@bongos/core 1.17.1 → 1.17.3

package/migrations/instance/018_pms_v3_planning_seed.sql

@@ -1,131 +0,0 @@
--- PMS-V3 Planning Session #1 seed
--- Applied under claim 166 (task 227, V3.R00 — Planning Session #1).
--- Idempotent on re-run.
---
--- What this migration does:
---   1. Updates versions.PMS-V3.done_when to match the 9 criteria
---   2. Seeds 9 done_when_criteria rows for version_id='PMS-V3'
---   3. Renames the 9 existing PMS-V3 tasks with their V3.R## prefix
---      and sets their priorities per the ranking. Existing descriptions
---      are preserved.
---
--- Net-new tasks (81 of them) are created via scripts/pms/seed-v3-tasks.js
--- which runs after this migration is applied. We split because tasks have
--- rich descriptions and the API handles task_kind classification + foreign-
--- key writes more cleanly than a long SQL VALUES list.
-
-BEGIN;
-
--- Short-circuit guard: migration 019 renames versions.id 'PMS-V3' to 'GDS-V3'.
--- If the rename has already happened (or this DB never had PMS-V3 at all),
--- every statement below is a no-op at best and a FK violation at worst.
--- Skip cleanly so a fresh restore + replay doesn't blow up the deploy.
---
--- We use a CTE-style WHERE-EXISTS guard on each statement (no DO block —
--- DO blocks can't short-circuit the rest of the file). The criteria INSERT
--- is wrapped with a SELECT-driven feed so it naturally produces zero rows
--- when PMS-V3 is absent.
-
--- ============================================================================
--- 1. Update versions.PMS-V3.done_when text
--- ============================================================================
-UPDATE versions
-SET done_when = 'When this is finished, multiple trusted builders will work the city in parallel — onboarded in under two hours, ranked into three tiers, shipping under their own credentials with their own karma alongside their drachmae, judged to the same quality bar, proposing scope into the next planning session, parallel-safe under load, gated by server-enforced permissions, cloneable in full with local-first memory that syncs on every ship, and able to earn drachmae by red-teaming a staging mirror of the city''s walls.'
-WHERE id = 'PMS-V3';
-
--- ============================================================================
--- 2. Seed 9 done_when_criteria rows for PMS-V3
---    UPSERT semantics via ON CONFLICT (version_id, criterion_id).
---    Outer WHERE EXISTS makes this a no-op when 019 has already renamed
---    PMS-V3 → GDS-V3 (the FK check would otherwise fail).
--- ============================================================================
-INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
-SELECT * FROM (VALUES
-  ('PMS-V3', 'onboarding-2h',
-   '**Trusted-newcomer onboarding to first shipped task is ≤ 2 hours.** A Metic-tier builder added by Archon today is shipping a real PMS task on `main` within 2 hours, without 1:1 help. Build environment bootstraps from `git clone` + one setup script; docs live outside CLAUDE.md, written for first-time readers; at least one newcomer-friendly task is always open per active version; `/builder-setup` no longer assumes Archon''s machine.',
-   1),
-  ('PMS-V3', 'three-ranks-gate-everything',
-   '**Three ranks exist, and they gate every privileged operation.** Xenos (default for any GitHub-authed person; read-only on public surfaces + ship only explicitly-tagged-open tasks), Metic (Archon-approved; full claim/ship, planning sessions in proposal mode, idea triage, blocker review, priority sessions), Archon (rank promotion, ratification, version close, infra). `builders.rank` enum + middleware on every privileged route + Archon-only promotion/demotion endpoint + rank visible on /builders hall.',
-   2),
-  ('PMS-V3', 'per-builder-credentials',
-   '**Every builder ships under their own credentials, with their own cost and authorship.** Per-builder Gemini key registered during `/builder-setup`; per-builder cost ledger entries; authorship in session_logs/claims/commits is the actual builder, never Archon-as-proxy; soft-cap warning before a builder hits their hard cost ceiling; Anthropic account linking via Claude Code self-verification.',
-   3),
-  ('PMS-V3', 'quality-bar-holds',
-   '**Work shipped by any builder meets the same quality bar Archon''s V2 work did.** Opus-subagent grader replaces the v1 process-audit grader and gates `completed → confirmed`; per-builder × per-kind calibration tightens the bar over time, never loosens; failed confirmations are visible to the builder with actionable feedback written to the learnings table; regressions caught by automation, not by Archon''s eye.',
-   4),
-  ('PMS-V3', 'propose-ratify',
-   '**Trusted builders propose; Archon ratifies; the cadence is structural.** Metics shape what comes next by surfacing proposals, not by writing system state directly. Planning sessions, priority sessions, idea triage, and blocker review are Metic-runnable; proposed criteria/tasks land in `idea_inbox` tagged with the source builder; Archon ratifies during the next planning session, writing them into `done_when_criteria` and `tasks`; nightly skill-usage feedback loop surfaces friction; builder analytics surface "AI dev curve" per builder; PMS-V4''s done-when criteria are mostly authored by Metic proposals captured during V3.',
-   5),
-  ('PMS-V3', 'parallel-safe-under-load',
-   '**N>1 builders work in parallel without colliding on claims, merges, or shared system state.** Claim concurrency is deterministic; merge serialization handles drift; scheduled tasks don''t multiplex per-builder state incorrectly; session-scoped hooks move off per-session onto scheduled timers where appropriate; parallel-safety bugs surfaced during V3 get fixed in V3.',
-   6),
-  ('PMS-V3', 'server-enforced-perms',
-   '**Permissions are enforced server-side; no builder can grant themselves authority by editing local files.** `rank` lives in the database, checked on every privileged request against the DB (no caching, so demotion is effectively instant); skills, hooks, and `.claude/settings.json` cannot grant authority — they can only call into server endpoints that themselves enforce rank; CLAUDE.md and other markdown files describe permissions but are never the source of truth; an ADR documents the trust boundary; a periodic auditor confirms no privileged route is missing a rank check.',
-   7),
-  ('PMS-V3', 'cloneable-local-memory-server-sync',
-   '**The repo, memory system, art pipeline, and methodology are cloneable by any Metic; memory is local-first, server-canonical on ship.** `git clone` is the onboarding path — no Archon-only handoffs beyond rank assignment. No secrets live in the repo (verified). Each builder''s local memory dir syncs to a server-side per-builder store every time a task ships; learnings remain server-canonical. Cloning the repo never exposes another builder''s local memory. Art pipeline runs end-to-end on a fresh checkout with the builder''s own Gemini key.',
-   8),
-  ('PMS-V3', 'security-baseline-plus-red-team',
-   '**The server has production-grade security basics, and Metics earn drachmae by red-teaming it.** Input validation, auth-token hygiene, rate limits on write paths, audit logging on privileged routes, dependency-scan in CI — all green before any non-Archon ships. A staging environment mirrors prod. Any Metic can role-play as an attacker on staging; confirmed vulnerabilities are filed by the discoverer and earn drachmae proportional to severity, auto-confirmed by a subagent reproducing the exploit on staging. Reported vulnerabilities are fixed in V3 unless Archon explicitly defers with an ADR. Observability dashboard (Grafana provisioned-as-code) makes regressions visible.',
-   9)
-) AS v(version_id, criterion_id, criterion_md, sort_order)
-WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'PMS-V3')
-ON CONFLICT (version_id, criterion_id) DO UPDATE
-  SET criterion_md = EXCLUDED.criterion_md,
-      sort_order = EXCLUDED.sort_order;
-
--- ============================================================================
--- 3. Update the 9 existing PMS-V3 task priorities + titles
---    Idempotent guard: only prepend V3.R## prefix when not already there.
---    These UPDATEs are intrinsically safe when PMS-V3 has been renamed:
---    the tasks they reference (by id) may still exist but their version_id
---    is now 'GDS-V3', and the WHERE-clause `id = N AND title NOT LIKE 'V3.R%'`
---    is already idempotent (title prefix was applied on the original run).
--- ============================================================================
-
--- V3.R04 — Builder rank system (Tier 1, P5)
-UPDATE tasks SET priority = 5,
-  title = 'V3.R04 — ' || title
-WHERE id = 106 AND title NOT LIKE 'V3.R%';
-
--- V3.R10 — Per-builder Gemini API key (Tier 1, P5)
-UPDATE tasks SET priority = 5,
-  title = 'V3.R10 — ' || title
-WHERE id = 91 AND title NOT LIKE 'V3.R%';
-
--- V3.R15 — Seamless builder onboarding umbrella (Tier 1, P5)
-UPDATE tasks SET priority = 5,
-  title = 'V3.R15 — ' || title
-WHERE id = 222 AND title NOT LIKE 'V3.R%';
-
--- V3.R18 — Replace v1 grader with Opus subagent (Tier 2, P5)
-UPDATE tasks SET priority = 5,
-  title = 'V3.R18 — ' || title
-WHERE id = 209 AND title NOT LIKE 'V3.R%';
-
--- V3.R19 — Subagent grader v1 (Tier 2, P5)
-UPDATE tasks SET priority = 5,
-  title = 'V3.R19 — ' || title
-WHERE id = 201 AND title NOT LIKE 'V3.R%';
-
--- V3.R20 — Grader calibration + per-builder × per-kind (Tier 2, P5)
-UPDATE tasks SET priority = 5,
-  title = 'V3.R20 — ' || title
-WHERE id = 202 AND title NOT LIKE 'V3.R%';
-
--- V3.R21 — Auto-flip confirmed→shipped on merge (Tier 2, P5)
-UPDATE tasks SET priority = 5,
-  title = 'V3.R21 — ' || title
-WHERE id = 98 AND title NOT LIKE 'V3.R%';
-
--- V3.R46 — version-close.js refusal bug fix (Tier 4, P4)
-UPDATE tasks SET priority = 4,
-  title = 'V3.R46 — ' || title
-WHERE id = 224 AND title NOT LIKE 'V3.R%';
-
--- V3.R47 — chat-inbox triage off per-session hook (Tier 4, P4)
-UPDATE tasks SET priority = 4,
-  title = 'V3.R47 — ' || title
-WHERE id = 220 AND title NOT LIKE 'V3.R%';
-
-COMMIT;

package/migrations/instance/080_gds_v4_planning_seed.sql

@@ -1,75 +0,0 @@
--- GDS-V4 Planning Session #1 seed
--- Applied under claim 742 (task 937, V4.R00 — Planning Session #1).
--- Idempotent on re-run.
---
--- What this migration does:
---   1. Updates versions.GDS-V4 name + done_when to match the 6 criteria
---   2. Seeds 6 done_when_criteria rows for version_id='GDS-V4'
---   3. Renames the 2 existing open GDS-V4 carry-over tasks (263, 594) with
---      their V4.R## prefix and sets their priorities per the ranking.
---      Existing descriptions are preserved.
---
--- Net-new tasks (38 of them) are created via scripts/gds/seed-gds-v4-tasks.js
--- which runs after this migration is applied (same split as the V3 planning
--- seed, migration 018: tasks have rich descriptions + dependency wiring that
--- the API handles more cleanly than a long SQL VALUES list).
---
--- Source research: 2026-06-12 retrieval-layer architecture report + BFG
--- session-corpus friction mining (1,349 session_records; ceremony +
--- failed-tool-use taxonomies).
-
-BEGIN;
-
--- ============================================================================
--- 1. Version name + done_when text
--- ============================================================================
-UPDATE versions
-SET name = 'GDS V4 — recall, resumable pipeline, honest measurement',
-    done_when = 'When this is finished, a builder''s session answers "have we done this before?" in one call instead of an afternoon — project knowledge (markdown and database prose alike) is searchable in one rank-scoped query and pushed into sessions at claim time; a failed ship is one command from resume instead of a consumed claim; the recurring tool-error classes (wrong-tree writes, HTML 404s, phantom smoke servers) are engineered away; the BFG''s measurements reflect real friction so the improvement is provable against the 2026-06-12 baseline; and the city watches itself on one pane of glass.'
-WHERE id = 'GDS-V4';
-
--- ============================================================================
--- 2. Seed 6 done_when_criteria rows for GDS-V4
---    UPSERT semantics via ON CONFLICT (version_id, criterion_id).
--- ============================================================================
-INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
-SELECT * FROM (VALUES
-  ('GDS-V4', 'one-call-recall',
-   '**Project knowledge is answerable in one call.** Any builder session — laptop, dev box, or browser — can ask one question and get back the relevant ADRs, recipes, session logs, learnings, ideas, and task notes, including the database prose nothing can search today. Done when: lexical search is live over repo markdown + DB prose; results are rank- and owner-scoped (Xenos never sees permission-core content; nobody sees another builder''s memory); every result cites its source so the agent can follow up; and a golden-question set mined from real sessions scores ≥80% recall@5 — whether plain text-search or embeddings gets there is decided by measurement, not taste.',
-   1),
-  ('GDS-V4', 'sessions-start-knowing',
-   '**Sessions start knowing, not hunting.** What a session needs to act correctly is pushed at claim time instead of rediscovered: its worktree root, the claims it holds, the GDS API path prefix and field enums, OS environment facts, the next free ADR/migration number, and the top recall hits for the claimed task. Done when: the guess-and-retry API errors and worktree-path floods measured in the June 2026 corpus stop appearing in new sessions.',
-   2),
-  ('GDS-V4', 'failed-ship-never-strands',
-   '**A failed ship never strands work.** Drift fails, grade failures, and merge bails leave the task one command from resume — no consumed claims, no reset-and-re-claim dance, no re-running an already-passing grader panel. Done when: a deliberately failed ship is resumed in one command, and claim_consumed_on_fail (which fired in 11 of 11 deep-dived sessions) goes quiet in new sessions.',
-   3),
-  ('GDS-V4', 'machine-room-ergonomics',
-   '**Sessions stop fighting the machine room.** The recurring tool-error classes are engineered away: cross-tree writes guarded, API 404s/409s answer in JSON with a hint instead of an HTML page, laptop sessions stop smoke-testing against a server that isn''t running. Done when: the wrong-path class (84 hits, #1 in the June 2026 corpus) and its siblings drop measurably in new sessions.',
-   4),
-  ('GDS-V4', 'bfg-measures-what-hurts',
-   '**The BFG measures what actually hurts.** The session evaluator''s numbers reflect real friction: ceremony is visible on cache-dominated marathon sessions (today they score ~99% efficient), the wrong-path footgun — the corpus''s #1 error class — is detected, harness guardrail retries stop inflating tool-error counts, and corpus coverage is reconciled. Done when: re-running the friction analysis produces numbers trustworthy enough to judge the other criteria.',
-   5),
-  ('GDS-V4', 'one-pane-of-glass',
-   '**The city watches itself on one pane of glass.** The observability carry-overs land — Grafana dashboards as code, status surface v2 — plus staleness/health visibility for the new search index. Done when: those surfaces are live and the search index cannot silently go stale.',
-   6)
-) AS v(version_id, criterion_id, criterion_md, sort_order)
-WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'GDS-V4')
-ON CONFLICT (version_id, criterion_id) DO UPDATE
-  SET criterion_md = EXCLUDED.criterion_md,
-      sort_order   = EXCLUDED.sort_order;
-
--- ============================================================================
--- 3. Re-prefix + re-prioritize the 2 existing open carry-over tasks.
---    Guarded so re-runs (and already-renamed rows) are no-ops.
--- ============================================================================
-UPDATE tasks
-SET title = 'V4.R28 — ' || regexp_replace(title, '^V\d+\.R\d+\s*—\s*', ''),
-    priority = 3
-WHERE id = 263 AND version_id = 'GDS-V4' AND title NOT LIKE 'V4.R%';
-
-UPDATE tasks
-SET title = 'V4.R29 — ' || regexp_replace(title, '^V\d+\.R\d+\s*—\s*', ''),
-    priority = 3
-WHERE id = 594 AND version_id = 'GDS-V4' AND title NOT LIKE 'V4.R%';
-
-COMMIT;

package/migrations/instance/110_medusa_planning_seed.sql

@@ -1,70 +0,0 @@
--- GDS-V4 Medusa Planning Session seed (2026-06-17)
--- Applied under claim 982 (task 1188 — "V4 — Medusa Planning Session").
--- Idempotent on re-run.
---
--- Adds the "Medusa" scope to GDS-V4: decouple the GDS from the Amazonprimea
--- game into a standalone, configurable, self-hostable, AGPL open-source,
--- non-profit, AI-first build platform. Amazonprimea becomes instance 1.
---
--- What this migration does:
---   1. Appends a Medusa clause to versions.GDS-V4 done_when (guarded so it
---      only appends once).
---   2. Seeds 2 done_when_criteria rows (C8 + C9) for version_id='GDS-V4'
---      at sort_order 8 and 9 (after the 7 existing criteria).
---
--- Net-new tasks (R50–R73, 24 of them) are created via
--- scripts/gds/seed-medusa-tasks.js which runs AFTER this migration is applied,
--- so the positional "C8"/"C9" criterion refs resolve. Same split as the
--- V4 Planning Session #1 seed (migration 080 + seed-gds-v4-tasks.js).
---
--- Locked owner decisions (this session): one project per install (no
--- multi-tenant project_id retrofit); migrate in place (OTB = instance 1, live
--- prod never breaks); AGPL-3.0 (anti-monopoly); keep the Greek rank ladder
--- (xenos<thetes<metic<archon) as the canonical enum (no rename); branding is a
--- per-instance config layer an owner's own LLM fills; feature-module selection
--- per instance; self-host canonical, managed hosting an optional later layer;
--- mobile contribution deferred to a later version; AI-first as a documented
--- norm (not a technical gate).
---
--- Source: 2026-06-17 Medusa decoupling codebase sweep (8-dimension audit +
--- synthesis + critique).
-
-BEGIN;
-
--- ============================================================================
--- 1. Append a Medusa clause to the version-level done_when (once only).
--- ============================================================================
-UPDATE versions
-SET done_when = done_when ||
-  ' And the build system itself becomes Medusa — a standalone, configurable, self-hostable, AGPL-licensed, non-profit, AI-first platform decoupled from any one project, with Amazonprimea running as its first instance.'
-WHERE id = 'GDS-V4'
-  AND done_when NOT LIKE '%Medusa%';
-
--- ============================================================================
--- 2. Seed the 2 Medusa done_when_criteria rows for GDS-V4 (C8 + C9).
---    UPSERT via ON CONFLICT (version_id, criterion_id).
---    sort_order 8/9 → positional refs "C8"/"C9" for the seed script.
--- ============================================================================
-INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
-SELECT * FROM (VALUES
-  ('GDS-V4', 'medusa-standalone-instance',
-   '**Medusa runs as a configurable, self-hostable, branded instance — Amazonprimea is instance 1.** The build system is no longer a fixture of the game: it boots with no game code in the process, runs on its own database, and takes its identity, branding, and feature selection from per-instance config — Amazonprimea becomes instance 1, its surfaces (status/builders) unchanged because their look now comes from config rather than hard-coding. Done when: a Medusa-only entrypoint boots with no Colyseus/Phaser/game routes; a fresh instance''s database holds only build-system tables (game tables only when the game module is enabled); one command (docker compose) stands an instance up with zero hard-coded server IP / service name / deploy script; product name, domain, sign-in origin, repo binding, currency label and the full branding pack resolve from one config with a neutral starter an owner''s own LLM fills; the first admin is set at install time, not in a migration; core carries no hard-coded project branding (the deploy-time diagram generator reads instance branding too; Greek rank names stay by decision); an instance turns feature modules (game, art pipeline, Discord, dev boxes) on/off; an instance declares its core version and `medusa upgrade` applies new migrations + code while preserving instance config; and a second, differently-branded non-game instance is created via a generic init flow and ships one task claim->grade->ship end-to-end. Live Amazonprimea is unaffected throughout.',
-   8),
-  ('GDS-V4', 'medusa-open-and-protected',
-   '**Medusa is open, free, and protected from capture.** The platform is released to the public as open source on a deliberate delay so the live edge stays ahead of would-be cloners, under a license that stops a company from running a closed hosted fork, with non-profit, AI-first governance so it cannot be quietly captured. Done when: an AGPL-3.0 LICENSE ships in the repo; a public mirror repository carries only the publishable subset (the build system — not the game, infra secrets, or trust-boundary internals); an automated pipeline publishes to the mirror on a ~6-month delay with a redaction layer that strips secrets and prod topology even from old commits; GOVERNANCE, CONTRIBUTING, and CODE_OF_CONDUCT define the non-profit, AI-first (AI always writes the code) anti-monopoly stance; and the private<->public lineages stay consistent (migration numbering and enum values do not diverge), verified by a no-leak check on the published mirror.',
-   9)
-) AS v(version_id, criterion_id, criterion_md, sort_order)
-WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'GDS-V4')
-ON CONFLICT (version_id, criterion_id) DO UPDATE
-  SET criterion_md = EXCLUDED.criterion_md,
-      sort_order   = EXCLUDED.sort_order;
-
--- ============================================================================
--- 3. Self-register so migrate.sh skips this file on the next deploy (it was
---    hot-applied via psql under the planning session). ON CONFLICT keeps it
---    safe if migrate.sh also registers it.
--- ============================================================================
-INSERT INTO schema_migrations (version) VALUES ('110_medusa_planning_seed')
-ON CONFLICT DO NOTHING;
-
-COMMIT;

package/migrations/instance/120_bongos_v1_planning_seed.sql

@@ -1,69 +0,0 @@
--- Bongos App — V1 planning seed (2026-06-20)
--- Owner-directed (archon). Idempotent on re-run.
---
--- Creates a NEW version line: BONGOS-V1 — the inaugural version of the "bongos"
--- platform line. Strategic intent (owner): bongos is the successor to the GDS;
--- the GDS deprecates after GDS-V4 and its infra/build-out migrates into bongos.
--- What V1 SHIPS is the Cloud Bongos desktop "Feedback Capture" tool: a Zoom-style
--- floating toolbar that captures narrated voice + ~1/sec snapshots and freehand
--- markup over ANY on-screen target, synthesizes them into one cheap, model-agnostic
--- prompt, and hands it to Claude Desktop + Claude Code. The existing Dev Box
--- desktop app (ADR 0045) is absorbed as a module of the bongos app (reusing its
--- Apple cert + distribution pipeline). Visual element-select is deferred to V2.
---
--- What this migration does:
---   1. INSERT the BONGOS-V1 versions row (track=internal, status=planning).
---   2. Seed 4 done_when_criteria (C1..C4) at sort_order 1..4.
--- Net-new tasks (R01..R17) are created AFTER this is applied via
--- scripts/gds/seed-bongos-app-tasks.js, so the positional C1..C4 refs resolve.
--- (Same split as migration 110 + seed-medusa-tasks.js.)
-
-BEGIN;
-
--- ============================================================================
--- 1. Create the BONGOS-V1 version row.
--- ============================================================================
-INSERT INTO versions (id, name, track, status, scope_doc_path, done_when, started_at)
-VALUES (
-  'BONGOS-V1',
-  'Bongos App — V1',
-  'internal',
-  'planning',
-  'limitations/bongos-v1.md',
-  'Bongos App V1 ships the Cloud Bongos desktop feedback tool: a Zoom-style floating toolbar that captures narrated voice + ~1/sec snapshots and freehand markup over any on-screen target, synthesizes them into one cheap, model-agnostic prompt, and hands it to Claude Desktop and Claude Code. The Dev Box desktop app is absorbed as a module of the bongos app. This is the inaugural version of the bongos line, the successor the GDS migrates into after GDS-V4. Visual element-select is deferred to V2.',
-  now()
-)
-ON CONFLICT (id) DO NOTHING;
-
--- ============================================================================
--- 2. Seed the 4 done_when_criteria (C1..C4). UPSERT on (version_id, criterion_id).
---    sort_order 1..4 -> positional refs C1..C4 for the seed script.
--- ============================================================================
-INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
-SELECT * FROM (VALUES
-  ('BONGOS-V1', 'signed-installable',
-   '**Signed, installable, and permission-guided on Mac + Windows.** A code-signed, notarized macOS build and a signed Windows build install from a branded download and launch as a floating menu-bar/tray app, reusing the existing Dev Box app distribution + Apple Developer ID; the Dev Box switch is absorbed as a module of the bongos app rather than shipping as a separate install. Done when: the bongos app is one Electron app that contains the prior Dev Box functionality as a module; a signed+notarized Mac build and a signed Windows build install from the branded /downloads redirect and auto-update; a first-run permission wizard detects + deep-links Screen Recording and Microphone grants with live grant-state; and an unsigned dev-build path exists for local iteration.',
-   1),
-  ('BONGOS-V1', 'captures-anywhere',
-   '**Captures narrated feedback over any on-screen target.** The floating toolbar overlays any window (the Zoom annotation model) and records the microphone plus time-aligned ~1/sec snapshots of the chosen target, with freehand/box/arrow/text markup and a freeze-frame, on macOS and Windows. Done when: a transparent, always-on-top, click-through overlay draws over arbitrary other apps (surviving macOS fullscreen/Spaces and Windows multi-monitor DPI); a global hotkey summons/dismisses the bar; Record captures mic + the chosen window/screen at ~1/sec with snapshot-on-change + perceptual dedup + a frame cap; and Markup draws and freezes over any pixels.',
-   2),
-  ('BONGOS-V1', 'cheap-complete-synthesis',
-   '**Synthesizes one cheap, complete, model-agnostic prompt.** The capture is fused into a single LLM-ready bundle at a disciplined token envelope — frames dominate cost, so audio is transcribed on-device to text and frames are deduped + salience-escalated rather than sent 1/sec at full resolution. Done when: on-device transcription (whisper.cpp) yields word-timestamped text; transcript and frames are time-aligned and only transcript/markup-flagged frames escalate to full resolution; a deterministic prompt.md is assembled with inlined absolute image paths; and a typical multi-minute session lands at the disciplined envelope (~5-11k tokens), not the ~70k+ naive cost.',
-   3),
-  ('BONGOS-V1', 'lands-in-claude',
-   '**Lands in Claude — Desktop and Code — reliably and model-agnostically.** The synthesized bundle reaches both Claude surfaces without a fragile step, under a documented contract that works for any agent. Done when: a file-bundle handoff (prompt.md + image files) plus clipboard text works for Claude Desktop; a /feedback path injects the prompt and loads the image paths in Claude Code; an optional local stdio MCP server exposes the latest bundle for a hands-free pull; and an ADR + README document the architecture and the model-agnostic prompt/handoff contract.',
-   4)
-) AS v(version_id, criterion_id, criterion_md, sort_order)
-WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'BONGOS-V1')
-ON CONFLICT (version_id, criterion_id) DO UPDATE
-  SET criterion_md = EXCLUDED.criterion_md,
-      sort_order   = EXCLUDED.sort_order;
-
--- ============================================================================
--- 3. Self-register so migrate.sh skips this file on the next deploy (it is
---    hot-applied via psql under this planning seed).
--- ============================================================================
-INSERT INTO schema_migrations (version) VALUES ('120_bongos_v1_planning_seed')
-ON CONFLICT DO NOTHING;
-
-COMMIT;

package/migrations/instance/144_bongos_v1_module_system_criterion.sql

@@ -1,26 +0,0 @@
--- BONGOS-V1 — module-system done-when criterion (C5) — 2026-06-21
--- Owner-directed (archon), task 1405 (BV1.R36) / ADR 0083.
---
--- Adds a 5th done_when_criterion to BONGOS-V1: the project-extensible module
--- system (the design scoped in docs/design/modular-architecture/, epic #1388 /
--- BV1.R34). The module-system child tasks are seeded AFTER this is applied via
--- scripts/gds/seed-bongos-module-system-tasks.js, so the positional ref C5
--- resolves at task-create. (Same migration+seed split as 120 + seed-bongos-app-tasks.js.)
---
--- Idempotent on re-run: UPSERT on (version_id, criterion_id). The companion
--- migration 120 already seeded C1..C4 (sort_order 1..4); this adds sort_order 5.
-
-BEGIN;
-
-INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
-SELECT * FROM (VALUES
-  ('BONGOS-V1', 'module-system-live',
-   '**The project-extensible module system is live — the whole product is `core + modules`.** Cloud Bongos''s closed four-module registry becomes self-describing packages the platform discovers, validates, and mounts; a host can ADD or CONFIGURE modules without forking core, and the trust boundary (ADR 0016) is ENFORCED across module routes, not trusted. Built as an incremental strangler migration (ADR 0083) — reorganize, not rewrite; single-package, single-process, no-bundler preserved. Done when: (1) `src/module-api.js` is the stable, semver''d doorway and the only core file a module may import; (2) a loader discovers/validates/mounts `modules/*/module.json` behind kernel-composed auth and replaces the hardcoded `KNOWN_MODULES` registry, with a kernel seam registry (ports + events) for cross-module capability; (3) the four feature modules (dev-box, game, discord, art-pipeline) are moved into `modules/<key>/` and the inline `if (isModuleEnabled())` gates are deleted, with OTB behaving byte-identically (the proof); (4) fitness functions fail the build on any boundary violation (core never imports a module, modules import only the published API, every module write-route is rank-gated, core carries no module code, module migrations are additive + namespaced); (5) module-owned migrations generalize the `migrations/game/` precedent to `modules/<key>/migrations/` (enabled-gated apply, disable-preserves-data); (6) `bongos module new <key>` scaffolds a module and `bongos upgrade` pre-checks coreVersion; and (7) docs/modules-contract.md documents the plugin-API contract + a module-author recipe.',
-   5)
-) AS v(version_id, criterion_id, criterion_md, sort_order)
-WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'BONGOS-V1')
-ON CONFLICT (version_id, criterion_id) DO UPDATE
-  SET criterion_md = EXCLUDED.criterion_md,
-      sort_order   = EXCLUDED.sort_order;
-
-COMMIT;

package/migrations/instance/159_bongos_v1_goal_hierarchy_criterion.sql

@@ -1,29 +0,0 @@
--- BONGOS-V1 — goal-scoped-work-hierarchy done-when criterion (C6) — 2026-06-24
--- Owner-directed (archon), task 1507 / ADR 0086 (docs/adr/0086-goal-scoped-work-hierarchy.md).
---
--- Adds a 6th done_when_criterion to BONGOS-V1: the goal-scoped work hierarchy —
--- assign module-scoped GOALS, not individual tasks, and let a goal's members
--- author their own tasks within the goal's module wall, enforced server-side.
--- A criterion cluster ALONGSIDE the ADR 0083 module work (C5). The build tasks
--- (BV1.R54..R66, the ADR's Phases 1-4 + a deferred Phase-5 ADR spike + the live
--- proof) are seeded AFTER this is applied via
--- scripts/gds/seed-bongos-goal-hierarchy-tasks.js, so the positional ref C6
--- resolves at task-create (same migration+seed split as 144 + the module seed).
---
--- Idempotent on re-run: UPSERT on (version_id, criterion_id). Migrations 120/144
--- already seeded C1..C5 (sort_order 1..5); this adds sort_order 6.
-
-BEGIN;
-
-INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order)
-SELECT * FROM (VALUES
-  ('BONGOS-V1', 'goal-scoped-work-hierarchy',
-   '**Builders are assigned module-scoped goals, not individual tasks — and can author their own work within a goal''s wall, enforced server-side.** The owner stops hand-authoring every task; a builder joins a shared, module-scoped goal and gains bounded authority to create + organize tasks beneath it, never exceeding the goal''s module scope or touching the protected core. The six-tier hierarchy (Project → Version → Goal → Criteria → Task → Sub-task) is a per-instance config preset; enforcement is core (ADR 0086, building on ADR 0016/0043/0049/0083/0084). Done when: (1) a module-scope map (`module-scope-map.js`, importing `PROTECTED_GLOBS`) + a configurable hierarchy preset (`config/hierarchy.json` + `hierarchy-config.js`, onboarding-edited) exist; (2) a `goals` tier (shared, joinable, `scope_modules`) sits between versions and criteria, `done_when_criteria` re-parent under goals (backfilled under a per-version default goal), and `tasks` carry `goal_id`, with the `/status` rollup running Version → Goals → Criteria → Tasks; (3) a goal member can author a task via `POST /goals/:id/tasks` only if it is scope-subset + clears the protected-path gate + the auto-derived rank floor, with two fitness checks (goal routes pinned in `route-rank-check`; scope code imports `PROTECTED_GLOBS`) and an abuse-matrix test proving the wall holds; (4) a polymorphic dependency edge spans tasks/goals/criteria and resolves at the existing claim gate, a criterion auto-flags "met — pending review" when its tasks ship, a `/goal-review` cadence (Metic+) confirms → auto-achieves goals, and goals archive/reopen/carry-forward at rescope; and (5) a sub-Metic builder demonstrably authors, claims, and ships a task inside an assigned goal while being BLOCKED server-side from authoring one that touches a protected path outside scope (the live proof). Phase 5 of the ADR (an AI relevance judge + sub-Metic membership inside protected-scope goals) is deferred to its own security-reviewed ADR.',
-   6)
-) AS v(version_id, criterion_id, criterion_md, sort_order)
-WHERE EXISTS (SELECT 1 FROM versions WHERE id = 'BONGOS-V1')
-ON CONFLICT (version_id, criterion_id) DO UPDATE
-  SET criterion_md = EXCLUDED.criterion_md,
-      sort_order   = EXCLUDED.sort_order;
-
-COMMIT;

package/migrations/instance/172_v2_world_planning_seed.sql

@@ -1,163 +0,0 @@
--- 172_v2_world_planning_seed.sql
--- Land Builder #25's world-building planning package (idea_inbox 416-427),
--- reviewed + adjusted with Lars, folded into the existing product version V2.
--- Backed by task 1569 (source_ref V2-world-planning-1).
---
--- Decisions baked in here:
---   * World-building folds into V2 — NO new version row.
---   * The warp stays in V2 (criterion connected-warps + its tasks).
---   * The in-house map editor (criterion map-editor + 6 tasks) defers to V3.
---   * Engineering/server lanes are split from design/art lanes (carried by the
---     per-task module_key + requires_rank set in the companion seed script).
---
--- This migration handles DB scope-truth only:
---   1. 4 goals (3 on V2, 1 on V3)
---   2. 7 done_when_criteria (6 on V2, 1 on V3), parented to their goals
---   3. V2 + V3 versions.done_when text
---   4. +5 karma x7 to builder #25 (the proposer), mirroring ratify
---   5. idea_inbox bookkeeping (416-424 resolved; 427 left open as the durable
---      world-expansion reference)
---
--- The 16 V2 + 6 V3 + 2 GDS-V4 tasks (with deps + criterion links) are created
--- by scripts/gds/seed-v2-world-tasks.js, run against the API after this deploys.
---
--- Idempotent: goals guarded by NOT EXISTS (version_id,title); criteria via
--- ON CONFLICT (version_id,criterion_id); karma via NOT EXISTS on a per-idea
--- reason marker; idea updates are naturally idempotent.
-
-BEGIN;
-
--- Vanilla-safe guard (task 1264 / hardware-verify R63): everything below seeds
--- OTB *product* scope-truth (V2/V3 game-world planning). A vanilla Cloud Bongos
--- instance has no V2/V3 version rows — no migration seeds them (they were created
--- via the API on the OTB instance) — so each INSERT below would violate the
--- versions foreign key on a fresh DB. Wrap the seed in a DO block that no-ops
--- unless the product versions exist. (On the OTB instance this migration is
--- already recorded in schema_migrations and never re-runs; the guard only bites
--- on a fresh self-host DB — see docker-compose.yml / self-host.)
-DO $seed$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM versions WHERE id IN ('V2','V3')) THEN
-    RAISE NOTICE '172: V2/V3 product versions absent — vanilla instance, skipping OTB world-planning seed.';
-    RETURN;
-  END IF;
-
--- ---------------------------------------------------------------------------
--- 1. Goals (module-scoped workspaces, ADR 0086). created_by = 1 (Archon land).
--- ---------------------------------------------------------------------------
-INSERT INTO goals (version_id, title, description, scope_modules, status, created_by)
-SELECT 'V2', 'World engine (multi-map runtime)',
-       'File-based maps, depth rendering, and per-map warp rooms. Engineering — touches protected game code (Metic+).',
-       ARRAY['game']::text[], 'open', 1
-WHERE NOT EXISTS (SELECT 1 FROM goals WHERE version_id='V2' AND title='World engine (multi-map runtime)');
-
-INSERT INTO goals (version_id, title, description, scope_modules, status, created_by)
-SELECT 'V2', 'Olympia art set',
-       'Terrain, temple kit, and decor for Olympia on the locked 64-color palette. Design — art pipeline, open to any builder.',
-       ARRAY['art-pipeline']::text[], 'open', 1
-WHERE NOT EXISTS (SELECT 1 FROM goals WHERE version_id='V2' AND title='Olympia art set');
-
-INSERT INTO goals (version_id, title, description, scope_modules, status, created_by)
-SELECT 'V2', 'Olympia vertical slice',
-       'Compose the walkable Olympia map from engine + art, second connected map, and score vs the reference.',
-       ARRAY['game']::text[], 'open', 1
-WHERE NOT EXISTS (SELECT 1 FROM goals WHERE version_id='V2' AND title='Olympia vertical slice');
-
-INSERT INTO goals (version_id, title, description, scope_modules, status, created_by)
-SELECT 'V3', 'Map authoring & editor',
-       'In-house map editor that round-trips maps into the game. Deferred out of V2; depends on the V2 engine shipping first.',
-       ARRAY['game']::text[], 'open', 1
-WHERE NOT EXISTS (SELECT 1 FROM goals WHERE version_id='V3' AND title='Map authoring & editor');
-
--- ---------------------------------------------------------------------------
--- 2. done_when_criteria, parented to the goals above. criterion_md text is
---    lifted verbatim from the ratified proposals (ideas 416-422).
--- ---------------------------------------------------------------------------
-INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order, goal_id)
-VALUES
- ('V2', 'world-data',
-  E'**The world loads from per-map data files, not hardcoded arrays — one source feeds both client render and server collision.**\n\n*Why:* retires the hand-mirrored map twins (`public/game/world/map.js` ↔ `src/world/map.js`, today''s top drift risk) and makes hand-designed maps possible.\n\n- A documented JSON map format at `public/assets/maps/<id>.json` with layers: ground (dense, drives autotile), decoration, objects, overlay; plus structures, warps, spawns.\n- A single shared parse + collision module (`mapFormat.js`) used by client and server; no duplicated map data.\n- Collision is *derived* from layers + structure solid-cells (generalizes today''s blocking-terrain / blocking-object rule).\n- ADR 0012 invariant intact: objects never pollute the ground autotile picker.\n- Today''s 26×20 room round-trips through the new format with identical render + walkability.',
-  100, (SELECT id FROM goals WHERE version_id='V2' AND title='World engine (multi-map runtime)')),
-
- ('V2', 'walk-olympia',
-  E'**A player can walk the Olympia Sanctuary in-game at the fidelity of the reference art.**\n\n*Why:* the vertical slice that proves the whole art + rendering direction before any expansion.\n\n- Temple of Zeus, Temple of Hera, the Altis grove, the plaza, and the stadium frontage are present and recognizable from the reference sheets.\n- The camera follows the player and scrolls a map larger than the viewport (canvas no longer equals map size).\n- Movement stays client-predicted / server-authoritative.\n- The scene is staged on the sandbox and walkable end-to-end.',
-  200, (SELECT id FROM goals WHERE version_id='V2' AND title='Olympia vertical slice')),
-
- ('V2', 'depth-sort',
-  E'**Tall structures render with correct depth — the player passes behind their tops and in front of their bases.**\n\n*Why:* 3/4-tilt temples, columns, and statues look wrong under today''s flat depth-0/1 layering.\n\n- 2.5D y-sort: player-plane objects and all character sprites share `depth = base*1000 + footY`.\n- An always-above overlay band carries structure tops (column capitals, roof crowns).\n- Reconciled with the existing autotile + interior-tile transform render path.\n- No z-fighting within a single structure''s footprint.',
-  300, (SELECT id FROM goals WHERE version_id='V2' AND title='World engine (multi-map runtime)')),
-
- ('V2', 'connected-warps',
-  E'**At least two connected maps with working warps — the player crosses between areas server-authoritatively.**\n\n*Why:* the classic Pokémon world model (overworld → enterable complex) the reference implies.\n\n- `mapId` in player state; one Colyseus room instance per map; per-map seating + queue.\n- Warp points move the player between maps at named spawns.\n- The 100-cap becomes per-map (overworld overflow can''t block Olympia).\n- Warping into a full destination map degrades gracefully (queue handoff).',
-  400, (SELECT id FROM goals WHERE version_id='V2' AND title='World engine (multi-map runtime)')),
-
- ('V2', 'olympia-art-set',
-  E'**The Olympia art set exists and passes the rubric on the locked 64-color palette.**\n\n*Why:* the slice cannot render without the terrain, building, and decor assets.\n\n- Terrain: marble plaza / flagstone, stone & cliff, river / water, forest + palm, grass variants — as autotile families where they tile.\n- Temple building kit: walls, columns / colonnade, orange-tile roof slopes, steps — authored as Pattern-B continuous illustrations sliced to the structure registry.\n- Decor: Zeus / Hera statues, altar-with-fire, amphorae, fountains.\n- All members land in the packed atlas + manifest; `tests/autotile_xverify.mjs` stays green.',
-  500, (SELECT id FROM goals WHERE version_id='V2' AND title='Olympia art set')),
-
- ('V2', 'scored-vs-reference',
-  E'**The Olympia slice is scored against the reference images, and the reference becomes the durable target.**\n\n*Why:* closes the loop — proves the criterion set actually produced the intended look.\n\n- The four reference sheets are ingested into `art/references/` as the durable target.\n- `otb-design-review` scores the new tiles ≥ the rubric threshold.\n- A before/after writeup lands in `docs/reviews/` with side-by-side screenshots vs the reference.',
-  700, (SELECT id FROM goals WHERE version_id='V2' AND title='Olympia vertical slice')),
-
- ('V3', 'map-editor',
-  E'**A lightweight in-house map editor lets a builder author maps that round-trip into the game.**\n\n*Why:* hand-editing JSON for scenes the size of Olympia doesn''t scale.\n\n- Paint ground with *live autotile preview* (imports the game''s `terrain.js`/`autotile.js` picker — no new autotile code).\n- Place objects + multi-tile structures; set warps, spawns, collision.\n- Save a valid map file (validated by the same `mapFormat` validator), persisted via the deploy-safe path (branch/PR per the save-model spike).\n- A map authored in the editor loads and plays in the game unchanged.',
-  50, (SELECT id FROM goals WHERE version_id='V3' AND title='Map authoring & editor'))
-ON CONFLICT (version_id, criterion_id) DO UPDATE
-  SET criterion_md = EXCLUDED.criterion_md,
-      sort_order   = EXCLUDED.sort_order,
-      goal_id      = EXCLUDED.goal_id;
-
--- ---------------------------------------------------------------------------
--- 3. Version done_when text (broaden V2 to cover the walkable world; note the
---    editor carry on V3).
--- ---------------------------------------------------------------------------
-UPDATE versions
-   SET done_when = 'Other players are visible in a real, walkable world: a player walks the Olympia Sanctuary in-game at reference-art fidelity, with file-based multi-layer maps feeding both client render and server collision, correct depth-sorting on tall structures, at least two connected maps with server-authoritative warps, and the Olympia art set passing the rubric on the locked palette.'
- WHERE id = 'V2';
-
-UPDATE versions
-   SET done_when = COALESCE(done_when, '') ||
-       E'\n\nAlso (folded in from the world-building plan): a lightweight in-house map editor lets a builder author maps that round-trip into the game (depends on the V2 world engine shipping first).'
- WHERE id = 'V3'
-   AND done_when NOT LIKE '%in-house map editor%';
-
--- ---------------------------------------------------------------------------
--- 4. Karma to the proposer (#25), mirroring the ratify path (+5 each, x7).
---    Guarded per-idea so a re-run can't double-credit.
--- ---------------------------------------------------------------------------
-INSERT INTO karma_log (builder_id, delta, reason, granted_by)
-SELECT 25, 5, m.reason, 1
-FROM (VALUES
-  ('proposal_ratified:idea-416'),
-  ('proposal_ratified:idea-417'),
-  ('proposal_ratified:idea-418'),
-  ('proposal_ratified:idea-419'),
-  ('proposal_ratified:idea-420'),
-  ('proposal_ratified:idea-421'),
-  ('proposal_ratified:idea-422')
-) AS m(reason)
-WHERE NOT EXISTS (
-  SELECT 1 FROM karma_log k WHERE k.builder_id = 25 AND k.reason = m.reason
-);
-
--- ---------------------------------------------------------------------------
--- 5. idea_inbox bookkeeping.
---    416-422 (criterion proposals) + 424 (the umbrella) -> promoted.
---    423 (superseded umbrella v1) -> discarded.
---    427 (reference manifest, future world-scale) -> LEFT OPEN on purpose as
---        the durable expansion reference; 425/426 are promoted by the seed.
--- ---------------------------------------------------------------------------
-UPDATE idea_inbox
-   SET status = 'promoted', reviewed_at = now()
- WHERE id IN (416,417,418,419,420,421,422,424)
-   AND status = 'open';
-
-UPDATE idea_inbox
-   SET status = 'discarded', reviewed_at = now()
- WHERE id = 423
-   AND status = 'open';
-
-END
-$seed$;
-
-COMMIT;

package/migrations/instance/173_bongos_v1_c7_core_modularized.sql

@@ -1,33 +0,0 @@
--- 173_bongos_v1_c7_core_modularized.sql
--- Adds BONGOS-V1 criterion C7 (gds-core-modularized) — the "Config B" core
--- decomposition wave seeded by planning session 2026-06-26 (task 1567).
--- The four feature modules (C5) shipped; this criterion owns breaking the GDS
--- *core* into kernel-mediated modules. Parented under goal 10 (GDS core
--- modularization). Idempotent on the (version_id, criterion_id) unique key.
--- Vanilla-safe guard (task 1264 / hardware-verify R63): this criterion parents to
--- goal id 10 (OTB's "GDS core modularization" goal). Goal ids aren't migration-seeded,
--- so a fresh self-host DB has no goal #10 and this INSERT would violate the goal_id
--- foreign key. Skip unless that goal exists. (Already applied on the OTB instance;
--- guard only bites on a fresh vanilla DB.)
-DO $c7$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM goals WHERE id = 10) THEN
-    RAISE NOTICE '173: goal 10 (GDS core modularization) absent — vanilla instance, skipping BONGOS-V1 C7 criterion seed.';
-    RETURN;
-  END IF;
-
-INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order, goal_id)
-VALUES (
-  'BONGOS-V1',
-  'gds-core-modularized',
-  '**The GDS core is itself decomposed into cohesive, kernel-mediated modules — not just the four feature modules.** A bounded ~3.5k-LOC kernel (auth · rank · pool · audit · trust primitives · loader · seams) is the *only* thing core domains import, through the published doorway; the ~6k-LOC shared `db.js` is carved per-domain so each module owns its SQL; capabilities the lifecycle invokes (grade, reward) resolve through kernel **ports**, never direct imports. **Proven when ≥2 core domains live as modules with their `db.js` slices extracted, the kernel is bounded + fitness-enforced, and OTB behaves byte-identically.** The lifecycle state machine (tasks/claims/versions) is NOT split — only the capabilities it calls are extracted behind seams. (ADR 0083 §"the four module moves" + design doc 02-module-map.md §3/§6; planning 2026-06-26, task 1567.)',
-  7,
-  10
-)
-ON CONFLICT (version_id, criterion_id) DO UPDATE
-  SET criterion_md = EXCLUDED.criterion_md,
-      sort_order  = EXCLUDED.sort_order,
-      goal_id     = EXCLUDED.goal_id;
-
-END
-$c7$;