Za-z0-9_]+$'; then
+  echo "REFUSING: PROD_DB '$PROD_DB' is not a bare database identifier." >&2
+  exit 2
+fi
+
+echo "==> rebuilding $STAGING_DB as an anonymized mirror of $PROD_DB"
+
+# The dump briefly holds real prod data (incl. real github_login). mktemp makes
+# it 0600; chmod is belt-and-braces. On exit, shred if available (defeats undelete
+# of the plaintext snapshot), else rm. A SIGKILL/OOM bypasses traps — see the
+# "restore window" note in docs/recipes/staging-data.md.
+DUMP="$(mktemp /tmp/otb-staging-seed.XXXXXX.sql)"
+chmod 600 "$DUMP"
+trap 'shred -u "$DUMP" 2>/dev/null || rm -f "$DUMP"' EXIT
+
+# 1. Full dump of prod (schema + data). --no-owner/--no-privileges so it loads
+#    cleanly as `lars` without role/grant statements.
+echo "==> dumping $PROD_DB (full: schema + data)..."
+pg_dump -d "$PROD_DB" --no-owner --no-privileges > "$DUMP"
+echo "    dump size: $(wc -c < "$DUMP") bytes"
+
+# 2. Drop + recreate the staging public schema, then restore.
+echo "==> resetting staging schema + restoring..."
+# `lars` owns the recreated schema (full rights). Grant only USAGE to PUBLIC —
+# the restore + the staging app both connect as lars, so no broad CREATE grant
+# to PUBLIC is needed.
+psql -d "$STAGING_DB" -v ON_ERROR_STOP=1 \
+  -c "DROP SCHEMA public CASCADE; CREATE SCHEMA public; GRANT USAGE ON SCHEMA public TO public;"
+psql -d "$STAGING_DB" -v ON_ERROR_STOP=1 --single-transaction -f "$DUMP" >/dev/null
+
+# 3. Anonymize: strip builder identity, then remove every real session token.
+echo "==> anonymizing builders + purging sessions..."
+psql -d "$STAGING_DB" -v ON_ERROR_STOP=1 <<'SQL'
+UPDATE builders SET
+  github_id    = '900000' || id::text,
+  github_login = 'builder-' || id::text,
+  display_name = 'Builder ' || id::text,
+  avatar_url   = NULL;
+
+-- Null every column that references builder_sessions, then delete all sessions
+-- so no real bearer token lives on staging. Generic over the FK graph.
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN
+    SELECT c.conrelid::regclass AS tbl, a.attname AS col
+      FROM pg_constraint c
+      JOIN pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = ANY (c.conkey)
+     WHERE c.contype = 'f' AND c.confrelid = 'public.builder_sessions'::regclass
+  LOOP
+    EXECUTE format('UPDATE %s SET %I = NULL', r.tbl, r.col);
+  END LOOP;
+END $$;
+DELETE FROM builder_sessions;
+SQL
+
+# 4. Report.
+echo "==> staging seeded. Row counts:"
+for t in builders tasks claims versions cost_log credit_log builder_sessions; do
+  n="$(psql -d "$STAGING_DB" -tAc "SELECT count(*) FROM $t" 2>/dev/null || echo '?')"
+  printf '    %-16s %s\n' "$t" "$n"
+done
+ready="$(psql -d "$STAGING_DB" -tAc "SELECT count(*) FROM tasks WHERE status='ready'" 2>/dev/null || echo '?')"
+echo "    tasks(ready)     $ready   <- the parallel-load test (#272) claims against these"
+echo "==> done. Sessions purged (mint a staging-only token for tests). chat-inbox is file-based — nothing to scrub in the DB."

package/scripts/bongos/seed-strict-versioning-tasks.js

@@ -0,0 +1,275 @@
+#!/usr/bin/env node
+// scripts/bongos/seed-strict-versioning-tasks.js — seeds goal 1000086 ("Strict
+// versioning: a goal cannot outlive its tasks") from the spec at
+// docs/specs/bongos-v1-strict-versioning.md. Idempotent on source_ref, throttled
+// against the per-IP write limiter, and self-verifying: the last step diffs the
+// criterion links that actually landed against the plan and exits non-zero on
+// any drift (task 1003076).
+
+const { execFile } = require('child_process');
+const path = require('path');
+const { expectedCriterionCounts, verifySeedCriteriaLinks } = require('./seed-verify-criteria');
+
+const VERSION = 'BONGOS-V1';
+const GOAL = 1000086;
+const PREFIX = 'strict-versioning';
+const API = path.join(__dirname, 'api.js');
+const WRITE_DELAY_MS = 4200;
+
+const C1 = 'sv-goal-set-closed';
+const C2 = 'sv-goal-outlives-nothing';
+const C3 = 'sv-killing-a-goal-is-deliberate';
+const C4 = 'sv-every-task-has-a-goal';
+const C5 = 'sv-a-version-can-close';
+const C6 = 'sv-one-train-per-project';
+const C7 = 'sv-cutover-proven-live';
+
+// TASKS — ref is the V##.R## rank suffix; deps are refs resolved to real task
+// ids after every task exists. Descriptions stay short and cross-reference by
+// ref rather than restating the spec (which is the durable context).
+const TASKS = [
+  {
+    ref: 'R01', kind: 'refactor', priority: 5, est: 90, criteria: [C2], deps: [],
+    title: 'BV1.R01 — One terminal-status vocabulary: shipped or abandoned, declared once',
+    desc: '`goal-rollup.js:37` counts shipped|confirmed|completed as done; `done-when.js:429` counts only shipped and treats abandoned as accounted-for. Two definitions of "finished" in one module is what lets a goal read closed on one surface and open on another. Declare the terminal set once and have both read it.\n\n**Done when:** a single exported constant is the only spelling of the terminal set; `goal-rollup.js` and `done-when.js` both consume it; `tests/goal_sort_staleness.mjs` (which pins the rollup against the client `goals-lib.js`) still passes, or is updated with the reason.',
+  },
+  {
+    ref: 'R02', kind: 'decision', priority: 5, est: 120, criteria: [C1], deps: [],
+    title: 'BV1.R02 — ADR: strict versioning — the version boundary is the scope gate',
+    desc: 'Write the ADR behind goal 1000086. Records the model: goals are scoped onto a `planning` version, the goal set closes when the version starts building, an Archon override admits a named goal with a reason, a goal cannot close while it holds non-terminal work, and exactly one version builds per project. Cite the measured state that motivated it (62 goals, 10 closed while holding 28 open tasks, 502 open tasks across 37 open goals, two building versions on one project).\n\n**Done when:** the ADR exists, is indexed in `docs/adr/README.md`, and is linked from goal 1000086. Take the next free ADR number immediately before pushing — concurrent agents collide on it.',
+  },
+  {
+    ref: 'R05', kind: 'feature', priority: 5, est: 90, criteria: [C4], deps: [],
+    title: 'BV1.R05 — POST /tasks and PATCH /tasks/:id read goal.status',
+    desc: '`POST /goals/:id/tasks` already refuses a non-open goal (`goal-route-authz.js:47`, 409 `goal_not_open`), but `POST /tasks` (`task-write-routes.js:167`) and `PATCH /tasks/:id` (`:392`) validate only that the goal exists and belongs to the version. A task can be created directly into an achieved or archived goal today. Close the asymmetry.\n\n**Done when:** both vectors refuse a non-open goal with the same named 409 the goal-scoped route uses; a test covers each vector.',
+  },
+  {
+    ref: 'R03', kind: 'feature', priority: 5, est: 120, criteria: [C1], deps: ['R02'],
+    title: 'BV1.R03 — POST /goals refuses a version that is not in planning',
+    desc: '`routes/goals.js:101` fetches the version row and discards it after the null check — `version.status` is never read, so a goal can be created on a shipped version. Add the gate: goals may be created on a `planning` version (that is where the next version is scoped in advance); a `building` version refuses without the R07 override.\n\n**Done when:** a pure `authorizeGoalCreate` lives beside `authorizeGoalTaskCreate` in `goal-route-authz.js` and is unit-tested DB-free; the refusal is a named 409 an agent can act on; reuse `versionAcceptsNewWork`\'s status vocabulary rather than respelling it.',
+  },
+  {
+    ref: 'R04', kind: 'feature', priority: 5, est: 90, criteria: [C1], deps: ['R02'],
+    title: 'BV1.R04 — POST /versions refuses a second planning version for a project',
+    desc: 'With R03 in place, a builder blocked from adding a goal to the building version could cut a second planning version and put it there. One planning version per project means exactly one queue for future goals and no parallel escape hatches.\n\n**Done when:** `POST /versions` returns a named 409 when a planning version already exists for the project; a test covers it.',
+  },
+  {
+    ref: 'R06', kind: 'spike', priority: 5, est: 180, criteria: [C5], deps: ['R02'],
+    title: 'BV1.R06 — Design pass: how a version closes (auto, early, roll-forward, maintenance exemption)',
+    desc: 'No route ships a version — `scripts/bongos/version-close.js:290` prints that the API exposes no version status transitions, and the flip is hand-run SQL on the droplet. The `version.close` permission exists at the archon floor (`government/catalog.js:103`) and nothing references it. Design the lifecycle before building it: auto-close when the last non-maintenance goal achieves, Archon early-close with a per-goal disposition, roll-forward via `succeeds_goal_id` lineage, and the maintenance goal\'s exemption from the close count. Reuse `version-close.js:66` `suggestClose` and `getCarryOverCount` — the judgement already exists and is merely advisory.\n\n**Done when:** an ADR states the model and the sub-tasks it implies are filed. Spike — will not auto-promote; open it manually.',
+  },
+  {
+    ref: 'R07', kind: 'feature', priority: 5, est: 150, criteria: [C1], deps: ['R03'],
+    title: 'BV1.R07 — Archon override: admit one named goal to a building version, with a reason',
+    desc: 'The escape valve for R03. An Archon may admit a specific net-new goal into an in-flight version and must record why. Per-goal, never a blanket unlock.\n\n**Done when:** an override row stores the goal, the actor, the reason and the timestamp; only an Archon can create one; a goal admitted this way is created normally in every other respect.',
+  },
+  {
+    ref: 'R08', kind: 'feature', priority: 5, est: 120, criteria: [C2], deps: ['R01'],
+    title: 'BV1.R08 — achieveGoalIfComplete refuses a goal that still holds non-terminal tasks',
+    desc: '`db-goals.js:193-213` decides achievement from `done_when_criteria` alone; tasks are never queried. A goal whose criteria are all satisfied auto-achieves while holding any number of backlog or ready tasks, because those tasks are linked to no criterion. Add the second condition to the manual-satisfy path.\n\n**Done when:** the check uses R01\'s terminal set; a goal holding a ready/backlog/blocked/active/completed/confirmed task cannot reach achieved via `POST /done-when/:id/satisfy`.',
+  },
+  {
+    ref: 'R09', kind: 'feature', priority: 5, est: 120, criteria: [C2], deps: ['R01'],
+    title: 'BV1.R09 — The achievement cascade gains the same check, on the caller exec',
+    desc: 'The sibling of R08 in `done-when.js:451-460` — the cascade inside `autoSatisfyShippedCriteria`, which is the path that actually fires on every ship (`db-ship.js:434`) and every reconciler tick (`publish-reconciler.js:847`). It is a deliberate duplicate of the `db-goals.js` rule (collapsing them creates a require cycle), so both must change or neither does.\n\n**Done when:** the same predicate is a third NOT EXISTS clause on the cascade UPDATE, run on `exec` and never the module pool, so the ship transaction sees its own uncommitted flips. Shipping itself must remain unblocked — only the goal flip is gated.',
+  },
+  {
+    ref: 'R10', kind: 'feature', priority: 5, est: 120, criteria: [C3], deps: ['R01'],
+    title: 'BV1.R10 — Archive previews its open tasks and refuses without a disposition',
+    desc: '`POST /goals/:id/archive` (`routes/goals.js:1043`) refuses only if the goal is already archived — no criterion check, no task check. It is the hole that bypasses R08/R09 entirely, and how goal 1000018 was archived with all 7 tasks still open. Archiving a goal that holds open work must first return that work.\n\n**Done when:** archiving a goal with non-terminal tasks returns them and a named 409; archiving one with none stays a single call.',
+  },
+  {
+    ref: 'R11', kind: 'feature', priority: 5, est: 150, criteria: [C4], deps: ['R05'],
+    title: 'BV1.R11 — goal_id becomes required; delete the catch-all fallback',
+    desc: '`db-tasks.js:150` silently falls back to `generalGoalIdForVersion` when no goal is named, and the two resulting catch-alls hold 53 open tasks. Goal-less work is the hole through which unscoped work accumulates invisibly.\n\n**Done when:** `POST /tasks` requires `goal_id`; the fallback is deleted; every in-repo caller passes a goal. R25 drains the existing catch-alls.',
+  },
+  {
+    ref: 'R12', kind: 'feature', priority: 5, est: 180, criteria: [C5], deps: ['R06'],
+    title: 'BV1.R12 — POST /versions/:id/close, behind the version.close permission',
+    desc: 'Build what R06 designed. Archon-only, wired to the already-defined `version.close` permission. Any goal still open at close time takes an explicit decision — roll forward (R17) or abandon.\n\n**Done when:** the route exists, refuses a non-Archon, refuses an early close that leaves a goal without a disposition, and sets `shipped_at`.',
+  },
+  {
+    ref: 'R13', kind: 'verify', priority: 4, est: 150, criteria: [C2], deps: ['R08', 'R09'],
+    title: 'BV1.R13 — Goal-closure invariant suite',
+    desc: 'Pin the C2 invariant across both writers so it cannot regress the way the two vocabularies drifted apart.\n\n**Done when:** tests cover the manual-satisfy path (R08) and the cascade (R09); one test proves the cascade sees the ship transaction\'s uncommitted flip; one test proves a ship still lands while its goal is held open by a sibling backlog task; the existing `goal_achievement.mjs`, `auto_satisfy_criteria.mjs` and `criterion_progress.mjs` all still pass.',
+  },
+  {
+    ref: 'R14', kind: 'feature', priority: 4, est: 180, criteria: [C3], deps: ['R10'],
+    title: 'BV1.R14 — Archive applies the disposition: abandon with a reason, or move to a named goal',
+    desc: 'The second half of R10. The caller re-submits naming what happens to each open task; nothing is discarded without a decision, which was the owner\'s explicit constraint.\n\n**Done when:** each task is either abandoned (stamped with the archive reason) or moved to a named surviving goal; the disposition is recorded per task; the goal ends archived holding zero non-terminal tasks.',
+  },
+  {
+    ref: 'R15', kind: 'feature', priority: 4, est: 120, criteria: [C1], deps: ['R07'],
+    title: 'BV1.R15 — Overrides are countable and visible on the version',
+    desc: 'An override nobody can count is indistinguishable from no gate at all. Surface them so abuse is measurable.\n\n**Done when:** the version rollup exposes the override count; the hall shows which goals were admitted mid-version, by whom, and why.',
+  },
+  {
+    ref: 'R16', kind: 'feature', priority: 4, est: 150, criteria: [C5], deps: ['R12', 'R08', 'R09'],
+    title: 'BV1.R16 — A version closes itself when its last non-maintenance goal achieves',
+    desc: 'The automatic finish line. Fires from the goal-achievement path (R08/R09), skipping the maintenance goal (R18) — without that exemption a version can never auto-close, because the maintenance goal is open by design.\n\n**Done when:** achieving the last non-exempt goal flips the version to closed; a version whose only open goal is the maintenance goal closes; the auto-promotion of the next version (R20) fires from the same event.',
+  },
+  {
+    ref: 'R17', kind: 'feature', priority: 4, est: 150, criteria: [C5], deps: ['R12'],
+    title: 'BV1.R17 — Roll-forward: an unfinished goal becomes a successor goal in the next version',
+    desc: 'The sanctioned exit for a goal that is not done when its version closes. `POST /goals` already accepts `succeeds_goal_id` and stamps the predecessor\'s `succeeded_by_goal_id` (`routes/goals.js:108,130`) — reuse it rather than inventing a second lineage.\n\n**Done when:** rolling a goal forward creates the successor in the target version with its open tasks, sets both lineage pointers, and archives the predecessor; the chain is queryable across versions.',
+  },
+  {
+    ref: 'R18', kind: 'feature', priority: 4, est: 180, criteria: [C6], deps: ['R06', 'R12'],
+    title: 'BV1.R18 — The maintenance goal: auto-created per version, exempt from close, carries bugs forward',
+    desc: 'Where a defect against already-shipped work lands. Auto-created with each version, flagged exempt so it never blocks the auto-close count, and on close its unfinished bugs move to the successor version\'s maintenance goal. The one goal that legitimately spans versions.\n\n**Done when:** creating a version creates its maintenance goal; the exempt flag is read by R16; close carries the open bugs forward; the goal is otherwise an ordinary goal.',
+  },
+  {
+    ref: 'R19', kind: 'feature', priority: 4, est: 90, criteria: [C6], deps: ['R04'],
+    title: 'BV1.R19 — Refuse a second building version for a project',
+    desc: 'BONGOS-V1 and CB-V1 are both building on the same project today, which is why "the current version" has no meaning and R03\'s gate would have two answers. This is the invariant every other rule depends on.\n\n**Done when:** the server refuses to put a second version into `building` for a project; a named 409; a test covers it. R27 resolves the existing violation.',
+  },
+  {
+    ref: 'R20', kind: 'feature', priority: 4, est: 120, criteria: [C6], deps: ['R12', 'R19'],
+    title: 'BV1.R20 — The planning version promotes itself when the building version closes',
+    desc: 'Keeps the "exactly one building version" invariant machine-maintained and leaves no window where the project has no live train and nothing is claimable.\n\n**Done when:** closing the building version flips the single planning version to building in the same transaction; with no planning version, close still succeeds and the project is simply idle.',
+  },
+  {
+    ref: 'R21', kind: 'feature', priority: 4, est: 90, criteria: [C6], deps: ['R04'],
+    title: 'BV1.R21 — Raise version.create back to the Archon floor',
+    desc: 'ADR 0157 delegated `version.create` to Metic. Once the version boundary gates all scope (R03), the power to cut a version is the power to bypass every gate in this design.\n\n**Done when:** the catalog floor is archon; an ADR records the partial reversal of ADR 0157 and its reason; `/planning-session` and `/goal-create` docs reflect the new floor.',
+  },
+  {
+    ref: 'R22', kind: 'feature', priority: 4, est: 120, criteria: [C4], deps: ['R11'],
+    title: 'BV1.R22 — Capture and idea-routing vectors name a goal',
+    desc: 'With R11 landed, any vector that creates a task without a goal simply breaks. `routeIdeaToGoal` (`modules/ideas/inbox.js:328`) already requires an open goal on a building version; `capture.js` and the other creation paths need the same discipline.\n\n**Done when:** every in-repo task-creation vector names a goal or fails loudly with an actionable message; no path silently produces an orphan.',
+  },
+  {
+    ref: 'R23', kind: 'cleanup', priority: 4, est: 60, criteria: [C5], deps: ['R12'],
+    title: 'BV1.R23 — version-close.js drives the route instead of printing that the API cannot',
+    desc: '`scripts/bongos/version-close.js:290` tells the operator the API exposes no version status transitions and to run SQL on the droplet. After R12 that text is false and the SQL path is the bypass.\n\n**Done when:** the script calls `POST /versions/:id/close`; the droplet-SQL instruction is deleted; the advisory `suggestClose` output is kept.',
+  },
+  {
+    ref: 'R24', kind: 'feature', priority: 3, est: 150, criteria: [C3], deps: ['R14'],
+    title: 'BV1.R24 — Hall surface: the archive two-step, and why a goal is held open',
+    desc: 'The gates are only usable if a builder can see what is holding a goal open before they try to close it, and can walk the archive disposition without curl.\n\n**Done when:** a goal page shows the non-terminal tasks blocking its closure; the archive flow presents the preview and collects the disposition; both follow the hall\'s existing row idioms.',
+  },
+  {
+    ref: 'R25', kind: 'cleanup', priority: 4, est: 180, criteria: [C4], deps: ['R11', 'R14'],
+    title: 'BV1.R25 — Rehome the 53 catch-all tasks; drain and archive both catch-alls',
+    desc: 'Goal 1000003 ("Work with no goal yet") holds 37 open tasks and CB-V1\'s general goal holds 16. Under R11 no new ones can appear; these are the existing population.\n\n**Done when:** every one of the 53 is moved to a real goal or abandoned with a reason via R14\'s flow; both catch-alls hold zero tasks and are archived; a query proving zero catch-all tasks is captured in the notes.',
+  },
+  {
+    ref: 'R26', kind: 'cleanup', priority: 4, est: 180, criteria: [C7], deps: ['R14'],
+    title: 'BV1.R26 — Disposition the 10 closed goals that still hold 28 open tasks',
+    desc: 'The existing violations of C2, measured 2026-09-04: goals 1000018 (archived, all 7 tasks open), 1000072 (achieved, 7), 1000051 (4), 1000041 (3), 1000060 (2), 1000031, 1000034, 1000056, 1000061, 1000071 (1 each). Walk each through R14\'s preview-and-dispose flow so the new rule starts from a true state.\n\n**Done when:** all 28 are moved or abandoned with a reason; a query returns zero closed goals holding non-terminal tasks.',
+  },
+  {
+    ref: 'R27', kind: 'infra', priority: 4, est: 180, criteria: [C7], deps: ['R12', 'R17'],
+    title: 'BV1.R27 — Fold CB-V1 into BONGOS-V1 and close CB-V1',
+    desc: 'CB-V1 is the same project as BONGOS-V1 ("CB" is Cloud Bongos), and both are building — the violation R19 forbids. Its 4 open goals (1000043, 1000066, 1000084 and its general catch-all) move to BONGOS-V1; its 2 achieved goals stay with the closed version.\n\n**Done when:** the open goals are in BONGOS-V1 with lineage intact; CB-V1 is closed via R12; its 98 non-terminal tasks are all accounted for under a real goal; exactly one version is building.',
+  },
+  {
+    ref: 'R28', kind: 'decision', priority: 4, est: 120, criteria: [C7], deps: ['R27', 'R26'],
+    title: 'BV1.R28 — Owner names the goals that ARE BONGOS-V1; everything else moves to V2',
+    desc: 'Measured during the planning session: a 14-day activity window keeps 28 of 37 open goals and 454 of 502 open tasks in V1 — nothing is stale because the instance is busy, so no mechanical rule produces a finish line. The owner names the handful of goals that define what V1 means (target ~5-8); every other open goal is targeted at BONGOS-V2 regardless of activity.\n\n**Done when:** the list is recorded in the task notes with each goal\'s open-task count; every open goal is labelled stay or move. Needs the owner — file a blocker if it stalls.',
+  },
+  {
+    ref: 'R29', kind: 'feature', priority: 4, est: 180, criteria: [C7], deps: ['R28', 'R03'],
+    title: 'BV1.R29 — Scope BONGOS-V2 in planning, with its goal set and criteria',
+    desc: 'The first version created under the new rules, and the proof that scoping-before-building works. Created in `planning` so its goals can be authored (R03), holding every goal R28 marked move.\n\n**Done when:** BONGOS-V2 exists in `planning`; the moved goals are on it as successors with lineage; every goal on it has at least one done-when criterion; it is the only planning version.',
+  },
+  {
+    ref: 'R30', kind: 'verify', priority: 4, est: 120, criteria: [C7], deps: ['R29', 'R25', 'R20', 'R13'],
+    title: 'BV1.R30 — Proof: the four invariants hold on the live instance',
+    desc: 'The single live demonstration that goal 1000086 is met. Run each query against live and capture its output verbatim in the task notes:\n1. zero goals in achieved/archived holding a task that is not shipped or abandoned;\n2. zero tasks in a catch-all goal, and zero tasks with a null goal;\n3. exactly one version in `building` for the project, and at most one in `planning`;\n4. BONGOS-V2 exists in `planning` with criteria on every goal.\nThen attempt one refusal of each gate (add a goal to the building version; close a goal holding a backlog task; archive without a disposition) and record the 409s.\n\n**Done when:** all four queries return the expected result and all three refusals fire, with transcripts in the notes.',
+  },
+];
+
+function api(method, route, body) {
+  return new Promise((resolve, reject) => {
+    const args = [API, method, route];
+    if (body) args.push('--body', JSON.stringify(body));
+    execFile('node', args, { maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+      const raw = String(stdout || '');
+      const start = raw.indexOf('{');
+      let json = null;
+      if (start >= 0) { try { json = JSON.parse(raw.slice(start)); } catch { /* non-JSON body */ } }
+      const status = Number((String(stderr || '') + raw).match(/→ (\d{3})/)?.[1] || 0);
+      if (err && !json) return reject(new Error(`${method} ${route} failed: ${err.message}\n${stderr}`));
+      resolve({ ok: status >= 200 && status < 300, status, json });
+    });
+  });
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// throttledWrite — the per-IP limiter kills a long seed halfway unless each
+// write is paced and a 429 backs off on the server's own retry_after.
+async function throttledWrite(method, route, body) {
+  for (let attempt = 0; attempt < 5; attempt++) {
+    const r = await api(method, route, body);
+    if (r.status === 429) {
+      // The limiter answers res.fail('rate_limited', 429, {scope, retry_after_seconds}),
+      // and the error envelope nests that payload under error.details — same path
+      // seed-bongos-v1-idea-routing-tasks.js reads. Any other spelling silently
+      // falls back to the default and ignores the server's computed wait.
+      const wait = (Number(r.json?.error?.details?.retry_after_seconds) || 30) * 1000 + 1000;
+      console.log(`  429 — backing off ${wait}ms`);
+      await sleep(wait);
+      continue;
+    }
+    await sleep(WRITE_DELAY_MS);
+    return r;
+  }
+  throw new Error(`${method} ${route} still rate-limited after 5 attempts`);
+}
+
+// The meta planning task (1003586) was created before this seed ran and links
+// to C1. It is a real link on the goal, so the plan must count it or the
+// verification below reports a false mismatch.
+const PRE_EXISTING_LINKS = [[C1]];
+
+async function main() {
+  const ids = {};
+  const planned = [...PRE_EXISTING_LINKS];
+
+  console.log(`Seeding ${TASKS.length} tasks into goal ${GOAL} (${VERSION})\n`);
+
+  for (const t of TASKS) {
+    const body = {
+      version_id: VERSION,
+      goal_id: GOAL,
+      title: t.title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: 'engineer',
+      priority: t.priority,
+      est_minutes: t.est,
+      source: 'planning-session',
+      source_ref: `${PREFIX}-${t.ref}`,
+      criterion_ids: t.criteria,
+    };
+    const r = await throttledWrite('POST', '/api/bongos/tasks', body);
+    const id = r.json?.task?.id;
+    if (!id) throw new Error(`No task id back for ${t.ref} (status ${r.status}): ${JSON.stringify(r.json)}`);
+    ids[t.ref] = id;
+    planned.push(t.criteria);
+    console.log(`  ${t.ref} -> task ${id} [${t.criteria.join(',')}] ${r.status}`);
+  }
+
+  console.log('\nWiring dependencies...');
+  for (const t of TASKS) {
+    for (const dep of t.deps) {
+      if (!ids[dep]) throw new Error(`${t.ref} depends on unknown ref ${dep}`);
+      const r = await throttledWrite('POST', `/api/bongos/tasks/${ids[t.ref]}/dependencies`, { depends_on_task_id: ids[dep] });
+      console.log(`  ${t.ref} depends on ${dep} (${ids[dep]}) ${r.status}`);
+    }
+  }
+
+  console.log('\nVerifying criterion links landed as planned...');
+  await verifySeedCriteriaLinks({
+    goalId: GOAL,
+    expectedCounts: expectedCriterionCounts(planned),
+    fetchGoal: (goalId) => api('GET', `/api/bongos/goals/${goalId}`),
+  });
+
+  console.log('\nSeed complete. Task ids:');
+  for (const t of TASKS) console.log(`  ${t.ref} = ${ids[t.ref]}`);
+}
+
+main().catch((e) => { console.error(e.message); process.exit(1); });