@bongos/core 1.17.0 → 1.17.1

package/modules/lifecycle/CLAUDE.md

@@ -1,63 +1,15 @@
-# `lifecycle` module — the build state machine + the `lifecycle` kernel port
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **LAST and most-coupled CORE-domain** carved into a module (BV1.R86, [ADR 0093](../../docs/adr/<redacted>.md) §1,§3) — after memory (R72), grading (R73), economy (R77), ideas (R78), security (R79), builder-settings (R80), onboarding (R81), sessions (R82), autonomy (R83), status-UI (R84), hall-UI (R85). Carved last on purpose: by now every capability it INVOKES (`grade`, `reward`, `onboarding`) is a kernel port it resolves, so the lifecycle imports only the kernel + resolves those ports ([02-module-map §4](../../docs/design/modular-architecture/02-module-map.md): keep the state machine WHOLE, never split). `default: true` — every instance runs the lifecycle. This carve makes the `db.js` residue exactly what ADR 0093 §3 predicted: the kernel identity/auth/twin slice + `db-kernel.js`.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **build state machine**: tasks · claims · versions · done-when criteria · goals · dependencies · the claim→ship→grade→credit lifecycle · override requests · the ship/confirm/promote orchestration · `github-push` (server-mediated branch publish) · `merge-lock` · `conflict-resolve` · the `publish-reconciler` (confirmed→shipped auto-heal) · `ship-card`/`ship-preflight` · `version-close` · the peer-vote→karma fold-in · the work-tracking analytics (est-drift, grade trend, AI-dev curve).
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway [`../../src/module-api.js`](../../src/module-api.js) (`coreVersion ^1.12.0` — it needs the R86 doorway additions: `repoInfo`, `moduleScopeMap`, `pathMatch`, `userAgent`, `asyncHandler`, `corsPublicGet`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches the lifecycle only through the `lifecycle` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## The `lifecycle` kernel PORT (ADR 0093 §3 — the headline of this carve)
-
-The inverse of every prior carve: the lifecycle is carved last, so every capability it *invokes* (`grade`/`reward`/`onboarding`) is already a port it RESOLVES; the `lifecycle` port is the surface **core and the other modules resolve to reach the build state machine** without importing this module.
-
-- **Provides — port `lifecycle`** → the surface in [`lifecycle.js`](lifecycle.js) (DELEGATES, does not spread, to `./db` + `./task-classifier` so test stubs bite at call time — the economy `reward` precedent). Registered in [`routes/lifecycle.js`](routes/lifecycle.js)'s factory (the loader runs it at boot + on every test router rebuild; `hasProvider`-guarded). It **retires the three ADR-0091 §3 doorway leaks** — `createTask`, `VOTABLE_TASK_STATUSES`, `tallyPeerVotes` — plus exposes `classifyTaskKind` and the work-tracking READS the staying-core read routes need.
-- **Core + the other modules consume it WITHOUT importing this module** (all via `seams.resolveOptional('lifecycle')`):
-  - `src/bongos/routes/public.js` (the status surface) — `getTask`/`listVersions`/`versionProgress`/`recentShippedTasks`/`estimationDriftSummary`/`rollingAvgGrade`/`gradeTrendByDay`.
-  - `src/bongos/routes/me.js` (the profile reader) — `<redacted>`/`getEstVsActualRatio`/`recentGradesForBuilder`/`<redacted>`/`<redacted>`.
-  - `src/bongos/routes/builders.js` (the Archon roster) — `getBuildersRoster`/`<redacted>`/`gradeByBuilder`/`<redacted>`.
-  - `src/bongos/cascade-dispatch.js` (dormant System 3) — `classifyTaskKind`.
-  - `modules/onboarding/db.js` (newcomer-restock) + `modules/discord/db.js` (#bugs→task) — `createTask`.
-  - `modules/discord/discord-reaction.js` — `VOTABLE_TASK_STATUSES`.
-  - `modules/autonomy/pollers/routine-timers.js` — `tallyPeerVotes`.
-- **It RESOLVES (as a transaction-participant consumer)** the `reward` + `onboarding` ports inside its own `withTx` — `claimTask`/`confirmTask`/`decideOverrideRequest`/`applyGrade` open the tx, run the state-machine SQL, and call `seams.resolveOptional('reward')|('onboarding').*(client, …)` so the credit/achievement/stage writes commit atomically with the status flip (ADR 0093 §2). It resolves via `resolveOptional` (graceful), so `consumes: []` — a vanilla instance without economy/onboarding degrades those writes to best-effort no-ops, it does not fail.
-
-## Files
-
-| File | What |
-|---|---|
-| `db.js` | the lifecycle data layer — ~97 functions: tasks/claims/versions/goals/dependencies/criteria, the claim→ship→grade→credit lifecycle (`claimTask`/`resolveClaim`/`confirmTask`/`shipTask`/`applyGrade`/`abandonTask`), overrides, estimation + work analytics, the merge lease, `tallyPeerVotes`, `createTask`. Reaches the pool/withTx/seams via the doorway; resolves `reward`/`onboarding` as a consumer. |
-| `task-classifier.js` | the `tasks.kind`/discipline heuristic + `VOTABLE_TASK_STATUSES`/`VALID_KINDS`/`VALID_DISCIPLINES`/`TASK_FIELD_BOUNDS`. `branding()` (instance blocker-vendors) via the doorway. |
-| `done-when.js` · `hierarchy.js` · `version-close.js` | the done-when criterion read/write surface, the shallow one-level task hierarchy, and the version-close gate evaluator. Pool via the doorway. |
-| `github-push.js` · `conflict-resolve.js` · `publish-reconciler.js` | server-mediated branch publish ([ADR 0055](../../docs/adr/<redacted>.md)) + the [ADR 0082](../../docs/adr/<redacted>.md) generated-file conflict resolver + the confirmed→shipped reconciler. `repoInfo`/`branding`/`userAgent` via the doorway; siblings require each other. |
-| `ship-card.js` · `ship-preflight.js` · `merge-lock.js` | the CLI lifecycle card, the ship preflight guards, and the cross-machine merge lease serializer (pure; `branding` via the doorway). |
-| `lifecycle.js` | the `lifecycle` port provider surface (delegates to `./db` + `./task-classifier`). |
-| `routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js` | the lifecycle HTTP surface — moved out of `src/bongos/routes/`; the loader mounts them via `contributes.routes`. Auth/validators/seams via the doorway; `./db` + libs are siblings. |
-| `routes/lifecycle.js` | the route factory that registers the `lifecycle` port (no HTTP endpoint). |
-| `pollers/publish-reconciler.js` | the loader poller entry (`start`/`stop`) for the publish reconciler — inverts the old `server.js` hardcoded start (the autonomy routine-timers precedent). |
-
-## Boundary-forced duplication (keep in sync)
-
-Two helpers are **deliberately duplicated** with core `src/bongos/db.js` (ADR 0091 §2 — "boundary-forced duplication is allowed + documented"): the same SQL runs on both sides of the kernel↔module line, and a module can't import core:
-
-- **`sealSessionLog`** — core `deactivateBuilder` (rank/identity management, stays core) writes the same `session_logs` close row; here `resolveClaim`/`shipTask` write it.
-- **`_applyRankChangeTx` (+ its `RANKS` / `singleRungPromotionError` deps)** — core `setBuilderRank` (Archon-driven, stays core) runs the same in-tx rank change; here it backs the automatic xenos→thetes graduation on ship (`maybeAutoGraduateToThetes`).
-- **the `gradePassCount` SQL fragment** — core `builderRollingAvgGrade` (the grade-trend read the sessions BFG also consumes, kept on the doorway) + the module's grade reads share it.
-
-## NOT in this module (the db.js residue — stays core)
-
-- **Builder IDENTITY + admission** (`upsertBuilder`/`getBuilderByGithubId`/`hasInvitedAccessRequest`/`linkAnthropicAccount`/`updateBuilderDisciplines`) — `auth.js` imports these; they CANNOT live in a module.
-- **Rank + status MANAGEMENT** (`setBuilderRank`/`_applyRankChangeTx`/`<redacted>`/`deactivate`/`reactivateBuilder`) — Archon identity ops consumed by `routes/builders.js`, NOT the task lifecycle.
-- **AUTH sessions** (`createSession`/`lookupSession`/`revoke*`/`hasCliSession`/`SESSION_TTL_MS`) — the `builder_sessions` token store `auth.js` drives.
-- **TWIN / social** (Discord link flow, karma feed, `listAuditLog`, the grade-trend `builderRollingAvgGrade`) + the **security_docs** store (the kernel security-PROPERTY plane).
-- **The Gemini-key leak** (`getBuilderGeminiKeyRow`/…) — art-pipeline credential infra.
-- **The lifecycle CLIs** — a command travels with its domain but stays a CLI under `scripts/gds/` (`ship.js`/`claim.js`/`release.js`/`merge-mode.js`/`confirm.js`/`merge-lock.js`/`version-close.js`/`main-audit.js`/`gate-review.js`/`push-main.js`/`ci-grade.js`), outside the kernel boundary — they may require this module directly (the grading/economy precedent).
-
-## Tables
-
-None owned. `tasks`/`claims`/`versions`/`goals`/`done_when_criteria`/`dependencies`/`task_grades`/`task_override_requests`/`merge_leases` (+ their migrations) were created before the module system and stay in core `migrations/` (the shared-schema additive rule). The module owns the *queries*; any **new** lifecycle migration belongs in `modules/lifecycle/migrations/` namespaced `lifecycle_*`.
-
-## Tests
-
-The DB-free carved-surface tests in `scripts/gds/coreB-carve-proof.sh` (`task_classifier_vocab`, `criterion_progress`, `github_push_*`, `ship_card`, `ship_preflight`, `merge_lock`, `conflict_resolve`, `publish_reconciler`, `goal_achievement`, `context_pack`) import from `modules/lifecycle/…` and pass byte-identical. The DB-integration tests (`grade_attempts`, `rank_gate`, `abandon_task`, `confirm_attribution`/`override_attribution`/`grade_attribution`, `goal_routes`/`goal_tier`/`goal_achievement`, `dependencies_*`, `task_create_idempotency`, `worktree_disambiguation`, `cap_newcomer_tasks`, `migration_allocation`, `task_ownership_gate`, `verify_task_guard`, `versions_route`, `gate_approvals`, `merge_lease`, `autonomous_fit_protected_paths`, …) require/read `modules/lifecycle/{db,routes/*,libs}.js`; the route-consumer tests (`onboarding_route_signals`, `onboarding_observability`, `discord_reaction`) register the `lifecycle` port. See [ADR 0093](../../docs/adr/<redacted>.md).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/lifecycle/routes/goals.js

@@ -376,6 +376,32 @@ function authorizeJoinRequestResponse({ goal, actorId, actorRank, actorMembershi
   return { ok: true };
 }
 
+// authorizeWithdrawJoinRequest — the gate for POST /goals/:id/requests/:reqId/withdraw
+// (task 1953): ONLY the requester may withdraw their OWN pending join-request — a
+// symmetric mirror of authorizeInvitationResponse (the invitee resolves their own
+// invite; here the requester resolves their own request, self-served instead of
+// waiting on an owner/manager deny). Ordering: request_not_found → wrong_goal →
+// not_a_join_request → not_pending → not_your_request. PURE + exported.
+function authorizeWithdrawJoinRequest({ request, goalId, actorId }) {
+  if (!request) return { ok: false, status: 404, body: { error: 'request_not_found' } };
+  if (String(request.goal_id) !== String(goalId)) {
+    return { ok: false, status: 404, body: { error: 'request_not_found', message: 'No such request on this goal.' } };
+  }
+  if (request.kind !== 'request') {
+    return { ok: false, status: 400, body: { error: 'not_a_join_request', message: 'That row is an invitation, not a join-request.' } };
+  }
+  if (request.status !== 'pending') {
+    return { ok: false, status: 409, body: { error: 'not_pending', status: request.status } };
+  }
+  if (String(request.builder_id) !== String(actorId)) {
+    return { ok: false, status: 403, body: {
+      error: 'not_your_request',
+      message: 'Only the requester may withdraw their own join-request.',
+    } };
+  }
+  return { ok: true };
+}
+
 module.exports = function buildGoalsRouter() {
   const router = express.Router();
 
@@ -798,6 +824,57 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // GET /goals/:id/requests — the goal's own pending invite/join-request queue
+  // (task 1953): every pending row on THIS goal, both kinds — outstanding invites
+  // the goal has sent (awaiting the invitee) and join-requests awaiting approval.
+  // db.listPendingRequestsForGoal was built for this route in task 1952's landing
+  // but never wired to HTTP; this is the goals-page manager view alongside the
+  // cross-goal GET /goals/inbox.
+  // rank: any-builder (requireBuilder) + the in-handler owner|manager|Archon gate
+  // (authorizeGoalManagement) — same wall as visibility/invite/request-respond.
+  router.get('/goals/:id/requests', auth.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    try {
+      const goal = await db.getGoal(id);
+      const actorMembership = goal
+        ? await db.getGoalMember({ goalId: id, builderId: req.builder.id })
+        : null;
+      const decision = authorizeGoalManagement({
+        goal, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
+      });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+      const requests = await db.listPendingRequestsForGoal(id);
+      return res.json({ requests });
+    } catch (err) {
+      console.error('[gds] GET /goals/:id/requests', err);
+      return res.fail('fetch_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /goals/:id/requests/:reqId/withdraw — the requester cancels their OWN
+  // pending join-request (task 1953): the symmetric self-served mirror of a
+  // manager's deny. Sets status='cancelled' (kept as the audit trail, like a
+  // deny's 'rejected'); never touches an invitation row.
+  // rank: any-builder (requireBuilder) + the in-handler authorizeWithdrawJoinRequest.
+  router.post('/goals/:id/requests/:reqId/withdraw', auth.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    const reqId = parseId(req, res, { param: 'reqId', code: 'bad_request_id', positiveInt: true });
+    if (reqId === null) return;
+    try {
+      const request = await db.getMembershipRequest(reqId);
+      const decision = authorizeWithdrawJoinRequest({ request, goalId: id, actorId: req.builder.id });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+      const resolved = await db.resolveMembershipRequest({ id: reqId, status: 'cancelled', resolvedBy: req.builder.id });
+      if (!resolved) return res.fail('not_pending', { status: 409, message: 'The request changed underneath this withdrawal — re-read and retry.' });
+      return res.json({ ok: true, request: resolved });
+    } catch (err) {
+      console.error('[gds] POST /goals/:id/requests/:reqId/withdraw', err);
+      return res.fail('withdraw_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // POST /goals/:id/members — the goal's own authority (owner | manager | Archon)
   // invites a builder to the goal (task 1762: widened from Archon-only so a
   // manager doesn't need an Archon in the loop for a normal goal). This stays the
@@ -1417,3 +1494,6 @@ module.exports.protectedScopeAdmissionBlock = protectedScopeAdmissionBlock;
 module.exports.authorizeCreateJoinRequest = authorizeCreateJoinRequest;
 module.exports.authorizeInvitationResponse = authorizeInvitationResponse;
 module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
+// task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
+// same precedent as its siblings above.
+module.exports.authorizeWithdrawJoinRequest = authorizeWithdrawJoinRequest;

package/modules/memory/CLAUDE.md

@@ -1,40 +1,15 @@
-# `memory` module — builder memory, recall/search, learnings
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **first CORE-domain** carved into a module (BV1.R72, [ADR 0091](../../docs/adr/<redacted>.md) §2) — not an optional feature like dev-box/discord/art/game, but a core methodology domain extracted to prove the kernel↔core-domain boundary. It is the reference every later core-domain carve (grading R73, …) copies.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns per-builder session **memory** (the BFG-scoped store the hall syncs), the lexical **recall/search** retrieval layer ([ADR 0060](../../docs/adr/0060-gds-retrieval-layer.md): Postgres FTS + trigram/RRF), and durable **learnings**. `default: true` in `module.json` — the build system's memory ships to **every** instance (unlike the default-off feature modules), so it mounts unconditionally unless an instance explicitly disables it.
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway `../../src/module-api.js` (`coreVersion ^1.5.0`). It must **never** `require()` a core internal (`../../src/bongos/db`, `../../src/bongos/auth`, `../../src/bongos/pool`, …) directly, and never another module. Core, in turn, must never `require()` a file in here — the route mounts left `src/bongos/routes.js`; `moduleLoader.mountModuleRoutes` discovers + mounts them now. Both directions are enforced by the BV1.R44/R45 fitness checks; R70's `kernel-imports-no-domain` check additionally keeps the kernel from reaching back in.
-
-## Files
-
-| File | What |
-|---|---|
-| `memory.js` | per-builder memory store (quotas, BFG namespace, store/fetch/list). Manages its own transactions via the doorway `pool`. |
-| `search.js` | the recall query engine — FTS + trigram, RRF fusion, rank-scoped (ADR 0060). |
-| `search-chunker.js` | pure markdown→chunk splitter (no DB). Also used by the `search-ingest-*` CLIs (memory-owned scripts). |
-| `learnings.js` | durable paid-once knowledge capture (the `learnings` table). |
-| `routes/memory.js` | `/memory/*` — sync/read/forensic. Carries its own larger `express.json` for `/memory/sync` (1 MB batches); core `routes.js` still skips the global parser for that path. |
-| `routes/search.js` | `/search` (recall) + `/search/mark` (the ADR 0095 C3 usefulness vote — `POST {chunk_id, useful?}`, session-scoped). |
-| `routes/learnings.js` | `/learnings` (POST capture + GET). |
-
-All four lib files reach Postgres through the doorway `pool`; the routes reach auth gates + the kernel db helpers (`getBuilderById`, `insertAuditLog`) + the shared request validators (`validateOrRespond`/`LIMITS`) off the doorway `api`, and the lib files via intra-module relative requires.
-
-## Tables (owned, not moved)
-
-`builder_memory`, `memory_search_chunks`, `learnings` (+ their migrations) were created before the module system and stay in core `migrations/` (the schema-migrations stem-key makes a later relocation a no-op). The module owns the *queries*; any **new** memory migration belongs in `modules/memory/migrations/` namespaced `memory_*` (the additive rule).
-
-## Seams
-
-None yet — memory neither provides nor consumes a port/event. Core reads memory only through its HTTP routes (the hall's sync/recall), never a direct import.
-
-## NOT in this module
-
-- **`bfg.js`** — the BFG memory-hygiene evaluator stays core (it scores memory quality across builders); it touches memory through the routes/store contract, not a sibling import.
-- **`migrations/`** — the memory tables' creating migrations stay in core `migrations/` (pre-module-system; see Tables above).
-
-## Tests
-
-`tests/memory_isolation.mjs`, `tests/bfg*.mjs`, `tests/search_*.mjs`, `tests/search_chunker.mjs`, `tests/diff_derived_signals.mjs`, `tests/recall_*.mjs` import from `modules/memory/…`. The ADR 0095 C3 mark/rank loop's DB-backed cases live in the `tests/search_isolation.mjs` Layer C class (integration gate); the pure ranker-factor + scope logic is exercised by the in-module assertions in `markChunkUsefulness`.
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/onboarding/CLAUDE.md

@@ -1,55 +1,15 @@
-# `onboarding` module — admission · onboarding state machine · newcomer floor + the `onboarding` kernel port
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **seventh CORE-domain** carved into a module (BV1.R81, [ADR 0093](../../docs/adr/<redacted>.md) §1) — after memory (R72), grading (R73), economy (R77), ideas (R78), security (R79), and builder-settings (R80). `default: true` in `module.json` — every instance onboards its own builders.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **newcomer ADMISSION + ORIENTATION domain**:
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-- **admission** ([`routes/access-requests.js`](routes/access-requests.js) + [`approval-broadcast.js`](approval-broadcast.js)) — the public `POST /access-requests` (the one unauthenticated GDS write) → the two Archon-only resolve endpoints. A pending request also posts a one-line approve/decline prompt to Discord `#member-approvals` (best-effort; the in-process bot's reaction handler closes the loop).
-- **the onboarding state machine** ([`onboarding-state.js`](onboarding-state.js)) — the server-ticked "Path into the City" checklist (`auth_complete → pick_disciplines → first_start → first_claim → ship_three → graduated`). The terminal `ship_three` stage clears at the same threshold that auto-promotes a Xenos to Thetes, so checklist-graduation coincides with the rank promotion. Backed by the `builder_onboarding_state` table (migration 045); the module reads/writes it directly with the client/pool its callers hand it.
-- **the friction analyzer** ([`onboarding.js`](onboarding.js)) — the *pure* half of "feedback without asking" (V3.R79 / C1): parse a consented onboarding transcript, compute deterministic friction signals, build the subagent prompt, validate its JSON, shape the `idea_inbox` payload. No FS/network/DB (those live in `scripts/gds/onboarding-analyze.js`).
-- **the evergreen newcomer-chore restock** ([`newcomer-restock.js`](newcomer-restock.js) + [`db.js`](db.js)) — a fresh first-builder task is always waiting: claiming a chore instance stamps a replacement synchronously, in the claim request. Template content lives in `scripts/gds/newcomer-floor.templates.json`; the supply read (`newcomerInstanceStats`) is the module's db slice.
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-## The boundary (the one rule)
-
-This module reaches core **only** through the published doorway [`../../src/module-api.js`](../../src/module-api.js) (`coreVersion ^1.9.0`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches the state-machine + restock surface only through the `onboarding` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## The `onboarding` kernel PORT
-
-The novel shape of this carve: it is the FIRST **core → module** port the LIFECYCLE drives (alongside the economy `reward` port). The onboarding state machine is ticked from inside core's claim/ship transactions, so the boundary can't be "module reaches into core" (the builder-settings pattern) — it's "core reaches the module's state machine through a kernel port."
-
-- **Provides — port `onboarding`** → the surface in [`port.js`](port.js): `{ getState, shapeForApi, safeMarkStage, markStage, broadcastGraduation, restockForClaim, restockAll, SOURCE_TAG }`. Registered in [`routes/onboarding.js`](routes/onboarding.js)'s factory (the loader runs it at boot, and again whenever a test rebuilds the GDS router — `hasProvider`-guarded). Mirrors `modules/economy/routes/reward.js`.
-- **The core consumers resolve it WITHOUT importing this module** (all via `seams.resolveOptional('onboarding')`):
-  - `src/bongos/db.js` — `claimTask`/`shipTask` tick `markStage` INSIDE their transaction (passing the txn `client`) and fire `broadcastGraduation` after COMMIT. The transaction-participant direction.
-  - `src/bongos/auth.js` — the Device-Flow + web auth callbacks mark `auth_complete` (`safeMarkStage`).
-  - `src/bongos/routes/me.js` — `GET /me` reads+shapes the checklist (`getState`/`shapeForApi`); `PATCH /me/disciplines` marks `pick_disciplines`.
-  - `src/bongos/routes/builders.js` — `GET /builders/:id/onboarding` reads+shapes the roster-visible checklist.
-  - `src/bongos/routes/tasks.js` — `GET /tasks/claimable` marks `first_start`; `POST /tasks/newcomer-restock` is the Archon backstop (`restockAll`).
-  - `src/bongos/routes/claims.js` — `POST /claims` restocks the chore shelf the instant one is claimed (`restockForClaim`/`SOURCE_TAG`).
-- All degrade gracefully when the module is off (a vanilla instance): the state-machine ticks become best-effort no-ops and the restock is skipped (the chore shelf simply isn't maintained), exactly as the surrounding try/catch already tolerated. The doorway gained one additive export (`enabledDisciplines`, CORE_VERSION → 1.9.0) the restock backstop needs; the onboarding capability itself is the port, not a doorway export.
-
-## Files
-
-| File | What |
-|---|---|
-| `onboarding-state.js` | the server-ticked onboarding state machine (markStage/getState/shapeForApi/safeMarkStage/broadcastGraduation/requireStageCleared + the displayed-checklist shaping). Pure of core `require()` — moved verbatim. |
-| `onboarding.js` | the *pure* friction analyzer (transcript parse → signals → prompt → validate → idea payload). Reads `branding().llmProjectName` through the doorway (de-branded in BV1.R76). |
-| `newcomer-restock.js` | the on-claim chore stamper — template load + per-template floor + monotonic-seq stamping. Reaches `createTask`/`newcomerInstanceStats` via the module `db.js`; `enabledDisciplines` via the doorway. |
-| `db.js` | the onboarding db slice — `newcomerInstanceStats` (the chore-supply read; pool via the doorway) + a `createTask` re-export off the doorway so the stamper's call site stays byte-identical. |
-| `approval-broadcast.js` | the `#member-approvals` outbound (the admission route's sole consumer; travels with it). Posts via `scripts/discord/lib` (a scripts/ require — outside the boundary). |
-| `port.js` | the `onboarding` port provider surface — DELEGATES (does not spread) to onboarding-state / newcomer-restock so test stubs bite at call time. |
-| `routes/onboarding.js` | the module route factory: registers the `onboarding` port + mounts the admission router. |
-| `routes/access-requests.js` | the admission cold-start endpoints (the public POST + the two Archon-only resolves). Auth/pool/validators via the doorway; approval-broadcast intra-module. |
-
-## NOT in this module (deliberately left in core)
-
-- **The admission GATE READS** — `db.hasInvitedAccessRequest` / `getBuilderByGithubId` stay core `db.js`: they are KERNEL identity/admission reads the trust boundary (`auth.js`) runs at first sign-in, not the onboarding state/restock domain (mirrors the Gemini-key staying core in the builder-settings carve).
-- **The `GET /me` + `GET /builders/:id/onboarding` AGGREGATORS** — `routes/me.js` / `routes/builders.js` stay core; they resolve this port for their onboarding slices (the facade precedent, 02-module-map §2).
-- **The onboarding-domain CLIs** — `scripts/gds/setup.js`, `onboarding-config.js`, `onboarding-analyze.js`, `newcomer-floor.js` travel with the domain but stay under `scripts/` and require the module directly (scripts are outside the kernel boundary — the grading/economy precedent).
-
-## Tables
-
-None owned. `builder_onboarding_state` (045) + `access_requests` live on the CORE schema and stay in core `migrations/`. This module owns the *onboarding-state queries* (inside `onboarding-state.js`) + the chore-supply read; any **new** onboarding migration belongs in `modules/onboarding/migrations/` namespaced `onboarding_*` (the additive rule).
-
-## Tests
-
-`tests/onboarding_state.mjs`, `tests/onboarding_gate.mjs`, `tests/onboarding_route_signals.mjs`, and `tests/newcomer_restock.mjs` import from `modules/onboarding/…` (the route-signal test registers the `onboarding` port). `tests/discord_approvals.mjs` imports the moved `approval-broadcast.js`. The doorway/boundary checks discover `onboarding` as a module. See [ADR 0093](../../docs/adr/<redacted>.md).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/security/CLAUDE.md

@@ -1,44 +1,15 @@
-# `security` module — red-team reports + bounty + the `security` kernel port
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **fifth CORE-domain** carved into a module (BV1.R79, [ADR 0093](../../docs/adr/<redacted>.md) §1) — after memory (R72), grading (R73), economy (R77), and ideas (R78). This is **<redacted>**, not <redacted> ([02-module-map §5](../../docs/design/modular-architecture/02-module-map.md)): the optional, rank-gated red-team-reports + bounty surface. A clean slice — its SQL already lived in a dedicated `security.js` (not the `db.js` monolith), so the carve is a git-move + a route split + a doorway re-point, OTB byte-identical. `default: true` in `module.json` — every instance can take red-team reports.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **red-team / vulnerability-report** lifecycle (file → adjudicate → pay) and the **bounty payout table**: the `/builder-redteam` skill POSTs a report (Metic+), the Archon dashboard reads + adjudicates it (confirm / dispute / fix / link-fix), and the env-aware per-severity drachmae schedule (the bounty table) is the single source of truth for "how much for a confirmed report."
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway [`../../src/module-api.js`](../../src/module-api.js) (`coreVersion ^1.8.0`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches the bounty schedule only through the `security` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## <redacted> stays KERNEL (the headline boundary call)
-
-[02-module-map §5](../../docs/design/modular-architecture/02-module-map.md) splits "security" in two, and only one half is here:
-
-- **PROPERTY → kernel (NOT moved):** the authz / trust-boundary machinery — `permission-path-check.js`, `route-rank-check.js`, `requireRank`/`requireBuilder` (`auth.js`). Imported everywhere, enforced by composition + fitness functions, never "called." Untouched by this carve.
-- **PROPERTY → kernel (NOT moved, the subtle part):** the **threat-model + engagement-doc plane** also stayed in core `src/bongos/routes/security.js`: `GET /security/adr` (reads the real ADR 0020 threat model off the droplet, Metic+) and `GET/POST /security/docs` (the Archon-only exploit-detail engagement-report store, backed by the core `db.js` `security_docs` queries). These document **defenses + exploits** — security-the-property's operational surface, not the bounty feature. They keep their `EXPECTED_RANKS` pins in `route-rank-check.js`.
-- **FEATURE → this module:** red-team / vulnerability **reports** + **bounty** (`/security/reports*`) and the payout table. Self-contained, optional, rank-gated.
-
-The core `src/bongos/routes/security.js` therefore did **not** disappear — it was *split*: the report/bounty routes moved here; the adr/docs (property) routes stayed.
-
-## The `security` kernel PORT
-
-- **Provides — port `security`** → `{ bountyTableDetailed, bountyTable }`. Registered in `routes/reports.js`'s factory (the loader runs it at boot, and again whenever a test rebuilds the GDS router — `hasProvider`-guarded so re-instantiation never trips the single-provider guard). Mirrors `modules/economy/routes/reward.js`.
-- **Why:** the **one** core consumer of the security feature is `src/bongos/routes/public.js`'s `GET /public/bounty-table` (the public payout schedule the hall renders). Core can't `require()` a module, so it resolves `seams.resolveOptional('security').bountyTableDetailed()` — the economy `reward`-port precedent for a core read route reaching module data.
-
-## Files
-
-| File | What |
-|---|---|
-| `security.js` | the bounty payout table (`bountyTable`/`bountyTableDetailed`, env-overridable per severity via `GDS_BOUNTY_*`) + the `vulnerability_reports` domain: `createVulnerabilityReport` (the `/builder-redteam` writer), `listVulnerabilityReports({scope})`, and the Archon adjudication transitions (`confirm`/`dispute`/`markFixed`/`linkFix`). Reaches the shared pool through the doorway. |
-| `routes/reports.js` | `POST /security/reports` (Metic+ file), `GET /security/reports` (Archon list), `POST /security/reports/:id/{confirm,dispute,fix,link-fix}` (Archon adjudicate). Its factory **registers the `security` port**. |
-
-## NOT in this module (deliberately left in core)
-
-- **The threat-model + engagement-doc routes** — `src/bongos/routes/security.js` keeps `GET /security/adr` + `GET/POST /security/docs` (security-the-property; see the boundary call above). They use the core `db.js` `security_docs` queries and `auth`/`_helpers` directly — core code, not this module.
-- **The `/builder-redteam` skill** — `.claude/skills/builder-redteam/` travels with the feature but stays under `.claude/skills/` (it just POSTs to `/api/gds/security/reports`, which this module now mounts).
-
-## Tables
-
-None owned. `vulnerability_reports` (migration 030) and `security_docs` (the property-side store) were created before the module system and stay in core `migrations/` (the `schema_migrations` stem-key makes a later relocation a no-op). This module owns the *report/bounty queries*; any **new** security-feature migration belongs in `modules/security/migrations/` namespaced `security_*` (the additive rule).
-
-## Tests
-
-`tests/security_reports.mjs` exercises the report/bounty domain (the `security.js` helpers + the bounty table). The route-rank fitness check (`tests/module_route_rank.mjs`) asserts every write route in `routes/reports.js` is rank-gated. The doorway/boundary checks (`tests/fitness.mjs`, `tests/module_loader.mjs`) discover `security` as a module. See [ADR 0093](../../docs/adr/<redacted>.md).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/sessions/CLAUDE.md

@@ -1,39 +1,15 @@
-# `sessions` module — session-records corpus, BFG, session-pulse
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> A CORE-domain carve (BV1.R82, [ADR 0093](../../docs/adr/<redacted>.md) §1) — the seventh tranche-2 domain extracted from the GDS core, after onboarding (R81). `default: true` — every instance records its builders' sessions for the BFG, so it mounts unconditionally unless an instance disables it.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **session_records corpus** + its data plane (the `/sessions` upload + the Archon-gated cross-builder search/deep-dive), the **BFG** cross-builder "read-the-room" scorer ([ADR 0026](../../docs/adr/<redacted>.md) §6B), and the **session-pulse / stale-claim** heartbeat helpers.
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway `../../src/module-api.js` (`coreVersion ^1.10.0`). It must **never** `require()` a core internal (`../../src/bongos/db`, `../../src/bongos/auth`, `../../src/bongos/pool`, …) directly, and **never** another module. Core, in turn, must never `require()` a file in here — the route mount left `src/bongos/routes.js`; `moduleLoader.mountModuleRoutes` discovers + mounts it now. Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## No port (the memory shape, not the economy shape)
-
-Unlike economy / security / builder-settings / onboarding, sessions registers **no kernel port** (`provides: []`) — exactly like `memory`. **Core never calls back into sessions:** the ship-time session-digest write is an **HTTP POST** to this module's own `/sessions` route (`scripts/gds/ship.js` → `POST /api/gds/sessions`), not a `require`. So there is nothing for a port to expose. The session-records db slice moved here cleanly with its sole consumer (the route).
-
-The **one outward edge** is the economy **`reward`** kernel port this module *consumes* (resolves, never imports): `upsertSessionRecordWithReward` (in `db.js`) and `POST /sessions` (in `routes/sessions.js`) both `seams.resolveOptional('reward')` — to award the cost-plus session token reward inside the upsert transaction (passing the tx `client`) and to sum the drachmae credited for the owned task(s). That is the kernel-mediated module↔module seam (ADR 0083 / 0093 §2).
-
-## Files
-
-| File | What |
-|---|---|
-| `db.js` | the `session_records` db slice — `upsertSessionRecord[WithReward]` (the token-reward txn resolves the `reward` port), `searchSessions` / `summarizeSessions` / `getSessionById` / `listSessionsByBuilder`, `filterTaskIdsClaimedBy`, the ORDER-BY whitelist + limit/offset clamps + the shared filter clause. Reaches Postgres via the doorway `pool` + `withTx`. |
-| `bfg.js` | the BFG's PURE scorers (`scoreInteractionQuality` / `scoreMemoryQuality`) + extractors + the thin `gatherInteractionSignals` DB gatherer (ADR 0026 §6B). Reads via the doorway (`pool`, `getBuilderById`, `builderRollingAvgGrade`). |
-| `pulse.js` | session-pulse + stale-claim heartbeat helpers (`recordPulse` / `sweepStaleClaims` / `getStaleClaimsForBuilder`). The CLI shell stays at `scripts/gds/pulse.js` and requires this lib directly. |
-| `routes/sessions.js` | `/sessions` (upload — carries its own 4 MB `express.json`; core `routes.js` still skips the global parser for that path), `/sessions/search` + `/sessions/:id` (Archon-gated cross-builder, fail-closed audited), `/sessions/mine`. |
-
-## Tables (owned, not moved)
-
-`session_records` (+ its migrations) was created before the module system and stays in core `migrations/` (the schema-migrations stem-key makes a later relocation a no-op). The module owns the *queries*; any **new** session migration belongs in `modules/sessions/migrations/` namespaced `sessions_*` (the additive rule). The `session_pulses` table (migration 006) is likewise shared-schema; pulse.js owns its queries.
-
-## NOT in this module
-
-- **`session_logs`** — the per-claim session LOG (the ship-time handoff record, `sealSessionLog`) stays in core `db.js` (lifecycle): it's written inside the claim/ship transaction and read by `routes/claims.js`/`builders.js`. Distinct from `session_records` (the BFG transcript corpus).
-- **`builder_sessions`** — the AUTH token table (`createSession`/`lookupSession`/…) is kernel (auth), not this domain.
-- **cost / reconcileSessionCosts** — the cost ledger + the session-cost reconciler graduated to [`modules/economy/`](../economy/CLAUDE.md) at BV1.R77. `scripts/gds/session-cost.js` (the SessionEnd cost hook) stays a CLI and posts to `/cost`.
-- **the session-domain CLIs** — `session.js`, `session-eval.js` (the 6D evaluator), `session-digest.js`, `session-cost.js`, `backfill-sessions.js`, `bfg-principal-token.js`, `repo-metrics.js`, `pulse.js` travel with the domain but stay under `scripts/` (a command travels with its domain — design 02§1). They're outside the kernel boundary, so `session-eval.js`'s sibling read of `modules/builder-settings/wandering-prefs` is fine (not a cross-module import — fitness scans `src/` + `modules/`, not `scripts/`).
-
-## Tests
-
-`tests/session_search.mjs` (ORDER-BY/clamp guards), `tests/session_caps.mjs` (SR-17 disk-fill bounds — route + db, with the `reward` port registered), `tests/session_eval.mjs` + `tests/session_506_regression.mjs` (the evaluator), `tests/session_digest.mjs` + `tests/session_records.mjs` (the ship-time digest), `tests/bfg*.mjs` (the scorers), `tests/backfill_sessions.mjs` import from `modules/sessions/…` or exercise it. `bfg`/`bfg_write`/`session_records`/`backfill_sessions` are DB-dependent (the `INTEGRATION` set in `run-unit-tests.js`).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/status-ui/CLAUDE.md

@@ -1,47 +1,15 @@
-# `status-ui` module — the public status dashboard ("The Watch")
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> A CORE-domain carve (BV1.R84, [ADR 0093](../../docs/adr/<redacted>.md) §1) — the **first WEB-SURFACE module** ([02-module-map §6](../../docs/design/modular-architecture/02-module-map.md): "a web surface is first-class"). `default: true` — a Cloud Bongos instance ships its status page like it ships its hall, so it mounts unconditionally unless an instance disables it.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the public build-status dashboard served at **`status.<apex>`** (`status.example.com`) — the live up/down banner, version-progress rollups, cost summary, recent ships, the leaderboard, and the kinds-of-work ecosystem fingerprint. A no-framework page (`status.js`) that polls the read-only `/api/gds/public/*` surface every 60s.
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The shape: a static surface, not a backend domain
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-Unlike every prior tranche-2 carve (economy/ideas/security/…), this module has **no `.js`, no `db.js` slice, no kernel port, and no routes**. It is purely:
-- `public/` — the static dashboard (HTML/CSS/JS/cursors/snapshots), moved verbatim from the old repo-root `public-status/`.
-- `module.json` — declares one **`contributes.webSurfaces`** entry `{ host: "status.", dir: "public" }`.
-
-## The serving seam (how a web surface reaches its host with no core edit)
-
-The loader exposes `moduleWebSurfaces({ isEnabled })` ([`src/module-loader/loader.js`](../../src/module-loader/loader.js)) — the Host-routed twin of `hallWidgetScripts`/`mountModuleRoutes`. It returns `[{ key, host, dir(abs) }]` for each enabled module that declares `webSurfaces` **and** ships the directory on disk. `src/bongos/serve-internal.js` iterates that set and serves each surface on its `Host:` prefix with the **same** machinery the status page always used:
-- the in-memory **content-hash-stamped** index (`buildStampedHtml`, #521 — defeats Cloudflare's 4h TTL),
-- the per-instance **branding/theme injection** (`injectBrandingInto`),
-- fall-through to `express.static` for assets.
-
-`serve-internal.js` names **no module key** (kernel stays module-agnostic, [ADR 0083](../../docs/adr/<redacted>.md) §Decision #4); it routes purely off the manifest-declared `host` prefix. The `isStatusHost` export stays the literal `status.` predicate the entrypoints (`server.js`/`src/platform-server.js`) use to keep their apex tail off the status host; **inside** `mountInternalSurfaces` the generic `isModuleSurfaceHost` (any enabled web-surface host) is used, so the next carved surface (hall-UI, R85) needs no new guard.
-
-## The boundary
-
-This module reaches **nothing** in core (no doorway require — it has no JS). Core, in turn, must never `require()` a file in here — `serve-internal.js` resolves the surface through `loader.moduleWebSurfaces`, never an import of `modules/status-ui/*`. Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## The data it renders STAYS shared core (the judgment call)
-
-The `/api/gds/public/*` read endpoints the dashboard polls (`/public/uptime`, `/public/progress`, `/public/cost-summary`, `/public/grades`, `/public/recent-shipped`, `/public/leaderboard`, `/public/analytics/ecosystem`, `/public/tasks|ideas|blockers/:id`, plus `/versions/:id/done-when`) **did not move** — they live in `src/bongos/routes/public.js` and are consumed by the hall and the **off-box GitHub-Pages mirror** too, not just this surface. A public read shared by multiple surfaces is correctly core/shared, not status-exclusive (the same call the economy/ideas carves made for `routes/public.js`'s inline reads). So the carve moves the *surface*, not the reads it happens to render.
-
-## Off-box mirror (operational)
-
-The LIVE page is served **off the droplet** for outage resilience ([ADR 0029](../../docs/adr/<redacted>.md)) — GitHub Pages from `example-owner/example-status`, fed by `scripts/status-mirror-sync.js`. That script (status-UI domain tooling that travels with its domain but stays a CLI under `scripts/`, the sessions/autonomy precedent) was re-pointed at `modules/status-ui/public/`. **Follow-up:** `.github/workflows/sync-status-mirror.yml` still triggers on `public-status/**` and must be re-pointed at `modules/status-ui/public/**` by an owner/Archon (the GitHub App can't push workflow files — learning 107).
-
-## Files & tooling
-
-| Path | What |
-|---|---|
-| `public/index.html` · `public/status.js` · `public/style.css` | the dashboard (no build step, no framework) |
-| `public/cursors/` · `public/snapshots/` | bronze cursors + the world-render snapshots the page shows |
-| `public/README.md` | the surface's own notes (off-box mirror, asset cache-busting) |
-| `module.json` | `contributes.webSurfaces: [{ host: "status.", dir: "public" }]`; no port, no routes |
-
-Generators that WRITE into this surface live under `scripts/` and were re-pointed: `scripts/art/gen-cursors.py` (cursors), `scripts/snapshots/render-*.mjs` (snapshots), `scripts/status-mirror-sync.js` (off-box publish).
-
-## Tests
-
-The loader seam is covered in `tests/module_loader.mjs` (`moduleWebSurfaces` — enabled lists, disabled vanishes, declared-but-not-shipped skipped, plus the live status-ui surface); the manifest `webSurfaces` validation in `tests/module_manifest.mjs`; the carve discovery-key membership in `tests/fitness.mjs` / `tests/module_loader.mjs` / `tests/modules.mjs`; and the carve proof in `scripts/gds/coreB-carve-proof.sh` (leg 4h).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.17.0",
+      "version": "1.17.1",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",