@bongos/core 1.17.3 → 1.18.0

package/docs/api/openapi.json

@@ -1,7 +1,7 @@
 {
   "openapi": "3.1.0",
   "info": {
-    "title": "Off the Boats — GDS API",
+    "title": "Cloud Bongos — GDS API",
     "version": "0.0.2",
     "license": {
       "name": "AGPL-3.0-or-later",
@@ -77,10 +77,6 @@
       "name": "cost",
       "description": "Endpoints under `/api/bongos/cost`."
     },
-    {
-      "name": "demo",
-      "description": "Endpoints under `/api/bongos/demo`."
-    },
     {
       "name": "dependencies",
       "description": "Endpoints under `/api/bongos/dependencies`."
@@ -3007,83 +3003,6 @@
         ]
       }
     },
-    "/demo/health": {
-      "get": {
-        "operationId": "get_demo_health",
-        "tags": [
-          "demo"
-        ],
-        "summary": "GET /demo/health",
-        "description": "READ — liveness + the core version this module was mounted against. No rank gate beyond the requireBuilder the loader composes around every module route. rank: public\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "modules/demo/routes/demo.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetDemoHealthResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          }
-        },
-        "security": []
-      }
-    },
-    "/demo/ping": {
-      "post": {
-        "operationId": "post_demo_ping",
-        "tags": [
-          "demo"
-        ],
-        "summary": "POST /demo/ping",
-        "description": "WRITE — EVERY module write route MUST be rank-gated (the BV1.R44 fitness check reds the build on an ungated module write route). `requireRank('metic', 'archon')` is Metic-and-above (the route-rank classifier records it as metic+archon). This records a ping into the module's own namespaced table (demo_pings) via the doorway pool.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
-        "x-rank": "metic+archon",
-        "x-source": "modules/demo/routes/demo.js",
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostDemoPingRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostDemoPingResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
     "/dependencies": {
       "post": {
         "operationId": "post_dependencies",
@@ -5475,182 +5394,6 @@
         ]
       }
     },
-    "/me/art-key": {
-      "get": {
-        "operationId": "get_me_art_key",
-        "tags": [
-          "me"
-        ],
-        "summary": "GET /me/art-key",
-        "description": "Shared art key for newcomers (task 1281 / ADR 0068). Hands a SHARED Google AI Studio (Gemini) key to rank=xenos builders so their first art task works without their own key — we pay up front. The session-start sync (scripts/gds/fetch-art-key.js) calls this and writes/removes the local shared_gemini_api_key slot from the response. Thetes+ get a 200 with entitled:false (NOT a 403) — the sync needs an unambiguous \"remove the shared key\" signal it can tell apart from an auth failure, and the rank is the gate, not the route. The secret is attached ONLY when entitled && configured; the response is no-store and the key is never logged. Rank is read live from the DB (no caching, per ADR 0016). rank: any-builder — any authenticated builder may ask; `entitled` in the body is the server-enforced gate. A non-newcomer never receives the secret.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/art-pipeline/routes/art-key.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/me/art-key/own": {
-      "get": {
-        "operationId": "get_me_art_key_own",
-        "tags": [
-          "me"
-        ],
-        "summary": "GET /me/art-key/own",
-        "description": "Masked metadata for the browser: { set, last4, set_at, storage_configured }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/art-pipeline/routes/art-key.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetMeArtKeyOwnResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      },
-      "put": {
-        "operationId": "put_me_art_key_own",
-        "tags": [
-          "me"
-        ],
-        "summary": "PUT /me/art-key/own",
-        "description": "Set or replace the builder's own key. Body: { key }. Validates the key with one cheap call to Google (catches typos), encrypts it, stores it. Returns the masked metadata — never the key.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/art-pipeline/routes/art-key.js",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PutMeArtKeyOwnRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      },
-      "delete": {
-        "operationId": "delete_me_art_key_own",
-        "tags": [
-          "me"
-        ],
-        "summary": "DELETE /me/art-key/own",
-        "description": "Remove the builder's own key (back to \"not set\"). The session-start sync then withdraws the managed local copy on its next run.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/art-pipeline/routes/art-key.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/me/art-key/storage-init": {
-      "post": {
-        "operationId": "post_me_art_key_storage_init",
-        "tags": [
-          "me"
-        ],
-        "summary": "POST /me/art-key/storage-init",
-        "description": "Archon-only: provision the server's secret-box master key so per-builder key storage can turn on (task 1398, blocker 41). Idempotent — NEVER overwrites an existing key. Lives under /me/art-key/* for client locality, but is a server-wide admin action — hence the requireRank('archon') gate.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
-        "x-rank": "archon",
-        "x-source": "modules/art-pipeline/routes/art-key.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostMeArtKeyStorageInitResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
     "/me/disciplines": {
       "patch": {
         "operationId": "patch_me_disciplines",
@@ -10456,21 +10199,6 @@
           "stale_hours"
         ]
       },
-      "GetDemoHealthResponse": {
-        "type": "object",
-        "properties": {
-          "module": {},
-          "ok": {
-            "type": "boolean"
-          },
-          "coreVersion": {}
-        },
-        "required": [
-          "module",
-          "ok",
-          "coreVersion"
-        ]
-      },
       "GetDiscordChannelsPlanResponse": {
         "type": "object",
         "properties": {
@@ -10635,21 +10363,6 @@
           "unlocked"
         ]
       },
-      "GetMeArtKeyOwnResponse": {
-        "type": "object",
-        "properties": {
-          "set": {},
-          "last4": {},
-          "set_at": {},
-          "storage_configured": {}
-        },
-        "required": [
-          "set",
-          "last4",
-          "set_at",
-          "storage_configured"
-        ]
-      },
       "GetMeDisplayNameResponse": {
         "type": "object",
         "properties": {
@@ -12314,30 +12027,6 @@
           "recorded_at": {}
         }
       },
-      "PostDemoPingRequest": {
-        "type": "object",
-        "properties": {
-          "note": {
-            "type": "string"
-          }
-        },
-        "additionalProperties": false
-      },
-      "PostDemoPingResponse": {
-        "type": "object",
-        "properties": {
-          "module": {},
-          "ok": {
-            "type": "boolean"
-          },
-          "ping": {}
-        },
-        "required": [
-          "module",
-          "ok",
-          "ping"
-        ]
-      },
       "PostDependenciesResponse": {
         "type": "object",
         "properties": {
@@ -13048,23 +12737,6 @@
           "linked"
         ]
       },
-      "PostMeArtKeyStorageInitResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "created": {},
-          "reason": {},
-          "storage_configured": {}
-        },
-        "required": [
-          "ok",
-          "created",
-          "reason",
-          "storage_configured"
-        ]
-      },
       "PostMemoryBuildersBuilderIdBfgWriteRequest": {
         "type": "object",
         "properties": {
@@ -13896,19 +13568,6 @@
           "criteria"
         ]
       },
-      "PutMeArtKeyOwnRequest": {
-        "type": "object",
-        "properties": {
-          "key": {
-            "type": "string",
-            "maxLength": 400
-          }
-        },
-        "required": [
-          "key"
-        ],
-        "additionalProperties": false
-      },
       "PutTasksIdDependenciesRequest": {
         "type": "object",
         "properties": {
@@ -14060,9 +13719,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 230,
-  "x-schema-count": 250,
+  "x-endpoint-count": 223,
+  "x-schema-count": 244,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 170,
+  "x-response-schemas": 166,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # GDS API reference
 
-> **Generated from the live route files** — the route file is authoritative. 230 endpoints across 38 route files.
+> **Generated from the live route files** — the route file is authoritative. 223 endpoints across 36 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -145,13 +145,6 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | POST | `/api/bongos/cost` | `any-builder` | `task_id`, `amount_usd`, `category`, `description`, `source`, `source_ref`, `recorded_at`, `fresh_input_usd`, `cache_read_usd`, `cache_write_usd`, `output_usd`, `builder_id`, `skill_name` | log cost on own claim (idempotent via source/source_ref). |
 
-## `demo` (2)
-
-| Method | Path | Rank | Body | Description |
-|---|---|---|---|---|
-| GET | `/api/bongos/demo/health` | `public` | — | READ — liveness + the core version this module was mounted against. |
-| POST | `/api/bongos/demo/ping` | `metic+archon` | `note` | WRITE — EVERY module write route MUST be rank-gated (the BV1.R44 fitness check reds the build on an ungated module write route). |
-
 ## `dependencies` (2)
 
 | Method | Path | Rank | Body | Description |
@@ -220,7 +213,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.example.com hits this anonymously. |
+| GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.amazonprimea.com hits this anonymously. |
 
 ## `inbox` (4)
 
@@ -263,18 +256,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (26)
+## `me` (21)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/me` | `any-builder` | — | PMS-V2 task 188: response now also carries `unlocked` (server-joined achievement metadata) + `locked_with_progress` (server-computed huma… |
 | GET | `/api/bongos/me/achievements` | `any-builder` | — | The builder's unlocked achievements (joined to achievement metadata). |
 | POST | `/api/bongos/me/anthropic-link` | `any-builder` | `anthropic_email`, `anthropic_user_id` | V3.R10 (task 235), criterion C3 — link the authed builder's Anthropic account. |
-| GET | `/api/bongos/me/art-key` | `any-builder` | — | Shared art key for newcomers (task 1281 / ADR 0068). |
-| GET | `/api/bongos/me/art-key/own` | `any-builder` | — | Masked metadata for the browser: { set, last4, set_at, storage_configured }. |
-| PUT | `/api/bongos/me/art-key/own` | `any-builder` | `key` | Set or replace the builder's own key. |
-| DELETE | `/api/bongos/me/art-key/own` | `any-builder` | — | Remove the builder's own key (back to "not set"). |
-| POST | `/api/bongos/me/art-key/storage-init` | `archon` | — | Archon-only: provision the server's secret-box master key so per-builder key storage can turn on (task 1398, blocker 41). |
 | PATCH | `/api/bongos/me/disciplines` | `any-builder` | `preferred_disciplines` | Self-service edit of the authenticated builder's preferred disciplines (migrations 027 + 086 / V3.R80). |
 | GET | `/api/bongos/me/display-name` | `any-builder` | — | Per-builder DISPLAY NAME (task 1669). |
 | PATCH | `/api/bongos/me/display-name` | `any-builder` | _undocumented_ | PATCH the display name. |
@@ -361,7 +349,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/public/repo-info` | `public` | — | GitHub URL bases for the deployed checkout (V3.R13-followup-2 task 411). |
 | GET | `/api/bongos/public/tasks/:id` | `public` | — | Single-task resolver for "#NNN" deep links. |
 | GET | `/api/bongos/public/uptime` | `public` | — | Uptime: current status + 90-day history bucketed by hour. |
-| GET | `/api/bongos/public/versions` | `public` | — | read-only surface for status.example.com. |
+| GET | `/api/bongos/public/versions` | `public` | — | read-only surface for status.amazonprimea.com. |
 
 ## `search` (2)
 
@@ -431,7 +419,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/versions` | `public` | — | read-only version list; mirrors /public/versions. |
 | POST | `/api/bongos/versions` | `archon` | `id`, `name`, `status`, `done_when`, `scope_doc_path`, `criteria` | POST /versions — create a version + its done-when criteria in one call. |
-| GET | `/api/bongos/versions/:id/done-when` | `public` | — | Public: status.example.com fetches this every 60s alongside other public/* surfaces. |
+| GET | `/api/bongos/versions/:id/done-when` | `public` | — | Public: status.amazonprimea.com fetches this every 60s alongside other public/* surfaces. |
 | POST | `/api/bongos/versions/:id/done-when` | `archon` | `criterion_id`, `criterion_md`, `goal_id`, `sort_order` | Auth (Archon): create a done-when criterion at RUNTIME. |
 | GET | `/api/bongos/versions/:id/progress` | `public` | — | Per-criterion progress rollup: each done-when criterion → the tasks that gate it (task_criteria, migration 055) → live statuses → what re… |
 | GET | `/api/bongos/versions/close-suggestions` | `public` | — | Close-flow gate suggestions for every version still 'building'. |

package/docs/file-map.md

@@ -322,7 +322,7 @@ tests/
 ├── builder-backup/SKILL.md        ← /builder-backup — check DB backup status or trigger a fresh local dump before risky changes (migrations, destructive SQL); no SSH required
 ├── builder-box/SKILL.md           ← /builder-box — show the builder their own dev box (state, IP/host, cost, SSH keys) and help them (re)connect
 ├── builder-claim/SKILL.md         ← /builder-claim N — atomic claim; prints the claim-time context pack + discipline playbook routing
-├── builder-connect/SKILL.md       ← /builder-connect — one-command connect of the builder's Claude Desktop to their Example dev box (ADR 0031)
+├── builder-connect/SKILL.md       ← /builder-connect — one-command connect of the builder's Claude Desktop to their Amazonprimea dev box (ADR 0031)
 ├── builder-cost/SKILL.md          ← /builder-cost — log a cost-ledger entry (api|compute|infra|domain|art|other)
 ├── builder-end/SKILL.md           ← /builder-end — safely close out a session: resolve the claim (ship/release) + clean-git verify + worktree teardown + (on a dev box) offer to close the box; the bookend to /builder-start, and the own-scoped session close-out that /builder-exit redirects non-Archons to
 ├── builder-exit/SKILL.md          ← /builder-exit — gracefully offboard (or reactivate) a builder: release claims, seal session logs, drop rank to xenos
@@ -336,20 +336,20 @@ tests/
 ├── builder-start/SKILL.md         ← /builder-start — list claimable tasks (parallel-safe vs active claims)
 ├── close-box/SKILL.md             ← /close-box — tear down the dev box you're working on, from inside the box terminal (POST /box/close)
 ├── design-sync/SKILL.md           ← /design-sync — export repo design tokens + surfaces into Claude Design (token-preview bundle) and land generated UI code back as a GDS task (ADR 0081)
-├── dev/SKILL.md                   ← /dev — engineering-session playbook for engineer-discipline tasks; the default understand→scoped-change→verify→ship loop made explicit ([#1272](https://example.com/builders#/task/1272))
+├── dev/SKILL.md                   ← /dev — engineering-session playbook for engineer-discipline tasks; the default understand→scoped-change→verify→ship loop made explicit ([#1272](https://amazonprimea.com/builders#/task/1272))
 ├── feedback/SKILL.md              ← /feedback — pull the latest Bongos feedback bundle (prompt.md + screenshot file paths) into a Claude Code session; backed by scripts/gds/feedback-latest.js (BV1.R13, ADR 0087)
 ├── figma-design-sync/SKILL.md     ← sync UI-surface tokens/surfaces with Figma (push a frame plan, land a designer's Code Connect / MCP snapshot edit back as code) — the ADR 0081 human escape hatch; distinct from otb-figma-sync's pixel-art tile review (task 2048)
 ├── goal-review/SKILL.md           ← /goal-review — walk the criterion review queue: each auto-flagged 'met — pending review' criterion gets confirm / reject / defer; confirming a goal's last criterion auto-achieves it (ADR 0086 §6); Metic+
 ├── idea-triage/SKILL.md           ← /idea-triage — daily walk through the GDS idea_inbox (promote / discard / merge); Metic+
-├── ideate/SKILL.md                ← /ideate — ideation-session playbook for ideator-discipline tasks; inverts the loop (human drives, Claude is the sounding board) ([#1267](https://example.com/builders#/task/1267))
+├── ideate/SKILL.md                ← /ideate — ideation-session playbook for ideator-discipline tasks; inverts the loop (human drives, Claude is the sounding board) ([#1267](https://amazonprimea.com/builders#/task/1267))
 ├── merge-mode/SKILL.md            ← /merge-mode — manual fallback for the auto-merge: land every confirmed task (merge + smoke + deploy)
-├── new-project/SKILL.md           ← /new-project — the canonical zero-to-live onboarding runbook for a new STANDALONE instance (name+address → init → scaffold → provision → OAuth+verified-secret+sign-in → verify → brand); the CLI + hall wizard are forms over it ([#1981](https://example.com/builders#/task/1981))
+├── new-project/SKILL.md           ← /new-project — the canonical zero-to-live onboarding runbook for a new STANDALONE instance (name+address → init → scaffold → provision → OAuth+verified-secret+sign-in → verify → brand); the CLI + hall wizard are forms over it ([#1981](https://amazonprimea.com/builders#/task/1981))
 ├── otb-character-review/SKILL.md  ← /otb-character-review — score a painterly character ANIMATION (same character / anatomy / pose / smooth motion) — the animation sibling of otb-design-review (ADR 0088)
-├── otb-design-review/SKILL.md     ← /otb-design-review — score a tile against the Example rubric
+├── otb-design-review/SKILL.md     ← /otb-design-review — score a tile against the Amazonprimea rubric
 ├── otb-feedback-capture/SKILL.md  ← /otb-feedback-capture — verbal design feedback → a durable style_guide.md rule
-├── otb-figma-sync/SKILL.md        ← /otb-figma-sync — push tiles into the Example Figma file as a review canvas
+├── otb-figma-sync/SKILL.md        ← /otb-figma-sync — push tiles into the Amazonprimea Figma file as a review canvas
 ├── otb-tile-generate/SKILL.md     ← /otb-tile-generate — run the pixel-art pipeline (generate world tiles/sprites)
-├── paint/SKILL.md                 ← /paint — art-session playbook for artist-discipline tasks; show-first/low-text, drives the otb-* pixel-art pipeline underneath ([#1269](https://example.com/builders#/task/1269))
+├── paint/SKILL.md                 ← /paint — art-session playbook for artist-discipline tasks; show-first/low-text, drives the otb-* pixel-art pipeline underneath ([#1269](https://amazonprimea.com/builders#/task/1269))
 ├── planning-session/SKILL.md      ← /planning-session — run a structured planning session for an upcoming version (set criteria, brainstorm, rank, seed GDS); Metic+
 ├── priority-session/SKILL.md      ← /priority-session — a trusted builder answers plain-speech questions; the answers reweight the idea_inbox + suggest what to build next
 ├── read-session-export/SKILL.md   ← /read-session-export — read a Claude Code /export zip fast (prompts + thinking + tool calls → stdout); reads the existing export, doesn't make one. Backed by scripts/gds/read-session-export.js
@@ -364,24 +364,6 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/scheduled-tasks/
-├── bfg/SKILL.md                       ← (MAS Phase 6, ADR 0026) BFG hygiene + read-the-room + steward routine: doc-vs-reality checks, memory hygiene, cross-builder learning. Read-mostly.
-├── bfg-session-eval/SKILL.md          ← (6D.3, ADR 0027) BFG session-inefficiency evaluator: search the session corpus, deep-dive wasteful sessions (ceremony-vs-work + footguns), file systemic findings. Read-only.
-├── box-dormant-reclaim/SKILL.md       ← (#598/ADR 0031) daily: deprovision dev boxes parked past the dormant threshold (pings the builder). Drives `box.js sweep-dormant --apply`. Control-plane only.
-├── box-idle-suspend/SKILL.md          ← (#598/ADR 0031) every 15 min: snapshot-and-park dev boxes idle past the idle threshold. Drives `box.js sweep-idle --apply`. Control-plane only.
-├── core-update-subscription/SKILL.md  ← (task 2150 / ADR 0136) daily: patch-only auto-upgrade of subscribed consumer instances (config/update-subscriptions.json) via `bongos upgrade --registry` with auto-rollback. Deterministic; opt-in + autonomy-gated (default OFF). Control-plane only.
-├── dep-audit-nightly/SKILL.md         ← autonomous nightly dependency-vulnerability scan on the droplet (`scripts/security/dep-audit.js --report-mode=nightly`) across npm + the devbox app
-├── diagram-drift/SKILL.md             ← belt-and-braces backstop for the onboarding diagrams — all five auto-regenerate on deploy, so this only flags any residual staleness
-├── idea-triage-nightly/SKILL.md       ← nightly autonomous walk of the idea_inbox; promotes high-confidence bugs/cleanups, discards obvious noise, defers ambiguous ideas
-├── main-audit/SKILL.md                ← (SEC #863 / ADR 0043) nightly post-push audit of `main` — flags commits where a sub-Metic builder edited a permission-sensitive surface
-├── newcomer-floor/SKILL.md            ← deterministic on-claim replenisher for the three evergreen newcomer chores (engineer/artist/ideator) — no cron; restocks when one is claimed (task 1168)
-├── newcomer-generator/SKILL.md        ← keep the newcomer_friendly task queue populated (C1) — deterministic generator tops the queue back up to its floor
-├── overnight-builder/SKILL.md         ← (#358) autonomous overnight session-runner: claims the highest-priority autonomous-fit task, works it in a fresh sub-agent, ships, re-polls. Archon-only. Runbook: docs/recipes/overnight-builder.md
-├── overnight-code-review/SKILL.md     ← nightly read-only code review; routes each finding into the idea_inbox (one row per finding; title prefix `[review YYYY-MM-DD]`)
-├── peer-vote-tally/SKILL.md           ← (V3.R25 / #245, C2) weekly tally of builder-on-builder peer votes into karma; folds votes ≥7 days old into karma_log
-├── repo-simplify-sweep/SKILL.md       ← weekly autonomous repo-cleanliness janitor: runs repo-metrics, files dead-code findings to the idea_inbox, auto-fixes the narrow safe class (unused vars/imports)
-├── security-review-weekly/SKILL.md    ← (V3.R69 / #288) autonomous weekly security-state review — surfaces stale vulnerability_reports + other stale-security signals
-├── skill-usage-review/SKILL.md        ← nightly skill-usage feedback loop: aggregates 24h of skill invocations, detects friction (over-invocation, errors), files findings
-└── stale-claim-release/SKILL.md       ← auto-release GDS claims whose session_pulses heartbeat went silent ≥ GDS_STALE_CLAIM_HOURS (default 6h); runs every 15 min on the droplet
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->
 

package/docs/onboarding/diagrams/05-versioning.mmd

@@ -7,21 +7,19 @@ flowchart TB
     POOL --> VERSIONS
     subgraph VERSIONS["Every task inherits its version; role/discipline is the work-type axis"]
         direction TB
-        v_V1["V1 — shipped"]
+        v_V1["V1 — building"]
         v_PMS_V1["PMS-V1 — shipped"]
         v_V1 --> v_PMS_V1
         v_PMS_V2["PMS-V2 — shipped"]
         v_PMS_V1 --> v_PMS_V2
         v_GDS_V3["GDS-V3 — shipped"]
         v_PMS_V2 --> v_GDS_V3
-        v_V2["V2 — planning"]
-        v_GDS_V3 --> v_V2
-        v_V3["V3 — planning"]
-        v_V2 --> v_V3
         v_GDS_V4["GDS-V4 — frozen"]
-        v_V3 --> v_GDS_V4
+        v_GDS_V3 --> v_GDS_V4
         v_BONGOS_V1["BONGOS-V1 — building"]
         v_GDS_V4 --> v_BONGOS_V1
+        v_CB_V1["CB-V1 — building"]
+        v_BONGOS_V1 --> v_CB_V1
     end
     VERSIONS --> CLOSE["Version close — all done_when_criteria satisfied"]
     CLOSE --> ARCHIVE["Archive scope to limitations/*.md; status=shipped"]

package/docs/onboarding/diagrams/assertions.json

@@ -47,7 +47,7 @@
     "versions": [
       {
         "id": "V1",
-        "status": "shipped"
+        "status": "building"
       },
       {
         "id": "PMS-V1",
@@ -61,14 +61,6 @@
         "id": "GDS-V3",
         "status": "shipped"
       },
-      {
-        "id": "V2",
-        "status": "planning"
-      },
-      {
-        "id": "V3",
-        "status": "planning"
-      },
       {
         "id": "GDS-V4",
         "status": "frozen"
@@ -76,6 +68,10 @@
       {
         "id": "BONGOS-V1",
         "status": "building"
+      },
+      {
+        "id": "CB-V1",
+        "status": "building"
       }
     ]
   },

package/modules/hall-ui/public/builders.js

@@ -1886,6 +1886,39 @@
     window.OTBAttention?.refresh();
   }
 
+  // ---- Home "Next up" slice (task 2184) -------------------------------------
+
+  // Fill the top of the "Your work" card with the first two rows of the
+  // claimable queue (server order: priority, then calibrated estimate) so Home
+  // answers "what's my next action". Best-effort: a primer-gated 403, an auth
+  // hiccup, or an empty queue hides the slice — Home never shows an error for
+  // it. Re-runs with every loadAll (SSE nudges keep it current).
+  async function loadNextUp() {
+    const wrap = document.getElementById('home-next');
+    const list = document.getElementById('home-next-list');
+    const subhead = document.getElementById('home-recent-subh');
+    if (!wrap || !list) return;
+    try {
+      const resp = await getJSON(`${API}/tasks/claimable`, { softAuth: true });
+      const rows = (resp && Array.isArray(resp.claimable) ? resp.claimable : []).slice(0, 2);
+      if (!rows.length) { wrap.hidden = true; if (subhead) subhead.hidden = true; return; }
+      const cur = (window.__BRANDING__ && window.__BRANDING__.currency && window.__BRANDING__.currency.label) || 'credits';
+      list.innerHTML = rows.map((t) => {
+        const credits = window.OTBBranding?.taskCreditValue?.(t) ?? t.credits_reward;
+        const mins = t.est_minutes ? ` · ~${escapeHtml(String(t.est_minutes))}m` : '';
+        return `<li class="next-up__item">
+            <a class="next-up__title" href="/task/${encodeURIComponent(t.id)}">${escapeHtml(t.title || `task ${t.id}`)}</a>
+            <span class="next-up__meta">#${escapeHtml(String(t.id))}${mins} · ${fmtNum(credits)} ${escapeHtml(cur)} est.</span>
+          </li>`;
+      }).join('');
+      wrap.hidden = false;
+      if (subhead) subhead.hidden = false;
+    } catch (_) {
+      wrap.hidden = true;
+      if (subhead) subhead.hidden = true;
+    }
+  }
+
   // ---- leaderboard ---------------------------------------------------------
 
   // Locked at 8 for V2 (per limitations/pms-v2.md). Hardcoding here avoids an
@@ -2225,6 +2258,10 @@
     // /me because it spans all builders' work), loaded fire-and-forget so a
     // slow/failed feed can't hold up the rest of the hall.
     loadAcclaimFeed();
+    // task 2184: the Home "Next up" slice — top of the claimable queue, so the
+    // page answers "what's my next action" without a trip to the Work board.
+    // Fire-and-forget; hides itself when the feed is gated (primer 403) or empty.
+    loadNextUp();
 
     // #408: build the sticky nav now that every section has settled its
     // hidden state (welcome → karma → onboarding → security/roster).