@bongos/core 1.21.69 → 1.21.71

package/modules/lifecycle/goal-spec-task.js

@@ -0,0 +1,129 @@
+'use strict';
+
+// modules/lifecycle/goal-spec-task.js — a goal made in the hall carries its own
+// spec task, and the goal's other work waits behind it (task 1004585, ADR 0366 D3).
+//
+// WHY. The hall's goal form asks only what a person knows (a name, a description,
+// a version, a category). The rest of a goal — its scope wall, its criteria, its
+// first tasks — is inference, which /goal-create does in a session (ADR 0366 D2).
+// So a hall-made goal arrives with a task that says exactly that, and nothing else
+// in the goal can be claimed until it ships: an unspecced goal is visible as a
+// task on the board, not a silence.
+//
+// HOW, with no new permission and no migration:
+//   - The spec task is an ordinary task, recognised by (source, source_ref) =
+//     ('goal-spec', 'goal-<id>-spec'). That pair is also what makes creating it
+//     idempotent (findTaskBySourceRef).
+//   - "Waits behind it" is an ordinary task→task dependency, so the claim gate's
+//     existing DEPS_NOT_SHIPPED refusal and the auto-promotion on ship do the rest.
+//     A goal-level edge would be simpler, but every task in the goal inherits it
+//     (unsatisfiedDeps), the spec task included, which would block it on itself.
+//   - The edge is added at the two places a task ENTERS a goal: db-tasks.createTask
+//     (every create vector passes through it) and db-tasks.updateTaskGoal (a move).
+
+const SPEC_SOURCE = 'goal-spec';
+
+function specSourceRef(goalId) {
+  return `goal-${goalId}-spec`;
+}
+
+// The spec task's fields, for db.createTask. `ready` so it can be claimed at once;
+// a spike, because its output is a decision (the scope and the criteria) rather
+// than code; ideator, the craft whose pack covers "the scopes of work ideas become".
+function specTaskFields(goal, { createdBy = null } = {}) {
+  const id = goal.id;
+  return {
+    versionId: goal.version_id,
+    goalId: id,
+    title: `Spec goal ${id}: its scope, criteria and first tasks`,
+    description: [
+      `Goal ${id} ("${goal.title}") was created from the hall, which asks only for a name and a description. This task settles the rest, and every other task in the goal waits on it (ADR 0366 D3).`,
+      '',
+      'Settle, in a session (run /goal-create against this goal):',
+      `1. The scope wall: which code areas the goal's tasks may touch. Set it with POST /goals/${id}/scope (the goal's owner or a manager; a protected area needs an Archon).`,
+      `2. Two to four done-when criteria, with POST /versions/${goal.version_id}/done-when under the goal (ADR 0154: the goal's owner or a manager).`,
+      '3. The first tasks, with their dependencies.',
+      '',
+      'If you do not own or manage this goal, draft the scope and criteria and hand them to its owner rather than skipping them.',
+      '',
+      'DONE WHEN: the goal has its scope (or a written reason it needs none), its criteria, and at least one claimable task.',
+    ].join('\n'),
+    status: 'ready',
+    kind: 'spike',
+    discipline: 'ideator',
+    source: SPEC_SOURCE,
+    sourceRef: specSourceRef(id),
+    createdBy,
+  };
+}
+
+// The goal's spec task if it is still open, else null. An abandoned spec task
+// gates nothing new (the owner decided the goal needs no spec); a shipped one is done.
+async function openSpecTaskId(goalId, client) {
+  if (goalId == null) return null;
+  const { rows } = await client.query(
+    `SELECT id FROM tasks
+      WHERE goal_id = $1 AND source = $2 AND source_ref = $3
+        AND status NOT IN ('shipped', 'abandoned')
+      ORDER BY id ASC
+      LIMIT 1`,
+    [goalId, SPEC_SOURCE, specSourceRef(goalId)]
+  );
+  return rows[0] ? Number(rows[0].id) : null;
+}
+
+// Make a task that just entered a goal wait on that goal's open spec task.
+// Returns the spec task id it now waits on, or null. A task that IS the spec task
+// is left alone. Safe without a cycle check only for a brand-new task (nothing can
+// depend on it yet) — a moved task goes through addTaskDependency, which checks.
+async function gateOnSpecTask(task, client, { addTaskDependency = null } = {}) {
+  if (!task || task.goal_id == null) return null;
+  if (task.source === SPEC_SOURCE && task.source_ref === specSourceRef(task.goal_id)) return null;
+  const specId = await openSpecTaskId(task.goal_id, client);
+  if (specId == null || specId === Number(task.id)) return null;
+  if (addTaskDependency) {
+    try {
+      await addTaskDependency(task.id, specId);
+    } catch (err) {
+      // A cycle means the spec task already waits on this task; gating it would
+      // deadlock both, so the move stands without the edge.
+      if (err && err.code === 'CYCLE') return null;
+      throw err;
+    }
+  } else {
+    await client.query(
+      `INSERT INTO dependencies (from_kind, from_id, to_kind, to_id)
+       VALUES ('task', $1, 'task', $2)
+       ON CONFLICT DO NOTHING`,
+      [task.id, specId]
+    );
+  }
+  return specId;
+}
+
+// Give a goal its spec task, safely re-runnable: if the goal already has an OPEN
+// spec task, that one is returned and nothing is written, so a second run (a retry,
+// or a future "re-offer the spec" path) never files a duplicate. Run it inside the
+// caller's transaction so the read and the insert see the same snapshot.
+async function ensureSpecTask({ db, goal, client, createdBy = null }) {
+  const existing = await openSpecTaskId(goal.id, client);
+  if (existing != null) return { specTask: { id: existing }, created: false };
+  const specTask = await db.createTask(specTaskFields(goal, { createdBy }), { client });
+  return { specTask, created: true };
+}
+
+// POST /goals's create step. Without the opt-in it is exactly db.createGoal. With it,
+// the goal and its spec task land in ONE transaction: a goal without its spec task
+// would be ungated, which is the state D3 exists to end.
+async function createGoalWithSpec({ db, withTx, goalFields, withSpecTask = false }) {
+  if (!withSpecTask) return { goal: await db.createGoal(goalFields), specTask: null };
+  let goal;
+  let specTask = null;
+  await withTx(async (client) => {
+    goal = await db.createGoal(goalFields, { client });
+    ({ specTask } = await ensureSpecTask({ db, goal, client, createdBy: goalFields.createdBy }));
+  });
+  return { goal, specTask };
+}
+
+module.exports = { SPEC_SOURCE, specSourceRef, specTaskFields, openSpecTaskId, gateOnSpecTask, ensureSpecTask, createGoalWithSpec };

package/modules/lifecycle/routes/goals.js

@@ -29,6 +29,7 @@ const hierarchy = require('../hierarchy');
 const goalSuggest = require('../goal-suggest.js'); // task 1003062 — pre-creation goal suggester
 const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edit handlers
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
+const goalSpecTask = require('../goal-spec-task.js'); // task 1004585 — a hall-made goal carries its own spec task (ADR 0366 D3)
 const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
 const goalGraph = require('../goal-graph.js'); // task 1003479 — the goal graph: nodes + cross-goal edges, aggregated in SQL
 const goalForest = require('../goal-forest.js'); // task 1003480 — per-goal dependency forest
@@ -97,6 +98,7 @@ module.exports = function buildGoalsRouter() {
       // requested without stating a cause. minLength 8 because 'ok' / '.' is not
       // a reason, and the row is the only place the why survives.
       admit_reason: { type: 'string', minLength: 8, maxLength: 500 },
+      spec_task: { type: 'boolean' }, // task 1004585 / ADR 0366 D3 — the hall form's opt-in (goal-spec-task.js)
     })) return;
 
     const scopeModules = req.body.scope_modules || [];
@@ -156,15 +158,11 @@ module.exports = function buildGoalsRouter() {
       const admission = versionDecision.overrideApplied
         ? { admittedBy: req.builder.id, reason: admitReason }
         : null;
-      const goal = await db.createGoal({
-        versionId: req.body.version_id,
-        title: req.body.title,
+      const { goal, specTask } = await goalSpecTask.createGoalWithSpec({ db, withTx: api.withTx, withSpecTask: req.body.spec_task === true, goalFields: {
+        versionId: req.body.version_id, title: req.body.title,
         subtitle: (req.body.subtitle || '').trim() || null, description: (req.body.description || '').trim() || null,
-        scopeModules,
-        createdBy: req.builder.id,
-        categoryId,
-        admission,
-      });
+        scopeModules, createdBy: req.builder.id, categoryId, admission,
+      } });
       // Stamp the predecessor's succeeded_by pointer at the new goal (the lineage).
       if (succeedsId != null) {
         await db.setGoalSuccessor({ goalId: succeedsId, successorId: goal.id });
@@ -182,7 +180,7 @@ module.exports = function buildGoalsRouter() {
       // waved into a building version, by whom and why — the caller should not
       // have to re-read the goal to find out whether their override took effect.
       const admitted = admission ? await db.getGoalAdmission(goal.id) : null;
-      return res.status(201).json({ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory, admitted });
+      return res.status(201).json({ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory, admitted, spec_task: specTask });
     } catch (err) {
       log.error('[gds] POST /goals', err);
       return res.fail('goal_create_failed', { status: 500, message: 'internal error' });

package/modules/lifecycle/routes/task-write-routes.js

@@ -29,6 +29,7 @@ const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, detectsMigration } = require('./task-route-helpers.js');
 const { describeCheckViolation } = require('../pg-constraint-fail.js');
 const { goalNotOpenRefusal } = require('./goal-route-authz.js');
+const { resolveUpkeepHome, isUpkeepFiling, UPKEEP_HINT } = require('../upkeep-home.js'); // task 1004597
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 
@@ -189,10 +190,18 @@ module.exports = function registerTaskWriteRoutes(router) {
     // nobody reads. This is the human/agent door, and it always has a goal to
     // name — /builder-start lists work by goal, and POST /goals/:id/tasks has
     // required one since BV1.R60.
+    // task 1004597: the one exception is PLATFORM UPKEEP (a core upgrade, Bongos
+    // maintenance), which fits no product goal. An explicit kind 'infra' with no
+    // goal lands in the version's maintenance goal — see upkeep-home.js.
+    const upkeepHome = await resolveUpkeepHome(body, { ensureMaintenanceGoal: db.ensureMaintenanceGoal, withTx: api.withTx });
+    if (upkeepHome) body.goal_id = Number(upkeepHome.id);
     if (body.goal_id == null) {
       return res.fail('goal_id_required', {
         status: 400,
-        message: 'goal_id is required — every task belongs to a goal. List them at GET /goals?version=<id>, or author under one directly with POST /goals/:id/tasks.',
+        message: 'goal_id is required — every task belongs to a goal. List them at GET /goals?version=<id>, or author under one directly with POST /goals/:id/tasks. ' +
+          (isUpkeepFiling(body)
+            ? `Version '${body.version_id}' is not being built right now, so it has no maintenance goal for upkeep — file it against the version that is.`
+            : UPKEEP_HINT),
       });
     }
     if (body.goal_id != null) {
@@ -297,6 +306,7 @@ module.exports = function registerTaskWriteRoutes(router) {
         needs_migration: needsMigration,
         criteria,
         suggested_criteria,
+        ...(upkeepHome ? { goal_home: 'maintenance' } : {}), // task 1004597
         goal_advisory, dependency_advisory, est_advisory: await require('../est-advisory').buildEstAdvisory({ db, task }), // task 1003148
       });
     } catch (err) {

package/modules/lifecycle/upkeep-home.js

@@ -0,0 +1,55 @@
+'use strict';
+
+// modules/lifecycle/upkeep-home.js — WHERE PLATFORM UPKEEP GOES WHEN NO PRODUCT
+// GOAL FITS (task 1004597).
+//
+// THE CONTRADICTION THIS CLOSES. The ledger rule says record a change before you
+// make it; the goal rule (ADR 0250 D4, BV1.R11) says every task belongs to a
+// goal. A project's goals are product goals ("Marketing", "Live Floor"), so a
+// builder about to upgrade the Bongos core had nowhere honest to file it: POST
+// /tasks refused `goal_id_required`, and the only ways forward were to misfile
+// the upgrade under a product goal or skip the record. One session (mercury,
+// 2026-10-06) chose the latter.
+//
+// THE ANSWER REUSES THE HOMELESS-BUG HOME. Every building version already has a
+// find-or-create MAINTENANCE goal (ADR 0262, `ensureMaintenanceGoal`): open, no
+// scope wall, exempt from the version-close count, carried forward on close.
+// Platform upkeep is maintenance in exactly that sense, so a task filed with
+// NO goal and kind 'infra' lands there.
+//
+// ONLY AN EXPLICIT kind COUNTS — never the classifier's guess. The defect
+// BV1.R11 fixed was SILENT bucketing (53 tasks filed out of sight by a default).
+// A caller who writes kind 'infra' has said out loud what the work is; a feature
+// whose text merely reads like infra must still name its goal.
+//
+// RANK AND APPROVAL ARE UNTOUCHED. This only answers "which goal"; the route's
+// own permission check (task.create, Metic+) and status rules run exactly as for
+// any other goal.
+
+const UPKEEP_KIND = 'infra';
+
+// isUpkeepFiling — true when a create names no goal and explicitly says it is
+// platform upkeep. PURE; exported so the rule has one spelling.
+function isUpkeepFiling(body) {
+  return !!body && body.goal_id == null && body.kind === UPKEEP_KIND;
+}
+
+// resolveUpkeepHome — the maintenance goal row an upkeep filing lands in, or
+// null when it is not an upkeep filing or the version cannot take work (not
+// `building`). The find-or-create runs inside its own transaction so the
+// advisory lock in ensureMaintenanceGoal actually serialises concurrent filers
+// (outside a transaction it would release at the end of its own statement).
+async function resolveUpkeepHome(body, deps) {
+  if (!isUpkeepFiling(body)) return null;
+  const { ensureMaintenanceGoal, withTx } = deps;
+  return withTx((client) => ensureMaintenanceGoal(body.version_id, { client }));
+}
+
+// The plain-words half of the goal_id_required refusal: what to do when the work
+// is upkeep rather than product work. Shared by the route and the CLI so the two
+// never drift.
+const UPKEEP_HINT =
+  'Platform upkeep — a Bongos upgrade or other maintenance — has a standing home: ' +
+  `file it with kind "${UPKEEP_KIND}" and no goal, and it goes into this version's maintenance goal.`;
+
+module.exports = { UPKEEP_KIND, UPKEEP_HINT, isUpkeepFiling, resolveUpkeepHome };

package/modules/platform-identity/instance-feedback.js

@@ -21,6 +21,15 @@
 // an absent rank as untrusted, so even the owner's own feedback waits for the nod
 // rather than inheriting a hub rank the instance never vouched for.
 //
+// TWO DOORS IN (task 1004591). The relay above needs the project linked to the hub,
+// which many are not, so the CLI now sends STRAIGHT here (POST /sso/feedback/direct)
+// with a one-time receipt from its own project (src/bongos/routes/feedback.js).
+// The hub answers at once, then redeems the receipt at the project's public URL:
+// the project names the signed-in sender and the hash of the text, and only a
+// matching report is filed. A project on the hub's own domain is one we run, so
+// its word is verified; any other domain is printed as "confirmed by <host>".
+// The relay stays for projects on cores older than the receipt.
+//
 // THE ATTRIBUTION IS THE HUB'S, NOT THE INSTANCE'S. Client credentials prove WHICH
 // PROJECT is calling and nothing about WHO sent it, so the sender must hold a
 // membership on that project carrying the hub's own sign-in witness
@@ -86,8 +95,11 @@ function feedbackTitle(message) {
   return `Feedback: ${title}`;
 }
 
-function feedbackBody({ message, client, account, githubId, context = {} }) {
-  const who = account && account.github_login ? `@${account.github_login}` : `GitHub user ${githubId}`;
+function feedbackBody({ message, client, account, githubId, context = {}, vouch = null }) {
+  // vouch (direct reports only): { hosted, host, login } — the receipt's word.
+  const claimed = vouch && typeof vouch.login === 'string' && /^[A-Za-z0-9-]{1,39}$/.test(vouch.login) ? vouch.login : null;
+  const who = account && account.github_login ? `@${account.github_login}`
+    : claimed ? `@${claimed} (GitHub user ${githubId})` : `GitHub user ${githubId}`;
   const project = client.name ? `${client.name} (${client.origin || client.client_id})` : (client.origin || client.client_id);
   const stamps = [
     ['Core', cleanStamp(context.core_version)],
@@ -97,10 +109,13 @@ function feedbackBody({ message, client, account, githubId, context = {} }) {
   // The hub's own attribution comes FIRST and the sender's words follow as a
   // quote, so text they type can never pose as the footer a reviewer trusts.
   const quoted = String(message).trim().split('\n').map((l) => `> ${l}`).join('\n');
+  const vouchLine = !vouch ? []
+    : [`- Sender: ${vouch.hosted ? 'verified (a project Cloud Bongos hosts)' : `confirmed by ${vouch.host} (self-hosted, not verified by us)`}`];
   return [
-    'Sent from a managed project with `bongos feedback`.',
+    vouch ? 'Sent with `bongos feedback`.' : 'Sent from a managed project with `bongos feedback`.',
     `- Project: ${project}`,
     `- Sent by: ${who}`,
+    ...vouchLine,
     ...(stamps ? [`- Running: ${stamps}`] : []),
     '',
     quoted,
@@ -110,12 +125,15 @@ function feedbackBody({ message, client, account, githubId, context = {} }) {
 // fileInstanceFeedback — file one relayed report. `deps.capture` is the
 // `ideas.capture` port; `deps.getAccount` and `deps.hubBuilderId` read the hub's
 // own rows for the sender. Returns the landing the CLI prints.
-async function fileInstanceFeedback({ client, githubId, message, kind, context }, deps) {
-  const account = await deps.getAccount(githubId).catch(() => null);
-  const capturedBy = await deps.hubBuilderId(githubId).catch(() => null);
+async function fileInstanceFeedback({ client, githubId, message, kind, context, vouch = null }, deps) {
+  // A self-hosted project's word cannot borrow a hub account: its owner could
+  // name anyone's GitHub id, so the hub's login and builder row stay unread.
+  const trusted = !vouch || vouch.hosted;
+  const account = trusted ? await deps.getAccount(githubId).catch(() => null) : null;
+  const capturedBy = trusted ? await deps.hubBuilderId(githubId).catch(() => null) : null;
   const idea = await deps.capture({
     title: feedbackTitle(message),
-    bodyMd: feedbackBody({ message, client, account, githubId, context }),
+    bodyMd: feedbackBody({ message, client, account, githubId, context, vouch }),
     kind: FEEDBACK_KINDS[kind],
     capturedBy,
     filerRank: null, // untrusted by design — see the header
@@ -129,7 +147,90 @@ async function fileInstanceFeedback({ client, githubId, message, kind, context }
     : { landed: 'inbox', idea_id: String(idea.id) };
 }
 
+// ── the direct door (task 1004591) ───────────────────────────────────────────
+
+const RECEIPT_TIMEOUT_MS = 8000;
+
+function sha256Hex(text) {
+  return require('node:crypto').createHash('sha256').update(String(text), 'utf8').digest('hex');
+}
+
+// projectOrigin — the caller-named project, accepted only as a bare https origin
+// on a DNS name (no IP literal, no port, no path, no userinfo). Null otherwise.
+function projectOrigin(raw) {
+  let u;
+  try { u = new URL(String(raw || '')); } catch { return null; }
+  if (u.protocol !== 'https:' || u.port || u.username || u.password) return null;
+  if (u.pathname !== '/' && u.pathname !== '') return null;
+  if (u.search || u.hash) return null;
+  const host = u.hostname.toLowerCase();
+  if (!host.includes('.') || require('node:net').isIP(host.replace(/^\[|\]$/g, ''))) return null;
+  if (/(^|\.)(localhost|local|internal|test|invalid)$/.test(host)) return null;
+  return { origin: `https://${host}`, host };
+}
+
+// isHostedBy — a project on the hub's own domain (or the hub itself) is one we run.
+function isHostedBy(host, hubHost) {
+  const h = String(hubHost || '').toLowerCase();
+  return !!h && (host === h || host.endsWith(`.${h}`));
+}
+
+// verifyDirectReport — redeem the receipt at the project and check it matches.
+// Resolves { ok: true, receipt } or { ok: false, reason }; never throws. The
+// address is attacker-named, so the host must resolve to a public address
+// (deps.assertPublicHost) and a redirect is an error, never followed.
+async function verifyDirectReport({ origin, receipt, message, kind }, deps) {
+  const target = projectOrigin(origin);
+  if (!target) return { ok: false, reason: 'bad_origin' };
+  if (!/^[A-Za-z0-9_-]{16,64}$/.test(String(receipt || ''))) return { ok: false, reason: 'bad_receipt' };
+  try {
+    await deps.assertPublicHost(target.host);
+  } catch {
+    return { ok: false, reason: 'private_host' };
+  }
+  let body;
+  try {
+    const res = await (deps.fetchImpl || fetch)(`${target.origin}/api/bongos/feedback/receipt/${receipt}`, {
+      headers: { accept: 'application/json' },
+      redirect: 'error',
+      signal: AbortSignal.timeout(RECEIPT_TIMEOUT_MS),
+    });
+    if (res.status !== 200) return { ok: false, reason: `receipt_http_${res.status}` };
+    body = await res.json();
+  } catch {
+    return { ok: false, reason: 'receipt_unreachable' };
+  }
+  if (!body || typeof body !== 'object') return { ok: false, reason: 'receipt_malformed' };
+  if (!/^\d{1,20}$/.test(String(body.github_id || ''))) return { ok: false, reason: 'receipt_malformed' };
+  if (body.sha256 !== sha256Hex(message)) return { ok: false, reason: 'text_mismatch' };
+  if ((body.kind || 'bug') !== kind) return { ok: false, reason: 'kind_mismatch' };
+  return { ok: true, target, receipt: body };
+}
+
+// fileDirectReport — the whole after-the-202 half: verify, then file. Returns the
+// landing, or { dropped: reason } for a report the project did not vouch for.
+async function fileDirectReport({ origin, receipt, message, kind, context = {}, hubHost }, deps) {
+  const v = await verifyDirectReport({ origin, receipt, message, kind }, deps);
+  if (!v.ok) return { dropped: v.reason };
+  const githubId = String(v.receipt.github_id);
+  const hosted = isHostedBy(v.target.host, hubHost);
+  return fileInstanceFeedback({
+    client: { name: v.target.host, origin: v.target.origin, client_id: v.target.host },
+    githubId,
+    message,
+    kind,
+    // The project's own core version beats whatever the CLI claimed.
+    context: { ...context, core_version: v.receipt.core_version || null },
+    vouch: { hosted, host: v.target.host, login: v.receipt.github_login },
+  }, deps);
+}
+
 module.exports = {
+  sha256Hex,
+  projectOrigin,
+  isHostedBy,
+  verifyDirectReport,
+  fileDirectReport,
   FEEDBACK_KINDS,
   MESSAGE_MAX,
   PER_SENDER_LIMIT,

package/modules/platform-identity/routes/sso.js

@@ -30,9 +30,25 @@ const applicationEcho = require('../application-echo');
 // The guild label the echo carries (task 1002303, ADR 0365 D5).
 const guildEngagements = require('../guild-engagements');
 const instanceFeedback = require('../instance-feedback');
+const projectStats = require('../project-stats');
 
 // One limiter per hub process for POST /sso/feedback (task 1004462).
 const feedbackLimiter = instanceFeedback.makeFeedbackLimiter();
+// …and two for POST /sso/feedback/direct (task 1004591), which carries no
+// credential: one keyed by the caller's address ALONE, so naming a fresh host on
+// every request buys nothing, and one by the named project and address.
+const directIpLimiter = instanceFeedback.makeFeedbackLimiter();
+const directFeedbackLimiter = instanceFeedback.makeFeedbackLimiter();
+
+// The hub's own host: a direct report from it or a subdomain of it comes from a
+// project we run. Best-effort — no host means nothing counts as hosted. Read once.
+let _hubHost = null;
+function hubHost() {
+  if (_hubHost === null) {
+    try { _hubHost = new URL(api.branding().domains.publicOrigin).hostname.toLowerCase(); } catch { _hubHost = ''; }
+  }
+  return _hubHost;
+}
 
 // Per-IP cap for POST /sso/applicant-profile — DEFENCE IN DEPTH behind the echo
 // gate, not the gate itself (task 1002972 grade advisory). The echo already
@@ -781,5 +797,60 @@ module.exports = function ssoRoutes() {
     }
   });
 
+  // POST /sso/feedback/direct — `bongos feedback` straight from a builder's CLI,
+  // with a one-time receipt from their own project (task 1004591). Answers 202 at
+  // once so the builder never waits; the receipt is redeemed AFTER, and a report
+  // the project does not vouch for is dropped (logged, never filed). Why this
+  // proves the sender, and what "hosted" earns: ../instance-feedback.js.
+  //
+  // rank: public — no session on the hub; the proof is the project's receipt.
+  // Capped per caller address (10/h whatever host it names), then per named
+  // project (30/h), BEFORE anything is fetched.
+  router.post('/sso/feedback/direct', (req, res) => {
+    if (validateOrRespond(req, res, {
+      origin: { required: true, type: 'string', maxLength: 200 },
+      receipt: { required: true, type: 'string', maxLength: 64 },
+      message: { required: true, type: 'string', maxLength: instanceFeedback.MESSAGE_MAX },
+      kind: { type: 'string', enum: Object.keys(instanceFeedback.FEEDBACK_KINDS) },
+      context: {},
+    })) return;
+    const b = req.body || {};
+    const target = instanceFeedback.projectOrigin(b.origin);
+    if (!target) return res.fail('bad_origin', 400);
+    const message = String(b.message).trim();
+    if (!message) return res.fail('message_required', 400);
+    // The address's own bucket first (both of its tiers keyed by the address, so
+    // no bucket is shared between callers); only an address still under its cap
+    // may spend from the named project's bucket — a refused caller costs a real
+    // project nothing.
+    const ip = String(req.ip || 'unknown');
+    let allowed = directIpLimiter.take(ip, 'direct');
+    if (allowed.ok) allowed = directFeedbackLimiter.take(target.host, ip);
+    if (!allowed.ok) {
+      res.set('Retry-After', String(allowed.retryAfter));
+      return res.fail('rate_limited', 429, { scope: `feedback-${allowed.scope}`, retry_after_seconds: allowed.retryAfter });
+    }
+    res.status(202).json({ ok: true, accepted: true });
+    const ctx = b.context && typeof b.context === 'object' ? b.context : {};
+    instanceFeedback.fileDirectReport({
+      origin: target.origin,
+      receipt: b.receipt,
+      message: b.message,
+      kind: b.kind || 'bug',
+      context: { cli_version: ctx.cli_version, os: ctx.os },
+      hubHost: hubHost(),
+    }, {
+      assertPublicHost: (host) => projectStats.assertPublicHost(host),
+      capture: (...a) => api.resolve('ideas.capture')(...a),
+      getAccount: (id) => pi.getAccount(id, { pool }),
+      hubBuilderId: async (id) => {
+        const { rows } = await pool.query('SELECT id FROM builders WHERE github_id = $1 LIMIT 1', [id]);
+        return rows[0] ? rows[0].id : null;
+      },
+    }).then((r) => {
+      if (r && r.dropped) log.warn(`[platform-identity] /sso/feedback/direct dropped from ${target.host}: ${r.dropped}`);
+    }, (err) => log.error('[platform-identity] /sso/feedback/direct', err));
+  });
+
   return router;
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.69",
+  "version": "1.21.71",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.69",
+      "version": "1.21.71",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.69",
+  "version": "1.21.71",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9194,5 +9194,47 @@
       "id": "1004277",
       "text": "The projects you build on, with their Leave buttons, now live on your account page. My projects links there."
     }
+  ],
+  "1.21.70": [
+    {
+      "text": "Reporting a problem with Bongos now works from every project, including ones like Will's that could not send feedback before. It takes a second, needs no extra sign-in, and the Bongos team can see who really sent each report."
+    }
+  ],
+  "1.21.71": [
+    {
+      "id": "1004595",
+      "text": "A hosted project's Software update page no longer stops at \"Update ready\". When the people who run its server do the upgrade, the owner now sees who that is and an \"Ask for this upgrade\" button; one press reaches the Cloud Bon"
+    },
+    {
+      "id": "1004621",
+      "text": "The assistant in a Bongos project no longer starts every session with a failed command. Its instructions now say `npx bongos …`, which works as soon as the project is installed, instead of a bare `bongos` that the computer cou"
+    },
+    {
+      "id": "1004586",
+      "text": "The goal-planning assistant can now finish a goal that was started in the hall: it works out the goal's scope, its 'done when' checks and its first tasks, then releases the goal's work."
+    },
+    {
+      "id": "1004622",
+      "text": "Fixed a broken test that was stopping every new Bongos release from being published."
+    },
+    {
+      "id": "1004596",
+      "text": "When someone on a hosted project (like Will's) asks to upgrade from their own computer, Bongos now tells them plainly that the project's operator does upgrades, and how to ask for one — from the Software update page or with on"
+    },
+    {
+      "id": "1004619",
+      "text": "Bongos now has a written plan for red and blue security teams: attacks happen on a separate practice server, never on the live site, and every release gets checked there."
+    },
+    {
+      "id": "1004597",
+      "text": "Recording routine Bongos upkeep, such as a core upgrade, no longer gets refused just because none of a project's goals fit. Filed as upkeep with no goal, it now goes into the version's standing maintenance goal. Any other task"
+    },
+    {
+      "id": "1004585",
+      "text": "A goal created from the hall now arrives with a 'Spec goal N' task. Nothing else in that goal can be picked up until someone finishes it, so a goal never sits half-defined."
+    },
+    {
+      "text": "Hosted projects like Will's now get a working Update button in Settings, instead of being told to run a command on a server they don't have access to."
+    }
   ]
 }