@bongos/core 1.17.0

package/modules/onboarding/routes/access-requests.js

@@ -0,0 +1,208 @@
+// src/bongos/routes/access-requests.js — onboarding cold-start (2026-05-30).
+//
+// The hall is gated: a brand-new person can't enter until an Archon admits
+// them. Admission is the ONLY gate — newcomers build on hosted dev boxes, so
+// they need no GitHub repo access / collaborator invite (2026-06-07). 'invited'
+// just means "Archon-approved for the hall"; the web sign-in (auth.js) checks
+// exactly that one flag. This router is how they ask and how the Archon
+// answers:
+//
+//   POST /api/bongos/access-requests          PUBLIC (the one unauthenticated GDS
+//                                          write) — a stranger submits their
+//                                          GitHub username; a pending row lands
+//                                          in the queue.
+//   GET  /api/bongos/access-requests          Archon-only — the pending queue (and
+//                                          ?status=invited|dismissed history).
+//   PATCH /api/bongos/access-requests/:id     Archon-only — resolve a request:
+//                                          { status: 'invited' | 'dismissed' }.
+//
+// The global IP rate-limiter (mounted in routes.js before every router) guards
+// the public POST against spam. A partial unique index on lower(github_login)
+// stops one username piling up duplicate open requests.
+
+const express = require('express');
+// Carved into modules/onboarding/ (BV1.R81 / ADR 0093 §1). The auth gates, the
+// shared pool, and the route validators reach the published doorway (the only
+// core file a module may require, ADR 0083); approval-broadcast travels WITH this
+// admission route (its sole consumer) and is an intra-module require.
+const api = require('../../../src/module-api');
+const auth = { requireBuilder: api.requireBuilder, requireRank: api.requireRank };
+const { pool } = api;
+const { validateOrRespond, parseId } = api;
+const approvalBroadcast = require('../approval-broadcast');
+
+// GitHub usernames: 1–39 chars, alphanumeric or single hyphens, no leading/
+// trailing hyphen. We accept a leading '@' and strip it (people paste "@name").
+const GITHUB_LOGIN_RE = /^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?=[a-zA-Z0-9])){0,38}$/;
+
+function normalizeLogin(raw) {
+  return String(raw || '').trim().replace(/^@/, '');
+}
+
+module.exports = function buildAccessRequestsRouter() {
+  const router = express.Router();
+
+  // POST /access-requests — PUBLIC. A would-be builder asks to be admitted.
+  // rank: public — the requester is by definition outside the system (no
+  // builder row yet); this is the one public write on the GDS.
+  router.post('/access-requests', async (req, res) => {
+    if (validateOrRespond(req, res, {
+      github_login: { required: true, type: 'string', minLength: 1, maxLength: 60 },
+      display_name: { type: 'string', maxLength: 100 },
+      note: { type: 'string', maxLength: 500 },
+    })) return;
+
+    const login = normalizeLogin(req.body.github_login);
+    if (!GITHUB_LOGIN_RE.test(login)) {
+      return res.fail('bad_github_login', { status: 400, message: 'That does not look like a GitHub username.' });
+    }
+    const displayName = (req.body.display_name || '').trim() || null;
+    const note = (req.body.note || '').trim() || null;
+
+    try {
+      // Already a builder? They have an account — point them at sign-in instead
+      // of opening a redundant request. (2026-05-30)
+      const member = await pool.query(
+        `SELECT 1 FROM builders WHERE lower(github_login) = lower($1) LIMIT 1`,
+        [login]
+      );
+      if (member.rows.length > 0) {
+        return res.fail('already_member', { status: 409, message: 'You already have an account — just sign in with GitHub.' });
+      }
+      // Already approved (invited) but not yet signed in? No new request needed.
+      const invited = await pool.query(
+        `SELECT 1 FROM access_requests
+          WHERE lower(github_login) = lower($1) AND status = 'invited' LIMIT 1`,
+        [login]
+      );
+      if (invited.rows.length > 0) {
+        return res.fail('already_approved', { status: 409, message: "You're already approved — sign in with GitHub to enter." });
+      }
+
+      const { rows } = await pool.query(
+        `INSERT INTO access_requests (github_login, display_name, note)
+         VALUES ($1, $2, $3)
+         RETURNING id, github_login, status, created_at`,
+        [login, displayName, note]
+      );
+      // Post the request to #member-approvals so an Archon can 👍/👎 it from
+      // Discord (task 1100). Fire-and-forget + best-effort — never blocks or
+      // fails the public submit (the hall queue is the source of truth either
+      // way). display_name/note aren't in the RETURNING set, so pass them along.
+      approvalBroadcast
+        .postMemberApprovalRequest({ ...rows[0], display_name: displayName, note })
+        .catch(() => {});
+      return res.status(201).json({ ok: true, request: rows[0] });
+    } catch (err) {
+      // Partial unique index → there's already an open request for this login.
+      // Treat as success-ish: the Archon already has them in the queue.
+      if (err.code === '23505') {
+        return res.status(200).json({ ok: true, already_pending: true });
+      }
+      console.error('[gds] POST /access-requests', err);
+      return res.fail('access_request_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // GET /access-requests/status?github_login=X — PUBLIC. The `bongos login` CLI
+  // polls this after filing a request: the device flow's not_approved is TERMINAL
+  // (the device_code is spent), so the CLI can't re-poll the flow — it polls this
+  // instead, then restarts sign-in once admitted. Exposes nothing the public POST
+  // above doesn't already reveal through its 409s (already_member / already_approved).
+  // status ∈ member | invited | pending | dismissed | none; admitted = member||invited.
+  // rank: public — a would-be builder is by definition outside the system.
+  // Declared BEFORE `GET /access-requests` so the literal `/status` path is matched
+  // as its own route (not swallowed as a query on the list route).
+  router.get('/access-requests/status', async (req, res) => {
+    const login = normalizeLogin(req.query.github_login);
+    if (!GITHUB_LOGIN_RE.test(login)) {
+      return res.fail('bad_github_login', { status: 400, message: 'That does not look like a GitHub username.' });
+    }
+    try {
+      const member = await pool.query(
+        `SELECT 1 FROM builders WHERE lower(github_login) = lower($1) LIMIT 1`,
+        [login]
+      );
+      if (member.rows.length > 0) {
+        return res.json({ github_login: login, status: 'member', admitted: true });
+      }
+      // Prefer an 'invited' row if one exists, else the most recent request.
+      const ar = await pool.query(
+        `SELECT status FROM access_requests
+          WHERE lower(github_login) = lower($1)
+          ORDER BY (status = 'invited') DESC, created_at DESC
+          LIMIT 1`,
+        [login]
+      );
+      const status = ar.rows.length > 0 ? ar.rows[0].status : 'none';
+      return res.json({ github_login: login, status, admitted: status === 'invited' });
+    } catch (err) {
+      console.error('[gds] GET /access-requests/status', err);
+      return res.fail('status_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // GET /access-requests?status=pending — Archon queue. Defaults to pending;
+  // pass ?status=invited|dismissed for the resolved history.
+  // rank: archon — the queue exposes would-be builders' usernames.
+  router.get('/access-requests', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+    const status = req.query.status || 'pending';
+    if (!['pending', 'invited', 'dismissed'].includes(status)) {
+      return res.fail('bad_status', 400);
+    }
+    try {
+      const { rows } = await pool.query(
+        `SELECT ar.id, ar.github_login, ar.display_name, ar.note, ar.status,
+                ar.created_at, ar.resolved_at,
+                rb.github_login AS resolved_by_login
+           FROM access_requests ar
+           LEFT JOIN builders rb ON rb.id = ar.resolved_by_builder_id
+          WHERE ar.status = $1
+          ORDER BY ar.created_at DESC
+          LIMIT 200`,
+        [status]
+      );
+      res.json({ requests: rows });
+    } catch (err) {
+      console.error('[gds] GET /access-requests', err);
+      res.fail('list_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // PATCH /access-requests/:id — Archon resolves a request.
+  // body: { status: 'invited' | 'dismissed' }. 'invited' = admitted to the hall
+  // (the only sign-in gate — no repo access needed); 'dismissed' = declined /
+  // spam / dup. The row stays as the audit trail either way.
+  // rank: archon — same gate as the rest of the roster management surface.
+  router.patch('/access-requests/:id', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_request_id' });
+    if (id === null) return;
+    if (validateOrRespond(req, res, {
+      status: { required: true, type: 'string' },
+    })) return;
+    const next = req.body.status;
+    if (!['invited', 'dismissed'].includes(next)) {
+      return res.fail('bad_status', { status: 400, message: "status must be 'invited' or 'dismissed'." });
+    }
+    try {
+      const { rows } = await pool.query(
+        `UPDATE access_requests
+            SET status = $1,
+                resolved_by_builder_id = $2,
+                resolved_at = now()
+          WHERE id = $3 AND status = 'pending'
+          RETURNING id, github_login, status, resolved_at`,
+        [next, req.builder.id, id]
+      );
+      if (rows.length === 0) {
+        return res.fail('not_pending', { status: 409, message: 'That request is gone or already resolved.' });
+      }
+      res.json({ ok: true, request: rows[0] });
+    } catch (err) {
+      console.error('[gds] PATCH /access-requests/:id', err);
+      res.fail('resolve_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/onboarding/routes/onboarding.js

@@ -0,0 +1,54 @@
+'use strict';
+
+// modules/onboarding/routes/onboarding.js — the onboarding module's route
+// factory (BV1.R81 / ADR 0093 §1).
+//
+// Two jobs, both run by the loader at boot (and again whenever a test rebuilds
+// the GDS router):
+//
+//   1. REGISTER the `onboarding` kernel PORT (below). The CORE consumers — the
+//      lifecycle (db.js claim/ship), the auth callbacks, and the me/builders
+//      profile readers + the tasks/claims chore-restock path — resolve it instead
+//      of importing this module (the boundary rule: core never requires a
+//      module). Pattern mirrors modules/economy/routes/reward.js +
+//      modules/builder-settings/routes/settings.js — registered from the route
+//      factory (the one boot hook that runs both live AND under a test router
+//      rebuild), hasProvider-guarded so re-instantiation never trips the
+//      single-provider guard.
+//
+//   2. MOUNT the ADMISSION routes (the access-request cold-start: the one public
+//      GDS write + the two Archon-only resolve endpoints). They moved here
+//      verbatim from core src/bongos/routes/access-requests.js — they keep their
+//      exact /access-requests paths (the loader mounts this router on the same
+//      /api/bongos router, BEFORE the public catch-all), so the API is byte-
+//      identical; only the require() paths changed (auth/pool/validators reach
+//      the doorway; approval-broadcast travels with the route as an intra-module
+//      require).
+//
+// The onboarding STATE MACHINE has no /me/* or /builders/* routes of its own —
+// those aggregator endpoints stay in core (routes/me.js, routes/builders.js) and
+// resolve the port for their onboarding slices (the GET /me facade precedent,
+// 02-module-map §2). So the only HTTP surface this module owns is admission.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const onboardingPort = require('../port');
+const buildAccessRequestsRouter = require('./access-requests');
+
+// Register the `onboarding` kernel PORT. See the header + port.js for the full
+// consumer list and the graceful-degradation contract.
+function registerSeams() {
+  if (!api.hasProvider('onboarding')) {
+    api.registerProvider('onboarding', onboardingPort);
+  }
+}
+
+module.exports = function buildOnboardingRouter() {
+  registerSeams();
+  const router = express.Router();
+  // The admission cold-start endpoints (POST /access-requests public + the two
+  // Archon-only resolve routes). Mounted on this same /api/bongos router by the
+  // loader, before the public catch-all — byte-identical paths.
+  router.use(buildAccessRequestsRouter());
+  return router;
+};

package/modules/security/CLAUDE.md

@@ -0,0 +1,44 @@
+# `security` module — red-team reports + bounty + the `security` kernel port
+
+> The **fifth CORE-domain** carved into a module (BV1.R79, [ADR 0093](../../docs/adr/<redacted>.md) §1) — after memory (R72), grading (R73), economy (R77), and ideas (R78). This is **<redacted>**, not <redacted> ([02-module-map §5](../../docs/design/modular-architecture/02-module-map.md)): the optional, rank-gated red-team-reports + bounty surface. A clean slice — its SQL already lived in a dedicated `security.js` (not the `db.js` monolith), so the carve is a git-move + a route split + a doorway re-point, OTB byte-identical. `default: true` in `module.json` — every instance can take red-team reports.
+
+Owns the **red-team / vulnerability-report** lifecycle (file → adjudicate → pay) and the **bounty payout table**: the `/builder-redteam` skill POSTs a report (Metic+), the Archon dashboard reads + adjudicates it (confirm / dispute / fix / link-fix), and the env-aware per-severity drachmae schedule (the bounty table) is the single source of truth for "how much for a confirmed report."
+
+## The boundary (the one rule)
+
+This module reaches core **only** through the published doorway [`../../src/module-api.js`](../../src/module-api.js) (`coreVersion ^1.8.0`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches the bounty schedule only through the `security` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks.
+
+## <redacted> stays KERNEL (the headline boundary call)
+
+[02-module-map §5](../../docs/design/modular-architecture/02-module-map.md) splits "security" in two, and only one half is here:
+
+- **PROPERTY → kernel (NOT moved):** the authz / trust-boundary machinery — `permission-path-check.js`, `route-rank-check.js`, `requireRank`/`requireBuilder` (`auth.js`). Imported everywhere, enforced by composition + fitness functions, never "called." Untouched by this carve.
+- **PROPERTY → kernel (NOT moved, the subtle part):** the **threat-model + engagement-doc plane** also stayed in core `src/bongos/routes/security.js`: `GET /security/adr` (reads the real ADR 0020 threat model off the droplet, Metic+) and `GET/POST /security/docs` (the Archon-only exploit-detail engagement-report store, backed by the core `db.js` `security_docs` queries). These document **defenses + exploits** — security-the-property's operational surface, not the bounty feature. They keep their `EXPECTED_RANKS` pins in `route-rank-check.js`.
+- **FEATURE → this module:** red-team / vulnerability **reports** + **bounty** (`/security/reports*`) and the payout table. Self-contained, optional, rank-gated.
+
+The core `src/bongos/routes/security.js` therefore did **not** disappear — it was *split*: the report/bounty routes moved here; the adr/docs (property) routes stayed.
+
+## The `security` kernel PORT
+
+- **Provides — port `security`** → `{ bountyTableDetailed, bountyTable }`. Registered in `routes/reports.js`'s factory (the loader runs it at boot, and again whenever a test rebuilds the GDS router — `hasProvider`-guarded so re-instantiation never trips the single-provider guard). Mirrors `modules/economy/routes/reward.js`.
+- **Why:** the **one** core consumer of the security feature is `src/bongos/routes/public.js`'s `GET /public/bounty-table` (the public payout schedule the hall renders). Core can't `require()` a module, so it resolves `seams.resolveOptional('security').bountyTableDetailed()` — the economy `reward`-port precedent for a core read route reaching module data.
+
+## Files
+
+| File | What |
+|---|---|
+| `security.js` | the bounty payout table (`bountyTable`/`bountyTableDetailed`, env-overridable per severity via `GDS_BOUNTY_*`) + the `vulnerability_reports` domain: `createVulnerabilityReport` (the `/builder-redteam` writer), `listVulnerabilityReports({scope})`, and the Archon adjudication transitions (`confirm`/`dispute`/`markFixed`/`linkFix`). Reaches the shared pool through the doorway. |
+| `routes/reports.js` | `POST /security/reports` (Metic+ file), `GET /security/reports` (Archon list), `POST /security/reports/:id/{confirm,dispute,fix,link-fix}` (Archon adjudicate). Its factory **registers the `security` port**. |
+
+## NOT in this module (deliberately left in core)
+
+- **The threat-model + engagement-doc routes** — `src/bongos/routes/security.js` keeps `GET /security/adr` + `GET/POST /security/docs` (security-the-property; see the boundary call above). They use the core `db.js` `security_docs` queries and `auth`/`_helpers` directly — core code, not this module.
+- **The `/builder-redteam` skill** — `.claude/skills/builder-redteam/` travels with the feature but stays under `.claude/skills/` (it just POSTs to `/api/gds/security/reports`, which this module now mounts).
+
+## Tables
+
+None owned. `vulnerability_reports` (migration 030) and `security_docs` (the property-side store) were created before the module system and stay in core `migrations/` (the `schema_migrations` stem-key makes a later relocation a no-op). This module owns the *report/bounty queries*; any **new** security-feature migration belongs in `modules/security/migrations/` namespaced `security_*` (the additive rule).
+
+## Tests
+
+`tests/security_reports.mjs` exercises the report/bounty domain (the `security.js` helpers + the bounty table). The route-rank fitness check (`tests/module_route_rank.mjs`) asserts every write route in `routes/reports.js` is rank-gated. The doorway/boundary checks (`tests/fitness.mjs`, `tests/module_loader.mjs`) discover `security` as a module. See [ADR 0093](../../docs/adr/<redacted>.md).

package/modules/security/module.json

@@ -0,0 +1,10 @@
+{
+  "key": "security",
+  "title": "Security (red-team · bounty)",
+  "description": "The red-team / vulnerability-report intake and the bounty payout system (rank-gated Metic+): the /builder-redteam skill files a report, the Archon dashboard adjudicates (confirm/dispute/fix/link-fix), and the env-aware bounty table sets the per-severity drachmae payout. A core-domain module carved out of the GDS core in BV1.R79 (ADR 0093 §1; 02-module-map §5 — security-the-FEATURE, NOT security-the-property, which stays kernel). default-on because every instance can take red-team reports. Registers the `security` kernel PORT the core /public/bounty-table resolves for the payout schedule.",
+  "coreVersion": "^1.8.0",
+  "default": true,
+  "contributes": { "routes": ["reports"] },
+  "provides": ["security"],
+  "consumes": []
+}

package/modules/security/routes/reports.js

@@ -0,0 +1,251 @@
+// modules/security/routes/reports.js — the red-team / vulnerability-report +
+// bounty intake & adjudication surface (BV1.R79 / ADR 0093 §1).
+//
+// Carved out of the core src/bongos/routes/security.js (V3.R63-R66 / #282-285): the
+// FEATURE half — file a report (Metic+), the Archon watch + adjudication view, and
+// the bounty payout table. security-the-PROPERTY (the /security/adr threat-model
+// reader + /security/docs exploit-detail store) STAYS in core (02-module-map §5).
+// OTB byte-identical — only the require() paths changed: auth gates + request
+// validators reach through the published doorway; the security domain is an
+// intra-module require (a module never requires a core internal).
+//
+// This factory also REGISTERS the `security` kernel PORT (below): the bounty
+// payout table the core public route resolves instead of importing the module.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const security = require('../security');
+const { validateOrRespond, LIMITS, parseId } = api;
+
+// Register the `security` kernel PORT (BV1.R79 / ADR 0093 §1). The ONLY core
+// consumer of the security feature is routes/public.js's /public/bounty-table,
+// which renders the env-aware payout schedule — it resolves this port instead of
+// importing the module (the boundary rule: core never requires a module). Pattern
+// mirrors modules/economy/routes/reward.js — registered from the route factory (the
+// one boot hook that runs both live AND when a test rebuilds the GDS router),
+// hasProvider-guarded so re-instantiation never trips the single-provider guard.
+// The seam functions are flat doorway exports (api.hasProvider/registerProvider).
+function registerSeams() {
+  if (!api.hasProvider('security')) {
+    api.registerProvider('security', {
+      // pure, DB-free, env-derived payout schedule the public bounty-table feeds
+      bountyTableDetailed: (...a) => security.bountyTableDetailed(...a),
+      bountyTable: (...a) => security.bountyTable(...a),
+    });
+  }
+}
+
+module.exports = function buildSecurityReportsRouter() {
+  registerSeams();
+  const router = express.Router();
+
+  // -----------------------------------------------------------------------
+  // Vulnerability reports — file (Metic+) + Archon adjudication (V3.R64/R66).
+  //
+  // The Archon-only watch surface in the /builders hall reads through these
+  // endpoints. The "own" path for non-Archons (a builder reading their own
+  // reports) is a future surface — for now everything read here is Archon, since
+  // the only consumer that exists is the Archon dashboard view.
+  // -----------------------------------------------------------------------
+
+  // POST /api/bongos/security/reports — file a new vulnerability report.
+  //
+  // V3.R64 (#283). Used by the /builder-redteam skill. Metic+ only — Xenos
+  // can't open the bounty surface (the rank gate keeps the noise-floor sane;
+  // a Xenos who finds a real flaw can flag it through normal channels).
+  //
+  // Body: { target, severity, title, description?, repro_steps_md? }
+  // Returns 201 + the inserted row (status='open' by default; the Archon view
+  // picks it up immediately).
+  //
+  // rank: metic+archon — bounty intake; Xenos kept out by design (V3.R63).
+  router.post(
+    '/security/reports',
+    api.requireBuilder,
+    api.requireRank('metic', 'archon'),
+    async (req, res) => {
+      if (validateOrRespond(req, res, {
+        target:         { required: true, type: 'string', maxLength: LIMITS.TITLE, minLength: 1 },
+        severity:       { required: true, type: 'string', maxLength: 32 },
+        title:          { required: true, type: 'string', maxLength: LIMITS.TITLE, minLength: 1 },
+        description:    { type: 'string', maxLength: LIMITS.DESCRIPTION },
+        repro_steps_md: { type: 'string', maxLength: LIMITS.DESCRIPTION },
+      })) return;
+      const { target, severity, title, description, repro_steps_md: reproStepsMd } = req.body || {};
+      try {
+        const row = await security.createVulnerabilityReport({
+          reporterBuilderId: req.builder.id,
+          target,
+          severity,
+          title,
+          description: description ?? null,
+          reproStepsMd: reproStepsMd ?? null,
+        });
+        res.status(201).json({ ok: true, report: row, bounty_table: security.bountyTable() });
+      } catch (err) {
+        if (err && err.code === 'INVALID_SEVERITY') {
+          return res.fail('invalid_severity', 400, { allowed: err.allowed });
+        }
+        console.error('[gds] POST /security/reports', err);
+        res.fail('create_failed', { status: 500, message: 'internal error' });
+      }
+    }
+  );
+
+  // GET /api/bongos/security/reports?status=<status>
+  //
+  // Archon-only, newest-first. The Archon dashboard view fetches this on
+  // load + after each adjudication action. ?status= narrows to one
+  // lifecycle bucket (open / repro_attempted / confirmed / disputed /
+  // fixed / wontfix); omitted = all.
+  //
+  // rank: archon — adjudication surface; reading every builder's reports.
+  router.get(
+    '/security/reports',
+    api.requireBuilder,
+    api.requireRank('archon'),
+    async (req, res) => {
+      const status = req.query.status ? String(req.query.status) : null;
+      if (status && !security.VULN_STATUSES.includes(status)) {
+        return res.fail('bad_status', 400, { allowed: security.VULN_STATUSES });
+      }
+      try {
+        const reports = await security.listVulnerabilityReports({ scope: 'all', status });
+        // The bounty table comes along so the UI can render "would pay X
+        // drachmae if confirmed" inline without a second request.
+        res.set('Cache-Control', 'no-store');
+        res.json({
+          reports,
+          bounty_table: security.bountyTable(),
+          statuses: security.VULN_STATUSES,
+        });
+      } catch (err) {
+        console.error('[gds] GET /security/reports', err);
+        res.fail('list_failed', { status: 500, message: 'internal error' });
+      }
+    }
+  );
+
+  // POST /api/bongos/security/reports/:id/confirm
+  // Body: { drachmae_awarded?: integer } — defaults to the severity tier
+  // bounty if omitted. Marks the report confirmed, stamps confirmed_at,
+  // and sets drachmae_awarded.
+  //
+  // rank: archon — confirms a payout-eligible report.
+  router.post(
+    '/security/reports/:id/confirm',
+    api.requireBuilder,
+    api.requireRank('archon'),
+    async (req, res) => {
+      const id = parseId(req, res, { code: 'bad_report_id', positiveInt: true });
+      if (id === null) return;
+      const drachmaeRaw = req.body?.drachmae_awarded;
+      let drachmaeAwarded = null;
+      if (drachmaeRaw !== undefined && drachmaeRaw !== null && drachmaeRaw !== '') {
+        const n = Number(drachmaeRaw);
+        if (!Number.isFinite(n) || n < 0) {
+          return res.fail('bad_drachmae_awarded', 400);
+        }
+        drachmaeAwarded = n;
+      }
+      try {
+        const report = await security.confirmVulnerabilityReport(id, { drachmaeAwarded });
+        res.json({ report });
+      } catch (err) {
+        if (err && err.code === 'REPORT_NOT_FOUND') {
+          return res.fail('report_not_found', 404, { id });
+        }
+        console.error('[gds] POST /security/reports/:id/confirm', err);
+        res.fail('confirm_failed', { status: 500, message: 'internal error' });
+      }
+    }
+  );
+
+  // POST /api/bongos/security/reports/:id/dispute
+  // Marks the report disputed and clears drachmae_awarded.
+  //
+  // rank: archon — dispute adjudication.
+  router.post(
+    '/security/reports/:id/dispute',
+    api.requireBuilder,
+    api.requireRank('archon'),
+    async (req, res) => {
+      const id = parseId(req, res, { code: 'bad_report_id', positiveInt: true });
+      if (id === null) return;
+      try {
+        const report = await security.disputeVulnerabilityReport(id);
+        res.json({ report });
+      } catch (err) {
+        if (err && err.code === 'REPORT_NOT_FOUND') {
+          return res.fail('report_not_found', 404, { id });
+        }
+        console.error('[gds] POST /security/reports/:id/dispute', err);
+        res.fail('dispute_failed', { status: 500, message: 'internal error' });
+      }
+    }
+  );
+
+  // POST /api/bongos/security/reports/:id/fix
+  // Marks the report fixed and stamps fixed_at. Does not change
+  // fix_task_id — link that separately via /link-fix.
+  //
+  // rank: archon — fix-confirmation adjudication.
+  router.post(
+    '/security/reports/:id/fix',
+    api.requireBuilder,
+    api.requireRank('archon'),
+    async (req, res) => {
+      const id = parseId(req, res, { code: 'bad_report_id', positiveInt: true });
+      if (id === null) return;
+      try {
+        const report = await security.markVulnerabilityReportFixed(id);
+        res.json({ report });
+      } catch (err) {
+        if (err && err.code === 'REPORT_NOT_FOUND') {
+          return res.fail('report_not_found', 404, { id });
+        }
+        console.error('[gds] POST /security/reports/:id/fix', err);
+        res.fail('fix_failed', { status: 500, message: 'internal error' });
+      }
+    }
+  );
+
+  // POST /api/bongos/security/reports/:id/link-fix
+  // Body: { task_id: integer } — attaches a fix-task FK. Doesn't change
+  // status (a confirmed report can have a linked fix-task while still
+  // open work). 422 if the referenced task doesn't exist.
+  //
+  // rank: archon — linking a report to its fix-task in the queue.
+  router.post(
+    '/security/reports/:id/link-fix',
+    api.requireBuilder,
+    api.requireRank('archon'),
+    async (req, res) => {
+      const id = parseId(req, res, { code: 'bad_report_id', positiveInt: true });
+      if (id === null) return;
+      const taskIdRaw = req.body?.task_id;
+      const taskId = Number(taskIdRaw);
+      if (!Number.isInteger(taskId) || taskId <= 0) {
+        return res.fail('bad_task_id', 400);
+      }
+      try {
+        const report = await security.linkVulnerabilityReportFix(id, taskId);
+        res.json({ report });
+      } catch (err) {
+        if (err && err.code === 'REPORT_NOT_FOUND') {
+          return res.fail('report_not_found', 404, { id });
+        }
+        if (err && err.code === 'FIX_TASK_NOT_FOUND') {
+          return res.fail('fix_task_not_found', 422, { task_id: taskId });
+        }
+        if (err && err.code === 'INVALID_FIX_TASK_ID') {
+          return res.fail('invalid_fix_task_id', 400);
+        }
+        console.error('[gds] POST /security/reports/:id/link-fix', err);
+        res.fail('link_fix_failed', { status: 500, message: 'internal error' });
+      }
+    }
+  );
+
+  return router;
+};