@bongos/core 1.17.0

package/migrations/core_189_core_upgrades_ledger.sql

@@ -0,0 +1,37 @@
+-- core_189_core_upgrades_ledger.sql — the per-instance core-upgrade ledger
+-- (task 1690, ADR 0100 §2 / ADR 0103 §4 — the `bongos upgrade` channel).
+--
+-- When a two-repo consumer pulls the Cloud Bongos core from version N to N+1 via
+-- `bongos upgrade`, the channel records the event here: which version it came
+-- from, which it went to, the core source commit (from the pin manifest), and an
+-- optional note. This is a small, per-instance audit trail — each consumer's own
+-- DB carries its own upgrade history — and doubles as the migration the first
+-- real bump actually APPLIES, so the channel's "runs additive migrations" step is
+-- exercised end-to-end rather than being a no-op on a consumer with no pending
+-- schema changes.
+--
+-- This is a CORE-owned table (it ships in the core package and every consumer
+-- gets it), so it lives in core migrations/, core_-namespaced (ADR 0108 §5: a new
+-- core migration numbered above LEGACY_BARE_CORE_MAX=187 must be core_-prefixed,
+-- else the fitness namespacing check reds the build).
+--
+-- PURELY ADDITIVE + idempotent (CREATE ... IF NOT EXISTS): fresh-DB-replay safe,
+-- no hard-coded builder ids (learning 1238). migrate.sh records this file's stem
+-- in schema_migrations (the modern 187/188 pattern — the file does not
+-- self-insert).
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS core_upgrades (
+  id            bigserial PRIMARY KEY,
+  from_version  text,                                   -- the core version upgraded FROM (null if unknown / first pin)
+  to_version    text NOT NULL,                          -- the core version upgraded TO
+  source_commit text,                                   -- the core's source commit (from the pin manifest), when known
+  note          text,                                   -- optional free-text (e.g. who ran it / why)
+  applied_at    timestamptz NOT NULL DEFAULT now()
+);
+
+-- Cheap "what's the latest applied upgrade" lookup.
+CREATE INDEX IF NOT EXISTS core_upgrades_applied_at_idx ON core_upgrades (applied_at DESC);
+
+COMMIT;

package/migrations/core_189_credit_log_task_id_index.sql

@@ -0,0 +1,19 @@
+-- 189 index credit_log(task_id) — back the per-task credits_awarded rollups
+-- Applied under task 1960 (follow-up from task 1957's review). Idempotent on re-run.
+--
+-- Problem: task 1957 added a per-task `credits_awarded` figure — the SUM of the
+-- task-reward credit_log deltas WHERE task_id = t.id (see CREDITS_AWARDED_SUBQUERY
+-- in modules/lifecycle/db.js). credit_log carried only idx_credit_log_builder
+-- (builder_id, recorded_at); its task_id column (a FK from migration 003, which
+-- Postgres does NOT auto-index) had no index, so every evaluation of that
+-- subquery — and the existing sumCreditsForTasks() query in
+-- modules/economy/credits.js — sequentially scans the append-only ledger.
+-- 1957 already mitigated the hot board/claimable path with a CASE guard (unsettled
+-- tasks skip the subquery entirely), but settled-task lists (the goal Done tab, the
+-- ships ledger) and future ledger growth still benefit from a real index lookup.
+--
+-- Plain (non-concurrent) CREATE INDEX: migrate.sh applies each file with `psql -f`
+-- in autocommit, and credit_log is small at current scale, so the brief exclusive
+-- lock during the build is negligible. IF NOT EXISTS keeps re-runs a no-op.
+
+CREATE INDEX IF NOT EXISTS idx_credit_log_task ON credit_log (task_id);

package/migrations/core_190_rebuild_claimable_task_views.sql

@@ -0,0 +1,71 @@
+-- core_190_rebuild_claimable_task_views.sql — task 2024: goal filter on the
+-- Work Board silently drops every task when a real goal is selected.
+--
+-- Root cause: claimable_tasks and tasks_session_fit are both `SELECT t.*, ...`
+-- views over `tasks`. Postgres freezes a `SELECT t.*` view's output column
+-- list at CREATE VIEW time — a later `ALTER TABLE tasks ADD COLUMN` does NOT
+-- retroactively add that column to the view. The last migration to rebuild
+-- these two views was 044 (tasks_requires_rank). Six columns landed on
+-- `tasks` since then and never made it into either view:
+--   081 needs_migration, 084 security_sensitive, 093 sandbox_review,
+--   160 goal_id, 165 module_key, 177 reward_gate_exempt.
+-- (086 and 176 correctly skipped a rebuild — they only changed the *values*
+-- of an already-projected column, not the column list.)
+--
+-- `/api/gds/tasks/claimable` (modules/hall-ui/public/work.js) reads goal_id
+-- off this exact feed to populate + filter the Work Board's Goal dropdown
+-- (task 1755): every row's goal_id comes back undefined, so
+-- `String(t.goal_id) !== gFilter` never matches any real goal and picking one
+-- empties the list — the reported bug. The other five missing columns are
+-- the same class of silent bug, just not yet reported.
+--
+-- Fix: rebuild both views (DROP+CREATE) with bodies identical to 044's — the
+-- `SELECT t.*` wildcard then re-expands to every current column, including
+-- the six added since. No WHERE/CASE logic changes.
+--
+-- Idempotent: safe to re-run.
+
+BEGIN;
+
+DROP VIEW IF EXISTS claimable_tasks;
+CREATE VIEW claimable_tasks AS
+SELECT t.*,
+       pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
+  FROM tasks t
+ WHERE t.status = 'ready'
+   AND t.title NOT LIKE '\_\_smoke\_\_%' ESCAPE '\'
+   AND NOT EXISTS (
+     SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id
+   )
+   AND NOT EXISTS (
+     SELECT 1 FROM claims c
+       JOIN tasks t2 ON t2.id = c.task_id
+      WHERE c.released_at IS NULL
+        AND t2.touches && t.touches
+   );
+
+DROP VIEW IF EXISTS tasks_session_fit;
+CREATE VIEW tasks_session_fit AS
+SELECT t.*,
+  CASE
+    WHEN t.automation_tag = 'overnight-safe' AND COALESCE(t.manual_degree, 5) <= 2
+         AND NOT EXISTS (SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id)
+      THEN ARRAY['autonomous','check-in','active']
+    WHEN t.automation_tag = 'live-only' OR COALESCE(t.manual_degree, 5) >= 4
+      THEN ARRAY['active']
+    ELSE ARRAY['check-in','active']
+  END AS fits_session_modes,
+  pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated,
+  CASE
+    WHEN t.credits_reward > 0
+     AND pms_calibrated_minutes(t.est_minutes, t.kind) IS NOT NULL
+     AND pms_calibrated_minutes(t.est_minutes, t.kind) > 0
+    THEN ROUND(t.credits_reward::numeric / pms_calibrated_minutes(t.est_minutes, t.kind), 3)
+    ELSE NULL
+  END AS credits_per_minute
+FROM tasks t;
+
+INSERT INTO schema_migrations (version) VALUES ('core_190_rebuild_claimable_task_views')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/migrations/instance/018_pms_v3_planning_seed.sql

@@ -0,0 +1,131 @@
+-- PMS-V3 Planning Session #1 seed
+-- Applied under claim 166 (task 227, V3.R00 — Planning Session #1).
+-- Idempotent on re-run.
+--
+-- What this migration does:
+--   1. Updates versions.PMS-V3.done_when to match the 9 criteria
+--   2. Seeds 9 done_when_criteria rows for version_id='PMS-V3'
+--   3. Renames the 9 existing PMS-V3 tasks with their V3.R## prefix
+--      and sets their priorities per the ranking. Existing descriptions
+--      are preserved.
+--
+-- Net-new tasks (81 of them) are created via scripts/pms/seed-v3-tasks.js
+-- which runs after this migration is applied. We split because tasks have
+-- rich descriptions and the API handles task_kind classification + foreign-
+-- key writes more cleanly than a long SQL VALUES list.
+
+BEGIN;
+
+-- Short-circuit guard: migration 019 renames versions.id 'PMS-V3' to 'GDS-V3'.
+-- If the rename has already happened (or this DB never had PMS-V3 at all),
+-- every statement below is a no-op at best and a FK violation at worst.
+-- Skip cleanly so a fresh restore + replay doesn't blow up the deploy.
+--
+-- We use a CTE-style WHERE-EXISTS guard on each statement (no DO block —
+-- DO blocks can't short-circuit the rest of the file). The criteria INSERT
+-- is wrapped with a SELECT-driven feed so it naturally produces zero rows
+-- when PMS-V3 is absent.
+
+-- ============================================================================
+-- 1. Update versions.PMS-V3.done_when text
+-- ============================================================================
+UPDATE versions
+SET done_when = 'When this is finished, multiple trusted builders will work the city in parallel — onboarded in under two hours, ranked into three tiers, shipping under their own credentials with their own karma alongside their drachmae, judged to the same quality bar, proposing scope into the next planning session, parallel-safe under load, gated by server-enforced permissions, cloneable in full with local-first memory that syncs on every ship, and able to earn drachmae by red-teaming a staging mirror of the city''s walls.'
+WHERE id = 'PMS-V3';
+
+-- ============================================================================
+-- 2. Seed 9 done_when_criteria rows for PMS-V3
+--    UPSERT semantics via ON CONFLICT (version_id, criterion_id).
+--    Outer WHERE EXISTS makes this a no-op when 019 has already renamed
+--    PMS-V3 → GDS-V3 (the FK check would otherwise fail).
+-- ============================================================================
+INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
+SELECT * FROM (VALUES
+  ('PMS-V3', 'onboarding-2h',
+   '**Trusted-newcomer onboarding to first shipped task is ≤ 2 hours.** A Metic-tier builder added by Archon today is shipping a real PMS task on `main` within 2 hours, without 1:1 help. Build environment bootstraps from `git clone` + one setup script; docs live outside CLAUDE.md, written for first-time readers; at least one newcomer-friendly task is always open per active version; `/builder-setup` no longer assumes Archon''s machine.',
+   1),
+  ('PMS-V3', 'three-ranks-gate-everything',
+   '**Three ranks exist, and they gate every privileged operation.** Xenos (default for any GitHub-authed person; read-only on public surfaces + ship only explicitly-tagged-open tasks), Metic (Archon-approved; full claim/ship, planning sessions in proposal mode, idea triage, blocker review, priority sessions), Archon (rank promotion, ratification, version close, infra). `builders.rank` enum + middleware on every privileged route + Archon-only promotion/demotion endpoint + rank visible on /builders hall.',
+   2),
+  ('PMS-V3', 'per-builder-credentials',
+   '**Every builder ships under their own credentials, with their own cost and authorship.** Per-builder Gemini key registered during `/builder-setup`; per-builder cost ledger entries; authorship in session_logs/claims/commits is the actual builder, never Archon-as-proxy; soft-cap warning before a builder hits their hard cost ceiling; Anthropic account linking via Claude Code self-verification.',
+   3),
+  ('PMS-V3', 'quality-bar-holds',
+   '**Work shipped by any builder meets the same quality bar Archon''s V2 work did.** Opus-subagent grader replaces the v1 process-audit grader and gates `completed → confirmed`; per-builder × per-kind calibration tightens the bar over time, never loosens; failed confirmations are visible to the builder with actionable feedback written to the learnings table; regressions caught by automation, not by Archon''s eye.',
+   4),
+  ('PMS-V3', 'propose-ratify',
+   '**Trusted builders propose; Archon ratifies; the cadence is structural.** Metics shape what comes next by surfacing proposals, not by writing system state directly. Planning sessions, priority sessions, idea triage, and blocker review are Metic-runnable; proposed criteria/tasks land in `idea_inbox` tagged with the source builder; Archon ratifies during the next planning session, writing them into `done_when_criteria` and `tasks`; nightly skill-usage feedback loop surfaces friction; builder analytics surface "AI dev curve" per builder; PMS-V4''s done-when criteria are mostly authored by Metic proposals captured during V3.',
+   5),
+  ('PMS-V3', 'parallel-safe-under-load',
+   '**N>1 builders work in parallel without colliding on claims, merges, or shared system state.** Claim concurrency is deterministic; merge serialization handles drift; scheduled tasks don''t multiplex per-builder state incorrectly; session-scoped hooks move off per-session onto scheduled timers where appropriate; parallel-safety bugs surfaced during V3 get fixed in V3.',
+   6),
+  ('PMS-V3', 'server-enforced-perms',
+   '**Permissions are enforced server-side; no builder can grant themselves authority by editing local files.** `rank` lives in the database, checked on every privileged request against the DB (no caching, so demotion is effectively instant); skills, hooks, and `.claude/settings.json` cannot grant authority — they can only call into server endpoints that themselves enforce rank; CLAUDE.md and other markdown files describe permissions but are never the source of truth; an ADR documents the trust boundary; a periodic auditor confirms no privileged route is missing a rank check.',
+   7),
+  ('PMS-V3', 'cloneable-local-memory-server-sync',
+   '**The repo, memory system, art pipeline, and methodology are cloneable by any Metic; memory is local-first, server-canonical on ship.** `git clone` is the onboarding path — no Archon-only handoffs beyond rank assignment. No secrets live in the repo (verified). Each builder''s local memory dir syncs to a server-side per-builder store every time a task ships; learnings remain server-canonical. Cloning the repo never exposes another builder''s local memory. Art pipeline runs end-to-end on a fresh checkout with the builder''s own Gemini key.',
+   8),
+  ('PMS-V3', 'security-baseline-plus-red-team',
+   '**The server has production-grade security basics, and Metics earn drachmae by red-teaming it.** Input validation, auth-token hygiene, rate limits on write paths, audit logging on privileged routes, dependency-scan in CI — all green before any non-Archon ships. A staging environment mirrors prod. Any Metic can role-play as an attacker on staging; confirmed vulnerabilities are filed by the discoverer and earn drachmae proportional to severity, auto-confirmed by a subagent reproducing the exploit on staging. Reported vulnerabilities are fixed in V3 unless Archon explicitly defers with an ADR. Observability dashboard (Grafana provisioned-as-code) makes regressions visible.',
+   9)
+) AS v(version_id, criterion_id, criterion_md, sort_order)
+WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'PMS-V3')
+ON CONFLICT (version_id, criterion_id) DO UPDATE
+  SET criterion_md = EXCLUDED.criterion_md,
+      sort_order = EXCLUDED.sort_order;
+
+-- ============================================================================
+-- 3. Update the 9 existing PMS-V3 task priorities + titles
+--    Idempotent guard: only prepend V3.R## prefix when not already there.
+--    These UPDATEs are intrinsically safe when PMS-V3 has been renamed:
+--    the tasks they reference (by id) may still exist but their version_id
+--    is now 'GDS-V3', and the WHERE-clause `id = N AND title NOT LIKE 'V3.R%'`
+--    is already idempotent (title prefix was applied on the original run).
+-- ============================================================================
+
+-- V3.R04 — Builder rank system (Tier 1, P5)
+UPDATE tasks SET priority = 5,
+  title = 'V3.R04 — ' || title
+WHERE id = 106 AND title NOT LIKE 'V3.R%';
+
+-- V3.R10 — Per-builder Gemini API key (Tier 1, P5)
+UPDATE tasks SET priority = 5,
+  title = 'V3.R10 — ' || title
+WHERE id = 91 AND title NOT LIKE 'V3.R%';
+
+-- V3.R15 — Seamless builder onboarding umbrella (Tier 1, P5)
+UPDATE tasks SET priority = 5,
+  title = 'V3.R15 — ' || title
+WHERE id = 222 AND title NOT LIKE 'V3.R%';
+
+-- V3.R18 — Replace v1 grader with Opus subagent (Tier 2, P5)
+UPDATE tasks SET priority = 5,
+  title = 'V3.R18 — ' || title
+WHERE id = 209 AND title NOT LIKE 'V3.R%';
+
+-- V3.R19 — Subagent grader v1 (Tier 2, P5)
+UPDATE tasks SET priority = 5,
+  title = 'V3.R19 — ' || title
+WHERE id = 201 AND title NOT LIKE 'V3.R%';
+
+-- V3.R20 — Grader calibration + per-builder × per-kind (Tier 2, P5)
+UPDATE tasks SET priority = 5,
+  title = 'V3.R20 — ' || title
+WHERE id = 202 AND title NOT LIKE 'V3.R%';
+
+-- V3.R21 — Auto-flip confirmed→shipped on merge (Tier 2, P5)
+UPDATE tasks SET priority = 5,
+  title = 'V3.R21 — ' || title
+WHERE id = 98 AND title NOT LIKE 'V3.R%';
+
+-- V3.R46 — version-close.js refusal bug fix (Tier 4, P4)
+UPDATE tasks SET priority = 4,
+  title = 'V3.R46 — ' || title
+WHERE id = 224 AND title NOT LIKE 'V3.R%';
+
+-- V3.R47 — chat-inbox triage off per-session hook (Tier 4, P4)
+UPDATE tasks SET priority = 4,
+  title = 'V3.R47 — ' || title
+WHERE id = 220 AND title NOT LIKE 'V3.R%';
+
+COMMIT;

package/migrations/instance/080_gds_v4_planning_seed.sql

@@ -0,0 +1,75 @@
+-- GDS-V4 Planning Session #1 seed
+-- Applied under claim 742 (task 937, V4.R00 — Planning Session #1).
+-- Idempotent on re-run.
+--
+-- What this migration does:
+--   1. Updates versions.GDS-V4 name + done_when to match the 6 criteria
+--   2. Seeds 6 done_when_criteria rows for version_id='GDS-V4'
+--   3. Renames the 2 existing open GDS-V4 carry-over tasks (263, 594) with
+--      their V4.R## prefix and sets their priorities per the ranking.
+--      Existing descriptions are preserved.
+--
+-- Net-new tasks (38 of them) are created via scripts/gds/seed-gds-v4-tasks.js
+-- which runs after this migration is applied (same split as the V3 planning
+-- seed, migration 018: tasks have rich descriptions + dependency wiring that
+-- the API handles more cleanly than a long SQL VALUES list).
+--
+-- Source research: 2026-06-12 retrieval-layer architecture report + BFG
+-- session-corpus friction mining (1,349 session_records; ceremony +
+-- failed-tool-use taxonomies).
+
+BEGIN;
+
+-- ============================================================================
+-- 1. Version name + done_when text
+-- ============================================================================
+UPDATE versions
+SET name = 'GDS V4 — recall, resumable pipeline, honest measurement',
+    done_when = 'When this is finished, a builder''s session answers "have we done this before?" in one call instead of an afternoon — project knowledge (markdown and database prose alike) is searchable in one rank-scoped query and pushed into sessions at claim time; a failed ship is one command from resume instead of a consumed claim; the recurring tool-error classes (wrong-tree writes, HTML 404s, phantom smoke servers) are engineered away; the BFG''s measurements reflect real friction so the improvement is provable against the 2026-06-12 baseline; and the city watches itself on one pane of glass.'
+WHERE id = 'GDS-V4';
+
+-- ============================================================================
+-- 2. Seed 6 done_when_criteria rows for GDS-V4
+--    UPSERT semantics via ON CONFLICT (version_id, criterion_id).
+-- ============================================================================
+INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
+SELECT * FROM (VALUES
+  ('GDS-V4', 'one-call-recall',
+   '**Project knowledge is answerable in one call.** Any builder session — laptop, dev box, or browser — can ask one question and get back the relevant ADRs, recipes, session logs, learnings, ideas, and task notes, including the database prose nothing can search today. Done when: lexical search is live over repo markdown + DB prose; results are rank- and owner-scoped (Xenos never sees permission-core content; nobody sees another builder''s memory); every result cites its source so the agent can follow up; and a golden-question set mined from real sessions scores ≥80% recall@5 — whether plain text-search or embeddings gets there is decided by measurement, not taste.',
+   1),
+  ('GDS-V4', 'sessions-start-knowing',
+   '**Sessions start knowing, not hunting.** What a session needs to act correctly is pushed at claim time instead of rediscovered: its worktree root, the claims it holds, the GDS API path prefix and field enums, OS environment facts, the next free ADR/migration number, and the top recall hits for the claimed task. Done when: the guess-and-retry API errors and worktree-path floods measured in the June 2026 corpus stop appearing in new sessions.',
+   2),
+  ('GDS-V4', 'failed-ship-never-strands',
+   '**A failed ship never strands work.** Drift fails, grade failures, and merge bails leave the task one command from resume — no consumed claims, no reset-and-re-claim dance, no re-running an already-passing grader panel. Done when: a deliberately failed ship is resumed in one command, and claim_consumed_on_fail (which fired in 11 of 11 deep-dived sessions) goes quiet in new sessions.',
+   3),
+  ('GDS-V4', 'machine-room-ergonomics',
+   '**Sessions stop fighting the machine room.** The recurring tool-error classes are engineered away: cross-tree writes guarded, API 404s/409s answer in JSON with a hint instead of an HTML page, laptop sessions stop smoke-testing against a server that isn''t running. Done when: the wrong-path class (84 hits, #1 in the June 2026 corpus) and its siblings drop measurably in new sessions.',
+   4),
+  ('GDS-V4', 'bfg-measures-what-hurts',
+   '**The BFG measures what actually hurts.** The session evaluator''s numbers reflect real friction: ceremony is visible on cache-dominated marathon sessions (today they score ~99% efficient), the wrong-path footgun — the corpus''s #1 error class — is detected, harness guardrail retries stop inflating tool-error counts, and corpus coverage is reconciled. Done when: re-running the friction analysis produces numbers trustworthy enough to judge the other criteria.',
+   5),
+  ('GDS-V4', 'one-pane-of-glass',
+   '**The city watches itself on one pane of glass.** The observability carry-overs land — Grafana dashboards as code, status surface v2 — plus staleness/health visibility for the new search index. Done when: those surfaces are live and the search index cannot silently go stale.',
+   6)
+) AS v(version_id, criterion_id, criterion_md, sort_order)
+WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'GDS-V4')
+ON CONFLICT (version_id, criterion_id) DO UPDATE
+  SET criterion_md = EXCLUDED.criterion_md,
+      sort_order   = EXCLUDED.sort_order;
+
+-- ============================================================================
+-- 3. Re-prefix + re-prioritize the 2 existing open carry-over tasks.
+--    Guarded so re-runs (and already-renamed rows) are no-ops.
+-- ============================================================================
+UPDATE tasks
+SET title = 'V4.R28 — ' || regexp_replace(title, '^V\d+\.R\d+\s*—\s*', ''),
+    priority = 3
+WHERE id = 263 AND version_id = 'GDS-V4' AND title NOT LIKE 'V4.R%';
+
+UPDATE tasks
+SET title = 'V4.R29 — ' || regexp_replace(title, '^V\d+\.R\d+\s*—\s*', ''),
+    priority = 3
+WHERE id = 594 AND version_id = 'GDS-V4' AND title NOT LIKE 'V4.R%';
+
+COMMIT;

package/migrations/instance/110_medusa_planning_seed.sql

@@ -0,0 +1,70 @@
+-- GDS-V4 Medusa Planning Session seed (2026-06-17)
+-- Applied under claim 982 (task 1188 — "V4 — Medusa Planning Session").
+-- Idempotent on re-run.
+--
+-- Adds the "Medusa" scope to GDS-V4: decouple the GDS from the Amazonprimea
+-- game into a standalone, configurable, self-hostable, AGPL open-source,
+-- non-profit, AI-first build platform. Amazonprimea becomes instance 1.
+--
+-- What this migration does:
+--   1. Appends a Medusa clause to versions.GDS-V4 done_when (guarded so it
+--      only appends once).
+--   2. Seeds 2 done_when_criteria rows (C8 + C9) for version_id='GDS-V4'
+--      at sort_order 8 and 9 (after the 7 existing criteria).
+--
+-- Net-new tasks (R50–R73, 24 of them) are created via
+-- scripts/gds/seed-medusa-tasks.js which runs AFTER this migration is applied,
+-- so the positional "C8"/"C9" criterion refs resolve. Same split as the
+-- V4 Planning Session #1 seed (migration 080 + seed-gds-v4-tasks.js).
+--
+-- Locked owner decisions (this session): one project per install (no
+-- multi-tenant project_id retrofit); migrate in place (OTB = instance 1, live
+-- prod never breaks); AGPL-3.0 (anti-monopoly); keep the Greek rank ladder
+-- (xenos<thetes<metic<archon) as the canonical enum (no rename); branding is a
+-- per-instance config layer an owner's own LLM fills; feature-module selection
+-- per instance; self-host canonical, managed hosting an optional later layer;
+-- mobile contribution deferred to a later version; AI-first as a documented
+-- norm (not a technical gate).
+--
+-- Source: 2026-06-17 Medusa decoupling codebase sweep (8-dimension audit +
+-- synthesis + critique).
+
+BEGIN;
+
+-- ============================================================================
+-- 1. Append a Medusa clause to the version-level done_when (once only).
+-- ============================================================================
+UPDATE versions
+SET done_when = done_when ||
+  ' And the build system itself becomes Medusa — a standalone, configurable, self-hostable, AGPL-licensed, non-profit, AI-first platform decoupled from any one project, with Amazonprimea running as its first instance.'
+WHERE id = 'GDS-V4'
+  AND done_when NOT LIKE '%Medusa%';
+
+-- ============================================================================
+-- 2. Seed the 2 Medusa done_when_criteria rows for GDS-V4 (C8 + C9).
+--    UPSERT via ON CONFLICT (version_id, criterion_id).
+--    sort_order 8/9 → positional refs "C8"/"C9" for the seed script.
+-- ============================================================================
+INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
+SELECT * FROM (VALUES
+  ('GDS-V4', 'medusa-standalone-instance',
+   '**Medusa runs as a configurable, self-hostable, branded instance — Amazonprimea is instance 1.** The build system is no longer a fixture of the game: it boots with no game code in the process, runs on its own database, and takes its identity, branding, and feature selection from per-instance config — Amazonprimea becomes instance 1, its surfaces (status/builders) unchanged because their look now comes from config rather than hard-coding. Done when: a Medusa-only entrypoint boots with no Colyseus/Phaser/game routes; a fresh instance''s database holds only build-system tables (game tables only when the game module is enabled); one command (docker compose) stands an instance up with zero hard-coded server IP / service name / deploy script; product name, domain, sign-in origin, repo binding, currency label and the full branding pack resolve from one config with a neutral starter an owner''s own LLM fills; the first admin is set at install time, not in a migration; core carries no hard-coded project branding (the deploy-time diagram generator reads instance branding too; Greek rank names stay by decision); an instance turns feature modules (game, art pipeline, Discord, dev boxes) on/off; an instance declares its core version and `medusa upgrade` applies new migrations + code while preserving instance config; and a second, differently-branded non-game instance is created via a generic init flow and ships one task claim->grade->ship end-to-end. Live Amazonprimea is unaffected throughout.',
+   8),
+  ('GDS-V4', 'medusa-open-and-protected',
+   '**Medusa is open, free, and protected from capture.** The platform is released to the public as open source on a deliberate delay so the live edge stays ahead of would-be cloners, under a license that stops a company from running a closed hosted fork, with non-profit, AI-first governance so it cannot be quietly captured. Done when: an AGPL-3.0 LICENSE ships in the repo; a public mirror repository carries only the publishable subset (the build system — not the game, infra secrets, or trust-boundary internals); an automated pipeline publishes to the mirror on a ~6-month delay with a redaction layer that strips secrets and prod topology even from old commits; GOVERNANCE, CONTRIBUTING, and CODE_OF_CONDUCT define the non-profit, AI-first (AI always writes the code) anti-monopoly stance; and the private<->public lineages stay consistent (migration numbering and enum values do not diverge), verified by a no-leak check on the published mirror.',
+   9)
+) AS v(version_id, criterion_id, criterion_md, sort_order)
+WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'GDS-V4')
+ON CONFLICT (version_id, criterion_id) DO UPDATE
+  SET criterion_md = EXCLUDED.criterion_md,
+      sort_order   = EXCLUDED.sort_order;
+
+-- ============================================================================
+-- 3. Self-register so migrate.sh skips this file on the next deploy (it was
+--    hot-applied via psql under the planning session). ON CONFLICT keeps it
+--    safe if migrate.sh also registers it.
+-- ============================================================================
+INSERT INTO schema_migrations (version) VALUES ('110_medusa_planning_seed')
+ON CONFLICT DO NOTHING;
+
+COMMIT;

package/migrations/instance/120_bongos_v1_planning_seed.sql

@@ -0,0 +1,69 @@
+-- Bongos App — V1 planning seed (2026-06-20)
+-- Owner-directed (archon). Idempotent on re-run.
+--
+-- Creates a NEW version line: BONGOS-V1 — the inaugural version of the "bongos"
+-- platform line. Strategic intent (owner): bongos is the successor to the GDS;
+-- the GDS deprecates after GDS-V4 and its infra/build-out migrates into bongos.
+-- What V1 SHIPS is the Cloud Bongos desktop "Feedback Capture" tool: a Zoom-style
+-- floating toolbar that captures narrated voice + ~1/sec snapshots and freehand
+-- markup over ANY on-screen target, synthesizes them into one cheap, model-agnostic
+-- prompt, and hands it to Claude Desktop + Claude Code. The existing Dev Box
+-- desktop app (ADR 0045) is absorbed as a module of the bongos app (reusing its
+-- Apple cert + distribution pipeline). Visual element-select is deferred to V2.
+--
+-- What this migration does:
+--   1. INSERT the BONGOS-V1 versions row (track=internal, status=planning).
+--   2. Seed 4 done_when_criteria (C1..C4) at sort_order 1..4.
+-- Net-new tasks (R01..R17) are created AFTER this is applied via
+-- scripts/gds/seed-bongos-app-tasks.js, so the positional C1..C4 refs resolve.
+-- (Same split as migration 110 + seed-medusa-tasks.js.)
+
+BEGIN;
+
+-- ============================================================================
+-- 1. Create the BONGOS-V1 version row.
+-- ============================================================================
+INSERT INTO versions (id, name, track, status, scope_doc_path, done_when, started_at)
+VALUES (
+  'BONGOS-V1',
+  'Bongos App — V1',
+  'internal',
+  'planning',
+  'limitations/bongos-v1.md',
+  'Bongos App V1 ships the Cloud Bongos desktop feedback tool: a Zoom-style floating toolbar that captures narrated voice + ~1/sec snapshots and freehand markup over any on-screen target, synthesizes them into one cheap, model-agnostic prompt, and hands it to Claude Desktop and Claude Code. The Dev Box desktop app is absorbed as a module of the bongos app. This is the inaugural version of the bongos line, the successor the GDS migrates into after GDS-V4. Visual element-select is deferred to V2.',
+  now()
+)
+ON CONFLICT (id) DO NOTHING;
+
+-- ============================================================================
+-- 2. Seed the 4 done_when_criteria (C1..C4). UPSERT on (version_id, criterion_id).
+--    sort_order 1..4 -> positional refs C1..C4 for the seed script.
+-- ============================================================================
+INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
+SELECT * FROM (VALUES
+  ('BONGOS-V1', 'signed-installable',
+   '**Signed, installable, and permission-guided on Mac + Windows.** A code-signed, notarized macOS build and a signed Windows build install from a branded download and launch as a floating menu-bar/tray app, reusing the existing Dev Box app distribution + Apple Developer ID; the Dev Box switch is absorbed as a module of the bongos app rather than shipping as a separate install. Done when: the bongos app is one Electron app that contains the prior Dev Box functionality as a module; a signed+notarized Mac build and a signed Windows build install from the branded /downloads redirect and auto-update; a first-run permission wizard detects + deep-links Screen Recording and Microphone grants with live grant-state; and an unsigned dev-build path exists for local iteration.',
+   1),
+  ('BONGOS-V1', 'captures-anywhere',
+   '**Captures narrated feedback over any on-screen target.** The floating toolbar overlays any window (the Zoom annotation model) and records the microphone plus time-aligned ~1/sec snapshots of the chosen target, with freehand/box/arrow/text markup and a freeze-frame, on macOS and Windows. Done when: a transparent, always-on-top, click-through overlay draws over arbitrary other apps (surviving macOS fullscreen/Spaces and Windows multi-monitor DPI); a global hotkey summons/dismisses the bar; Record captures mic + the chosen window/screen at ~1/sec with snapshot-on-change + perceptual dedup + a frame cap; and Markup draws and freezes over any pixels.',
+   2),
+  ('BONGOS-V1', 'cheap-complete-synthesis',
+   '**Synthesizes one cheap, complete, model-agnostic prompt.** The capture is fused into a single LLM-ready bundle at a disciplined token envelope — frames dominate cost, so audio is transcribed on-device to text and frames are deduped + salience-escalated rather than sent 1/sec at full resolution. Done when: on-device transcription (whisper.cpp) yields word-timestamped text; transcript and frames are time-aligned and only transcript/markup-flagged frames escalate to full resolution; a deterministic prompt.md is assembled with inlined absolute image paths; and a typical multi-minute session lands at the disciplined envelope (~5-11k tokens), not the ~70k+ naive cost.',
+   3),
+  ('BONGOS-V1', 'lands-in-claude',
+   '**Lands in Claude — Desktop and Code — reliably and model-agnostically.** The synthesized bundle reaches both Claude surfaces without a fragile step, under a documented contract that works for any agent. Done when: a file-bundle handoff (prompt.md + image files) plus clipboard text works for Claude Desktop; a /feedback path injects the prompt and loads the image paths in Claude Code; an optional local stdio MCP server exposes the latest bundle for a hands-free pull; and an ADR + README document the architecture and the model-agnostic prompt/handoff contract.',
+   4)
+) AS v(version_id, criterion_id, criterion_md, sort_order)
+WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'BONGOS-V1')
+ON CONFLICT (version_id, criterion_id) DO UPDATE
+  SET criterion_md = EXCLUDED.criterion_md,
+      sort_order   = EXCLUDED.sort_order;
+
+-- ============================================================================
+-- 3. Self-register so migrate.sh skips this file on the next deploy (it is
+--    hot-applied via psql under this planning seed).
+-- ============================================================================
+INSERT INTO schema_migrations (version) VALUES ('120_bongos_v1_planning_seed')
+ON CONFLICT DO NOTHING;
+
+COMMIT;

package/migrations/instance/144_bongos_v1_module_system_criterion.sql

@@ -0,0 +1,26 @@
+-- BONGOS-V1 — module-system done-when criterion (C5) — 2026-06-21
+-- Owner-directed (archon), task 1405 (BV1.R36) / ADR 0083.
+--
+-- Adds a 5th done_when_criterion to BONGOS-V1: the project-extensible module
+-- system (the design scoped in docs/design/modular-architecture/, epic #1388 /
+-- BV1.R34). The module-system child tasks are seeded AFTER this is applied via
+-- scripts/gds/seed-bongos-module-system-tasks.js, so the positional ref C5
+-- resolves at task-create. (Same migration+seed split as 120 + seed-bongos-app-tasks.js.)
+--
+-- Idempotent on re-run: UPSERT on (version_id, criterion_id). The companion
+-- migration 120 already seeded C1..C4 (sort_order 1..4); this adds sort_order 5.
+
+BEGIN;
+
+INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
+SELECT * FROM (VALUES
+  ('BONGOS-V1', 'module-system-live',
+   '**The project-extensible module system is live — the whole product is `core + modules`.** Cloud Bongos''s closed four-module registry becomes self-describing packages the platform discovers, validates, and mounts; a host can ADD or CONFIGURE modules without forking core, and the trust boundary (ADR 0016) is ENFORCED across module routes, not trusted. Built as an incremental strangler migration (ADR 0083) — reorganize, not rewrite; single-package, single-process, no-bundler preserved. Done when: (1) `src/module-api.js` is the stable, semver''d doorway and the only core file a module may import; (2) a loader discovers/validates/mounts `modules/*/module.json` behind kernel-composed auth and replaces the hardcoded `KNOWN_MODULES` registry, with a kernel seam registry (ports + events) for cross-module capability; (3) the four feature modules (dev-box, game, discord, art-pipeline) are moved into `modules/<key>/` and the inline `if (isModuleEnabled())` gates are deleted, with OTB behaving byte-identically (the proof); (4) fitness functions fail the build on any boundary violation (core never imports a module, modules import only the published API, every module write-route is rank-gated, core carries no module code, module migrations are additive + namespaced); (5) module-owned migrations generalize the `migrations/game/` precedent to `modules/<key>/migrations/` (enabled-gated apply, disable-preserves-data); (6) `bongos module new <key>` scaffolds a module and `bongos upgrade` pre-checks coreVersion; and (7) docs/modules-contract.md documents the plugin-API contract + a module-author recipe.',
+   5)
+) AS v(version_id, criterion_id, criterion_md, sort_order)
+WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'BONGOS-V1')
+ON CONFLICT (version_id, criterion_id) DO UPDATE
+  SET criterion_md = EXCLUDED.criterion_md,
+      sort_order   = EXCLUDED.sort_order;
+
+COMMIT;

package/migrations/instance/159_bongos_v1_goal_hierarchy_criterion.sql

@@ -0,0 +1,29 @@
+-- BONGOS-V1 — goal-scoped-work-hierarchy done-when criterion (C6) — 2026-06-24
+-- Owner-directed (archon), task 1507 / ADR 0086 (docs/adr/0086-goal-scoped-work-hierarchy.md).
+--
+-- Adds a 6th done_when_criterion to BONGOS-V1: the goal-scoped work hierarchy —
+-- assign module-scoped GOALS, not individual tasks, and let a goal's members
+-- author their own tasks within the goal's module wall, enforced server-side.
+-- A criterion cluster ALONGSIDE the ADR 0083 module work (C5). The build tasks
+-- (BV1.R54..R66, the ADR's Phases 1-4 + a deferred Phase-5 ADR spike + the live
+-- proof) are seeded AFTER this is applied via
+-- scripts/gds/seed-bongos-goal-hierarchy-tasks.js, so the positional ref C6
+-- resolves at task-create (same migration+seed split as 144 + the module seed).
+--
+-- Idempotent on re-run: UPSERT on (version_id, criterion_id). Migrations 120/144
+-- already seeded C1..C5 (sort_order 1..5); this adds sort_order 6.
+
+BEGIN;
+
+INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
+SELECT * FROM (VALUES
+  ('BONGOS-V1', 'goal-scoped-work-hierarchy',
+   '**Builders are assigned module-scoped goals, not individual tasks — and can author their own work within a goal''s wall, enforced server-side.** The owner stops hand-authoring every task; a builder joins a shared, module-scoped goal and gains bounded authority to create + organize tasks beneath it, never exceeding the goal''s module scope or touching the protected core. The six-tier hierarchy (Project → Version → Goal → Criteria → Task → Sub-task) is a per-instance config preset; enforcement is core (ADR 0086, building on ADR 0016/0043/0049/0083/0084). Done when: (1) a module-scope map (`module-scope-map.js`, importing `PROTECTED_GLOBS`) + a configurable hierarchy preset (`config/hierarchy.json` + `hierarchy-config.js`, onboarding-edited) exist; (2) a `goals` tier (shared, joinable, `scope_modules`) sits between versions and criteria, `done_when_criteria` re-parent under goals (backfilled under a per-version default goal), and `tasks` carry `goal_id`, with the `/status` rollup running Version → Goals → Criteria → Tasks; (3) a goal member can author a task via `POST /goals/:id/tasks` only if it is scope-subset + clears the protected-path gate + the auto-derived rank floor, with two fitness checks (goal routes pinned in `route-rank-check`; scope code imports `PROTECTED_GLOBS`) and an abuse-matrix test proving the wall holds; (4) a polymorphic dependency edge spans tasks/goals/criteria and resolves at the existing claim gate, a criterion auto-flags "met — pending review" when its tasks ship, a `/goal-review` cadence (Metic+) confirms → auto-achieves goals, and goals archive/reopen/carry-forward at rescope; and (5) a sub-Metic builder demonstrably authors, claims, and ships a task inside an assigned goal while being BLOCKED server-side from authoring one that touches a protected path outside scope (the live proof). Phase 5 of the ADR (an AI relevance judge + sub-Metic membership inside protected-scope goals) is deferred to its own security-reviewed ADR.',
+   6)
+) AS v(version_id, criterion_id, criterion_md, sort_order)
+WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'BONGOS-V1')
+ON CONFLICT (version_id, criterion_id) DO UPDATE
+  SET criterion_md = EXCLUDED.criterion_md,
+      sort_order   = EXCLUDED.sort_order;
+
+COMMIT;