@bongos/core 1.17.0

package/migrations/090_box_scoped_sessions.sql

@@ -0,0 +1,38 @@
+-- migration 090: box-scoped dev-box sessions (task 919, security_reports SR#2 + SR#11)
+--
+-- The dev-box provisioner (scripts/gds/box.js) bakes a GDS session into cloud-init
+-- so box-source-fetch can clone the rank-scoped repo on first boot (#818). Until
+-- now that baked token was source='cli' — a FULL-authority builder session (it can
+-- claim/grade/ship/hit every requireBuilder route). source was purely informational;
+-- no scope gate existed. SR#2 (HIGH): any on-box process or the metadata endpoint
+-- could read it and act as the full builder, breaking the ADR 0016 trust boundary
+-- (the box is OUTSIDE it).
+--
+-- Fix: a third session source, 'box'. auth.requireBuilder denies a 'box' session on
+-- every route EXCEPT the handful the on-box crons need (allow-listed via
+-- auth.allowBoxScope), so a leaked box credential can do nothing but bootstrap.
+--
+-- 1) Widen the source CHECK to admit 'box'. The constraint was created inline in
+--    migration 003 (builder_sessions.source CHECK (source IN ('cli','web'))), so
+--    Postgres auto-named it builder_sessions_source_check. Drop-if-exists keeps this
+--    idempotent across environments where the name might differ.
+ALTER TABLE builder_sessions
+  DROP CONSTRAINT IF EXISTS builder_sessions_source_check;
+ALTER TABLE builder_sessions
+  ADD CONSTRAINT builder_sessions_source_check CHECK (source IN ('cli', 'web', 'box'));
+
+-- 2) Retroactively scope sessions already baked onto LIVE boxes. box.js stamps the
+--    baked session with user_agent='box-provision' (and only that path does), so
+--    this targets exactly those tokens and downgrades them to box scope in place.
+--    Safe: a running box only ever calls the 4 allow-listed bootstrap endpoints, and
+--    a builder who re-authed ON the box (interactive /builder-reauth) holds a
+--    SEPARATE cli/web session with a different user_agent, untouched here.
+UPDATE builder_sessions
+   SET source = 'box'
+ WHERE source = 'cli'
+   AND user_agent = 'box-provision'
+   AND revoked_at IS NULL;
+
+-- Counter hygiene: keep the migration-number allocator above this file so the next
+-- reservation can't collide with 090 (per the planning-session learning).
+UPDATE migration_counter SET next_number = GREATEST(next_number, 91) WHERE id = 1;

package/migrations/091_session_token_reward.sql

@@ -0,0 +1,44 @@
+-- 091_session_token_reward.sql
+-- Task 1005 — flat cost-plus SESSION TOKEN REWARD (ADR 0054).
+--
+-- A builder now earns drachmae for a SHIPPED session proportional to its true
+-- API token cost: drachmae = round(true_cost_usd * (1 + REWARD_MARGIN_PCT/100) * 100),
+-- i.e. cost-plus-20%, denominated in integer cents. Computed SERVER-SIDE from
+-- uploaded per-model token counts (never a client dollar figure). Idempotent
+-- per session_id, append-only, reversible.
+--
+-- Three additive, nullable/defaulted changes — no backfill of historical rows,
+-- no destructive edits. Forward-looking only.
+
+-- (a) Per-model token usage rides as jsonb on the session record. ship.js
+--     accumulates it from the same transcript usage it already parses; promoting
+--     it to a first-class column (vs burying it in the free-form metrics blob)
+--     makes the reward auditable + re-computable without parsing a blob. Shape:
+--       { "<model-id>": { input, output, cache_read, cache_creation } }
+ALTER TABLE session_records
+  ADD COLUMN IF NOT EXISTS model_usage jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+-- (b) The token-reward drachmae actually granted for this session, mirrored here
+--     for audit/reversibility. Authoritative payout is still the credit_log row;
+--     this is an observability mirror (like drachmae_earned mirrors task credits).
+ALTER TABLE session_records
+  ADD COLUMN IF NOT EXISTS token_reward_drachmae integer NOT NULL DEFAULT 0;
+
+-- (c) credit_log idempotency for the session token reward. credit_log has no
+--     unique constraint anywhere today. We add a nullable session_id column + a
+--     PARTIAL unique index scoped to the new reason. Existing rows keep
+--     session_id = NULL and are unaffected (the partial index only covers rows
+--     whose reason = 'session.token_reward'). This is the hard DB-level backstop
+--     against a double payout when two ship uploads of the same session race.
+ALTER TABLE credit_log
+  ADD COLUMN IF NOT EXISTS session_id text;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_credit_session_token_reward
+  ON credit_log (session_id)
+  WHERE reason = 'session.token_reward';
+
+-- Counter hygiene: this migration was hand-authored (not handed out by the
+-- claim-time allocator), so advance the allocator floor past 090 with GREATEST
+-- (never a bare assignment) so a parallel claim can't reuse this number and a
+-- concurrently-advanced counter is never rewound. (See 081 tail for the rule.)
+UPDATE migration_counter SET next_number = GREATEST(next_number, 92) WHERE id = 1;

package/migrations/093_tasks_sandbox_review.sql

@@ -0,0 +1,22 @@
+-- migrations/093_tasks_sandbox_review.sql
+-- Task #1048 (GDS-V4) — record the builder's sandbox self-approval as a durable
+-- fact on the task. ADR 0046 follow-up.
+--
+-- The sandbox-first review gate (#927, ADR 0046) previously recorded the
+-- "reviewed on the sandbox and approved" decision ONLY in an ephemeral temp-dir
+-- marker (otb-sandbox-staged.json) that vanished after the ship — nothing
+-- durable said this exact game build was reviewed and signed off. Lars's
+-- 2026-06-13 directive: that approval must be recorded. We persist it as a small
+-- JSONB blob on the task, written by db.resolveClaim from the value ship.js
+-- threads through POST /claims/:id/resolve.
+--
+-- Shape (server stamps `by`/`at` authoritatively; the rest is client-supplied):
+--   { "by": "<github_login>", "at": "<iso8601>", "stamp": "<sha256>",
+--     "url": "https://sandbox-<login>.amazonprimea.com", "method": "tty"|"flag" }
+-- NULL = no sandbox review recorded for this task (laptop ship, non-game diff,
+-- quick-tunnel box, --skip-stage, or a fresh-marker re-run without --approved).
+--
+-- Idempotent + re-runnable.
+
+ALTER TABLE tasks
+  ADD COLUMN IF NOT EXISTS sandbox_review jsonb;

package/migrations/102_remove_box_first_provision_approval.sql

@@ -0,0 +1,58 @@
+-- 102_remove_box_first_provision_approval.sql — ADR 0059 (task 1141): REMOVE the
+-- dev-box "first-box Archon approval" gate. Reverts migration 071.
+--
+-- Context
+-- -------
+-- Migration 071 (#717, ADR 0035 Decision 2) added a 'pending_approval' state to
+-- box_intents so a newcomer's FIRST paid droplet was held until an Archon ran
+-- POST /box/intents/:id/approve. That double-gated admission: a builder already
+-- had to be admitted to the project (the invite/member-join gate) before they
+-- could ever reach /box/ensure, and then their first box was gated AGAIN.
+--
+-- ADR 0059 / task 1141 collapses this to a single approval — the member-join
+-- (invite) admission gate — and lets an admitted builder's first box auto-drain
+-- like every subsequent provision and every wake. The web tier still only RECORDS
+-- A REQUEST and never holds DO_API_TOKEN (the migration-070 invariant is
+-- unchanged); the box lifecycle stays operator/control-plane only. This migration
+-- only removes the SECOND, redundant gate on box provisioning. The member-join /
+-- access-request admission flow is untouched.
+--
+-- This file reverts migration 071 back to the migration-070 schema: it drains any
+-- held first-box requests, removes 'pending_approval' from the state CHECK, restores
+-- the migration-070 partial unique index, and drops the approval audit columns.
+--
+-- Do NOT edit migration 071 itself — it already ran on prod; this forward migration
+-- undoes its effects.
+--
+-- Idempotent: safe to re-run.
+
+-- Step 1 — drain held requests FIRST, before the tightened CHECK is re-added, so no
+-- live row violates the constraint. A 'pending_approval' row was a first-box request
+-- waiting on an Archon; with the gate gone, it simply becomes a normal 'pending'
+-- request the control-plane runner will auto-drain.
+UPDATE box_intents
+   SET state = 'pending', updated_at = now()
+ WHERE state = 'pending_approval';
+
+-- Step 2 — restore the migration-070 state CHECK (drop 'pending_approval'). Postgres
+-- has no ALTER ... DROP VALUE for a CHECK, so drop + re-add. Same constraint name
+-- migration 071 used.
+ALTER TABLE box_intents DROP CONSTRAINT IF EXISTS box_intents_state_check;
+ALTER TABLE box_intents ADD CONSTRAINT box_intents_state_check
+  CHECK (state IN ('pending', 'running', 'done', 'error'));
+
+-- Step 3 — restore the migration-070 partial unique index (one open intent per
+-- builder), dropping 'pending_approval' from the open set. After step 1 no held rows
+-- remain, so the open set is again {pending, running}.
+DROP INDEX IF EXISTS ux_box_intents_open;
+CREATE UNIQUE INDEX IF NOT EXISTS ux_box_intents_open
+  ON box_intents (builder_id)
+  WHERE state IN ('pending', 'running');
+
+-- Step 4 — drop the approval audit columns migration 071 added. With the gate gone
+-- there is nothing to attribute.
+ALTER TABLE box_intents DROP COLUMN IF EXISTS approved_by;
+ALTER TABLE box_intents DROP COLUMN IF EXISTS approved_at;
+
+INSERT INTO schema_migrations (version) VALUES ('102_remove_box_first_provision_approval')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/103_search_chunks.sql

@@ -0,0 +1,90 @@
+-- migration 103: search_chunks — the lexical retrieval substrate (task 944, V4.R06)
+--
+-- Implements ADR 0060 §2 (GDS retrieval layer: Postgres-resident, lexical-first,
+-- rank-scoped, fail-open). One table in the EXISTING GDS Postgres holds every
+-- searchable chunk (markdown docs + DB prose); full-text (tsvector) and trigram
+-- (pg_trgm) match run as SQL against it, fused with RRF in the search route
+-- (#949). No new service, no new monthly cost (CLAUDE.md §4).
+--
+-- SCOPING IS A FIRST-CLASS COLUMN, NOT A LATER FILTER (ADR 0060 §6 / ADR 0016):
+--   * min_rank          — the LOWEST builder rank that may see this chunk. The
+--                         search route filters in the SQL WHERE clause against the
+--                         caller's LIVE, server-resolved rank, so a sub-Metic query
+--                         can never select a Metic+ chunk in the first place. This
+--                         keeps the index from becoming a read-side bypass of the
+--                         trust boundary (the exact failure mode ADR 0016 guards).
+--   * owner_builder_id  — non-null ⟺ a per-builder PRIVATE chunk (e.g. a builder's
+--                         own memory). Returned ONLY to that owner (the route adds
+--                         `owner_builder_id IS NULL OR owner_builder_id = <session>`),
+--                         the owner always taken from the authenticated session,
+--                         never from input — same posture as src/bongos/routes/memory.js.
+--
+-- The isolation suite (#950, tests/search_isolation.mjs) is the regression guard
+-- that both filters live in SQL and can't be dropped by a later refactor.
+
+-- pg_trgm ships with standard Postgres contrib (no new package); enables the
+-- trigram fuzzy-match leg (similarity / % operator + a GIN gin_trgm_ops index).
+CREATE EXTENSION IF NOT EXISTS pg_trgm;
+
+CREATE TABLE IF NOT EXISTS search_chunks (
+  id               bigserial PRIMARY KEY,
+  -- 'doc' = a chunk of a repo markdown file; 'db' = a chunk of DB prose
+  -- (task description/value summary, learning, session-log summary, etc.).
+  source_kind      text   NOT NULL CHECK (source_kind IN ('doc', 'db')),
+  -- The source identity: a repo-relative path ('docs/adr/0016-....md') for docs,
+  -- or a typed ref ('task:431', 'learning:53') for DB prose. Together with
+  -- chunk_index it uniquely names a chunk, so re-ingest is an idempotent upsert.
+  source_ref       text   NOT NULL,
+  chunk_index      int    NOT NULL,
+  -- Breadcrumb to the chunk's section, e.g. 'CLAUDE.md > §8 Versioning > Working
+  -- rules'. Carried so a result is self-locating and the snippet has context.
+  heading_path     text,
+  -- The source's human title, for result display.
+  title            text,
+  -- The chunk text — what gets shown as a snippet and (with title + heading_path)
+  -- indexed into tsv.
+  body             text   NOT NULL,
+  -- Scoping (see header). Default 'xenos' = visible to everyone (the common case
+  -- for ordinary docs); permission-core docs are ingested at 'metic'.
+  min_rank         text   NOT NULL DEFAULT 'xenos'
+                     CHECK (min_rank IN ('xenos', 'thetes', 'metic', 'archon')),
+  -- Per-builder private chunk owner (NULL = shared/non-private). ON DELETE CASCADE:
+  -- a private chunk has no meaning once its owner is gone (mirrors builder_memory).
+  owner_builder_id bigint REFERENCES builders(id) ON DELETE CASCADE,
+  -- sha256 of body — the ingestion delta key (skip re-write when unchanged).
+  content_hash     text   NOT NULL,
+  -- Generated FTS vector over title (weight A) + heading_path (B) + body (C), so
+  -- ts_rank_cd weights a title/heading hit above a body hit. Uses the 2-arg
+  -- to_tsvector('english', ...) form — IMMUTABLE, as a generated column requires
+  -- (the 1-arg form depends on default_text_search_config and is NOT immutable).
+  tsv              tsvector GENERATED ALWAYS AS (
+                     setweight(to_tsvector('english', coalesce(title, '')), 'A') ||
+                     setweight(to_tsvector('english', coalesce(heading_path, '')), 'B') ||
+                     setweight(to_tsvector('english', body), 'C')
+                   ) STORED,
+  created_at       timestamptz NOT NULL DEFAULT now(),
+  updated_at       timestamptz NOT NULL DEFAULT now(),
+  -- One row per (source, chunk ordinal) → re-ingest is ON CONFLICT upsert.
+  UNIQUE (source_kind, source_ref, chunk_index)
+);
+
+-- FTS leg: GIN over the generated tsvector.
+CREATE INDEX IF NOT EXISTS idx_search_chunks_tsv
+  ON search_chunks USING gin (tsv);
+
+-- Trigram leg: GIN gin_trgm_ops over body for similarity() / % fuzzy match.
+CREATE INDEX IF NOT EXISTS idx_search_chunks_body_trgm
+  ON search_chunks USING gin (body gin_trgm_ops);
+
+-- Idempotent re-ingest + delete-by-source (the ingesters key on this).
+CREATE INDEX IF NOT EXISTS idx_search_chunks_source
+  ON search_chunks (source_kind, source_ref);
+
+-- Owner-scoped lookups (a builder's own private chunks). Partial — most chunks
+-- are shared (owner NULL), so only index the private ones.
+CREATE INDEX IF NOT EXISTS idx_search_chunks_owner
+  ON search_chunks (owner_builder_id) WHERE owner_builder_id IS NOT NULL;
+
+-- Counter hygiene: keep the migration-number allocator above this file so the
+-- next reservation can't collide with 103 (per the planning-session learning).
+UPDATE migration_counter SET next_number = GREATEST(next_number, 104) WHERE id = 1;

package/migrations/104_builder_box_blocked.sql

@@ -0,0 +1,34 @@
+-- migration 104: per-builder dev-box provisioning block (task 1163, idea 257)
+--
+-- Idea 257 ("Dev Box management"): an Archon needs to bar a specific builder
+-- from opening dev boxes (abuse, runaway cost, a departed teammate). This adds
+-- the block flag + a small audit trail to `builders`, parallel to the budget
+-- ceiling (migration 089).
+--
+-- It is a builder-LEVEL capability flag, NOT a per-box row, deliberately:
+--   * it must apply BEFORE the builder ever has a builder_boxes row (block a
+--     newcomer pre-emptively), and
+--   * it must SURVIVE box teardown (a destroyed box leaves a state='destroyed'
+--     row; the block must outlive it), so it cannot hang off builder_boxes.
+--
+-- Enforced server-side in boxes.decideEnsureAction / POST /box/ensure
+-- (BOX_PROVISION_BLOCKED, fail-closed) — the block bars the "open" actions
+-- (provision a new box, wake a parked one) but does NOT by itself tear down a
+-- box that is already running (that stays the Archon's explicit, separate
+-- choice). The markdown/UI only describes this; the server is the authority
+-- (ADR 0016 trust boundary). Toggled by PATCH /boxes/:builderId/block (archon);
+-- the same call can optionally also enqueue a deprovision intent ("close the
+-- box they have running too").
+
+ALTER TABLE builders
+  ADD COLUMN IF NOT EXISTS box_blocked        boolean NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS box_blocked_reason text,
+  ADD COLUMN IF NOT EXISTS box_blocked_at     timestamptz,
+  ADD COLUMN IF NOT EXISTS box_blocked_by     bigint REFERENCES builders(id);
+
+-- Counter hygiene: keep the migration-number allocator above this file so the
+-- next reservation can't collide with 104 (mirrors migration 089's tail).
+UPDATE migration_counter SET next_number = GREATEST(next_number, 105) WHERE id = 1;
+
+INSERT INTO schema_migrations (version) VALUES ('104_builder_box_blocked')
+  ON CONFLICT DO NOTHING;

package/migrations/105_box_host_keys.sql

@@ -0,0 +1,35 @@
+-- 105_box_host_keys.sql — task 1187 (idea 235): authoritative box SSH host keys.
+--
+-- Why
+-- ---
+-- A re-provision is a FRESH droplet with brand-new /etc/ssh/ssh_host_* keys.
+-- ssh_deletekeys:false (task 1040) only preserves them across park->wake (the
+-- snapshot restores the disk); the idle-reaper DEPROVISIONS (destroys droplet +
+-- snapshot), so the key changes on every reap->reprovision cycle — now routine.
+-- The laptop/Desktop SSH path then throws "Host denied (verification failed)"
+-- because known_hosts still pins the old box's key. Today's only recovery is TOFU
+-- accept-new (which REJECTS a changed key) or the OTB Dev Box app's ssh-keyscan
+-- re-pin (TOFU + racey — the 925/926 ed25519 partial-scan flakiness).
+--
+-- Fix: the box reports its own PUBLIC host keys UP to the GDS at provision (the
+-- same report-up / serve-to-owner shape as the terminal_* columns in migration
+-- 073), and the connect path WRITES known_hosts from this authoritative value —
+-- no TOFU, no keyscan race. `host_keys` is newline-joined bare `<keytype> <base64>`
+-- pairs (NO hostname prefix — the consumer prepends the host it dials).
+--
+-- PUBLIC KEYS ONLY. The box reporter reads only *.pub files; the PRIVATE half is
+-- NEVER stored here. A host's public key is non-secret and is served to the box's
+-- own builder via GET /box/me (no new read route, no allowBoxScope read surface).
+--
+-- Staleness model (same as 073): WRITTEN only when state='active'
+-- (boxes.setBoxHostKeys gates on it); the value persists across park/wake (the
+-- host identity survives a snapshot wake) and is replaced wholesale by the next
+-- report after a re-provision. No NULL-clear on park.
+--
+-- Idempotent: safe to re-run.
+
+ALTER TABLE builder_boxes ADD COLUMN IF NOT EXISTS host_keys    text;
+ALTER TABLE builder_boxes ADD COLUMN IF NOT EXISTS host_keys_at timestamptz;
+
+INSERT INTO schema_migrations (version) VALUES ('105_box_host_keys')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/111_medusa_customer0_framing.sql

@@ -0,0 +1,35 @@
+-- GDS-V4 Medusa — customer-0 framing + vanilla brand pack (2026-06-17)
+-- Applied under claim 985 (task 1215). Idempotent on re-run.
+--
+-- Refines the Medusa model from the planning session: Medusa runs on its own
+-- plain "vanilla" brand as CUSTOMER 0 and builds itself (the GDS builds itself);
+-- Amazonprimea is CUSTOMER 1. Adds the vanilla-brand-pack task (R74) via
+-- scripts/gds/seed-medusa-tasks.js (re-run after this migration).
+--
+-- What this migration does:
+--   1. Updates the C8 (medusa-standalone-instance) criterion_md to the
+--      customer-0 / customer-1 framing.
+--   2. Updates the R67 dogfood proof task description to "Medusa builds itself
+--      as customer 0" (matched by source_ref; idempotent).
+
+BEGIN;
+
+-- 1. C8 criterion text → customer-0 / customer-1 framing.
+UPDATE done_when_criteria
+SET criterion_md = '**Medusa runs as a configurable, self-hostable, branded instance — Medusa itself is customer 0, Amazonprimea is customer 1.** The build system is no longer a fixture of the game: it boots with no game code in the process, runs on its own database, and takes its identity, branding, and feature selection from per-instance config. Medusa runs on its own plain "vanilla" brand as **customer 0** and builds itself (the GDS builds itself); **Amazonprimea is customer 1**, its surfaces (status/builders) unchanged because their look now comes from config rather than hard-coding. Done when: a Medusa-only entrypoint boots with no Colyseus/Phaser/game routes; a fresh instance''s database holds only build-system tables (game tables only when the game module is enabled); one command (docker compose) stands an instance up with zero hard-coded server IP / service name / deploy script; product name, domain, sign-in origin, repo binding, currency label and the full branding pack resolve from one config (the Medusa vanilla brand is customer 0''s pack; an owner''s own LLM fills a new customer''s pack); the first admin is set at install time, not in a migration; core carries no hard-coded project branding (the deploy-time diagram generator reads instance branding too; Greek rank names stay by decision); an instance turns feature modules (game, art pipeline, Discord, dev boxes) on/off; an instance declares its core version and `medusa upgrade` applies new migrations + code while preserving instance config; and Medusa builds itself as customer 0 on the vanilla brand, taking a task claim->grade->ship end-to-end. Live Amazonprimea (customer 1) is unaffected throughout.'
+WHERE version_id = 'GDS-V4' AND criterion_id = 'medusa-standalone-instance';
+
+-- 2. R67 dogfood proof → customer-0 self-build framing.
+UPDATE tasks
+SET description = 'Part of Medusa (C8) — the proof-task that satisfies C8 ("the GDS builds itself"). Customer 0 = Medusa itself, running on the vanilla brand pack (R74); customer 1 = Amazonprimea.
+
+Stand Medusa up as customer 0 (its own database, vanilla brand, no game code) and take one real task through the full lifecycle on it: claim -> grade -> merge -> ship with credits awarded. Medusa building Medusa, on Medusa. (A separate non-game third project is an acceptable alternative proof, but customer-0 self-build is the truest.)
+
+**Done when:** a task reaches ''shipped'' with credits on the customer-0 Medusa instance carrying zero game code; documented as the C8 acceptance.'
+WHERE source_ref = 'gds-v4-r67';
+
+-- Self-register so migrate.sh skips this hot-applied file on the next deploy.
+INSERT INTO schema_migrations (version) VALUES ('111_medusa_customer0_framing')
+ON CONFLICT DO NOTHING;
+
+COMMIT;

package/migrations/112_drop_track_check.sql

@@ -0,0 +1,25 @@
+-- Migration 112 — drop the product|internal track CHECK on versions (ADR 0062 §3/§5, task 1191).
+--
+-- The track taxonomy is now INSTANCE CONFIG (config/branding.json "tracks"), validated in the API
+-- (src/bongos/routes/tasks.js validTracks()), not a hardcoded 2-value DB constraint. The column stays
+-- NOT NULL — a version still HAS a track — but any value the instance configures is allowed.
+--
+-- Live prod unaffected: existing 'product'/'internal' rows stay valid; this only LOOSENS. The drop
+-- is name-independent (finds the track CHECK by its definition) so it works regardless of the
+-- auto-generated constraint name, and is a no-op if it was already dropped.
+
+DO $$
+DECLARE r record;
+BEGIN
+  FOR r IN
+    SELECT conname
+      FROM pg_constraint
+     WHERE conrelid = 'versions'::regclass
+       AND contype = 'c'
+       AND pg_get_constraintdef(oid) ILIKE '%track%'
+  LOOP
+    EXECUTE format('ALTER TABLE versions DROP CONSTRAINT %I', r.conname);
+  END LOOP;
+END $$;
+
+INSERT INTO schema_migrations (version) VALUES ('112_drop_track_check') ON CONFLICT DO NOTHING;

package/migrations/113_merge_lease.sql

@@ -0,0 +1,16 @@
+-- Migration 113 — server-side merge lease (task 585 / idea 124).
+--
+-- A TTL'd advisory lease keyed on the merge target ("main"), so builders shipping from DIFFERENT
+-- physical machines serialize their main-mutating merges. merge-lock.js handles the intra-machine
+-- (single-checkout) case with a filesystem lock; this is the cross-machine counterpart, handed out
+-- by the GDS API (src/bongos/db.js acquireMergeLease/releaseMergeLease). A dead holder's lease is
+-- reclaimed automatically once expires_at passes — no reaper needed. Single-row-per-key table.
+
+CREATE TABLE IF NOT EXISTS merge_lease (
+  key         text PRIMARY KEY,
+  holder      text        NOT NULL,
+  acquired_at timestamptz NOT NULL DEFAULT now(),
+  expires_at  timestamptz NOT NULL
+);
+
+INSERT INTO schema_migrations (version) VALUES ('113_merge_lease') ON CONFLICT DO NOTHING;

package/migrations/114_cloudbongos_rename_live_strings.sql

@@ -0,0 +1,32 @@
+-- 114 — Cloud Bongos rename: rewrite live user-facing DB strings (2026-06-19, task 1244 / ADR 0064).
+--
+-- The platform was renamed Medusa -> Cloud Bongos (task 1242 / ADR 0064). Migration 111 had baked
+-- "Medusa" into LIVE rows the API still serves (/status, the builders' hall, /recall): the GDS-V4
+-- C8 + C9 done-when criteria and the R67 dogfood-proof task. Per owner directive (2026-06-19) those
+-- live strings are rewritten forward here. Display text ONLY — never the criterion_id keys
+-- (medusa-standalone-instance / medusa-open-and-protected, referenced by task_criteria + code) and
+-- never schema_migrations version strings. Editing 110/111 directly would break idempotency.
+--
+-- Case-sensitive REPLACE on 'Medusa' (the platform name) leaves lowercase filenames/keys
+-- (seed-medusa-tasks.js, medusa-*) untouched; the CLI 'medusa upgrade' becomes 'cloudbongos upgrade'.
+-- Idempotent: REPLACE over already-rewritten text is a no-op. The other 23 R50-R74 task
+-- descriptions are deliberately KEPT as history (owner "history preserved" choice).
+
+BEGIN;
+
+-- C8 + C9 done-when criteria — display text only (criterion_id keys stay).
+UPDATE done_when_criteria
+SET criterion_md = REPLACE(REPLACE(criterion_md, 'Medusa', 'Cloud Bongos'), 'medusa upgrade', 'cloudbongos upgrade')
+WHERE version_id = 'GDS-V4'
+  AND criterion_id IN ('medusa-standalone-instance', 'medusa-open-and-protected');
+
+-- R67 dogfood-proof task (the owner-flagged live string) — title + description.
+UPDATE tasks
+SET title = REPLACE(title, 'Medusa', 'Cloud Bongos'),
+    description = REPLACE(REPLACE(description, 'Medusa', 'Cloud Bongos'), 'medusa upgrade', 'cloudbongos upgrade')
+WHERE source_ref = 'gds-v4-r67';
+
+INSERT INTO schema_migrations (version) VALUES ('114_cloudbongos_rename_live_strings')
+ON CONFLICT DO NOTHING;
+
+COMMIT;

package/migrations/118_currency_label_decoupling.sql

@@ -0,0 +1,23 @@
+-- Migration 118 — document that the currency COLUMN NAMES are decoupled from the
+-- configurable display LABEL (R56 / task 1195, ADR 0062 §3).
+--
+-- R56 makes the reward unit's *display label* instance config (branding.currency.label;
+-- OTB = "drachmae", the neutral starter = "credits"), resolved at render time. The DB
+-- COLUMN NAMES below keep the historical "drachmae" stem ON PURPOSE — they are fixed
+-- schema identifiers, NOT user-facing copy. Renaming them would churn every query +
+-- the wire field names the front-end reads, and — for token_reward_drachmae — risks
+-- disturbing the migration-091 idempotency key (credit_log uniqueness on
+-- reason='session.token_reward'). The cost-plus reward MATH is unchanged by R56.
+--
+-- These COMMENTs are the durable signpost so a future builder doesn't "tidy" the
+-- column names to match a re-branded label and break the ledger. Metadata-only +
+-- idempotent (COMMENT ON overwrites); changes no data and no behaviour.
+
+COMMENT ON COLUMN session_records.drachmae_earned IS
+  'Reward earned for the session, in the instance reward unit. FIXED identifier — the user-facing unit LABEL is config (branding.currency.label, R56/task 1195); do not rename to match a re-branded label.';
+
+COMMENT ON COLUMN session_records.token_reward_drachmae IS
+  'Per-session token reward (cost-plus, ADR 0054), in the instance reward unit. FIXED identifier — display label is config (R56). Do NOT rename: the migration-091 idempotency key (credit_log reason=''session.token_reward'') and the reward math depend on this column.';
+
+COMMENT ON COLUMN vulnerability_reports.drachmae_awarded IS
+  'Bounty paid for a confirmed report, in the instance reward unit. FIXED identifier — the user-facing unit LABEL is config (branding.currency.label, R56/task 1195); do not rename to match a re-branded label.';

package/migrations/119_builder_behavior_prefs.sql

@@ -0,0 +1,31 @@
+-- 119_builder_behavior_prefs.sql — per-builder agent-behavior preferences,
+-- starting with the "wandering" knob (task 1268).
+--
+-- One jsonb column on `builders` (behavior_prefs), default '{}'. It holds
+-- reserved keys for per-builder behavior tuning; the first is 'wandering' — an
+-- integer level 0..3 (Locked | Focused | Balanced | Exploratory) controlling how
+-- readily an agent opens a NEW THREAD of work (a tangent, an investigation, an
+-- unsolicited suggestion) vs. staying on its claimed task. A MISSING key falls
+-- back to the rank-derived default resolved in src/bongos/wandering-prefs.js
+-- (Xenos→Locked … Archon→Exploratory), so the column stays sparse: a builder
+-- who never touches the setting has '{}' and behaves at their rank's default.
+--
+-- This deliberately mirrors migration 037 (skill_model_prefs) and 075
+-- (sound_prefs): per-builder personalized config, sparse + irregular, read by
+-- primary key, with the allowlist + defaults + the rank clamp living in code
+-- (src/bongos/wandering-prefs.js) rather than a Postgres CHECK — so adding a new
+-- behavior knob (or a new level) is a one-line code change, not a coordinated
+-- schema migration. behavior_prefs is the blob; 'wandering' is one reserved key.
+--
+-- Enforcement note: the stored value is the builder's DESIRED level; the
+-- effective level is clamp(override, 0, maxForRank) computed server-side on
+-- every read (wandering-prefs.effectiveLevel). A Xenos who stores Exploratory is
+-- still resolved to Locked — so opening this up for self-service later is safe.
+--
+-- Idempotent: safe to re-run.
+
+ALTER TABLE builders
+  ADD COLUMN IF NOT EXISTS behavior_prefs jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+INSERT INTO schema_migrations (version) VALUES ('119_builder_behavior_prefs')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/121_box_code_version.sql

@@ -0,0 +1,37 @@
+-- 121_box_code_version.sql — dev-box code-version reporting (idea 332, task 1316).
+--
+-- Why
+-- ---
+-- Boxes already auto-update: infra/box-source-fetch.sh (cron */10) `git pull
+-- --ff-only`s /workspace and self-updates its own baked scripts/crons (#985). But
+-- two failure modes leave a box silently STALE with no visibility:
+--   1. A box provisioned BEFORE that machinery existed has no self-update cron, so
+--      it can never pull the fix — only a rebuild helps (box-LarsCode, 2026-06-07).
+--   2. When `pull --ff-only` can't fast-forward, the script logs and leaves the
+--      tree as-is — stale, silently.
+-- A stale box then fails CRYPTICALLY (no shared art key delivered, host-key
+-- reporter absent → connect fails) and the builder has no idea the cause is old
+-- code. This adds the VISIBILITY layer — the box reports its HEAD commit so the
+-- server can flag "running old code → rebuild." (We never auto-reset: that would
+-- clobber a builder's uncommitted work — ADR 0072.)
+--
+-- Columns on builder_boxes (same report-up shape as host_keys, migration 105):
+--   code_sha          — the box's /workspace HEAD commit sha (40-hex), reported up.
+--   code_committed_at — that commit's date (ISO), for the "how far behind"
+--                       comparison against the server's own deployed commit date
+--                       (src/build-info.js).
+--   code_reported_at  — when the box last reported; NULL on an active box past the
+--                       provision grace ⇒ the box is too old to even run the
+--                       reporter (a pre-machinery box) ⇒ stale.
+--
+-- Staleness is COMPUTED in code (boxes.computeCodeStaleness), not stored, so the
+-- thresholds live with the logic + tests — nothing to migrate to tune them.
+--
+-- Idempotent: safe to re-run.
+
+ALTER TABLE builder_boxes ADD COLUMN IF NOT EXISTS code_sha          text;
+ALTER TABLE builder_boxes ADD COLUMN IF NOT EXISTS code_committed_at timestamptz;
+ALTER TABLE builder_boxes ADD COLUMN IF NOT EXISTS code_reported_at  timestamptz;
+
+INSERT INTO schema_migrations (version) VALUES ('121_box_code_version')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/122_builder_gemini_key.sql

@@ -0,0 +1,30 @@
+-- 122_builder_gemini_key.sql — per-builder Gemini key, encrypted at rest (task 1013).
+--
+-- Pragmatic BYOK (ADR 0073). The builder's own Google AI Studio (Gemini) key
+-- moves from local-file-only (~/.config/otb/gds-session.json#gemini_api_key,
+-- entered via the CLI) to a server-stored encrypted column that becomes the
+-- source of truth — so a browser-first builder can enter it on the Settings page
+-- and it syncs down to their box at session start (mirrors the shared-key rail).
+--
+-- Three columns on `builders`:
+--   gemini_key_enc    — the AES-256-GCM blob "v1.<iv>.<tag>.<ct>" (base64url
+--                       parts). NULL = no own key set. The plaintext NEVER lands
+--                       in the DB; the master key lives only in server env
+--                       (BUILDER_SECRET_KEY), so a DB dump alone cannot decrypt
+--                       (src/bongos/secret-box.js).
+--   gemini_key_last4  — last 4 chars of the plaintext, for the masked "…ABCD"
+--                       display (like GitHub/Stripe). Not a secret.
+--   gemini_key_set_at — when it was last set/replaced.
+--
+-- This mirrors the sparse per-builder column pattern (migrations 119, 075, 037):
+-- behaviour lives in code (secret-box.js + builder-needs.js), not in a CHECK.
+--
+-- Idempotent: safe to re-run.
+
+ALTER TABLE builders
+  ADD COLUMN IF NOT EXISTS gemini_key_enc    text,
+  ADD COLUMN IF NOT EXISTS gemini_key_last4  text,
+  ADD COLUMN IF NOT EXISTS gemini_key_set_at timestamptz;
+
+INSERT INTO schema_migrations (version) VALUES ('122_builder_gemini_key')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/123_cost_log_tiers.sql

@@ -0,0 +1,33 @@
+-- 123_cost_log_tiers.sql — per-tier USD breakdown on cost_log (GDS-V4 task 1344,
+-- System 1: Cost Attribution & Savings Ledger).
+--
+-- priceUsage (src/bongos/llm-pricing.js, task 1343) already computes the per-tier
+-- component split (fresh input / cache-read / cache-write / output) but the
+-- ledger discarded it, lumping every call into a single amount_usd. The
+-- marathon-session finding (~82% of spend is cache_read, re-billed every turn for
+-- hours) stays an *inference* until that tier is a queryable column. These four
+-- nullable columns persist the split so costSummary() can GROUP BY tier (task
+-- 1345) and the audit can report the cache_read share (task 1346).
+--
+--   fresh_input_usd — uncached input tokens priced at the family input rate.
+--   cache_read_usd  — cache-read tokens (0.1× input). The marathon cost sink.
+--   cache_write_usd — cache-creation tokens: the 5m + 1h tiers SUMMED into one
+--                     "what we paid to write cache" figure (priceUsage splits
+--                     them; the ledger does not need that granularity).
+--   output_usd      — output tokens.
+--
+-- All nullable: historical rows and non-LLM rows (manual/infra/domain/compute,
+-- e.g. boxes.js 'box-lifecycle' compute rows) stay NULL. The four need not sum
+-- to amount_usd for legacy rows; for the session/cron rows written by
+-- scripts/gds/session-cost.js they sum to amount_usd by construction.
+--
+-- Additive + idempotent: safe to re-run.
+
+ALTER TABLE cost_log
+  ADD COLUMN IF NOT EXISTS fresh_input_usd numeric,
+  ADD COLUMN IF NOT EXISTS cache_read_usd  numeric,
+  ADD COLUMN IF NOT EXISTS cache_write_usd numeric,
+  ADD COLUMN IF NOT EXISTS output_usd      numeric;
+
+INSERT INTO schema_migrations (version) VALUES ('123_cost_log_tiers')
+  ON CONFLICT (version) DO NOTHING;