@bongos/core 1.21.175 → 1.21.177

package/scripts/bongos/search-ingest-md.js

@@ -0,0 +1,269 @@
+#!/usr/bin/env node
+// scripts/bongos/search-ingest-md.js — repo-markdown ingester for the GDS recall
+// layer (task 947, V4.R09 / ADR 0060 §4). Walks the repo's markdown, chunks each
+// file (src/bongos/search-chunker.js), and upserts into search_chunks — DELTA-DRIVEN
+// by content_hash so an unchanged chunk is never rewritten. Vanished sources are
+// deleted, so the index tracks the tree.
+//
+// DEPLOY HOOK: a step in the prod deploy (scripts/deploy/deploy-prod.sh, mirrored
+// in the droplet's ~/deploy.sh) runs this AFTER the code update + migrate, where
+// the new markdown + the DB are both on disk. Best-effort there: an ingest hiccup
+// must never fail a deploy (the next deploy / a manual run catches up).
+//
+// SCOPING (ADR 0060 §6): a doc that documents a permission-core surface is tagged
+// min_rank='metic' so a sub-Metic search can never surface it (the search route's
+// SQL filter, #949/#950, enforces it). Everything else is 'xenos' (shared). Docs
+// are never owner-scoped (owner_builder_id stays NULL) — that's for DB-prose
+// memory (#948).
+//
+// Usage:
+//   node scripts/bongos/search-ingest-md.js            # ingest (writes)
+//   node scripts/bongos/search-ingest-md.js --dry-run  # report what WOULD change, no writes
+//   node scripts/bongos/search-ingest-md.js --root DIR # override the repo root (tests)
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { chunkMarkdown } = require('../../modules/memory/search-chunker'); // carved in BV1.R72 (ADR 0091 §2)
+const { matchProtected } = require('../../src/bongos/permission-path-check');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+// Directories we never index: deps, git internals, parallel worktrees, and the
+// web front-ends (assets, not project knowledge). Both web surfaces now live under
+// modules/<key>/public/ — the status surface at modules/status-ui/public/ (BV1.R84)
+// and the hall at modules/hall-ui/public/ (BV1.R85) — so both are already covered
+// by the `public` basename below.
+const EXCLUDE_DIRS = new Set(['node_modules', '.git', 'public']);
+// .claude/worktrees holds throwaway parallel checkouts — skip by path fragment.
+const EXCLUDE_PATH_RE = /(^|\/)\.claude\/worktrees\//;
+
+// Permission-core / read-sensitive DOCUMENTATION surfaces → min_rank='metic'
+// (ADR 0060 §6 / ADR 0043 "sub-Metic must not read deeply into … trust-boundary
+// docs"). The PROTECTED_GLOBS in permission-path-check are WRITE-protection over
+// CODE paths; READ-gating in the index is a DIFFERENT axis, so we curate the doc
+// surfaces a sub-Metic search must not surface: the security/audit corpus, the
+// permissions authority doc, and the two trust-boundary ADRs. A trailing '/' is
+// a subtree. (CLAUDE.md is write-protected but READ-PUBLIC — see minRankForDoc.)
+const SENSITIVE_DOC_GLOBS = [
+  'docs/canonical-permissions.md',  // the rank-ladder / authority reference
+  'docs/security/',                 // threat models + red-team reports
+  'docs/audits/',                   // security + architecture audit findings
+  'docs/governance/',               // the gate ENUMERATION + choke-point map
+  'docs/adr/0016-trust-boundary-server-enforced-permissions.md',
+  'docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md',
+];
+
+function relPath(abs) {
+  return path.relative(REPO_ROOT, abs).split(path.sep).join('/');
+}
+
+function minRankForDoc(rel) {
+  // CLAUDE.md is in permission-path-check's PROTECTED_GLOBS, but that's
+  // WRITE-protection (sub-Metic can't EDIT it). For RECALL it's the universal
+  // onboarding index every rank reads at session start — read-public. Carve it
+  // out so a Xenos search still surfaces it (it links to the gated detail docs,
+  // which stay metic via the curated list below).
+  if (rel === 'CLAUDE.md') return 'xenos';
+  // Curated read-sensitive documentation surfaces → metic.
+  for (const g of SENSITIVE_DOC_GLOBS) {
+    if (g.endsWith('/') ? rel.startsWith(g) : rel === g) return 'metic';
+  }
+  // Defensive: any OTHER markdown that physically lives under a protected CODE
+  // surface (e.g. a future README inside src/bongos/) → metic. matchProtected over
+  // an md path only ever matches CLAUDE.md today (carved out above) or such a
+  // nested doc, so this is a forward-looking guard, not a second CLAUDE.md hit.
+  if (matchProtected([rel]).length > 0) return 'metic';
+  return 'xenos';
+}
+
+// Recursively collect *.md files under root, honoring the exclusions.
+function collectMarkdown(dir, root, out = []) {
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return out; }
+  for (const e of entries) {
+    const abs = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (EXCLUDE_DIRS.has(e.name)) continue;
+      const rel = relPath(abs);
+      if (EXCLUDE_PATH_RE.test(rel + '/')) continue;
+      collectMarkdown(abs, root, out);
+    } else if (e.isFile() && e.name.toLowerCase().endsWith('.md')) {
+      const rel = relPath(abs);
+      if (EXCLUDE_PATH_RE.test(rel)) continue;
+      out.push(abs);
+    }
+  }
+  return out;
+}
+
+function sha256(s) {
+  return crypto.createHash('sha256').update(s, 'utf8').digest('hex');
+}
+
+// The pg Pool lives in the ROOT src/db.js — src/bongos/db.js USES it but does NOT
+// re-export it (src/bongos/search.js requires '../db' for the same reason). Pulled
+// into an exported helper so a unit test pins the path: the original
+// require('../../src/bongos/db') returned no `pool`, crashing only on the DB path
+// (which the pure tests + --dry-run never exercised). task 1156.
+function requirePool() {
+  const { pool } = require('../../src/bongos/pool');
+  return pool;
+}
+
+// Build the per-file chunk rows (pure — no DB). Exported for the dry-run report
+// + tests.
+function chunkFile(abs) {
+  const rel = relPath(abs);
+  const content = fs.readFileSync(abs, 'utf8');
+  const { title, chunks } = chunkMarkdown({ path: rel, content });
+  const min_rank = minRankForDoc(rel);
+  return chunks.map((c) => ({
+    source_kind: 'doc',
+    source_ref: rel,
+    chunk_index: c.chunk_index,
+    heading_path: c.heading_path,
+    title: title || rel,
+    body: c.body,
+    min_rank,
+    content_hash: sha256(c.body),
+  }));
+}
+
+// Upsert one file's chunks in a transaction: delta-update changed chunks, prune
+// any trailing chunks (file shrank). Returns { inserted, updated, unchanged, pruned }.
+async function ingestFile(client, rows, sourceRef) {
+  const stats = { inserted: 0, updated: 0, unchanged: 0, pruned: 0 };
+  for (const r of rows) {
+    const res = await client.query(
+      `INSERT INTO search_chunks
+         (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash, updated_at)
+       VALUES ('doc', $1, $2, $3, $4, $5, $6, NULL, $7, now())
+       ON CONFLICT (source_kind, source_ref, chunk_index) DO UPDATE
+         SET heading_path = EXCLUDED.heading_path,
+             title        = EXCLUDED.title,
+             body         = EXCLUDED.body,
+             min_rank     = EXCLUDED.min_rank,
+             content_hash = EXCLUDED.content_hash,
+             updated_at   = now()
+         WHERE search_chunks.content_hash IS DISTINCT FROM EXCLUDED.content_hash
+            OR search_chunks.min_rank    IS DISTINCT FROM EXCLUDED.min_rank
+       RETURNING (xmax = 0) AS inserted`,
+      [sourceRef, r.chunk_index, r.heading_path, r.title, r.body, r.min_rank, r.content_hash]
+    );
+    if (res.rowCount === 0) stats.unchanged += 1;        // WHERE skipped the update (no change)
+    else if (res.rows[0].inserted) stats.inserted += 1;  // fresh row
+    else stats.updated += 1;                             // changed row rewritten
+  }
+  // Prune chunks beyond the new count (file shrank / sections removed).
+  const pruneRes = await client.query(
+    `DELETE FROM search_chunks WHERE source_kind='doc' AND source_ref=$1 AND chunk_index >= $2`,
+    [sourceRef, rows.length]
+  );
+  stats.pruned = pruneRes.rowCount || 0;
+  return stats;
+}
+
+// task 1002859 (panel finding): bound the driver's error text before it reaches a
+// log. A Postgres error message is unbounded upstream text and CAN embed row
+// content (a constraint violation quotes the offending key), and these logs are
+// deploy/cron sinks that get shipped around. One line, capped, is enough to
+// identify the fault; the source_ref beside it is what actually locates it. The
+// DB corpus makes this matter more than it looks — its prose is session-log and
+// memory-derived text the file elsewhere treats as scrub-sensitive.
+const ERR_LOG_MAX = 300;
+function errLine(e) {
+  const raw = e && e.message ? String(e.message) : String(e);
+  const flat = raw.replace(/\s+/g, ' ').trim();
+  return flat.length > ERR_LOG_MAX ? `${flat.slice(0, ERR_LOG_MAX)}… (truncated)` : flat;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const dryRun = args.includes('--dry-run');
+  const rootIdx = args.indexOf('--root');
+  const root = rootIdx >= 0 ? path.resolve(args[rootIdx + 1]) : REPO_ROOT;
+
+  const files = collectMarkdown(root, root).sort();
+  const allRows = [];
+  let metic = 0;
+  for (const abs of files) {
+    const rows = chunkFile(abs);
+    if (rows.some((r) => r.min_rank === 'metic')) metic += 1;
+    allRows.push({ sourceRef: relPath(abs), rows });
+  }
+  const totalChunks = allRows.reduce((n, f) => n + f.rows.length, 0);
+  console.log(`search-ingest-md: ${files.length} markdown file(s), ${totalChunks} chunk(s), ${metic} file(s) tagged min_rank=metic`);
+
+  if (dryRun) {
+    console.log('--dry-run: no writes. Sample of metic-tagged sources:');
+    for (const f of allRows.filter((f) => f.rows[0] && f.rows[0].min_rank === 'metic').slice(0, 10)) {
+      console.log(`  metic  ${f.sourceRef} (${f.rows.length} chunk(s))`);
+    }
+    return;
+  }
+
+  const pool = requirePool();
+  const client = await pool.connect();
+  const totals = { inserted: 0, updated: 0, unchanged: 0, pruned: 0, deleted: 0 };
+  // task 1002859: ONE TRANSACTION PER FILE, not one for the whole run. The old
+  // shape opened a single BEGIN before this loop, so ANY failure on ANY file
+  // rolled back the ENTIRE index update — that is the "rolls back the entire
+  // re-index" in this task's title, and it is what turned a one-character data
+  // problem into a total, permanent recall outage. Per-file scope makes the
+  // blast radius one file: the other ~900 still land, and the failure is
+  // reported by name instead of vanishing.
+  const failures = [];
+  for (const f of allRows) {
+    try {
+      await client.query('BEGIN');
+      const s = await ingestFile(client, f.rows, f.sourceRef);
+      await client.query('COMMIT');
+      totals.inserted += s.inserted; totals.updated += s.updated;
+      totals.unchanged += s.unchanged; totals.pruned += s.pruned;
+    } catch (e) {
+      await client.query('ROLLBACK').catch(() => {});
+      failures.push({ sourceRef: f.sourceRef, message: errLine(e) });
+      console.error(`search-ingest-md: SKIPPED ${f.sourceRef} — ${errLine(e)}`);
+    }
+  }
+  // Delete chunks for doc sources that no longer exist in the tree. Its own
+  // transaction, and deliberately SKIPPED when any file failed: `present` is the
+  // list of sources we intended to write, so pruning against it after a partial
+  // run could delete chunks for a file that only failed transiently.
+  try {
+    if (failures.length === 0) {
+      await client.query('BEGIN');
+      const present = allRows.map((f) => f.sourceRef);
+      const del = await client.query(
+        `DELETE FROM search_chunks WHERE source_kind='doc' AND NOT (source_ref = ANY($1::text[]))`,
+        [present]
+      );
+      totals.deleted = del.rowCount || 0;
+      await client.query('COMMIT');
+    } else {
+      console.error(`search-ingest-md: vanished-source prune SKIPPED — ${failures.length} file(s) failed, so the present-sources list is incomplete`);
+    }
+  } catch (e) {
+    await client.query('ROLLBACK').catch(() => {});
+    failures.push({ sourceRef: '(vanished-source prune)', message: errLine(e) });
+    console.error('search-ingest-md: vanished-source prune FAILED:', errLine(e));
+  }
+  client.release();
+  await pool.end().catch(() => {});
+  console.log(`search-ingest-md: inserted=${totals.inserted} updated=${totals.updated} unchanged=${totals.unchanged} pruned=${totals.pruned} deleted_sources_chunks=${totals.deleted}`);
+  if (failures.length > 0) {
+    // NON-SILENT (task 1003097's sibling half): the deploy step runs this
+    // best-effort, so a non-zero exit is the only signal that reaches a log a
+    // human reads. Name every casualty — "some files were skipped" is what let
+    // this hide.
+    console.error(`search-ingest-md: ${failures.length} file(s) FAILED and were skipped:`);
+    for (const f of failures) console.error(`  ${f.sourceRef}: ${f.message}`);
+    process.exitCode = 1;
+  }
+}
+
+if (require.main === module) {
+  main().catch((e) => { console.error('search-ingest-md: error', e); process.exit(1); });
+}
+
+module.exports = { chunkFile, minRankForDoc, collectMarkdown, ingestFile, requirePool, SENSITIVE_DOC_GLOBS };

package/scripts/bongos/seed-bongos-v1-idea-routing-tasks.js

@@ -0,0 +1,152 @@
+// DO NOT COPY THE `crit:` TOKENS FROM THIS FILE (task 1003108) — copy its
+// verifySeedCriteriaLinks tail instead, which is what this script is cited for.
+// Its positional "Cn" refs rank over the whole VERSION's criteria, so on a
+// multi-goal version they resolve to another goal's criterion silently (learning
+// 1000188). POST /tasks now refuses a positional ref there (400
+// ambiguous_criterion_ref). A new seed uses criterion_id SLUGS.
+//
+// Seed the tasks for goal 1000071 "Idea routing — work that has a home lands in it" (BONGOS-V1).
+// Source of truth: docs/specs/bongos-v1-idea-routing.md (status: final).
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+// Reference implementation (task 1003076) for the seeding contract's self-check:
+// ends by tallying the criterion_ids it actually POSTed and diffing that plan
+// against GET /goals/<id>'s real linked_tasks — see seed-verify-criteria.js.
+//
+// Run: node scripts/bongos/seed-bongos-v1-idea-routing-tasks.js
+const os = require('os');
+const { expectedCriterionCounts, verifySeedCriteriaLinks } = require('./seed-verify-criteria');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = sess.api_base.replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V1';
+const GOAL = 1000071;
+const SRC = 'planning-session';
+const META_TASK = 1003059;      // this planning session's meta task — moved into the goal
+const DISCORD_BUGS_IDEA = 1000771; // subsumed by R11; marked promoted against it
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(400); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/bongos${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// Landing matrix (interview-decided): bugs hard-land (Metic+ filer → ready; sub-Metic → backlog);
+// every other goal-bound kind soft-lands (backlog, one Metic+ promote away); homeless → inbox.
+//
+// crit uses the goal's criterion SLUGS via CRIT — positional "Cn" tokens resolve against the
+// whole VERSION's criterion order (and even matched an old criterion literally slugged "C1"),
+// which mislinked the first seed run; slugs are position-independent.
+const CRIT = {
+  C1: 'bug-lands-in-its-goal', C2: 'inbox-holds-only-homeless', C3: 'no-route-loses-the-author',
+  C4: 'filing-cannot-outrun-rank', C5: 'system-offers-the-home', C6: 'triage-shrinks-to-judgment',
+};
+const TASKS = [
+  // T1 — zero-dep layer — P5
+  { ref:'R02', kind:'infra',    disc:'engineer', prio:5, est:90,  crit:['C1','C3'], deps:[],                title:'R02 · Schema: idea_inbox.suggested_goal_id + lineage origin \'route\'', desc:'Core migration: nullable suggested_goal_id FK on idea_inbox (routing hint for soft-landed/Discord/homeless ideas). Module migration (ideas_*): extend ideas_task_lineage.origin CHECK with \'route\'. See docs/specs/bongos-v1-idea-routing.md.' },
+  { ref:'R03', kind:'bug',      disc:'engineer', prio:5, est:90,  crit:['C1'],      deps:[],                title:'R03 · Catch-all fallback never resolves to a non-building version', desc:'generalGoalIdForVersion (modules/lifecycle/db.js:1343) + the null-goal fallback (:1414): a task create must never land in a shipped/frozen version\'s catch-all goal (the 1000771 failure shape). Routed creates with no goal go to the inbox instead. Done-when: test proves a create against a shipped version cannot resolve a catch-all.' },
+  { ref:'R07', kind:'feature',  disc:'engineer', prio:5, est:120, crit:['C5'],      deps:[],                title:'R07 · Capture-time goal suggester (advisory consulted BEFORE creation)', desc:'Expose candidate goals for a draft capture — reuse buildGoalAdvisory\'s candidate logic (modules/lifecycle/goal-advisory.js:89) as a pre-creation read (e.g. GET /inbox/goal-suggestions?title=&kind=&version=). Feeds the hall picker (R08), CLI (R09), and Discord suggestion (R11). Done-when: candidates returned for a draft title/kind without creating anything.' },
+  { ref:'R10', kind:'feature',  disc:'ui',       prio:5, est:120, crit:['C5'],      deps:[],                title:'R10 · Hall move-a-task-to-goal affordance', desc:'PATCH /tasks/:id {goal_id} (task 1763) exists but has no hall UI. Add move-to-goal on the task overlay (Metic+, task.edit) so a wrong routing pick is one reassignment, never a re-file. Done-when: a Metic+ moves a task between same-version goals from the hall.' },
+  { ref:'R14', kind:'decision', disc:'engineer', prio:5, est:60,  crit:['C2'],      deps:[],                title:'R14 · ADR: idea routing — capture-time promotion, the landing matrix, the homeless-only inbox', desc:'Write the ADR recording: routing mechanism is capture-time promotion (never inbox bypass — the Discord #bugs lesson), the landing matrix (bugs hard-land by rank; other kinds soft-land; Full Ideas/criterion-proposals/decisions never auto-route), and the inbox\'s new identity (holds only work without a home). Source: docs/specs/bongos-v1-idea-routing.md interview decisions.' },
+
+  // T2 — the core mechanism — P5
+  { ref:'R01', kind:'feature',  disc:'engineer', prio:5, est:240, crit:['C1','C3'], deps:['R02'],           title:'R01 · Capture-time routing core: POST /inbox accepts goal_id and converts in one transaction', desc:'Extend inbox.captureIdea/route: when goal_id present and the landing matrix says route, one transaction writes the idea row (status=promoted, promoted_to_task_id), the task (in the goal, matrix-decided status), and ideas_task_lineage (origin=route). Validations: goal open + belongs to a building version; Full-grade and criterion-proposal/decision kinds never auto-route; goal-less capture behaves exactly as today. Deps R02.' },
+
+  // T3 — enforcement + surfaces — P4
+  { ref:'R05', kind:'feature',  disc:'engineer', prio:4, est:150, crit:['C4'],      deps:['R01'],           title:'R05 · Rank-aware landing: matrix enforcement server-side', desc:'Metic+ filer\'s bug → status=ready; sub-Metic filer / any non-bug kind → backlog (awaiting any Metic+ promote via the existing task.promote, surfaced in the Needs-your-attention slice). Auto-derived requires_rank floors (ADR 0084) and the goal scope wall run on routed tasks exactly as on authored ones. Deps R01.' },
+  { ref:'R11', kind:'feature',  disc:'engineer', prio:4, est:180, crit:['C1','C3'], deps:['R01'],           title:'R11 · Discord #bugs retired onto the routing path', desc:'Replace discord-bugs.js\'s direct createTask bypass (hardcoded GDS-V3 → goal 1000002 catch-all; destroys attribution) with capture-time routing: idea row + classifier-suggested goal (suggested_goal_id), soft-landing into the pending queue for a one-click Metic+ route. Unlinked authors still yield an attributable idea row (captured_by null). Closes inbox idea 1000771. Deps R01.' },
+  { ref:'R12', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C5'],      deps:['R02'],           title:'R12 · Discord #ideas carries routing hints', desc:'The #ideas inbound (discord-inbound.js) files with no suggested_version at all today. Add: default suggested_version (most-recent building), classifier-suggested suggested_goal_id. Deps R02.' },
+  { ref:'R08', kind:'feature',  disc:'ui',       prio:4, est:240, crit:['C1','C5'], deps:['R01','R07'],     title:'R08 · Hall filing surface: file a bug/idea with a goal picker', desc:'The hall has NO capture surface today (triage only). Add file-a-bug/idea: title, body, kind, goal picker fed by the suggester (R07); submits to POST /inbox with goal_id so goal-bound work routes at filing time. Grade capture untouched. Deps R01,R07.' },
+  { ref:'R09', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C1','C5'], deps:['R01','R07'],     title:'R09 · CLI capture routing: --goal, suggester prompt, active-claim default', desc:'capture.js gains --goal; when the builder holds a claim the suggested goal defaults to the claim\'s goal (interview decision 4); suggester candidates offered otherwise. Deps R01,R07.' },
+  { ref:'R13', kind:'feature',  disc:'engineer', prio:4, est:120, crit:['C2','C6'], deps:['R07'],           title:'R13 · Promote path passes goal_id; /idea-triage goes homeless-only', desc:'task-detail.js (:320) and triage.js (:160) finally send goal_id (suggester-fed default) so even triaged promotions land in a real goal; the /idea-triage skill doc is updated to the homeless-only contract. Deps R07.' },
+
+  // T4 — proofs — P3
+  { ref:'R04', kind:'verify',   disc:'engineer', prio:3, est:90,  crit:['C3'],      deps:['R01'],           title:'R04 · PROOF: attribution survives the route end-to-end', desc:'A routed bug\'s task ships; sourceIdeaForTask returns the filer; ideas_task_lineage (origin=route) + captured_by intact — the trail goal 1000067\'s ideator credit will pay against (test). Deps R01.' },
+  { ref:'R06', kind:'verify',   disc:'engineer', prio:3, est:120, crit:['C4'],      deps:['R05'],           title:'R06 · PROOF: abuse matrix — filing cannot escalate', desc:'A Xenos mass-filing bugs never lands claimable work, never reaches protected scope, rate limits hold; a sub-Metic cannot reach ready via any capture vector (test suite). Deps R05.' },
+
+  // T5 — the measured close — P2
+  { ref:'R15', kind:'verify',   disc:'engineer', prio:2, est:120, crit:['C2','C6'], deps:['R01','R05','R13'], title:'R15 · PROOF: reclassification sweep of the open inbox', desc:'Walk the open idea_inbox (~50 rows at planning time; 14 bugs) under the new rules: every goal-bound bug homed in a real goal; residual inbox is homeless-only; before/after counts recorded in this task\'s notes as the goal\'s measured evidence. Deps R01,R05,R13.' },
+];
+
+const ROOTS = ['R02', 'R03', 'R07', 'R10', 'R14']; // zero-dep, non-spike → open for claiming
+
+(async () => {
+  const idByRef = {};
+  let created = 0, existing = 0;
+  // Resolved (post-CRIT-mapping) criterion_ids per task — the plan the final
+  // self-check diffs against, kept in lockstep with what's actually POSTed
+  // below rather than re-derived from the raw "Cn" tokens.
+  const criterionIdListsPerTask = [];
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const criterionIds = t.crit.map((c) => CRIT[c]);
+    const r = await api('POST', '/tasks', {
+      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc,
+      kind: t.kind, discipline: t.disc, priority: t.prio, est_minutes: t.est,
+      criterion_ids: criterionIds, source: SRC, source_ref: `bongos-v1-idea-routing-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    // Only a task that actually landed contributes to the self-check's plan —
+    // a failed POST is already reported above as FAILED, not as a criterion
+    // mismatch (task 1003076 grade finding: counting it here regardless of
+    // r.ok blamed a real create failure on the wrong cause).
+    criterionIdListsPerTask.push(criterionIds);
+    const task = r.json.task || r.json;
+    idByRef[t.ref] = task.id;
+    if (r.json.idempotent || r.json.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    const depIds = t.deps.map((d) => idByRef[d]).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) { console.log(`  ${t.ref}: dep resolve gap, skipping`); continue; }
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) { console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    edges += (r.json.added || depIds.length);
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting the zero-dep layer to ready…');
+  for (const ref of ROOTS) {
+    const id = idByRef[ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.json).slice(0, 120)}`);
+  }
+
+  console.log('Linking provenance…');
+  if (idByRef.R11) {
+    const r = await api('PATCH', `/inbox/${DISCORD_BUGS_IDEA}`, { status: 'promoted', promoted_to_task_id: Number(idByRef.R11) });
+    console.log(`  idea ${DISCORD_BUGS_IDEA} → ${r.ok ? `promoted against R11 (task ${idByRef.R11})` : 'PATCH note ' + JSON.stringify(r.json).slice(0, 160)}`);
+  }
+  const meta = await api('PATCH', `/tasks/${META_TASK}`, { goal_id: GOAL });
+  console.log(`  meta task ${META_TASK} → ${meta.ok ? `goal ${GOAL}` : 'PATCH note ' + JSON.stringify(meta.json).slice(0, 160)}`);
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}. Roots opened: ${ROOTS.join(', ')}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+
+  // Self-check (task 1003076): fetch the goal back and confirm every
+  // criterion's linked_tasks matches what was actually POSTed — exits 1 loudly
+  // on any mismatch instead of a seed that mislinks and reports success.
+  console.log('Verifying criterion links against the plan…');
+  await verifySeedCriteriaLinks({
+    goalId: GOAL,
+    expectedCounts: expectedCriterionCounts(criterionIdListsPerTask),
+    fetchGoal: (id) => api('GET', `/goals/${id}`),
+  });
+})();

package/scripts/bongos/seed-bv1-profiles-tasks.js

@@ -0,0 +1,135 @@
+// DO NOT COPY THE `crit:` TOKENS FROM THIS FILE (task 1003108). Its positional
+// "Cn" refs were written when BONGOS-V1 held one goal, where they were unambiguous.
+// Cn ranks over the whole VERSION's criteria, so on a multi-goal version it resolves
+// to another goal's criterion silently — that is how all 15 tasks of goal 1000071 were
+// mislinked (learning 1000188). POST /tasks now refuses a positional ref on a
+// multi-goal version (400 ambiguous_criterion_ref). A new seed uses criterion_id
+// SLUGS. This file is kept as-is because it has already run and is idempotent on
+// source_ref — a re-run returns the existing rows before criterion resolution.
+//
+// Seed the tasks for goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
+// Source of truth: docs/specs/bongos-v1-public-builder-profiles.md (status: final).
+// Idempotent on (source, source_ref). Re-running resolves to the existing rows.
+//
+// Run: node scripts/bongos/seed-bv1-profiles-tasks.js
+const os = require('os');
+const sess = require(os.homedir() + '/.config/cloudbongos/gds-session.json');
+const BASE = sess.api_base.replace(/\/$/, '');
+const TOKEN = sess.token;
+const VER = 'BONGOS-V1';
+const GOAL = 1000045;
+const SRC = 'planning-session';
+const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function api(method, path, body, _tries = 0) {
+  await sleep(400); // base throttle to stay under the per-IP rate limit
+  const res = await fetch(`${BASE}/api/bongos${path}`, {
+    method, headers: H, body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { _raw: text.slice(0, 300) }; }
+  if (res.status === 429 && _tries < 8) {
+    const wait = ((json.error && json.error.details && json.error.details.retry_after_seconds) || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return { status: res.status, ok: res.ok, json };
+}
+
+// disc: engineer (backend/API/spike) | ui (frontend). kind: spike | feature | verify (proofs).
+const TASKS = [
+  // Phase 1 — profile shows cross-project record + hide (C1,C2) — P5
+  { ref:'R01', kind:'spike',   disc:'engineer', prio:5, est:180, crit:['C1','C2'], deps:[],            title:'R01 · Design profile↔cross-project rollup join + consent model', desc:'Needs-exploration: how the public profile reads the platform-identity rollup (listScoutingRollup / platform_identity_builder_project_activity), public-by-default, and where the hide flag (C2) lives. Output an ADR + sub-tasks. See docs/specs/bongos-v1-public-builder-profiles.md.' },
+  { ref:'R02', kind:'feature', disc:'engineer', prio:5, est:240, crit:['C1'],      deps:['R01'],        title:'R02 · Profile API returns cross-project record + project names', desc:'Extend GET /builders/:id/profile to include aggregated cross-project credits/ships/karma/disciplines + the list of projects by name, from the platform-identity rollup; public by default; respects the whitelist + leak test (tests/profile_route.mjs). Done-when: another account sees the aggregate + project names, no private columns. Deps R01.' },
+  { ref:'R03', kind:'feature', disc:'engineer', prio:5, est:180, crit:['C2'],      deps:['R01'],        title:'R03 · Hide flag: builder hides cross-project stats (opt-out, live)', desc:'Self-serve opt-out that hides the cross-project record from the profile + applications, honored live everywhere. Default is shown. Deps R01.' },
+  { ref:'R04', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C1','C2'], deps:['R02','R03'],  title:'R04 · Profile UI: cross-project section + self hide-toggle', desc:'Render the cross-project section (totals + project names) on the profile; show the hide toggle to the profile owner. Deps R02,R03.' },
+  { ref:'R05', kind:'feature', disc:'ui',       prio:4, est:120, crit:['C1'],      deps:['R02'],        title:'R05 · Shareable-by-login profile URL (?builder=<login>)', desc:'Add a login-addressable profile URL alongside ?id=. Promotes idea #1000522. Deps R02.' },
+  { ref:'R06', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C1','C2'], deps:['R04','R03'],  title:'R06 · PROOF: cross-project record shows to a viewer; hide removes it live', desc:'Verify a 2-project builder\'s combined record shows to another account, and hiding removes it within one load. Extends tests/profile_route.mjs. Deps R04,R03.' },
+
+  // Phase 2 — apply from orbs + application carries profile (C3,C4) — P5
+  { ref:'R07', kind:'spike',   disc:'engineer', prio:5, est:180, crit:['C3','C4'], deps:[],             title:'R07 · Design application model + "project owner (registrant+delegates)" authz', desc:'Needs-exploration: extend access_requests vs a new cross-project applications record; how the profile snapshot travels hub→target; the owner (registrant + delegates) authz; pending queue + approve/decline. Output an ADR + sub-tasks. Deps none.' },
+  { ref:'R08', kind:'feature', disc:'engineer', prio:5, est:240, crit:['C3','C4'], deps:['R07'],        title:'R08 · Application API: apply / list-pending / approve / decline', desc:'Cross-project application flow reusing the join relay (/my-projects/join → target /access-requests). Deps R07.' },
+  { ref:'R09', kind:'feature', disc:'engineer', prio:5, est:150, crit:['C4'],      deps:['R08','R02'],  title:'R09 · Application carries the applicant\'s cross-project record (+note)', desc:'Attach the applicant\'s cross-project record (subject to the C2 hide, live) + optional note to the application the owner sees. Deps R08,R02.' },
+  { ref:'R10', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C3'],      deps:['R08'],        title:'R10 · "Apply" affordance on the in-core browse surface', desc:'Apply action + state (applied/pending/member) on the project cards / My Projects. Deps R08.' },
+  { ref:'R11', kind:'feature', disc:'ui',       prio:5, est:180, crit:['C4'],      deps:['R08'],        title:'R11 · Owner pending-applications view (approve/decline)', desc:'A project owner sees pending applications for their project and approves/declines. Deps R08.' },
+  { ref:'R12', kind:'feature', disc:'ui',       prio:4, est:150, crit:['C3'],      deps:['R10'],        title:'R12 · Surface "Apply" on the orbs front door', desc:'Wire the Apply affordance onto the orbs page. NOTE: the orbs front door is a separate static site — this likely lands instance-side. Deps R10.' },
+  { ref:'R13', kind:'verify',  disc:'engineer', prio:5, est:90,  crit:['C3','C4'], deps:['R10','R11','R09'], title:'R13 · PROOF: apply → owner sees record → approves → applicant joins', desc:'End-to-end verify of the apply→approve flow carrying the profile. Deps R10,R11,R09.' },
+
+  // Phase 3 — owners browse builder profiles (C5) — P4
+  { ref:'R14', kind:'feature', disc:'engineer', prio:4, est:210, crit:['C5'],      deps:['R02'],        title:'R14 · Graduate /scouting to project-owner-facing + opt-out-of-recruiting flag', desc:'Widen the Archon-only /scouting to a project owner (registrant+delegates); add a builder opt-out-of-recruiting flag. Touches authz → Metic+ floor. Deps R02.' },
+  { ref:'R15', kind:'feature', disc:'ui',       prio:4, est:210, crit:['C5'],      deps:['R14'],        title:'R15 · Owner recruiting UI (search/filter/sort; honors hide + opt-out)', desc:'Owner-facing recruiting surface: search/filter by discipline, sort by track record; honors C2 hide + recruiting opt-out. Deps R14.' },
+  { ref:'R16', kind:'feature', disc:'ui',       prio:4, est:150, crit:['C5'],      deps:['R15','R08'],  title:'R16 · Browse → invite/recruit a builder to your project', desc:'Invite/recruit a builder from the browse surface, tying into the application/invite flow. Deps R15,R08.' },
+  { ref:'R17', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C5'],      deps:['R15','R16'],  title:'R17 · PROOF: non-Archon owner browses, filters, invites', desc:'Verify a non-Archon project owner browses builder profiles, filters by discipline, invites one. Deps R15,R16.' },
+
+  // Phase 4 — builder-to-builder connections + degrees (C6) — P4
+  { ref:'R18', kind:'spike',   disc:'engineer', prio:4, est:180, crit:['C6'],      deps:[],             title:'R18 · Design connections model incl. 1st/2nd/3rd-degree traversal', desc:'Needs-exploration: platform-level connections (account↔account) with request/accept/decline/remove; degree-of-separation traversal (1st/2nd/3rd); "people you may know" from native signals. Output an ADR + sub-tasks. Deps none.' },
+  { ref:'R19', kind:'feature', disc:'engineer', prio:4, est:240, crit:['C6'],      deps:['R18'],        title:'R19 · Connections API: request/accept/decline/remove/list + degree queries', desc:'The connection graph API incl. degree-of-separation queries. Deps R18.' },
+  { ref:'R20', kind:'feature', disc:'ui',       prio:4, est:180, crit:['C6'],      deps:['R19','R04'],  title:'R20 · Connections on the profile (with degree labels) + connect button', desc:'Show a builder\'s connections (public) with 1st/2nd/3rd-degree labels; connect/pending/accept from the profile. Deps R19,R04.' },
+  { ref:'R21', kind:'feature', disc:'engineer', prio:4, est:150, crit:['C6'],      deps:['R19'],        title:'R21 · "Builders you may know" from mutuals + shared projects/guilds', desc:'Suggest connections from mutual connections + shared projects/guilds (2nd/3rd degree). Deps R19.' },
+  { ref:'R22', kind:'verify',  disc:'engineer', prio:4, est:90,  crit:['C6'],      deps:['R20','R21'],  title:'R22 · PROOF: two builders connect; each sees the other + a 2nd-degree suggestion', desc:'Verify request→accept, mutual visibility, and a 2nd-degree suggestion appears. Deps R20,R21.' },
+
+  // Phase 5 — guilds + apply/invite + guild map (C7,C8,C9) — P3
+  { ref:'R23', kind:'spike',   disc:'engineer', prio:3, est:210, crit:['C7','C8','C9'], deps:['R18','R07'], title:'R23 · Design guild model (tables, roles, public/unlisted, rollup, map ranking)', desc:'Needs-exploration: platform-level guilds + guild_members (multi-guild, distinct from goal_members); roles; public/unlisted visibility; collective rollup (excludes hidden members); guild↔project application reuse; map ranking. Output an ADR + sub-tasks. Deps R18,R07.' },
+  { ref:'R24', kind:'feature', disc:'engineer', prio:3, est:240, crit:['C7'],      deps:['R23'],        title:'R24 · Guild CRUD + membership API + public/unlisted visibility', desc:'Create guild, invite/accept/join-request, roster, leave; owner sets public/unlisted. Deps R23.' },
+  { ref:'R25', kind:'feature', disc:'ui',       prio:3, est:210, crit:['C7'],      deps:['R24'],        title:'R25 · Guild page UI (identity, roster, collective record)', desc:'Guild page: identity, roster, collective track record (N of M counted). Deps R24.' },
+  { ref:'R26', kind:'feature', disc:'engineer', prio:3, est:180, crit:['C7'],      deps:['R24','R02'],  title:'R26 · Guild collective track-record rollup (excludes hidden members)', desc:'Aggregate members\' cross-project stats into the guild total; exclude C2-hidden members ("N of M counted"). Deps R24,R02.' },
+  { ref:'R27', kind:'feature', disc:'engineer', prio:3, est:210, crit:['C8'],      deps:['R24','R08'],  title:'R27 · Guild → project applications + owner invites a guild (each-member-opt-in)', desc:'Guild applies to / is invited to a project (guild-level mirror of R08); each member opts in before being attached. Deps R24,R08.' },
+  { ref:'R28', kind:'feature', disc:'ui',       prio:3, est:150, crit:['C8'],      deps:['R27','R11'],  title:'R28 · Owner view: pending guild applications', desc:'Extends the owner application view (R11) to guild applications. Deps R27,R11.' },
+  { ref:'R29', kind:'spike',   disc:'engineer', prio:3, est:150, crit:['C9'],      deps:['R26'],        title:'R29 · Design guild map ranking + orb-sky viz approach', desc:'Needs-exploration: rank guilds by size/success; render on the orb-sky visual language (goal 1000044). Output design + sub-tasks. Deps R26.' },
+  { ref:'R30', kind:'feature', disc:'engineer', prio:3, est:150, crit:['C9'],      deps:['R26'],        title:'R30 · Guild map API (ranked; public guilds only; honors hide)', desc:'Ranked guilds by size/success; only public (not unlisted) guilds; honors member hide. Deps R26.' },
+  { ref:'R31', kind:'feature', disc:'ui',       prio:3, est:210, crit:['C9'],      deps:['R30','R29','R15'], title:'R31 · Guild map UI on the recruiting surface (orb-sky visual)', desc:'Visual guild map on the owner recruiting surface. Deps R30,R29,R15.' },
+  { ref:'R32', kind:'verify',  disc:'engineer', prio:3, est:120, crit:['C7','C8','C9'], deps:['R25','R27','R31'], title:'R32 · PROOF: form guild → applies (members opt in) → owner approves → ranked on map', desc:'End-to-end verify of the guild lifecycle incl. the map. Deps R25,R27,R31.' },
+
+  // Phase 6 — connection proximity via orb-sky physics (C10) — P3
+  { ref:'R33', kind:'spike',   disc:'engineer', prio:3, est:210, crit:['C10'],     deps:['R19','R23'],  title:'R33 · Design connection→orb-physics proximity + degree model', desc:'Needs-exploration: connection strength (direct + mutuals + shared projects/guilds + co-shipped; no time-decay) feeding orb-world physics (goals 1000044/1000049); cluster detection. NOTE cross-goal dependency on orb-physics infra. Output an ADR + sub-tasks. Deps R19,R23.' },
+  { ref:'R34', kind:'feature', disc:'engineer', prio:3, est:210, crit:['C10'],     deps:['R33'],        title:'R34 · Connection-strength + degree + cluster compute API', desc:'Compute connection strength + degrees + close-knit clusters; feeds orb physics + recruiting. Deps R33.' },
+  { ref:'R35', kind:'feature', disc:'ui',       prio:3, est:180, crit:['C10'],     deps:['R34','R25'],  title:'R35 · Builder-side: clusters in the orb sky → invite a close cluster to a guild', desc:'Close connections cluster in the orb sky; invite a cluster to form a guild from it. Deps R34,R25.' },
+  { ref:'R36', kind:'feature', disc:'ui',       prio:3, est:180, crit:['C10'],     deps:['R34','R16'],  title:'R36 · Project-side: recruit a close-knit cluster together', desc:'Surface close-knit clusters on the recruiting surface; recruit them together. Deps R34,R16.' },
+  { ref:'R37', kind:'verify',  disc:'engineer', prio:3, est:120, crit:['C10'],     deps:['R35','R36'],  title:'R37 · PROOF: cluster forms a guild from the sky; owner recruits a cluster', desc:'End-to-end verify of the proximity-driven guild-forming + cluster-recruiting. Deps R35,R36.' },
+];
+
+const ROOTS = ['R01', 'R07', 'R18']; // zero-dep entry spikes to open for claiming
+
+(async () => {
+  const idByRef = {};
+  let created = 0, existing = 0;
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER, goal_id: GOAL, title: t.title, description: t.desc,
+      kind: t.kind, discipline: t.disc, priority: t.prio, est_minutes: t.est,
+      criterion_ids: t.crit, source: SRC, source_ref: `bv1-profiles-${t.ref}`,
+    });
+    if (!r.ok) { console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    const task = r.json.task || r.json;
+    idByRef[t.ref] = task.id;
+    if (r.json.idempotent || r.json.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    const depIds = t.deps.map((d) => idByRef[d]).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) { console.log(`  ${t.ref}: dep resolve gap, skipping`); continue; }
+    const r = await api('POST', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) { console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.json)}`); continue; }
+    edges += (r.json.added || depIds.length);
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting root spikes to ready…');
+  for (const ref of ROOTS) {
+    const id = idByRef[ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.json).slice(0,120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}. Roots opened: ${ROOTS.join(', ')}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();