@bongos/core 1.17.0

package/migrations/instance/172_v2_world_planning_seed.sql

@@ -0,0 +1,163 @@
+-- 172_v2_world_planning_seed.sql
+-- Land Builder #25's world-building planning package (idea_inbox 416-427),
+-- reviewed + adjusted with Lars, folded into the existing product version V2.
+-- Backed by task 1569 (source_ref V2-world-planning-1).
+--
+-- Decisions baked in here:
+--   * World-building folds into V2 — NO new version row.
+--   * The warp stays in V2 (criterion connected-warps + its tasks).
+--   * The in-house map editor (criterion map-editor + 6 tasks) defers to V3.
+--   * Engineering/server lanes are split from design/art lanes (carried by the
+--     per-task module_key + requires_rank set in the companion seed script).
+--
+-- This migration handles DB scope-truth only:
+--   1. 4 goals (3 on V2, 1 on V3)
+--   2. 7 done_when_criteria (6 on V2, 1 on V3), parented to their goals
+--   3. V2 + V3 versions.done_when text
+--   4. +5 karma x7 to builder #25 (the proposer), mirroring ratify
+--   5. idea_inbox bookkeeping (416-424 resolved; 427 left open as the durable
+--      world-expansion reference)
+--
+-- The 16 V2 + 6 V3 + 2 GDS-V4 tasks (with deps + criterion links) are created
+-- by scripts/gds/seed-v2-world-tasks.js, run against the API after this deploys.
+--
+-- Idempotent: goals guarded by NOT EXISTS (version_id,title); criteria via
+-- ON CONFLICT (version_id,criterion_id); karma via NOT EXISTS on a per-idea
+-- reason marker; idea updates are naturally idempotent.
+
+BEGIN;
+
+-- Vanilla-safe guard (task 1264 / hardware-verify R63): everything below seeds
+-- OTB *product* scope-truth (V2/V3 game-world planning). A vanilla Cloud Bongos
+-- instance has no V2/V3 version rows — no migration seeds them (they were created
+-- via the API on the OTB instance) — so each INSERT below would violate the
+-- versions foreign key on a fresh DB. Wrap the seed in a DO block that no-ops
+-- unless the product versions exist. (On the OTB instance this migration is
+-- already recorded in schema_migrations and never re-runs; the guard only bites
+-- on a fresh self-host DB — see docker-compose.yml / self-host.)
+DO $seed$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM versions WHERE id IN ('V2','V3')) THEN
+    RAISE NOTICE '172: V2/V3 product versions absent — vanilla instance, skipping OTB world-planning seed.';
+    RETURN;
+  END IF;
+
+-- ---------------------------------------------------------------------------
+-- 1. Goals (module-scoped workspaces, ADR 0086). created_by = 1 (Archon land).
+-- ---------------------------------------------------------------------------
+INSERT INTO goals (version_id, title, description, scope_modules, status, created_by)
+SELECT 'V2', 'World engine (multi-map runtime)',
+       'File-based maps, depth rendering, and per-map warp rooms. Engineering — touches protected game code (Metic+).',
+       ARRAY['game']::text[], 'open', 1
+WHERE NOT EXISTS (SELECT 1 FROM goals WHERE version_id='V2' AND title='World engine (multi-map runtime)');
+
+INSERT INTO goals (version_id, title, description, scope_modules, status, created_by)
+SELECT 'V2', 'Olympia art set',
+       'Terrain, temple kit, and decor for Olympia on the locked 64-color palette. Design — art pipeline, open to any builder.',
+       ARRAY['art-pipeline']::text[], 'open', 1
+WHERE NOT EXISTS (SELECT 1 FROM goals WHERE version_id='V2' AND title='Olympia art set');
+
+INSERT INTO goals (version_id, title, description, scope_modules, status, created_by)
+SELECT 'V2', 'Olympia vertical slice',
+       'Compose the walkable Olympia map from engine + art, second connected map, and score vs the reference.',
+       ARRAY['game']::text[], 'open', 1
+WHERE NOT EXISTS (SELECT 1 FROM goals WHERE version_id='V2' AND title='Olympia vertical slice');
+
+INSERT INTO goals (version_id, title, description, scope_modules, status, created_by)
+SELECT 'V3', 'Map authoring & editor',
+       'In-house map editor that round-trips maps into the game. Deferred out of V2; depends on the V2 engine shipping first.',
+       ARRAY['game']::text[], 'open', 1
+WHERE NOT EXISTS (SELECT 1 FROM goals WHERE version_id='V3' AND title='Map authoring & editor');
+
+-- ---------------------------------------------------------------------------
+-- 2. done_when_criteria, parented to the goals above. criterion_md text is
+--    lifted verbatim from the ratified proposals (ideas 416-422).
+-- ---------------------------------------------------------------------------
+INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order, goal_id)
+VALUES
+ ('V2', 'world-data',
+  E'**The world loads from per-map data files, not hardcoded arrays — one source feeds both client render and server collision.**\n\n*Why:* retires the hand-mirrored map twins (`public/game/world/map.js` ↔ `src/world/map.js`, today''s top drift risk) and makes hand-designed maps possible.\n\n- A documented JSON map format at `public/assets/maps/<id>.json` with layers: ground (dense, drives autotile), decoration, objects, overlay; plus structures, warps, spawns.\n- A single shared parse + collision module (`mapFormat.js`) used by client and server; no duplicated map data.\n- Collision is *derived* from layers + structure solid-cells (generalizes today''s blocking-terrain / blocking-object rule).\n- ADR 0012 invariant intact: objects never pollute the ground autotile picker.\n- Today''s 26×20 room round-trips through the new format with identical render + walkability.',
+  100, (SELECT id FROM goals WHERE version_id='V2' AND title='World engine (multi-map runtime)')),
+
+ ('V2', 'walk-olympia',
+  E'**A player can walk the Olympia Sanctuary in-game at the fidelity of the reference art.**\n\n*Why:* the vertical slice that proves the whole art + rendering direction before any expansion.\n\n- Temple of Zeus, Temple of Hera, the Altis grove, the plaza, and the stadium frontage are present and recognizable from the reference sheets.\n- The camera follows the player and scrolls a map larger than the viewport (canvas no longer equals map size).\n- Movement stays client-predicted / server-authoritative.\n- The scene is staged on the sandbox and walkable end-to-end.',
+  200, (SELECT id FROM goals WHERE version_id='V2' AND title='Olympia vertical slice')),
+
+ ('V2', 'depth-sort',
+  E'**Tall structures render with correct depth — the player passes behind their tops and in front of their bases.**\n\n*Why:* 3/4-tilt temples, columns, and statues look wrong under today''s flat depth-0/1 layering.\n\n- 2.5D y-sort: player-plane objects and all character sprites share `depth = base*1000 + footY`.\n- An always-above overlay band carries structure tops (column capitals, roof crowns).\n- Reconciled with the existing autotile + interior-tile transform render path.\n- No z-fighting within a single structure''s footprint.',
+  300, (SELECT id FROM goals WHERE version_id='V2' AND title='World engine (multi-map runtime)')),
+
+ ('V2', 'connected-warps',
+  E'**At least two connected maps with working warps — the player crosses between areas server-authoritatively.**\n\n*Why:* the classic Pokémon world model (overworld → enterable complex) the reference implies.\n\n- `mapId` in player state; one Colyseus room instance per map; per-map seating + queue.\n- Warp points move the player between maps at named spawns.\n- The 100-cap becomes per-map (overworld overflow can''t block Olympia).\n- Warping into a full destination map degrades gracefully (queue handoff).',
+  400, (SELECT id FROM goals WHERE version_id='V2' AND title='World engine (multi-map runtime)')),
+
+ ('V2', 'olympia-art-set',
+  E'**The Olympia art set exists and passes the rubric on the locked 64-color palette.**\n\n*Why:* the slice cannot render without the terrain, building, and decor assets.\n\n- Terrain: marble plaza / flagstone, stone & cliff, river / water, forest + palm, grass variants — as autotile families where they tile.\n- Temple building kit: walls, columns / colonnade, orange-tile roof slopes, steps — authored as Pattern-B continuous illustrations sliced to the structure registry.\n- Decor: Zeus / Hera statues, altar-with-fire, amphorae, fountains.\n- All members land in the packed atlas + manifest; `tests/autotile_xverify.mjs` stays green.',
+  500, (SELECT id FROM goals WHERE version_id='V2' AND title='Olympia art set')),
+
+ ('V2', 'scored-vs-reference',
+  E'**The Olympia slice is scored against the reference images, and the reference becomes the durable target.**\n\n*Why:* closes the loop — proves the criterion set actually produced the intended look.\n\n- The four reference sheets are ingested into `art/references/` as the durable target.\n- `otb-design-review` scores the new tiles ≥ the rubric threshold.\n- A before/after writeup lands in `docs/reviews/` with side-by-side screenshots vs the reference.',
+  700, (SELECT id FROM goals WHERE version_id='V2' AND title='Olympia vertical slice')),
+
+ ('V3', 'map-editor',
+  E'**A lightweight in-house map editor lets a builder author maps that round-trip into the game.**\n\n*Why:* hand-editing JSON for scenes the size of Olympia doesn''t scale.\n\n- Paint ground with *live autotile preview* (imports the game''s `terrain.js`/`autotile.js` picker — no new autotile code).\n- Place objects + multi-tile structures; set warps, spawns, collision.\n- Save a valid map file (validated by the same `mapFormat` validator), persisted via the deploy-safe path (branch/PR per the save-model spike).\n- A map authored in the editor loads and plays in the game unchanged.',
+  50, (SELECT id FROM goals WHERE version_id='V3' AND title='Map authoring & editor'))
+ON CONFLICT (version_id, criterion_id) DO UPDATE
+  SET criterion_md = EXCLUDED.criterion_md,
+      sort_order   = EXCLUDED.sort_order,
+      goal_id      = EXCLUDED.goal_id;
+
+-- ---------------------------------------------------------------------------
+-- 3. Version done_when text (broaden V2 to cover the walkable world; note the
+--    editor carry on V3).
+-- ---------------------------------------------------------------------------
+UPDATE versions
+   SET done_when = 'Other players are visible in a real, walkable world: a player walks the Olympia Sanctuary in-game at reference-art fidelity, with file-based multi-layer maps feeding both client render and server collision, correct depth-sorting on tall structures, at least two connected maps with server-authoritative warps, and the Olympia art set passing the rubric on the locked palette.'
+ WHERE id = 'V2';
+
+UPDATE versions
+   SET done_when = COALESCE(done_when, '') ||
+       E'\n\nAlso (folded in from the world-building plan): a lightweight in-house map editor lets a builder author maps that round-trip into the game (depends on the V2 world engine shipping first).'
+ WHERE id = 'V3'
+   AND done_when NOT LIKE '%in-house map editor%';
+
+-- ---------------------------------------------------------------------------
+-- 4. Karma to the proposer (#25), mirroring the ratify path (+5 each, x7).
+--    Guarded per-idea so a re-run can't double-credit.
+-- ---------------------------------------------------------------------------
+INSERT INTO karma_log (builder_id, delta, reason, granted_by)
+SELECT 25, 5, m.reason, 1
+FROM (VALUES
+  ('proposal_ratified:idea-416'),
+  ('proposal_ratified:idea-417'),
+  ('proposal_ratified:idea-418'),
+  ('proposal_ratified:idea-419'),
+  ('proposal_ratified:idea-420'),
+  ('proposal_ratified:idea-421'),
+  ('proposal_ratified:idea-422')
+) AS m(reason)
+WHERE NOT EXISTS (
+  SELECT 1 FROM karma_log k WHERE k.builder_id = 25 AND k.reason = m.reason
+);
+
+-- ---------------------------------------------------------------------------
+-- 5. idea_inbox bookkeeping.
+--    416-422 (criterion proposals) + 424 (the umbrella) -> promoted.
+--    423 (superseded umbrella v1) -> discarded.
+--    427 (reference manifest, future world-scale) -> LEFT OPEN on purpose as
+--        the durable expansion reference; 425/426 are promoted by the seed.
+-- ---------------------------------------------------------------------------
+UPDATE idea_inbox
+   SET status = 'promoted', reviewed_at = now()
+ WHERE id IN (416,417,418,419,420,421,422,424)
+   AND status = 'open';
+
+UPDATE idea_inbox
+   SET status = 'discarded', reviewed_at = now()
+ WHERE id = 423
+   AND status = 'open';
+
+END
+$seed$;
+
+COMMIT;

package/migrations/instance/173_bongos_v1_c7_core_modularized.sql

@@ -0,0 +1,33 @@
+-- 173_bongos_v1_c7_core_modularized.sql
+-- Adds BONGOS-V1 criterion C7 (gds-core-modularized) — the "Config B" core
+-- decomposition wave seeded by planning session 2026-06-26 (task 1567).
+-- The four feature modules (C5) shipped; this criterion owns breaking the GDS
+-- *core* into kernel-mediated modules. Parented under goal 10 (GDS core
+-- modularization). Idempotent on the (version_id, criterion_id) unique key.
+-- Vanilla-safe guard (task 1264 / hardware-verify R63): this criterion parents to
+-- goal id 10 (OTB's "GDS core modularization" goal). Goal ids aren't migration-seeded,
+-- so a fresh self-host DB has no goal #10 and this INSERT would violate the goal_id
+-- foreign key. Skip unless that goal exists. (Already applied on the OTB instance;
+-- guard only bites on a fresh vanilla DB.)
+DO $c7$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM goals WHERE id = 10) THEN
+    RAISE NOTICE '173: goal 10 (GDS core modularization) absent — vanilla instance, skipping BONGOS-V1 C7 criterion seed.';
+    RETURN;
+  END IF;
+
+INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order, goal_id)
+VALUES (
+  'BONGOS-V1',
+  'gds-core-modularized',
+  '**The GDS core is itself decomposed into cohesive, kernel-mediated modules — not just the four feature modules.** A bounded ~3.5k-LOC kernel (auth · rank · pool · audit · trust primitives · loader · seams) is the *only* thing core domains import, through the published doorway; the ~6k-LOC shared `db.js` is carved per-domain so each module owns its SQL; capabilities the lifecycle invokes (grade, reward) resolve through kernel **ports**, never direct imports. **Proven when ≥2 core domains live as modules with their `db.js` slices extracted, the kernel is bounded + fitness-enforced, and OTB behaves byte-identically.** The lifecycle state machine (tasks/claims/versions) is NOT split — only the capabilities it calls are extracted behind seams. (ADR 0083 §"the four module moves" + design doc 02-module-map.md §3/§6; planning 2026-06-26, task 1567.)',
+  7,
+  10
+)
+ON CONFLICT (version_id, criterion_id) DO UPDATE
+  SET criterion_md = EXCLUDED.criterion_md,
+      sort_order  = EXCLUDED.sort_order,
+      goal_id     = EXCLUDED.goal_id;
+
+END
+$c7$;

package/migrations/instance/182_gdsv4_bongos_consolidation.sql

@@ -0,0 +1,132 @@
+-- Migration 182 — Consolidate GDS-V4 into BONGOS-V1 + split out the Bongos desktop app
+-- ============================================================================
+-- Archon-directed project cleanup, 2026-07-02 (task 1709, ADR 0103; with Lars).
+--
+-- GDS-V4 and BONGOS-V1 were two parallel internal / Cloud-Bongos versions with
+-- no clean divide. This migration makes BONGOS-V1 the single go-forward internal
+-- (Cloud Bongos platform) version, carries GDS-V4's still-relevant open work
+-- into it, splits the Bongos DESKTOP APP into its own goal, prunes superseded
+-- work, and freezes GDS-V4.
+--
+-- REVERSIBLE by construction: no destructive drops — only status / version_id /
+-- goal_id / one dependency-edge mutations. The exact before-state is snapshotted
+-- in the task-1709 session notes. See ADR 0103 for the full rationale + the
+-- ADR-0095 (grep-over-embeddings) decision that retires the C1 recall arm.
+--
+-- Idempotency: migrate.sh applies each numbered migration once; the goal INSERT
+-- is additionally NOT-EXISTS-guarded so a manual re-run cannot double-create it.
+-- ============================================================================
+
+BEGIN;
+
+-- 1. Create the "Bongos desktop app" goal under BONGOS-V1 and reparent the app
+--    tasks (mascot/brand, branded download + auto-update, the cloudbongos.com
+--    landing/download page, the feedback-capture app, the absorbed Dev Box
+--    switch). scope_modules stays empty until the code carve (bongos-app/ ->
+--    modules/bongos-app/) creates the module, at which point the goal is scoped
+--    to it. See ADR 0087 (the app absorbs Dev Box).
+DO $$
+DECLARE app_goal_id bigint;
+BEGIN
+  SELECT id INTO app_goal_id
+    FROM goals
+   WHERE version_id = 'BONGOS-V1' AND title = 'Bongos desktop app'
+   LIMIT 1;
+
+  IF app_goal_id IS NULL THEN
+    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
+    VALUES (
+      'BONGOS-V1',
+      'Bongos desktop app',
+      'The Cloud Bongos DESKTOP APP (bongos-app/): a Zoom-style feedback-capture '
+      || 'walkthrough tool that produces one model-agnostic prompt bundle for a coding '
+      || 'agent, and the umbrella app that absorbs the Dev Box switch (ADR 0045/0072/0087). '
+      || 'Distinct from the Cloud Bongos PLATFORM (the GDS engine, modules, grader, hosting). '
+      || 'Covers: mascot/brand (Bongo Buddha), branded download + auto-update, the '
+      || 'cloudbongos.com landing/download page, and the dev-box desktop client. The code '
+      || 'carve bongos-app/ -> modules/bongos-app/ is tracked as a task under this goal.',
+      '{}',
+      1,
+      'open'
+    )
+    RETURNING id INTO app_goal_id;
+  END IF;
+
+  -- App tasks currently in GDS-V4: rebind version AND attach to the app goal.
+  --   1523 interactive mascot · 1294 devbox-app go-live bump ·
+  --   1463 devbox-app build workflow · 1484 dev-box host-key / app re-pin
+  UPDATE tasks
+     SET version_id = 'BONGOS-V1', goal_id = app_goal_id, updated_at = now()
+   WHERE id IN (1523, 1294, 1463, 1484)
+     AND version_id = 'GDS-V4';
+
+  -- App tasks already in BONGOS-V1: attach to the app goal.
+  --   1311 branded download + auto-update · 1682/1700/1701 Bongo Buddha anim ·
+  --   1702 cloudbongos.com landing/download page
+  UPDATE tasks
+     SET goal_id = app_goal_id, updated_at = now()
+   WHERE id IN (1311, 1682, 1700, 1701, 1702)
+     AND version_id = 'BONGOS-V1';
+END $$;
+
+-- 2. Abandon 19 superseded tasks:
+--      C1 recall/embeddings arm (939,962,966-971,1221) — retired by ADR 0095's
+--        grep-over-embeddings decision (Anthropic + Sourcegraph removed embedding
+--        indexes; the endorsed path is meaning-in-source, tracked separately).
+--      Old V3.R## grader tasks (201,202,242,292,388,490,492) — superseded by the
+--        shipped 4-worker grader panel + ADR 0089.
+--      T-NNN task-ref migration (753,754,755) — the current hall-link convention
+--        already works and is enforced.
+UPDATE tasks
+   SET status = 'abandoned', updated_at = now()
+ WHERE id IN (939,962,966,967,968,969,970,971,1221,
+              201,202,242,292,388,490,492,
+              753,754,755)
+   AND version_id = 'GDS-V4'
+   AND status IN ('backlog', 'ready');
+
+-- 3. Sever the 758 -> 753 dependency edge. 753 (T-NNN ADR) is being abandoned;
+--    758 ("document the hall as the canonical doc surface") is kept and must not
+--    be left permanently unclaimable (DEPS_NOT_SHIPPED) by a dead dependency.
+--    Delete from both the polymorphic table (the gate read) and the legacy one.
+DELETE FROM dependencies
+ WHERE from_kind = 'task' AND from_id = 758 AND to_kind = 'task' AND to_id = 753;
+DELETE FROM task_dependencies
+ WHERE task_id = 758 AND depends_on_task_id = 753;
+
+-- 4. Move two misfiled game-art tasks to product V2 (they are world art, not
+--    internal-track work): 586 grass_on_sand variety, 587 player_walk family.
+UPDATE tasks
+   SET version_id = 'V2', updated_at = now()
+ WHERE id IN (586, 587)
+   AND version_id = 'GDS-V4';
+
+-- 5. Carry every remaining NON-TERMINAL GDS-V4 task (the platform work) forward
+--    to BONGOS-V1. Non-terminal = backlog/ready/completed/blocked. This leaves
+--    the in-flight tail (10 confirmed + 1 active) and terminal history
+--    (shipped/abandoned) attributed to GDS-V4, exactly like a normal
+--    version-close carry-over. Runs AFTER steps 1/2/4 so the app / abandoned /
+--    product tasks are already out of scope; self-correcting for the remainder.
+UPDATE tasks
+   SET version_id = 'BONGOS-V1', updated_at = now()
+ WHERE version_id = 'GDS-V4'
+   AND status IN ('backlog', 'ready', 'completed', 'blocked');
+
+-- 6. BONGOS-V1 becomes the single go-forward internal version: rename it off the
+--    misleading "Bongos App" title (the app is now a GOAL inside it, step 1) and
+--    mark it 'building' (it is actively being built).
+UPDATE versions
+   SET name = 'Cloud Bongos — platform (V1)', status = 'building'
+ WHERE id = 'BONGOS-V1';
+
+-- 7. Freeze GDS-V4 — sealed to new planning. Its 11 in-flight tasks land as its
+--    final shipped history; its 358 shipped + 51 abandoned rows stay as the
+--    archive of what GDS-V4 delivered. ('frozen', not 'shipped': GDS-V4 did not
+--    ship — it was absorbed — and 'shipped' would falsely read 100% + could gate
+--    the in-flight tail.)
+UPDATE versions
+   SET status = 'frozen'
+ WHERE id = 'GDS-V4'
+   AND status <> 'shipped';
+
+COMMIT;

package/migrations/instance/183_gdsv4_carryover_themed_goals.sql

@@ -0,0 +1,116 @@
+-- Migration 183 — Five themed goals for the GDS-V4 carryover (BONGOS-V1)
+-- ============================================================================
+-- Follow-up to ADR 0103 (migration 182): the ~72 still-relevant GDS-V4 tasks
+-- carried into BONGOS-V1 were left goal-less. This gives the platform debt a
+-- spine — five OUTCOME goals (ADR 0086 goal tier), each with done-when criteria,
+-- and reparents the tasks under them. Evergreen chores + grader/economy/misc +
+-- recent non-debt work are deliberately LEFT goal-less (they are not carryover
+-- outcomes). Owner-directed 2026-07-02 (with Lars).
+--
+-- Goals are Archon-owned (created_by = 1), scope_modules empty (grouping goals,
+-- not scope-walled; tasks attach here via this migration, not the API route).
+-- Criteria start satisfied=false, so each goal stays 'open' until its work lands.
+--
+-- REVERSIBLE: only INSERTs (goals + criteria) and task goal_id UPDATEs. To undo,
+-- NULL the goal_id on the affected tasks and DELETE the 5 goals + their criteria.
+-- Idempotent: goal INSERTs are title-guarded, criteria use ON CONFLICT DO NOTHING,
+-- task UPDATEs only touch still-goal-less rows.
+-- ============================================================================
+
+BEGIN;
+
+DO $$
+DECLARE gid bigint;
+BEGIN
+  -- ---- G1: Build-pipeline integrity --------------------------------------
+  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Build-pipeline integrity' LIMIT 1;
+  IF gid IS NULL THEN
+    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
+    VALUES ('BONGOS-V1', 'Build-pipeline integrity',
+      'GDS-V4 carryover (ADR 0103): the system that builds Cloud Bongos never fails silently or carries known integrity holes — ship/merge/deploy, CI, the nightly backup, and the SEC-863 deploy-gate.',
+      '{}', 1, 'open')
+    RETURNING id INTO gid;
+  END IF;
+  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
+    ('BONGOS-V1','gcarry-pipe-loud','Every stage of ship->merge->deploy and the nightly DB backup fails LOUDLY (surfaces in CI or journald), never silently.',gid,10),
+    ('BONGOS-V1','gcarry-pipe-sec863','The SEC-863 deploy-gate has no known bypass: audit range anchored to last-successful-deploy, sub-Metic protected-path claims blocked at claim time, and each protected-path commit tied to a task in the main audit.',gid,20),
+    ('BONGOS-V1','gcarry-pipe-smoke','A full-stack integration smoke (server + Postgres) runs as a required PR check, and the flaky unit harness is isolated so a green run is trustworthy.',gid,30)
+  ON CONFLICT (version_id, criterion_id) DO NOTHING;
+  UPDATE tasks SET goal_id=gid, updated_at=now()
+   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
+     AND id IN (1426,1427,1429,1431,1432,1433,1435,1436,1462,1479,1641,1703,1219,861,862,1140,1437,1440,1461,1434,723);
+
+  -- ---- G2: Builder experience — hall, dev box, and skills ----------------
+  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Builder experience — hall, dev box, and skills' LIMIT 1;
+  IF gid IS NULL THEN
+    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
+    VALUES ('BONGOS-V1', 'Builder experience — hall, dev box, and skills',
+      'GDS-V4 carryover (ADR 0103): everything a builder directly touches — the builders hall UI, the dev box + sandbox, and the day-to-day skills — works without needing Claude for routine actions.',
+      '{}', 1, 'open')
+    RETURNING id INTO gid;
+  END IF;
+  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
+    ('BONGOS-V1','gcarry-bx-hall','Core task actions (claim, release, ship-trigger, triage) and a task board work in the builders hall WITHOUT invoking the LLM.',gid,10),
+    ('BONGOS-V1','gcarry-bx-identity','A builder can view and edit their own profile, see works-completed, and read an efficiency-aware leaderboard.',gid,20),
+    ('BONGOS-V1','gcarry-bx-onramp','Newcomers never dead-end: auth/re-auth is browser-clickable and self-explanatory, and the dev box + sandbox are discoverable.',gid,30),
+    ('BONGOS-V1','gcarry-bx-box','A builder dev box + sandbox is robust: uncommitted work is not lost on reclaim, host-keys survive rebuilds, and staging is cross-platform.',gid,40)
+  ON CONFLICT (version_id, criterion_id) DO NOTHING;
+  UPDATE tasks SET goal_id=gid, updated_at=now()
+   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
+     AND id IN (758,751,759,424,1466,1467,1468,1469,1471,1473,1474,1475,1476,1481,1482,594,1472,1715,1696,1650,1470,1391,1165,837,843,885,1477,1493,1430,1665);
+
+  -- ---- G3: Cloud Bongos productization and self-host ---------------------
+  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Cloud Bongos productization and self-host' LIMIT 1;
+  IF gid IS NULL THEN
+    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
+    VALUES ('BONGOS-V1', 'Cloud Bongos productization and self-host',
+      'GDS-V4 carryover (ADR 0103): someone other than the owner can run Cloud Bongos — a second instance, a real update channel, a clean vanilla boot, and hosting as a module.',
+      '{}', 1, 'open')
+    RETURNING id INTO gid;
+  END IF;
+  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
+    ('BONGOS-V1','gcarry-prod-customer2','A second instance (Mercury) runs live on a pinned Cloud Bongos core, with its own repo and GDS.',gid,10),
+    ('BONGOS-V1','gcarry-prod-upgrade','bongos upgrade is a real update-consumption channel for a two-repo consumer (not a stub).',gid,20),
+    ('BONGOS-V1','gcarry-prod-vanilla','A vanilla docker compose up boots clean: no instance/product seed data runs and no host-brand leaks, both gated in CI.',gid,30),
+    ('BONGOS-V1','gcarry-prod-hosting','Instance hosting (provision, manage, cost read-out) is available as a Cloud Bongos module.',gid,40)
+  ON CONFLICT (version_id, criterion_id) DO NOTHING;
+  UPDATE tasks SET goal_id=gid, updated_at=now()
+   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
+     AND id IN (1689,1690,1326,1704,1706,1485,1619,1620,1621,1388,1439);
+
+  -- ---- G4: Findability — the grep path (ADR 0095) ------------------------
+  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Findability — the grep path (ADR 0095)' LIMIT 1;
+  IF gid IS NULL THEN
+    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
+    VALUES ('BONGOS-V1', 'Findability — the grep path (ADR 0095)',
+      'GDS-V4 carryover (ADR 0103 / ADR 0095): a repo agents navigate by literal search, with meaning written into the source rather than an embedding index.',
+      '{}', 1, 'open')
+    RETURNING id INTO gid;
+  END IF;
+  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
+    ('BONGOS-V1','gcarry-find-docstrings','The docstring / module-header convention is rolled out across the codebase and guarded by a fitness/density check so it cannot rot.',gid,10),
+    ('BONGOS-V1','gcarry-find-why','Code rationale (the why) is surfaced forward-facing, and the AST/tree-sitter repo-map upgrade is decided.',gid,20)
+  ON CONFLICT (version_id, criterion_id) DO NOTHING;
+  UPDATE tasks SET goal_id=gid, updated_at=now()
+   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
+     AND id IN (1654,1655,1656,1657,1659,848);
+
+  -- ---- G5: Autonomy groundwork -------------------------------------------
+  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Autonomy groundwork' LIMIT 1;
+  IF gid IS NULL THEN
+    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
+    VALUES ('BONGOS-V1', 'Autonomy groundwork',
+      'GDS-V4 carryover (ADR 0103): safe unattended routines — guardrails first, then arm the safe set.',
+      '{}', 1, 'open')
+    RETURNING id INTO gid;
+  END IF;
+  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
+    ('BONGOS-V1','gcarry-auto-guardrails','An off-droplet spend ceiling, a scoped file-only automation token, and a hall kill-switch all exist.',gid,10),
+    ('BONGOS-V1','gcarry-auto-armed','The cloud-routine execution environment is verified and the safe routine set is armed behind the autonomy flag.',gid,20)
+  ON CONFLICT (version_id, criterion_id) DO NOTHING;
+  UPDATE tasks SET goal_id=gid, updated_at=now()
+   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
+     AND id IN (1393,1394,1395,1396);
+END $$;
+
+COMMIT;

package/migrations/instance/186_bongos_v1_governance_planning_seed.sql

@@ -0,0 +1,69 @@
+-- 186_bongos_v1_governance_planning_seed.sql  (migrations/instance/ — OTB scope-truth)
+-- Planning session (2026-07-03): the BONGOS-V1 "Governance — configurable roles &
+-- permissions" goal + its six done-when criteria.
+--
+-- WHY THIS LIVES IN migrations/instance/ (ADR 0105 / selfhost-boot gate):
+-- versions/goals/done_when_criteria are OTB scope-truth, NOT platform-universal
+-- schema. In migrations/ root they would seed a vanilla third-party self-host with
+-- OTB's governance criteria (the selfhost-boot VANILLA assertion: a fresh DB seeds
+-- ZERO scope-truth). Here, migrate.sh applies the file only when the OWNING instance
+-- opts in (GDS_APPLY_INSTANCE_SEEDS=1); a vanilla self-host skips the whole dir.
+--
+-- DR-SAFE: the goal was first created via the API (a runtime row), so a from-scratch
+-- owning-instance replay would have no goal to parent the criteria under. This
+-- migration recreates the goal idempotently (title-guard) so replay stays whole and
+-- so it is a no-op on prod (where goal 30 already exists). Mirrors migration 183.
+--
+-- The 25 tasks (BV1.R90-R114) + dependency graph are seeded by
+-- scripts/gds/seed-governance-tasks.js after this deploys (so the slugs resolve).
+
+BEGIN;
+
+DO $do$
+DECLARE gid bigint;
+BEGIN
+  SELECT id INTO gid FROM goals
+    WHERE version_id = 'BONGOS-V1'
+      AND title = 'Governance — configurable roles & permissions'
+    LIMIT 1;
+
+  IF gid IS NULL THEN
+    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
+    VALUES (
+      'BONGOS-V1',
+      'Governance — configurable roles & permissions',
+      $desc$A core, Discord-style roles-and-permissions system where PERMISSIONS are the atomic primitive and ranks become seeded roles. Adds first-class principals (machine identities), session-scopes (box tokens), ownership-scoped permissions, and a governance-owned protected-surface registry (policy owns / substrate enforces). Capability lives in core (modules/governance/, default:true); per-project settings split config/governance.json (over neutral) + governance_* DB tables. Ships an Archon-only Governance hall tab (assign + toggle; system permissions locked). Preserves the ADR 0016 trust boundary end-to-end. Protected-scope (kernel/lifecycle) -> Archon-mediated.$desc$,
+      '{kernel,lifecycle,hall-ui}',
+      1,
+      'open'
+    )
+    RETURNING id INTO gid;
+  END IF;
+
+  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
+  ('BONGOS-V1', 'gov-perms-atom',
+   $md$**Permissions become the atom; ranks become seeded roles — with zero day-one behavior change.** Authority stops being a fixed rank threshold and becomes a resolved set of granular permissions. Done when: a code-defined permission catalog exists (each permission flagged `system` or not, since permissions map to real routes and cannot be UI-invented); a per-request, uncached resolver returns a builder's effective permission set as the union of their roles (preserving ADR 0016); four seeded roles (`xenos`/`thetes`/`metic`/`archon`) reproduce today's thresholds exactly; a `requirePermission()` gate exists alongside `requireRank`; and a parity test proves every builder resolves to exactly today's powers (behavior-identical at ship).$md$,
+   gid, 20),
+  ('BONGOS-V1', 'gov-gates-permissioned',
+   $md$**Every DB-resolvable authority gate reads permissions, not rank.** Rank stops being special everywhere the server decides access. Done when: the ~60 HTTP route gates migrate `requireRank(...)` -> `requirePermission(...)`; claim eligibility (`xenosClaimAllowed`/`rankAllowsTask`/per-task floor), the page-level gates, and the wandering-prefs clamp are re-expressed as permissions; the ~6 duplicated numeric rank-tier maps collapse into the single resolver; and the `route-rank-check` fitness function is updated to assert permission gates so nothing silently regresses.$md$,
+   gid, 21),
+  ('BONGOS-V1', 'gov-full-model',
+   $md$**The complete authority model is represented — not just role -> permission.** The 2026-07-03 authority sweep proved Cloud Bongos authority runs on ~7 mechanisms, not one. Done when: first-class **principals** (machine identities like the BFG memory-writer and the Discord bot, keyed on `system_role`, never UI-grantable) are modeled; **session-scopes** (box-scoped tokens, deny-by-default) are a first-class capability distinct from a builder's roles; **ownership-scoped** permissions ("act on *own* X" — own box/memory/credentials/claim) are expressible; and the **protected-surface registry** (today's `PROTECTED_GLOBS` / `EXPECTED_RANKS`) becomes governance-owned *data* while the out-of-band substrate (git hooks, CI, GitHub branch protection, SSH) stays the *enforcer* — policy owns, substrate enforces.$md$,
+   gid, 22),
+  ('BONGOS-V1', 'gov-core-project-split',
+   $md$**Capability lives in core; settings live per project.** The governance engine is portable to any Cloud Bongos instance; each project keeps its own governance data. Done when: `modules/governance/` is a `default:true` core module with its own `governance_*` additive migrations and a resolver exposed through a kernel port; role *templates/defaults* ship as `config/governance.json` resolved over a `config/governance.neutral.json` (the branding pattern); live role/permission/assignment *data* lives in the DB; and a fresh vanilla instance boots with sane neutral defaults and no OTB identity.$md$,
+   gid, 23),
+  ('BONGOS-V1', 'gov-archon-tab',
+   $md$**The Archon Governance tab — assign + toggle.** The owner can configure governance from the builders' hall, Discord-style. Done when: an Archon-only Governance tab lets you view/edit the ~12 operational permissions per role, create custom roles, and assign roles to builders; `system` permissions render **locked** (visible but not grantable); and the tab is gated in depth at the page layer (`serve-internal`), the API layer (`governance.manage`), and pinned in `route-rank-check`.$md$,
+   gid, 24),
+  ('BONGOS-V1', 'gov-boundary-proof',
+   $md$**The trust boundary provably holds — with a live proof and the docs corrected.** This criterion de-risks the whole goal: no amount of governance configuration can weaken production safety. Done when: an abuse-matrix test proves no configurable role/permission can grant a low-trust builder deploy or protected-path access; a live demonstration creates a custom role granting an operational permission (it works) while a `system` permission stays enforced by substrate; an ADR records the "permissions-as-atom + principals + session-scopes + protected-surface registry, policy-owns/substrate-enforces" decision; and the stale ADR 0043 / canonical-permissions.md branch-protection claims are fixed (GitHub branch protection is now live).$md$,
+   gid, 25)
+  ON CONFLICT (version_id, criterion_id) DO UPDATE
+    SET criterion_md = EXCLUDED.criterion_md,
+        goal_id      = EXCLUDED.goal_id,
+        sort_order   = EXCLUDED.sort_order;
+END
+$do$;
+
+COMMIT;

package/modules/autonomy/CLAUDE.md

@@ -0,0 +1,49 @@
+# `autonomy` module — the Multi-Agent System (conductor · architect · gate · routine timers)
+
+> A CORE-domain carve (BV1.R83, [ADR 0093](../../docs/adr/<redacted>.md) §1) — the eighth tranche-2 domain extracted from the GDS core, after sessions (R82). `default: true` — the autonomy machinery + the durable in-process routine timer ship to every instance (both inert/no-op until armed or the pool is reachable), so it mounts unconditionally unless an instance disables it.
+
+Owns the **Multi-Agent System** surfaces ([ADR 0024](../../docs/adr/<redacted>.md)):
+- the **autonomy gate** (System 3, task 1351) — the $0 deterministic precheck that decides go/no-go before any model boots; a precheck HTTP route + the gate CLI, **inert until `OTB_AUTONOMY_ENABLED=1`**;
+- the **routine timers** (System 4 / [ADR 0078](../../docs/adr/<redacted>.md) amendment, task 1382) — the in-process weekly **peer-vote-tally** poller (no model, no external cron);
+- the **Conductor** mid-flight dispatch CLI (Phase 4, task 439) and the **Architect** bounded first-principles `--scope` audit CLI (Phase 5, task 459) — domain commands.
+
+## The boundary (the one rule)
+
+The module's `src/`-scanned files (`db.js`, `pollers/`, `routes/`) reach core **only** through the published doorway `../../src/module-api.js` (`coreVersion ^1.11.0`). They must **never** `require()` a core internal (`../../src/bongos/db`, `../../src/bongos/auth`, …) directly, and **never** another module. Core, in turn, must never `require()` a file in here — the route mount + the timer-start both left `src/bongos/`/`server.js`; the loader (`mountModuleRoutes` + `startModulePollers`) wires them now. Both directions are enforced by the BV1.R44/R45 fitness checks.
+
+## Cross-cutting: it OBSERVES lifecycle (the seams)
+
+This is the cross-cutting domain the carve sequence flagged. Two inbound core→autonomy edges existed; each was inverted so the module is wired, not imported:
+
+1. **The routine timer** (was `routineTimers.start()` in `server.js`) → now a **POLLER** (`contributes.pollers:["routine-timers"]`). The loader's `startModulePollers` requires `pollers/routine-timers.js` and calls `start()` at boot / `stop()` at shutdown — the module-agnostic successor to the hardcoded block (the Discord-bot-poller pattern, BV1.R47). server.js is the only `startModulePollers` caller (not `src/platform-server.js`), so a second always-on instance can't double-run. The timer's work is the lifecycle **`tallyPeerVotes`** capability (the SAME transaction `POST /tasks/peer-votes/tally` runs — route + timer share ONE path), reached through the **doorway** (`api.tallyPeerVotes`, a tracked lifecycle leak — it writes karma_log/peer_votes/tasks, all core-owned; relocates behind a `lifecycle.*` port at R86), never a core require.
+2. **The autonomy precheck route** (was mounted in `src/bongos/routes.js`) → now a **module route** (`contributes.routes:["autonomy"]`, mounted by `mountModuleRoutes`). `GET /autonomy/precheck` (Archon-gated) calls the gate's `precheck`.
+
+## No port (the sessions/memory shape)
+
+Like `sessions`/`memory`, autonomy registers **no kernel port** (`provides: []`) — **core never calls back into it.** The timer is a loader-started poller, the precheck a module route, and the gate/conductor/architect are CLIs. There is nothing for a port to expose. (`consumes: []` too — `tallyPeerVotes` is a doorway export, not a seam port.)
+
+## Files
+
+| File | What |
+|---|---|
+| `db.js` | the `autonomy_runs` db slice — `recordAutonomyRun` (audit each precheck decision) + `lastAutonomyHead` (the stored last-`go` head the no-signal check compares origin/main against). Reaches Postgres through the doorway `pool`. |
+| `pollers/routine-timers.js` | the in-process weekly **peer-vote-tally** timer (the loader's poller entry — `start`/`stop`). `runPeerVoteTally` resolves the lifecycle `tallyPeerVotes` via the doorway; pure w.r.t. injected `deps` (tests pass `deps.db`). Kill-switch `ROUTINE_TIMERS_DISABLED`; unref'd, best-effort. |
+| `routes/autonomy.js` | `GET /autonomy/precheck` (Archon-gated) — the autonomy precheck over HTTP; wraps the gate CLI's `precheck`. Inert (always `go`) until `OTB_AUTONOMY_ENABLED=1`. |
+
+## NOT in this module (the domain CLIs travel with the domain but stay under `scripts/`)
+
+A command travels with its domain but stays a CLI (design 02§1; the sessions/memory precedent). These live under `scripts/gds/` — **outside** the kernel boundary (fitness scans `src/` + `modules/`, not `scripts/`), so they may still read the ideas/economy/lifecycle signals + the grader directly, which a `modules/` file may not:
+
+- **`scripts/gds/autonomy-gate.js`** — the gate CLI (Step 0 of the nightly routines). Its pure decision logic (`decide`, `autofixAllowed`) is `$0`; its `gatherSignals` reads claimable tasks (core db), open ideas (`modules/ideas`), autonomous MTD spend (`modules/economy`), and the autonomy_runs head/record (**this module's `db.js`**). The precheck route + scheduled tasks invoke it.
+- **`scripts/gds/conductor-dispatch.js`** — the Conductor mid-flight dispatch (runs grader specialists on the current diff; reuses `modules/grading/grader` + `src/bongos/sensitive-surfaces` + `src/bongos/path-match`).
+- **`scripts/gds/architect-audit.js`** — the Architect's bounded `--scope` audit → `docs/audits/` + seed ideas (reuses the grader + `src/bongos/llm-cache`).
+- **`scripts/gds/run-routine.js`** — the deterministic-first cron dispatcher (parses a routine's SKILL.md, runs steps at the cheapest sufficient tier).
+- **`.claude/scheduled-tasks/`** — the cron routine SKILL.md files that invoke these CLIs (re-pointed at the moved gate; the scripts they call are unchanged paths).
+
+## Tables (owned, not moved)
+
+`autonomy_runs` (migration 126) was created before the module system and stays in core `migrations/` (the shared-schema additive rule the sessions/onboarding carves established). The module owns the *queries*; any **new** autonomy migration belongs in `modules/autonomy/migrations/` namespaced `autonomy_*`.
+
+## Tests
+
+`tests/autonomy_gate.mjs` (the pure gate decision — DB-free), `tests/routine_timers.mjs` (the peer-vote timer — pure w.r.t. injected deps), `tests/conductor.mjs`, `tests/architect.mjs`, `tests/run_routine.mjs` exercise the CLIs (which import from `scripts/gds/…`). The carve discovery-key membership is asserted in `tests/fitness.mjs` / `tests/module_loader.mjs` / `tests/modules.mjs`; the doorway `tallyPeerVotes` export in `tests/module_api.mjs`.

package/modules/autonomy/db.js

@@ -0,0 +1,50 @@
+'use strict';
+
+// modules/autonomy/db.js — the autonomy_runs db slice (BV1.R83 / ADR 0093 §1).
+//
+// The Multi-Agent System's autonomy gate (System 3, task 1351) records every
+// precheck decision to the `autonomy_runs` table — both as an audit trail and as
+// the source of the "stored last_head" the no-signal check compares origin/main
+// against. These two queries were carved out of the ~5k-LOC src/bongos/db.js
+// monolith alongside the rest of the autonomy/MAS domain (the gate CLI, the
+// conductor/architect CLIs, the routine timer + precheck route).
+//
+// THE BOUNDARY (the one rule): this slice reaches the kernel ONLY through the
+// published doorway `../../src/module-api.js` — the shared `pool`. It must never
+// `require()` a core internal directly, and never another module.
+//
+// The autonomy_runs TABLE (migration 126) was created before the module system
+// and stays in core migrations/ (the shared-schema additive rule the sessions /
+// onboarding carves established — a NEW autonomy migration belongs in
+// modules/autonomy/migrations/ namespaced autonomy_*). The module owns the
+// QUERIES; the schema stays put.
+
+const { pool } = require('../../src/module-api');
+
+// Record one autonomy-precheck decision (audit + the "stored last_head" source).
+async function recordAutonomyRun({ routine, decision, reason = null, headSha = null, claimableCount = null, enabled = false }) {
+  const { rows } = await pool.query(
+    `INSERT INTO autonomy_runs (routine, decision, reason, head_sha, claimable_count, enabled)
+     VALUES ($1, $2, $3, $4, $5, $6)
+     RETURNING id, created_at`,
+    [routine, decision, reason, headSha, claimableCount, enabled === true]
+  );
+  return rows[0] || null;
+}
+
+// The head_sha of this routine's most recent `go` — the baseline the next
+// precheck compares origin/main against ("did anything land since we last ran?").
+async function lastAutonomyHead(routine) {
+  const { rows } = await pool.query(
+    `SELECT head_sha FROM autonomy_runs
+      WHERE routine = $1 AND decision = 'go' AND head_sha IS NOT NULL
+      ORDER BY created_at DESC LIMIT 1`,
+    [routine]
+  );
+  return rows[0]?.head_sha || null;
+}
+
+module.exports = {
+  recordAutonomyRun,
+  lastAutonomyHead,
+};