@bongos/core 1.21.3 → 1.21.4

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.3",
-  "core_contract": "1.21.3",
-  "source_commit": "a694645f58d7360adc29badc79e5cefbd91e9958",
+  "core_version": "1.21.4",
+  "core_contract": "1.21.4",
+  "source_commit": "227ae34b0487683d4edf44ffe2bc124e642bdad7",
   "source_ref": "HEAD",
-  "built_at": "2026-10-02T00:11:07.226Z",
+  "built_at": "2026-10-02T02:09:36.609Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 576,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2848,
+    "functional_verbatim": 2849,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3452,
-  "tree_sha256": "b1bdc1e227ffd858e81feb70ce0a0e84792b730b569f5f132acb40360e1c065d",
+  "file_count": 3453,
+  "tree_sha256": "745f91270b3cdca0328608ed1dad6684e2aebe6a52a1fe7e294d9016458f470b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2817,7 +2817,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "382700e91796438ead85187899b7f09a43964b68035bfc0ada301d049cb7d8e1"
+      "sha256": "53996e5c9e4a988cff115ec80dc2d61b9f16fa151c4c96fb6ccd2b5e1b6b6a29"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4029,6 +4029,11 @@
       "mode": "0000644",
       "sha256": "7b05f548a3498aa472267ca10b26236cc81fa52df0334be9ec89c9d620866e2f"
     },
+    {
+      "path": "migrations/core_272_rename_cn_criterion_slugs.sql",
+      "mode": "0000644",
+      "sha256": "a9a435bf6e5d6bc94f6029a9375519c80041cbac8d791f98989dffc09b5b1dfe"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -6572,7 +6577,7 @@
     {
       "path": "modules/lifecycle/criterion-ref.js",
       "mode": "0000644",
-      "sha256": "5ae49c40d6f7ec8a1bb62f038b405e7c4e69b844ea204a50bded2eddef29faae"
+      "sha256": "90f77854fb0d0c7c70d9bd20f018100e555c72920840e84afe24789531f1db2f"
     },
     {
       "path": "modules/lifecycle/criterion-suggest.js",
@@ -6652,7 +6657,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "5f58f89cdf7055461a62c17209fbca84b11bcacc0100ec18ad6f12db3884ce06"
+      "sha256": "2efcf47f6240b7a21e1d908440a04e3f0af3e86ca22aed5b74ba03ed354de437"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -6997,7 +7002,7 @@
     {
       "path": "modules/lifecycle/routes/done-when.js",
       "mode": "0000644",
-      "sha256": "503d1b4f483dcca715146530e8ca71e33f72d855dd19aa7a59eebe7a8ba574d1"
+      "sha256": "a6adbf715fb5f2994a0f4603859e5047b321311b66e04d9fcb96ce9ce854c5b3"
     },
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
@@ -9602,12 +9607,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "220d50d4e763e778d8027917440a7dfc58f691660e5de8c98d88d4f9b2f9becf"
+      "sha256": "b2c580b1a1dac4d154f0210d9a505aff2793d869c4a9daf2e74662684924e71b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d6def8e4ddd25e3d57f226dcd345360204f41ebc8188744a9804faf2854cfe96"
+      "sha256": "ea4e035d42d25f49b75519085179ae3162c28a9ea263d47db99532354c4e4c4b"
     },
     {
       "path": "public-docs/index.html",
@@ -9627,7 +9632,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "26fccda86a4b69f5b14d2f12bc1ac63a79659544fe7dcb46d8a964600e3e67d7"
+      "sha256": "39ceec2a9fbb1e216f935e73b23f3a380ba319100a13f99bf71bc3783d90e987"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11842,7 +11847,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4d274e5ab27d9b6ffc5eeb602286391e9db864e757ca2e5f6cd564133a2b7440"
+      "sha256": "59ddf172c5c74312f7140b65decd20aa6e6e54778ba47b7d3b78913fdea45d4a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12897,7 +12902,7 @@
     {
       "path": "tests/criterion_goal_attach.mjs",
       "mode": "0000644",
-      "sha256": "6cf361f2ab0914a85b1c7556717c39802fa4c267a1d73fdaa5aee78d230ebcb5"
+      "sha256": "49a2d85d679669efd63c0b2600bd2f207106f37f00cb5beebcd0e6a4775b6452"
     },
     {
       "path": "tests/criterion_progress.mjs",
@@ -12912,7 +12917,7 @@
     {
       "path": "tests/criterion_ref_parse.mjs",
       "mode": "0000644",
-      "sha256": "80ce711abf62a78dc4f36b513b852a5396173a2ff50e5deab2460531d17911e4"
+      "sha256": "8373511dace3ecb37d88961d22a9f8fb2f01fb34d12a0075d287b78ef02d398a"
     },
     {
       "path": "tests/criterion_ref_status.mjs",

package/docs/module-api-changelog.md

@@ -2833,5 +2833,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.1 with no explicit bump. run 36943290103. (task 1002620)
   1.21.3 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.2 with no explicit bump. run 36944637655. (task 1002620)
+  1.21.4 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.3 with no explicit bump. run 36954271746. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_272_rename_cn_criterion_slugs.sql

@@ -0,0 +1,40 @@
+-- core_272 — rename goal 1000045's criteria off the positional shape (task 1003122)
+--
+-- parseCriterionRef reads a ref shaped C1, C2... as a POSITION before it ever
+-- consults slugs, so a criterion whose criterion_id is literally 'C5' cannot be
+-- named by its own slug (and on a multi-goal version the ref is refused as
+-- ambiguous). Goal 1000045 slugged ten criteria C1..C10, and a seeder passing 'C5'
+-- meaning that goal's C5 got another goal's criterion. createCriterion now refuses
+-- the shape; this renames the ten that already exist, once, owner-approved names.
+--
+-- Links are by done_when_criteria.id (task_criteria.criterion_id), so no task link
+-- moves. Scoped by goal AND old slug, so it is idempotent and touches nothing on an
+-- instance that never had this goal. Data only: forward-safe.
+--
+-- WHY core/ AND NOT migrations/instance/ (ADR 0105). That directory does not exist
+-- in the portable core, and the instance seed path only runs under the owner opt-in
+-- GDS_APPLY_INSTANCE_SEEDS=1 (a DR step), so a rename placed there would never run
+-- on the live instance that needs it. The cost is a no-op UPDATE on every other
+-- host; the double guard (this goal id AND the exact old slug AND the new slug free)
+-- keeps it from touching an unrelated goal that happens to share the id.
+
+UPDATE done_when_criteria c
+   SET criterion_id = m.new_slug
+  FROM (VALUES
+    ('C1',  'bp-public-cross-project-record'),
+    ('C2',  'bp-hide-my-record'),
+    ('C3',  'bp-apply-from-orbs'),
+    ('C4',  'bp-application-carries-profile'),
+    ('C5',  'bp-owner-browses-builders'),
+    ('C6',  'bp-builder-connections'),
+    ('C7',  'bp-guilds'),
+    ('C8',  'bp-guild-apply-and-invite'),
+    ('C9',  'bp-guild-map'),
+    ('C10', 'bp-connection-graph-to-guild')
+  ) AS m(old_slug, new_slug)
+ WHERE c.goal_id = 1000045
+   AND c.criterion_id = m.old_slug
+   AND NOT EXISTS (
+     SELECT 1 FROM done_when_criteria d
+      WHERE d.version_id = c.version_id AND d.criterion_id = m.new_slug
+   );

package/modules/lifecycle/criterion-ref.js

@@ -46,6 +46,16 @@ function parseCriterionRef(raw) {
   return { kind: 'slug', slug: ref };
 }
 
+// A criterion_id slug may not be shaped like a positional token (task 1003122).
+// parseCriterionRef reads 'C5' as a position BEFORE it ever consults slugs, so a
+// criterion whose slug is literally 'C5' is unreachable by its own name — and on a
+// multi-goal version the ref is refused as ambiguous. Goal 1000045 slugged ten
+// criteria 'C1'..'C10' and a seeder's 'C5' landed on another goal's criterion.
+// Refuse the shape at write time so the ambiguity cannot exist (option b).
+function isReservedCriterionSlug(raw) {
+  return parseCriterionRef(raw).kind === 'cnum';
+}
+
 // A version id as this project writes them: an uppercase prefix (possibly none)
 // followed by V + digits — V1, PMS-V2, GDS-V4, BONGOS-V2, CB-V1.
 //
@@ -101,6 +111,7 @@ function criterionLabel(c) {
 
 module.exports = {
   parseCriterionRef,
+  isReservedCriterionSlug,
   looksLikeVersionId,
   resolveCriterionIn,
   criterionLabel,

package/modules/lifecycle/db-tasks.js

@@ -18,6 +18,7 @@ const { matchProtected } = api.permissionPathCheck;
 const { decorateGoalMembership, capNewcomerTasks } = require('./claim-feed.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { executorFor } = require('./db-executor.js');
+const { isReservedCriterionSlug } = require('./criterion-ref.js');
 const { resolveWriteDiscipline, WRITABLE_DISCIPLINES } = require('./task-classifier.js');
 
 // -------------------------------------------------------------------------
@@ -366,6 +367,12 @@ async function updateTaskColumn(id, column, value) {
 // it are one decision, and splitting them across connections reopens a narrower
 // version of the same race — two creates reading the same next order.
 async function createCriterion({ versionId, criterionId, criterionMd, goalId = null, sortOrder = null }, deps = {}) {
+  if (isReservedCriterionSlug(criterionId)) {
+    // Task 1003122: a 'Cn' slug is unreachable by name (the positional reading wins).
+    const err = new Error(`criterion_id '${criterionId}' is shaped like a positional ref (C1, C2, ...); choose a descriptive slug.`);
+    err.code = 'RESERVED_CRITERION_SLUG';
+    throw err;
+  }
   const executor = executorFor(deps, pool);
   let order = sortOrder;
   if (order == null) {

package/modules/lifecycle/routes/done-when.js

@@ -23,6 +23,7 @@ const { isGoalOwnerOrManager } = require('../goal-authz');
 const goalEdits = require('../goal-edits.js');
 // task 1004392 — /satisfy is the override now and records itself as one.
 const uatDb = require('../criterion-uat-db.js');
+const { isReservedCriterionSlug } = require('../criterion-ref.js');
 const { validateOrRespond, parseId, asyncHandler, LIMITS } = api;
 
 // authorizeCriterionCreate — the ORDERED, FAIL-CLOSED decision for a non-Archon
@@ -132,6 +133,11 @@ module.exports = function buildDoneWhenRouter() {
       goal_id: { type: 'integer', min: 1 },
       sort_order: { type: 'integer', min: 0 },
     })) return;
+    // Task 1003122: refuse before the transaction takes its locks. createCriterion
+    // enforces the same rule for every other caller (the ratified-goal path).
+    if (isReservedCriterionSlug(req.body.criterion_id)) {
+      return res.fail('reserved_criterion_slug', { status: 400, message: 'criterion_id may not be shaped like a positional ref (C1, C2, ...); choose a descriptive slug.' });
+    }
     // bad_goal_id now means exactly what it says: the goal is absent or belongs
     // to another version. (The unauthorized case rendered through this same
     // helper until task 1002614 — see the mask note in authorizeCriterionCreate.)

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.3",
+  "version": "1.21.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.3",
+      "version": "1.21.4",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.3",
+  "version": "1.21.4",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8710,5 +8710,11 @@
       "id": "1004532",
       "text": "Hovering over a badge on the builders list or the public status page now shows its real name, such as \"Art Pipeline Engineer\" or \"A Thought That Built Ten\", instead of words made from its internal code. Screen readers read the"
     }
+  ],
+  "1.21.4": [
+    {
+      "id": "1003122",
+      "text": "New criteria can no longer be named like C5, which the system always read as a position and so could never find by name."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.3'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/criterion_goal_attach.mjs

@@ -487,7 +487,7 @@ await test('FOR UPDATE outside a transaction is refused, not silently downgraded
 await test('CREATE: the goal is locked, inside the transaction (task 1003840)', async () => {
   actor = ARCHON;
   goalReads.length = 0;
-  const r = await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  const r = await post(V1, { criterion_id: 'brand-new-slug', criterion_md: 'x', goal_id: 3 });
   assert.equal(r.status, 201, JSON.stringify(r.body));
   assert.ok(goalReads.length > 0, 'the route read the goal');
   for (const g of goalReads) {
@@ -498,7 +498,7 @@ await test('CREATE: the goal is locked, inside the transaction (task 1003840)',
 
 await test('CREATE: the INSERT runs ON the transaction client (task 1003840)', async () => {
   actor = ARCHON;
-  await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  await post(V1, { criterion_id: 'brand-new-slug', criterion_md: 'x', goal_id: 3 });
   const inserts = sqlLog.filter((q) => /INSERT INTO done_when_criteria/.test(q.sql));
   assert.equal(inserts.length, 1, 'exactly one INSERT');
   assert.equal(inserts[0].via, 'client', 'the INSERT must not leave the transaction');
@@ -512,7 +512,7 @@ await test('CREATE: the INSERT runs ON the transaction client (task 1003840)', a
 await test('CREATE: a refusal writes nothing and releases the client (task 1003840)', async () => {
   actor = METIC;
   goals.set(3, { id: 3, version_id: V1, owner_builder_id: 999, status: 'open' });
-  const r = await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  const r = await post(V1, { criterion_id: 'brand-new-slug', criterion_md: 'x', goal_id: 3 });
   assert.ok(r.status >= 400, `expected a refusal, got ${r.status}`);
   assert.equal(sqlLog.filter((q) => /INSERT INTO done_when_criteria/.test(q.sql)).length, 0, 'nothing was inserted');
   assert.ok(clients.length > 0 && clients.every((c) => c.released), 'the client is released on the refusal path');
@@ -524,7 +524,7 @@ await test('the VERSION is locked too, not only the goal (task 1003840)', async
   // version could still be frozen between this read and this COMMIT.
   actor = ARCHON;
   versionReads.length = 0;
-  await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  await post(V1, { criterion_id: 'brand-new-slug', criterion_md: 'x', goal_id: 3 });
   assert.ok(versionReads.length > 0, 'the route read the version');
   for (const v of versionReads) {
     assert.ok(v.deps && v.deps.client, 'the version was read outside the transaction');
@@ -566,6 +566,14 @@ await test('setGoalStatus writes on the transaction client (task 1003840)', asyn
   assert.match(seen[1].sql, /UPDATE goal_membership_requests/);
 });
 
+await test('POST refuses a Cn-shaped criterion_id with a 400 before any SQL runs (task 1003122)', async () => {
+  actor = ARCHON;
+  const r = await post(V1, { criterion_id: 'C5', criterion_md: 'x', goal_id: 3 });
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error, 'reserved_criterion_slug');
+  assert.equal(sqlLog.length, 0, 'refused before the transaction took any lock');
+});
+
 // The wrapper installed above is removed, so nothing after this file's own tests
 // inherits a patched module export.
 db.getGoal = realGetGoal;

package/tests/criterion_ref_parse.mjs

@@ -16,6 +16,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const db = require('../modules/lifecycle/db.js');
+const { isReservedCriterionSlug } = require('../modules/lifecycle/criterion-ref.js');
 
 let passed = 0;
 let failed = 0;
@@ -51,6 +52,20 @@ test('a "Cn" embedded in a longer string does NOT match (anchored)', () => {
   assert.equal(db.parseCriterionRef('see C8 above').kind, 'slug');
 });
 
+test('a Cn-shaped slug is reserved; real slugs are not (task 1003122)', () => {
+  for (const r of ['C5', 'c10', ' C1 ']) assert.equal(isReservedCriterionSlug(r), true, r);
+  for (const r of ['C', 'C8x', 'wa6-kernel', 'C-5', '5', '']) assert.equal(isReservedCriterionSlug(r), false, r);
+});
+
+test("core_272 renames all ten of goal 1000045's Cn slugs to non-Cn names (task 1003122)", () => {
+  const sql = require('node:fs').readFileSync(new URL('../migrations/core_272_rename_cn_criterion_slugs.sql', import.meta.url), 'utf8');
+  const pairs = [...sql.matchAll(/\('(C\d+)',\s*'([^']+)'\)/g)].map((m) => [m[1], m[2]]);
+  assert.deepEqual(pairs.map((p) => p[0]), ['C1','C2','C3','C4','C5','C6','C7','C8','C9','C10']);
+  assert.equal(new Set(pairs.map((p) => p[1])).size, 10, 'new slugs are distinct');
+  for (const [, n] of pairs) assert.equal(isReservedCriterionSlug(n), false, n);
+  assert.match(sql, /goal_id = 1000045/);
+});
+
 // --- resolveCriterionIds: the multi-goal refusal (task 1003108) -------------
 // resolveCriterionIds is DB-backed, but it takes an `executor` seam (the one
 // countTasksWithoutCriterionLink uses), so a fake SQL-recording client covers the
@@ -125,6 +140,32 @@ async function main() {
     assert.deepEqual(r, { ids: [], unresolved: [], ambiguous: [] });
   });
 
+  await atest('a criterion whose slug is literally "C5" is read positionally, never by slug (task 1003122)', async () => {
+    // The incident shape: goal 1000045 slugs ten criteria C1..C10. The ref "C5"
+    // takes the positional branch on a single-goal version (the 5th row, NOT the
+    // row slugged C5) and is refused on a multi-goal one, so the slug is
+    // unreachable — which is why creation now refuses the shape.
+    const rows = [
+      { id: 601, criterion_id: 'alpha', cnum: 1 },
+      { id: 602, criterion_id: 'C1', cnum: 2 },
+      { id: 603, criterion_id: 'C5', cnum: 3 },
+    ];
+    const ex = (goals) => ({ async query(sql) { return /FROM goals/.test(sql) ? { rows: [{ n: goals }] } : { rows }; } });
+    const single = await db.resolveCriterionIds('V9', ['C1'], ex(1));
+    assert.deepEqual(single.ids, [601], 'C1 means position 1, not the row slugged C1 (602)');
+    const multi = await db.resolveCriterionIds('V9', ['C5'], ex(2));
+    assert.deepEqual(multi.ids, []);
+    assert.deepEqual(multi.ambiguous, ['C5']);
+  });
+
+  await atest('createCriterion refuses a Cn slug before touching the database (task 1003122)', async () => {
+    const ex = { query: async () => { throw new Error('must not query'); } };
+    await assert.rejects(
+      db.createCriterion({ versionId: 'V9', criterionId: 'C5', criterionMd: 'x', goalId: 1 }, { client: ex }),
+      (e) => e.code === 'RESERVED_CRITERION_SLUG'
+    );
+  });
+
   console.log(`\ncriterion ref parse (task 438) + multi-goal refusal (task 1003108) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);
 }