@bongos/core 1.17.3 → 1.18.3

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # GDS API reference
 
-> **Generated from the live route files** — the route file is authoritative. 230 endpoints across 38 route files.
+> **Generated from the live route files** — the route file is authoritative. 245 endpoints across 41 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -34,7 +34,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/audit-log` | `archon` | — | GET /api/gds/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
 
-## `auth` (15)
+## `auth` (16)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -43,6 +43,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/auth/app-pair/poll` | `public` | `poll_token` | poll with the secret poll_token; the token IS the bearer (mirrors /auth/device/poll, where the device_code is the bearer). |
 | POST | `/api/bongos/auth/app-pair/start` | `public` | `device_name`, `platform` | starts a pairing; returns opaque codes only, no identity. |
 | POST | `/api/bongos/auth/cli-token/issue` | `any-builder` | — | POST /auth/cli-token/issue — V3.R91 / task 401. |
+| POST | `/api/bongos/auth/device/exchange` | `public` | `assertion` | POST /auth/device/exchange — CLI federation (ADR 0141 §1). |
 | POST | `/api/bongos/auth/device/poll` | `public` | `device_code` | auth flow; the device code itself is the bearer. |
 | POST | `/api/bongos/auth/device/start` | `public` | — | /auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization. |
 | GET | `/api/bongos/auth/discord/callback` | `any-builder` | — | completes the link to the caller's own identity. |
@@ -145,13 +146,6 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | POST | `/api/bongos/cost` | `any-builder` | `task_id`, `amount_usd`, `category`, `description`, `source`, `source_ref`, `recorded_at`, `fresh_input_usd`, `cache_read_usd`, `cache_write_usd`, `output_usd`, `builder_id`, `skill_name` | log cost on own claim (idempotent via source/source_ref). |
 
-## `demo` (2)
-
-| Method | Path | Rank | Body | Description |
-|---|---|---|---|---|
-| GET | `/api/bongos/demo/health` | `public` | — | READ — liveness + the core version this module was mounted against. |
-| POST | `/api/bongos/demo/ping` | `metic+archon` | `note` | WRITE — EVERY module write route MUST be rank-gated (the BV1.R44 fitness check reds the build on an ungated module write route). |
-
 ## `dependencies` (2)
 
 | Method | Path | Rank | Body | Description |
@@ -181,6 +175,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/gate-approvals` | `archon` | — | GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. |
 | POST | `/api/bongos/gate-approvals/:pr/approve` | `archon` | — | POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and re-run the gate-review check so it clears. |
 
+## `github` (2)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/github/repos` | `any-builder` | — | acts only on the caller's OWN GitHub identity (the token they granted). |
+| POST | `/api/bongos/github/repos` | `any-builder` | `name` | creates a repo in the caller's OWN account. |
+
 ## `goals` (24)
 
 | Method | Path | Rank | Body | Description |
@@ -263,18 +264,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (26)
+## `me` (21)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/me` | `any-builder` | — | PMS-V2 task 188: response now also carries `unlocked` (server-joined achievement metadata) + `locked_with_progress` (server-computed huma… |
 | GET | `/api/bongos/me/achievements` | `any-builder` | — | The builder's unlocked achievements (joined to achievement metadata). |
 | POST | `/api/bongos/me/anthropic-link` | `any-builder` | `anthropic_email`, `anthropic_user_id` | V3.R10 (task 235), criterion C3 — link the authed builder's Anthropic account. |
-| GET | `/api/bongos/me/art-key` | `any-builder` | — | Shared art key for newcomers (task 1281 / ADR 0068). |
-| GET | `/api/bongos/me/art-key/own` | `any-builder` | — | Masked metadata for the browser: { set, last4, set_at, storage_configured }. |
-| PUT | `/api/bongos/me/art-key/own` | `any-builder` | `key` | Set or replace the builder's own key. |
-| DELETE | `/api/bongos/me/art-key/own` | `any-builder` | — | Remove the builder's own key (back to "not set"). |
-| POST | `/api/bongos/me/art-key/storage-init` | `archon` | — | Archon-only: provision the server's secret-box master key so per-builder key storage can turn on (task 1398, blocker 41). |
 | PATCH | `/api/bongos/me/disciplines` | `any-builder` | `preferred_disciplines` | Self-service edit of the authenticated builder's preferred disciplines (migrations 027 + 086 / V3.R80). |
 | GET | `/api/bongos/me/display-name` | `any-builder` | — | Per-builder DISPLAY NAME (task 1669). |
 | PATCH | `/api/bongos/me/display-name` | `any-builder` | _undocumented_ | PATCH the display name. |
@@ -315,6 +311,17 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/modules/:key/submit` | `metic+archon` | `signed_by` | POST /api/gds/modules/:key/submit — ADR 0107 §1 upstreaming submission. |
 | GET | `/api/bongos/modules/submissions` | `metic+archon` | — | GET /api/gds/modules/submissions?status=&module_key= — the upstreaming review queue (task 1771 reads this). |
 
+## `my-projects` (6)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/my-projects` | `any-builder` | — | the caller's OWN cross-project memberships (own data). |
+| POST | `/api/bongos/my-projects/:clientId/leave` | `any-builder` | — | leave a project from the caller's OWN membership list. |
+| GET | `/api/bongos/my-projects/invites` | `any-builder` | — | the caller's OWN pending invitations (ADR 0141 §5). |
+| POST | `/api/bongos/my-projects/invites/:clientId/accept` | `any-builder` | — | accept an invite (pending → builder) for the caller's OWN account. |
+| POST | `/api/bongos/my-projects/invites/:clientId/decline` | `any-builder` | — | decline an invite (delete the pending row) for the caller's OWN account. |
+| POST | `/api/bongos/my-projects/join` | `any-builder` | `origin` | request to join a project. |
+
 ## `override-requests` (2)
 
 | Method | Path | Rank | Body | Description |
@@ -322,6 +329,16 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/override-requests` | `archon` | — | GET /override-requests?status=open — Archon queue. |
 | POST | `/api/bongos/override-requests/:id/decide` | `archon` | `decision`, `note` | POST /override-requests/:id/decide — body: { decision: 'approve'\|'deny', note? } On approve, atomically flips the task completed→confirme… |
 
+## `projects` (5)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/projects` | `archon` | — | the full curation list (includes unfeatured + owner attribution). |
+| POST | `/api/bongos/projects` | `archon` | `origin`, `name`, `tagline`, `art_url` | create / update a catalog entry (manual seed for hand-wired instances; federated projects auto-catalogue at registration). |
+| PATCH | `/api/bongos/projects/:id/featured` | `archon` | `featured` | the feature / unfeature control (the ADR 0141 §5 curation gate). |
+| GET | `/api/bongos/projects/featured` | `public` | — | a curated public showcase; no auth by design. |
+| POST | `/api/bongos/projects/invite` | `archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |
+
 ## `provisioning` (13)
 
 | Method | Path | Rank | Body | Description |
@@ -363,6 +380,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/public/uptime` | `public` | — | Uptime: current status + 90-day history bucketed by hour. |
 | GET | `/api/bongos/public/versions` | `public` | — | read-only surface for status.example.com. |
 
+## `scouting` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/scouting` | `archon` | — | the internal talent directory across every project. |
+
 ## `search` (2)
 
 | Method | Path | Rank | Body | Description |
@@ -393,6 +416,18 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/sessions/mine` | `any-builder` | — | your OWN sessions (self-serve; no audit needed). |
 | GET | `/api/bongos/sessions/search` | `archon` | — | cross-builder corpus search (BFG-principal posture until 6C.1). |
 
+## `sso` (7)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| POST | `/api/bongos/sso/activity/rollup` | `public` | `client_id`, `client_secret`, `github_id`, `credits`, `tasks_shipped`, `karma`, `rank`, `disciplines` | POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). |
+| GET | `/api/bongos/sso/authorize` | `public` | — | GET /sso/authorize?client_id=&redirect_uri=&state= — the browser authorize leg. |
+| POST | `/api/bongos/sso/device/poll` | `public` | `device_code` | POST /sso/device/poll — poll the hub device flow. |
+| POST | `/api/bongos/sso/device/start` | `public` | `origin` | POST /sso/device/start — begin CLI federation. |
+| POST | `/api/bongos/sso/membership/check-in` | `public` | `client_id`, `client_secret`, `github_id`, `github_login`, `display_name`, `avatar_url`, `role` | POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). |
+| GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
+| POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
+
 ## `tasks` (27)
 
 | Method | Path | Rank | Body | Description |

package/docs/file-map.md

@@ -364,24 +364,6 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/scheduled-tasks/
-├── bfg/SKILL.md                       ← (MAS Phase 6, ADR 0026) BFG hygiene + read-the-room + steward routine: doc-vs-reality checks, memory hygiene, cross-builder learning. Read-mostly.
-├── bfg-session-eval/SKILL.md          ← (6D.3, ADR 0027) BFG session-inefficiency evaluator: search the session corpus, deep-dive wasteful sessions (ceremony-vs-work + footguns), file systemic findings. Read-only.
-├── box-dormant-reclaim/SKILL.md       ← (#598/ADR 0031) daily: deprovision dev boxes parked past the dormant threshold (pings the builder). Drives `box.js sweep-dormant --apply`. Control-plane only.
-├── box-idle-suspend/SKILL.md          ← (#598/ADR 0031) every 15 min: snapshot-and-park dev boxes idle past the idle threshold. Drives `box.js sweep-idle --apply`. Control-plane only.
-├── core-update-subscription/SKILL.md  ← (task 2150 / ADR 0136) daily: patch-only auto-upgrade of subscribed consumer instances (config/update-subscriptions.json) via `bongos upgrade --registry` with auto-rollback. Deterministic; opt-in + autonomy-gated (default OFF). Control-plane only.
-├── dep-audit-nightly/SKILL.md         ← autonomous nightly dependency-vulnerability scan on the droplet (`scripts/security/dep-audit.js --report-mode=nightly`) across npm + the devbox app
-├── diagram-drift/SKILL.md             ← belt-and-braces backstop for the onboarding diagrams — all five auto-regenerate on deploy, so this only flags any residual staleness
-├── idea-triage-nightly/SKILL.md       ← nightly autonomous walk of the idea_inbox; promotes high-confidence bugs/cleanups, discards obvious noise, defers ambiguous ideas
-├── main-audit/SKILL.md                ← (SEC #863 / ADR 0043) nightly post-push audit of `main` — flags commits where a sub-Metic builder edited a permission-sensitive surface
-├── newcomer-floor/SKILL.md            ← deterministic on-claim replenisher for the three evergreen newcomer chores (engineer/artist/ideator) — no cron; restocks when one is claimed (task 1168)
-├── newcomer-generator/SKILL.md        ← keep the newcomer_friendly task queue populated (C1) — deterministic generator tops the queue back up to its floor
-├── overnight-builder/SKILL.md         ← (#358) autonomous overnight session-runner: claims the highest-priority autonomous-fit task, works it in a fresh sub-agent, ships, re-polls. Archon-only. Runbook: docs/recipes/overnight-builder.md
-├── overnight-code-review/SKILL.md     ← nightly read-only code review; routes each finding into the idea_inbox (one row per finding; title prefix `[review YYYY-MM-DD]`)
-├── peer-vote-tally/SKILL.md           ← (V3.R25 / #245, C2) weekly tally of builder-on-builder peer votes into karma; folds votes ≥7 days old into karma_log
-├── repo-simplify-sweep/SKILL.md       ← weekly autonomous repo-cleanliness janitor: runs repo-metrics, files dead-code findings to the idea_inbox, auto-fixes the narrow safe class (unused vars/imports)
-├── security-review-weekly/SKILL.md    ← (V3.R69 / #288) autonomous weekly security-state review — surfaces stale vulnerability_reports + other stale-security signals
-├── skill-usage-review/SKILL.md        ← nightly skill-usage feedback loop: aggregates 24h of skill invocations, detects friction (over-invocation, errors), files findings
-└── stale-claim-release/SKILL.md       ← auto-release GDS claims whose session_pulses heartbeat went silent ≥ GDS_STALE_CLAIM_HOURS (default 6h); runs every 15 min on the droplet
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->
 

package/docs/onboarding/diagrams/05-versioning.mmd

@@ -7,21 +7,19 @@ flowchart TB
     POOL --> VERSIONS
     subgraph VERSIONS["Every task inherits its version; role/discipline is the work-type axis"]
         direction TB
-        v_V1["V1 — shipped"]
+        v_V1["V1 — building"]
         v_PMS_V1["PMS-V1 — shipped"]
         v_V1 --> v_PMS_V1
         v_PMS_V2["PMS-V2 — shipped"]
         v_PMS_V1 --> v_PMS_V2
         v_GDS_V3["GDS-V3 — shipped"]
         v_PMS_V2 --> v_GDS_V3
-        v_V2["V2 — planning"]
-        v_GDS_V3 --> v_V2
-        v_V3["V3 — planning"]
-        v_V2 --> v_V3
         v_GDS_V4["GDS-V4 — frozen"]
-        v_V3 --> v_GDS_V4
+        v_GDS_V3 --> v_GDS_V4
         v_BONGOS_V1["BONGOS-V1 — building"]
         v_GDS_V4 --> v_BONGOS_V1
+        v_CB_V1["CB-V1 — building"]
+        v_BONGOS_V1 --> v_CB_V1
     end
     VERSIONS --> CLOSE["Version close — all done_when_criteria satisfied"]
     CLOSE --> ARCHIVE["Archive scope to limitations/*.md; status=shipped"]

package/docs/onboarding/diagrams/assertions.json

@@ -47,7 +47,7 @@
     "versions": [
       {
         "id": "V1",
-        "status": "shipped"
+        "status": "building"
       },
       {
         "id": "PMS-V1",
@@ -61,14 +61,6 @@
         "id": "GDS-V3",
         "status": "shipped"
       },
-      {
-        "id": "V2",
-        "status": "planning"
-      },
-      {
-        "id": "V3",
-        "status": "planning"
-      },
       {
         "id": "GDS-V4",
         "status": "frozen"
@@ -76,6 +68,10 @@
       {
         "id": "BONGOS-V1",
         "status": "building"
+      },
+      {
+        "id": "CB-V1",
+        "status": "building"
       }
     ]
   },

package/docs/recipes/packaging-the-core.md

@@ -26,12 +26,25 @@ Every file is **redacted** through the same fail-closed pipeline the public mirr
 bongos package-core                 # from HEAD, version = platform CORE_VERSION
 bongos package-core --ref origin/main --version 1.13.0
 node scripts/gds/package-core.js --droplet-ip <ip>   # add the prod IP as an exact gate literal
+bongos package-core --self-verify   # after building, prove the artifact reproduces its pin
+bongos package-core --self-verify --self-verify-boot   # ALSO npm-install the .tgz + boot /healthz
 ```
 
 `--ref` chooses the source commit (default `HEAD`), `--out-dir` the output dir (default `dist`), `--version` overrides the stamped version. `stdout` carries a one-line JSON pin (`{ core_version, source_commit, tree_sha256, tarball }`) for CI/scripts to capture; human detail goes to `stderr`.
 
+`--self-verify` (task [#1002218](https://example.com/builders#/task/1002218), audit H3) closes the produce-side of the integrity loop: after writing the artifact it **unpacks the built `.tgz` and recomputes `tree_sha256`, asserting it equals the manifest** (+ the on-disk `.tgz` bytes vs `tarball.sha256`) — proving the packager's own output reproduces its pin before it is trusted or published (a mismatch exits non-zero, ahead of the `--publish` leg). It is deterministic and network-free. Add `--self-verify-boot` to *also* `npm install` the tarball into a throwaway consumer and boot `/healthz` (reuses [`tests/consumer_layout_boot.mjs`](../../tests/consumer_layout_boot.mjs); needs npm/registry access — the deeper standing CI gate is task [#1002221](https://example.com/builders#/task/1002221)).
+
 If the no-leak gate fails, it names the file + the residual literal. Fix the redaction rules ([`scripts/gds/mirror-redact.js`](../../scripts/gds/mirror-redact.js)) or the manifest exclusions ([`scripts/gds/publish-manifest.js`](../../scripts/gds/publish-manifest.js)) and re-run — do not weaken the gate to force a pass.
 
+**The neutral floor** (task [#1002217](https://example.com/builders#/task/1002217), audit H4). Because the trunk carries no `config/branding.json`, the *branding-derived* redaction would strip nothing — so `package-core.js` always injects a fixed **`PRIOR_INSTANCE_FLOOR`** (prior-instance tokens/owners) into the doc-redaction + no-leak gate. Published **docs** are de-branded against it and the gate **fails closed** if a floor literal survives, even with no branding.json. **Functional** files still ship verbatim (the R88 fix) and are instead surfaced by the non-fatal `[leak-scan]` (task 1002220). To retire a new prior-instance token, add it to `PRIOR_INSTANCE_FLOOR` (kept in `package-core.js`, never in `mirror-redact.js` — that file's self-leak invariant forbids hardcoded literals).
+
+## Prove it boots (the standing PROVE-PUBLISH gates)
+
+Two standing gates keep "a published core boots clean from a bare install" honest (task [#1002221](https://example.com/builders#/task/1002221), audit H1/H2):
+
+- **`node scripts/gds/run-unit-tests.js --integration`** — the integration-smoke gate. Runs the heavier integration set (longer per-test budget), including [`tests/consumer_layout_boot.mjs`](../../tests/consumer_layout_boot.mjs), which packages the core, `npm install`s the `.tgz`, and boots `/healthz` from the real consumer layout. Run it per release / on a schedule in an env that provides the services (network, and — for the deeper DB leg tracked as a follow-up — Postgres). The default `run-unit-tests.js` (no flag) stays the fast DB-free unit gate and *excludes* this set.
+- **[`tests/pruned_lockfile_integrity.mjs`](../../tests/pruned_lockfile_integrity.mjs)** — a network-free unit guard (runs in the default gate every PR) that rebuilds the shipped pruned lockfile and asserts every registry package keeps a **well-formed, verbatim `integrity` hash**. This is the exact R88 regression (redaction once blanked those base64 hashes → `npm ci` could no longer verify) caught before a consumer's install ever fails.
+
 ## Consume + pin it (the R85 side)
 
 A downstream instance repo:

package/docs/recipes/upgrading-the-core.md

@@ -9,11 +9,12 @@
 1. **pre-flight** — module-compat vs the target core + a clean git tree (skip with `--force`).
 2. **bump the pin** — vendor the new `bongos-core-<version>.tgz` and rewrite the `"@bongos/core": "file:vendor/…"` dependency.
 3. **`npm install`** — `node_modules/@bongos/core` becomes the new version.
+3b. **verify the integrity pin** (task [#1002216](https://example.com/builders#/task/1002216)) — recompute `tree_sha256` over the installed core and check the vendored `.tgz` bytes against `tarball.sha256`, comparing to the trusted reference manifest (the committed `vendor/…manifest.json`; the installed inner manifest for `--registry`). Runs **before** migrate so a corrupted core never touches the DB. A **mismatch is fatal → rollback**; a missing reference warns (fatal with `--require-pin`); opt out with `--skip-pin-verify`.
 4. **`npm run migrate`** — the core's `migrate.sh` applies additive `core_*` migrations (merged three-root: core + instance + modules).
 5. **materialize `.claude/`** — refresh skills/settings/hooks from the new core (`materializeClaude`), rewriting invocations to the `bongos` bin.
 6. **restart** — `--service <unit>` or `--restart-cmd "<cmd>"`.
-7. **verify** — installed version == target (+ optional `--health-url`).
-8. **auto-rollback on failure** (task [#2149](https://example.com/builders#/task/2149), default ON) — if `npm install`/`migrate` fails or the step-7 health check fails, revert the pin → reinstall the previous core → restart → re-verify → write a `rolled_back:` ledger row. Opt out with `--no-rollback-on-failure`. See the section below.
+7. **verify** — installed version == target + the **mandatory post-restart health check** (task [#1002222](https://example.com/builders#/task/1002222)): a bump that restarts the service **requires `--health-url <url>`** (it can't report success without confirming the new core serves). Opt out explicitly with `--no-health-check`; a bump with no managed restart needs no URL (it reports the new core installed-but-unconfirmed). A still-failing health poll fails the bump (auto-rollback).
+8. **auto-rollback on failure** (task [#2149](https://example.com/builders#/task/2149), default ON) — if `npm install`/pin-verify/`migrate` fails or the step-7 health check fails, revert the pin → reinstall the previous core → restart → re-verify → write a `rolled_back:` ledger row. Opt out with `--no-rollback-on-failure`. See the section below.
 
 Run bare (`bongos upgrade`, no `--to`) it stays the module-compat **pre-check** only.
 
@@ -63,6 +64,8 @@ By default (`--rollback-on-failure`, ON unless `--no-rollback-on-failure`) the c
 
 **The DB is NOT rolled back — only the code pin.** Core migrations are additive + forward-safe (the core migration rule), so an already-applied migration is left in place; a *failed* migration is never recorded in `schema_migrations`, so a retry re-runs it cleanly. The reversal is recorded via the always-present `note` column (not a new `outcome` column) so it lands even in the failed-migrate path — where a newer column wouldn't yet exist on that instance.
 
+> **The forward-safe rule is now enforced, not just documented** (task [#1002223](https://example.com/builders#/task/1002223), audit H10). A core migration that DROPs/RENAMEs/retypes existing state (which would strand the rolled-back old code on the new schema) fails the [`tests/migrations_forward_safe.mjs`](../../tests/migrations_forward_safe.mjs) unit gate unless it carries an explicit `-- forward-unsafe: <reason>` acknowledgement pragma. `migrate.sh` also prints a non-fatal notice at apply time (via [`scripts/gds/lint-migrations.js`](../../scripts/gds/lint-migrations.js)). Additive migrations (the norm) need no annotation.
+
 **Proven live on demo.cloudbongos.com** (task [#2157](https://example.com/builders#/task/2157)): demo, on rollback-capable 1.17.3, was upgraded to a canary carrying a deliberately-failing migration. Migrate raised → the channel auto-reverted the pin to 1.17.3, reinstalled + restarted it, `/healthz` stayed 200 (**zero downtime** — the failure was at migrate, before the restart), and a `rolled_back` ledger row was written. This is the safety gate the unattended patch-only auto-upgrade subscription (task [#2150](https://example.com/builders#/task/2150)) depends on.
 
 ## Subscribing to updates — unattended patch-only auto-upgrade (task 2150 / ADR 0136)

package/migrations/039_newcomer_friendly_column.sql

@@ -1,6 +1,11 @@
 -- 039_newcomer_friendly_column.sql — V3.R15: tasks.newcomer_friendly column +
 -- view-level filter + Xenos claim-policy error code.
 --
+-- forward-unsafe: rename-column (RENAME tasks.xenos_claimable → newcomer_friendly). Historical
+--   (V3.R15, 2026), already applied on every instance long before `bongos upgrade`'s code-only
+--   rollback existed — no core version a current rollback could revert to reads the old column
+--   name. Acknowledged per audit H10 / task 1002223 (scripts/gds/lint-migrations.js).
+--
 -- Context: V3.R15 (#239) was planned as the row-level "newcomer-friendly task"
 -- gate for the Xenos rank. In parallel, #360 / ADR 0018 (migration 029) shipped
 -- the same idea under the name `xenos_claimable`. Now V3.R15 closes by:

package/migrations/102_remove_box_first_provision_approval.sql

@@ -1,6 +1,10 @@
 -- 102_remove_box_first_provision_approval.sql — ADR 0059 (task 1141): REMOVE the
 -- dev-box "first-box Archon approval" gate. Reverts migration 071.
 --
+-- forward-unsafe: drop-column (box_intents.approved_by / approved_at). Historical (ADR 0059, task
+--   1141); the code that read those columns was removed in the SAME change, and it predates
+--   `bongos upgrade`'s code-only rollback. Acknowledged per audit H10 / task 1002223.
+--
 -- Context
 -- -------
 -- Migration 071 (#717, ADR 0035 Decision 2) added a 'pending_approval' state to

package/migrations/core_192_github_oauth_tokens.sql

@@ -0,0 +1,33 @@
+-- core_192_github_oauth_tokens.sql — short-lived, encrypted GitHub repo tokens for
+-- the onboarding wizard (task 1002099, ADR 0143).
+--
+-- The wizard (public-landing/create.html) opts into `public_repo` at GitHub sign-in
+-- so it can LIST the signed-in user's repos (adopt) and CREATE an empty repo (fresh)
+-- — things `read:user` cannot do. That user-to-server GitHub token is held here
+-- BRIEFLY: one row per builder, the token encrypted with secret-box (master key in
+-- server env only — a DB dump alone decrypts nothing), with a short expires_at (one
+-- wizard sitting). It is read back by the repo picker/creator over the next few
+-- minutes and deleted on use; getGithubToken lazily sweeps an expired row so the
+-- table self-cleans without a cron. ON DELETE CASCADE ties a token to its builder.
+--
+-- This is the AUTH system's OWN handshake token (not a feature's third-party API
+-- key like the art module's Gemini key, ADR 0102), so it lives in core. When
+-- secret-box is unconfigured no row is ever written and the wizard falls back to
+-- manual repo entry (ADR 0143).
+--
+-- Idempotent: safe to re-run.
+
+CREATE TABLE IF NOT EXISTS github_oauth_tokens (
+  builder_id  bigint PRIMARY KEY REFERENCES builders(id) ON DELETE CASCADE,
+  token_enc   text NOT NULL,
+  scope       text,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  expires_at  timestamptz NOT NULL
+);
+
+-- The read/sweep hot path filters on expiry.
+CREATE INDEX IF NOT EXISTS idx_github_oauth_tokens_expires
+  ON github_oauth_tokens (expires_at);
+
+INSERT INTO schema_migrations (version) VALUES ('core_192_github_oauth_tokens')
+  ON CONFLICT (version) DO NOTHING;

package/modules/hall-ui/public/builders.js

@@ -1886,6 +1886,39 @@
     window.OTBAttention?.refresh();
   }
 
+  // ---- Home "Next up" slice (task 2184) -------------------------------------
+
+  // Fill the top of the "Your work" card with the first two rows of the
+  // claimable queue (server order: priority, then calibrated estimate) so Home
+  // answers "what's my next action". Best-effort: a primer-gated 403, an auth
+  // hiccup, or an empty queue hides the slice — Home never shows an error for
+  // it. Re-runs with every loadAll (SSE nudges keep it current).
+  async function loadNextUp() {
+    const wrap = document.getElementById('home-next');
+    const list = document.getElementById('home-next-list');
+    const subhead = document.getElementById('home-recent-subh');
+    if (!wrap || !list) return;
+    try {
+      const resp = await getJSON(`${API}/tasks/claimable`, { softAuth: true });
+      const rows = (resp && Array.isArray(resp.claimable) ? resp.claimable : []).slice(0, 2);
+      if (!rows.length) { wrap.hidden = true; if (subhead) subhead.hidden = true; return; }
+      const cur = (window.__BRANDING__ && window.__BRANDING__.currency && window.__BRANDING__.currency.label) || 'credits';
+      list.innerHTML = rows.map((t) => {
+        const credits = window.OTBBranding?.taskCreditValue?.(t) ?? t.credits_reward;
+        const mins = t.est_minutes ? ` · ~${escapeHtml(String(t.est_minutes))}m` : '';
+        return `<li class="next-up__item">
+            <a class="next-up__title" href="/task/${encodeURIComponent(t.id)}">${escapeHtml(t.title || `task ${t.id}`)}</a>
+            <span class="next-up__meta">#${escapeHtml(String(t.id))}${mins} · ${fmtNum(credits)} ${escapeHtml(cur)} est.</span>
+          </li>`;
+      }).join('');
+      wrap.hidden = false;
+      if (subhead) subhead.hidden = false;
+    } catch (_) {
+      wrap.hidden = true;
+      if (subhead) subhead.hidden = true;
+    }
+  }
+
   // ---- leaderboard ---------------------------------------------------------
 
   // Locked at 8 for V2 (per limitations/pms-v2.md). Hardcoding here avoids an
@@ -2225,6 +2258,10 @@
     // /me because it spans all builders' work), loaded fire-and-forget so a
     // slow/failed feed can't hold up the rest of the hall.
     loadAcclaimFeed();
+    // task 2184: the Home "Next up" slice — top of the claimable queue, so the
+    // page answers "what's my next action" without a trip to the Work board.
+    // Fire-and-forget; hides itself when the feed is gated (primer 403) or empty.
+    loadNextUp();
 
     // #408: build the sticky nav now that every section has settled its
     // hidden state (welcome → karma → onboarding → security/roster).