@bongos/core 1.18.0 → 1.18.18

package/docs/api/openapi.json

@@ -1,13 +1,13 @@
 {
   "openapi": "3.1.0",
   "info": {
-    "title": "Cloud Bongos — GDS API",
+    "title": "Cloud Bongos — Bongos API",
     "version": "0.0.2",
     "license": {
       "name": "AGPL-3.0-or-later",
       "url": "https://www.gnu.org/licenses/agpl-3.0.html"
     },
-    "description": "The Game Development System (GDS) API — the build-methodology backend\n(builders, tasks, claims, credits, grading, memory, dev boxes).\n\n**API version:** `v1` — served at `/api/bongos/v1`. The\nunversioned `/api/bongos` and legacy `/api/gds` are permanent aliases\npinned to this version; pin to `/api/bongos/v1` for a stable\ncontract (breaking changes ship a new `/vN`, ADR 0117). This is the\nCONTRACT version, distinct from the package build in `info.version`.\n\n**Base path:** `/api/bongos` (every path below is relative to it).\n\n**Auth:** a builder session — the `gds_session` cookie (web) or\n`Authorization: Bearer <token>` (CLI). **Ranks** gate writes and are\nenforced server-side per request, never cached (ADR 0016):\n`public` < `any-builder` < `metic+archon` < `archon`.\nEach operation carries its required rank in `x-rank`.\n\nGenerated from the live route files by `scripts/gds/gen-api-docs.js` —\ndo not hand-edit; it regenerates on every ship."
+    "description": "The Bongos API — the build-methodology backend\n(builders, tasks, claims, credits, grading, memory, dev boxes).\n\n**API version:** `v1` — served at `/api/bongos/v1`. The\nunversioned `/api/bongos` and legacy `/api/gds` are permanent aliases\npinned to this version; pin to `/api/bongos/v1` for a stable\ncontract (breaking changes ship a new `/vN`, ADR 0117). This is the\nCONTRACT version, distinct from the package build in `info.version`.\n\n**Base path:** `/api/bongos` (every path below is relative to it).\n\n**Auth:** a builder session — the `gds_session` cookie (web) or\n`Authorization: Bearer <token>` (CLI). **Ranks** gate writes and are\nenforced server-side per request, never cached (ADR 0016):\n`public` < `any-builder` < `metic+archon` < `archon`.\nEach operation carries its required rank in `x-rank`.\n\nGenerated from the live route files by `scripts/gds/gen-api-docs.js` —\ndo not hand-edit; it regenerates on every ship."
   },
   "x-api-version": "v1",
   "servers": [
@@ -93,6 +93,10 @@
       "name": "gate-approvals",
       "description": "Endpoints under `/api/bongos/gate-approvals`."
     },
+    {
+      "name": "github",
+      "description": "Endpoints under `/api/bongos/github`."
+    },
     {
       "name": "goals",
       "description": "Endpoints under `/api/bongos/goals`."
@@ -141,10 +145,18 @@
       "name": "modules",
       "description": "Endpoints under `/api/bongos/modules`."
     },
+    {
+      "name": "my-projects",
+      "description": "Endpoints under `/api/bongos/my-projects`."
+    },
     {
       "name": "override-requests",
       "description": "Endpoints under `/api/bongos/override-requests`."
     },
+    {
+      "name": "projects",
+      "description": "Endpoints under `/api/bongos/projects`."
+    },
     {
       "name": "provisioning",
       "description": "Endpoints under `/api/bongos/provisioning`."
@@ -153,6 +165,10 @@
       "name": "public",
       "description": "Endpoints under `/api/bongos/public`."
     },
+    {
+      "name": "scouting",
+      "description": "Endpoints under `/api/bongos/scouting`."
+    },
     {
       "name": "search",
       "description": "Endpoints under `/api/bongos/search`."
@@ -169,6 +185,10 @@
       "name": "sessions",
       "description": "Endpoints under `/api/bongos/sessions`."
     },
+    {
+      "name": "sso",
+      "description": "Endpoints under `/api/bongos/sso`."
+    },
     {
       "name": "tasks",
       "description": "Endpoints under `/api/bongos/tasks`."
@@ -624,6 +644,45 @@
         "security": []
       }
     },
+    "/auth/backchannel-logout": {
+      "post": {
+        "operationId": "post_auth_backchannel_logout",
+        "tags": [
+          "auth"
+        ],
+        "summary": "POST /auth/backchannel-logout",
+        "description": "POST /auth/backchannel-logout — the INSTANCE side of federated single-logout (ADR 0144, task 1002238). The hub POSTs a hub-signed logout token here when a builder signs out of the hub; we verify it and revoke ALL of that builder's local sessions, so one hub logout ends the session on every federated project. rank: public — the hub-signed EdDSA logout token IS the credential (like the OAuth callback), NOT a builder session. Inert (404) on an instance that does not federate through a hub (idp unset), so a self-hosted instance exposes no new surface. Idempotent: an unknown/replayed subject just revokes nothing.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAuthBackchannelLogoutRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostAuthBackchannelLogoutResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
     "/auth/cli-token/issue": {
       "post": {
         "operationId": "post_auth_cli_token_issue",
@@ -662,6 +721,45 @@
         ]
       }
     },
+    "/auth/device/exchange": {
+      "post": {
+        "operationId": "post_auth_device_exchange",
+        "tags": [
+          "auth"
+        ],
+        "summary": "POST /auth/device/exchange",
+        "description": "POST /auth/device/exchange — CLI federation (ADR 0141 §1). The CLI ran the device flow against the HUB and got a hub-signed assertion; it presents it here. The instance verifies the Ed25519 signature OFFLINE against the provisioned hub public key (aud must equal this instance's client_id, unexpired), then runs the instance's OWN admission gate + upsertBuilder + createSession(source='cli') and returns the existing { token, builder }. Only reachable when auth.idp is set. rank: public — an auth-establishment endpoint; the hub-signed assertion IS the bearer and is cryptographically verified before any session is minted.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAuthDeviceExchangeRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostAuthDeviceExchangeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
     "/auth/device/poll": {
       "post": {
         "operationId": "post_auth_device_poll",
@@ -951,6 +1049,34 @@
         ]
       }
     },
+    "/auth/web/admission-status": {
+      "get": {
+        "operationId": "get_auth_web_admission_status",
+        "tags": [
+          "auth"
+        ],
+        "summary": "GET /auth/web/admission-status",
+        "description": "GET /auth/web/admission-status?login=X — the probe renderAccessPendingPage polls (task 1002097). Answers ONE question: would this login be admitted right now? It mirrors the real gate via auth.webAdmissionStatus so the page can never invite someone in the gate would refuse. rank: public — it must be reachable by a visitor with no session (that is the entire situation it exists for). It grants nothing: admission still runs through the normal sign-in, and this only reads state. WHAT IT LEAKS, stated plainly (task 1002430 — an earlier version of this comment claimed the opposite and was wrong). Returning only a boolean does NOT make it non-enumerable: with open enrollment off, and for any login that is not the configured firstAdmin, `admitted:true` means that login is a member or has been invited. That reveals account existence to an unauthenticated caller. It is also NOT throttled — rateLimitMiddleware returns early for non-write methods, so GETs bypass it entirely; the page's 3s poll bounds the honest client, not an attacker. Why it is nonetheless not a new exposure: the onboarding module's GET /access-requests/status?github_login=X is ALREADY public and returns the strictly richer member|invited|pending|dismissed|none plus its own `admitted`. Anything derivable here is already derivable there, so this adds no net-new surface — and hardening only this route would accomplish nothing while that one stays open. Whether unauthenticated login-existence probing is acceptable at all is a real question, but it belongs to both routes together, not to a comment here. That endpoint is also why this one exists: it models neither the firstAdmin bypass nor open enrollment, so it reports the OWNER as 'none' forever — the exact case this page has to resolve.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAuthWebAdmissionStatusResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/auth/web/callback": {
       "get": {
         "operationId": "get_auth_web_callback",
@@ -1683,6 +1809,37 @@
         ]
       }
     },
+    "/box/scope": {
+      "get": {
+        "operationId": "get_box_scope",
+        "tags": [
+          "box"
+        ],
+        "summary": "GET /box/scope",
+        "description": "GET /box/scope — the credential-FREE companion to /box/source-access (BV1.R100 / goal 1000051). Answers \"what code does my box hold RIGHT NOW?\" — the resolved sparse set + the module keys of the builder's active claims — WITHOUT issuing the pull credential. The laptop app reads it to confirm \"your box now has <module> for task N\" after a pick+claim; R104's proof reads it to VERIFY the scope is minimal (excludes other modules). Same live rank+ status + lifecycle-port scope logic as source-access, so the answer can't drift from the actual checkout — it just omits the secret. Deliberately NOT gated on a live box (boxCanHoldSource): the SCOPE is metadata, so a builder can ask \"what WOULD my box hold for my current claims\" the instant they claim, before the box has even synced. The ALLOW/DENY still comes from the live rank+status (a demoted/inactive builder gets the same 403 as source-access). allowBoxScope so it works both from the laptop app (full session) and on the box (box-scoped session) — safe here precisely because no credential is returned.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/dev-box/routes/box.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/box/source-access": {
       "get": {
         "operationId": "get_box_source_access",
@@ -3198,7 +3355,7 @@
           "done-when"
         ],
         "summary": "POST /done-when/:criterionId/satisfy",
-        "description": "Auth (Metic+): confirm a criterion — flip it to satisfied. Accepts optional satisfied_by_task_id so the UI can show which ship-task fulfilled it. When the criterion belongs to a goal and was its LAST unsatisfied one, the goal auto- flips open→achieved (ADR 0086 §6 / BV1.R63). Re-ranked Archon→Metic+ so the planner — not only the Archon — closes the criterion/goal loop; the route is pinned in route-rank-check.EXPECTED_RANKS so a further downgrade is caught. rank: metic+archon — criterion confirmation + goal auto-achieve (the closing loop).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
+        "description": "Auth (Metic+): confirm a criterion — flip it to satisfied. Accepts optional satisfied_by_task_id so the UI can show which ship-task fulfilled it. When the criterion belongs to a goal and was its LAST unsatisfied one, the goal auto- flips open→achieved (ADR 0086 §6 / BV1.R63). Re-ranked Archon→Metic+ so the planner — not only the Archon — closes the criterion/goal loop; the route is pinned in route-rank-check.MODULE_EXPECTED_RANKS.lifecycle so a further downgrade is caught. rank: metic+archon — criterion confirmation + goal auto-achieve (the closing loop).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/done-when.js",
         "parameters": [
@@ -3389,6 +3546,91 @@
         ]
       }
     },
+    "/github/repos": {
+      "get": {
+        "operationId": "get_github_repos",
+        "tags": [
+          "github"
+        ],
+        "summary": "GET /github/repos",
+        "description": "acts only on the caller's OWN GitHub identity (the token they granted). No rank gate beyond being a signed-in builder.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/github.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetGithubReposResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_github_repos",
+        "tags": [
+          "github"
+        ],
+        "summary": "POST /github/repos",
+        "description": "creates a repo in the caller's OWN account.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/github.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostGithubReposRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostGithubReposResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/goals": {
       "get": {
         "operationId": "get_goals",
@@ -5013,6 +5255,62 @@
         ]
       }
     },
+    "/inbox/{id}/ratify": {
+      "post": {
+        "operationId": "post_inbox_id_ratify",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "POST /inbox/:id/ratify",
+        "description": "V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE idea_inbox SET status='promoted', reviewed_at=now() - INSERT karma_log (delta=+3, reason='proposal_ratified') for proposer (V3.R28 / task 248 tuned the delta from +5 → +3; tunable.) - INSERT criterion_proposal_audit row capturing who/when/what Archon-only — done_when_criteria writes are scope-shaping (criterion C2 in canonical-permissions.md). The kind='criterion-proposal' POST is Metic+ (gated above), but the ratification is the Archon decision. Returns 400 if the source idea isn't kind='criterion-proposal' or its body_md isn't a parseable {target_version, criterion_md, sort_order_hint} JSON object. Returns 404 if the idea doesn't exist. Returns 409 if the idea is already promoted/discarded/merged (status != 'open'). All four writes happen in one transaction — partial failures roll back cleanly.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostInboxIdRatifyRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/instance": {
       "get": {
         "operationId": "get_instance",
@@ -6288,18 +6586,122 @@
         ]
       }
     },
-    "/memory/file": {
+    "/memory/builders/{builderId}/file": {
       "get": {
-        "operationId": "get_memory_file",
+        "operationId": "get_memory_builders_builderId_file",
         "tags": [
           "memory"
         ],
-        "summary": "GET /memory/file",
-        "description": "GET /memory/file?path=... — fetch ONE of the AUTHENTICATED builder's files (content included). Single query (fetchMemoryFile is one SELECT). 404 if this builder has no file at that path. We use a ?path= query rather than a path-segment param because the stored keys are relative paths that may contain '/' (e.g. 'sub/dir/notes.md'); a single :path segment can't carry a slash, and a wildcard segment re-opens the traversal surface that assertValidPath exists to close. The query value is validated by assertValidPath (no leading '/', no '..', no NUL, no backslash) before it ever reaches the store. Auth: any authenticated builder. Self-scoped: owner is req.builder.id. Response 200: { builder_id, path, content, sha256, byte_len, mtime, updated_at, created_at }\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
+        "summary": "GET /memory/builders/:builderId/file",
+        "description": "GET /memory/builders/:builderId/file?path=... — Archon reads ONE of ANOTHER builder's files (content included). Audit-logged. 404 if the target has no file at that path.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
         "x-source": "modules/memory/routes/memory.js",
-        "responses": {
-          "200": {
+        "parameters": [
+          {
+            "name": "builderId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `builderId`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMemoryBuildersBuilderIdFileResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/memory/builders/{builderId}/files": {
+      "get": {
+        "operationId": "get_memory_builders_builderId_files",
+        "tags": [
+          "memory"
+        ],
+        "summary": "GET /memory/builders/:builderId/files",
+        "description": "GET /memory/builders/:builderId/files — Archon lists ANOTHER builder's memory file metadata. Audit-logged.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/memory/routes/memory.js",
+        "parameters": [
+          {
+            "name": "builderId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `builderId`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMemoryBuildersBuilderIdFilesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/memory/file": {
+      "get": {
+        "operationId": "get_memory_file",
+        "tags": [
+          "memory"
+        ],
+        "summary": "GET /memory/file",
+        "description": "GET /memory/file?path=... — fetch ONE of the AUTHENTICATED builder's files (content included). Single query (fetchMemoryFile is one SELECT). 404 if this builder has no file at that path. We use a ?path= query rather than a path-segment param because the stored keys are relative paths that may contain '/' (e.g. 'sub/dir/notes.md'); a single :path segment can't carry a slash, and a wildcard segment re-opens the traversal surface that assertValidPath exists to close. The query value is validated by assertValidPath (no leading '/', no '..', no NUL, no backslash) before it ever reaches the store. Auth: any authenticated builder. Self-scoped: owner is req.builder.id. Response 200: { builder_id, path, content, sha256, byte_len, mtime, updated_at, created_at }\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/memory/routes/memory.js",
+        "responses": {
+          "200": {
             "description": "Success.",
             "content": {
               "application/json": {
@@ -6656,23 +7058,23 @@
         ]
       }
     },
-    "/override-requests": {
+    "/my-projects": {
       "get": {
-        "operationId": "get_override_requests",
+        "operationId": "get_my_projects",
         "tags": [
-          "override-requests"
+          "my-projects"
         ],
-        "summary": "GET /override-requests",
-        "description": "GET /override-requests?status=open — Archon queue. Status defaults to open; pass ?status=approved or ?status=denied for the resolved history. rank: archon — same gate as the audit log + Archon view.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
-        "x-rank": "archon",
-        "x-source": "modules/lifecycle/routes/tasks.js",
+        "summary": "GET /my-projects",
+        "description": "the caller's OWN cross-project memberships (own data).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/my-projects.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetOverrideRequestsResponse"
+                  "$ref": "#/components/schemas/GetMyProjectsResponse"
                 }
               }
             }
@@ -6694,44 +7096,78 @@
         ]
       }
     },
-    "/override-requests/{id}/decide": {
+    "/my-projects/invites": {
+      "get": {
+        "operationId": "get_my_projects_invites",
+        "tags": [
+          "my-projects"
+        ],
+        "summary": "GET /my-projects/invites",
+        "description": "the caller's OWN pending invitations (ADR 0141 §5).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/my-projects.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMyProjectsInvitesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/my-projects/invites/{clientId}/accept": {
       "post": {
-        "operationId": "post_override_requests_id_decide",
+        "operationId": "post_my_projects_invites_clientId_accept",
         "tags": [
-          "override-requests"
+          "my-projects"
         ],
-        "summary": "POST /override-requests/:id/decide",
-        "description": "POST /override-requests/:id/decide — body: { decision: 'approve'|'deny', note? } On approve, atomically flips the task completed→confirmed and awards the credits to the original requester (NOT the Archon). On deny, only the row updates; the task stays at completed and the builder must release or re-ship after fixing whatever the grader caught. rank: archon — grader-bypass authority; same gate as POST /tasks/:id/confirm.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
-        "x-rank": "archon",
-        "x-source": "modules/lifecycle/routes/tasks.js",
+        "summary": "POST /my-projects/invites/:clientId/accept",
+        "description": "accept an invite (pending → builder) for the caller's OWN account.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/my-projects.js",
         "parameters": [
           {
-            "name": "id",
+            "name": "clientId",
             "in": "path",
             "required": true,
             "schema": {
               "type": "string"
             },
-            "description": "Path parameter `id`."
+            "description": "Path parameter `clientId`."
           }
         ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostOverrideRequestsIdDecideRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMyProjectsInvitesClientIdAcceptResponse"
+                }
+              }
+            }
           },
           "400": {
-            "$ref": "#/components/responses/ValidationFailed"
+            "$ref": "#/components/responses/BadRequest"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
@@ -6750,23 +7186,34 @@
         ]
       }
     },
-    "/provisioning/fleet": {
-      "get": {
-        "operationId": "get_provisioning_fleet",
+    "/my-projects/invites/{clientId}/decline": {
+      "post": {
+        "operationId": "post_my_projects_invites_clientId_decline",
         "tags": [
-          "provisioning"
+          "my-projects"
+        ],
+        "summary": "POST /my-projects/invites/:clientId/decline",
+        "description": "decline an invite (delete the pending row) for the caller's OWN account.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/my-projects.js",
+        "parameters": [
+          {
+            "name": "clientId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `clientId`."
+          }
         ],
-        "summary": "GET /provisioning/fleet",
-        "description": "GET /provisioning/fleet — the full instance roster across all owners. rank: archon (exposes every owner's instance + cost; the /boxes precedent).\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
-        "x-rank": "archon",
-        "x-source": "modules/provisioning/routes/provisioning.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetProvisioningFleetResponse"
+                  "$ref": "#/components/schemas/PostMyProjectsInvitesClientIdDeclineResponse"
                 }
               }
             }
@@ -6779,6 +7226,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         },
         "security": [
@@ -6788,22 +7238,40 @@
         ]
       }
     },
-    "/provisioning/fleet/cost-ledger": {
-      "get": {
-        "operationId": "get_provisioning_fleet_cost_ledger",
+    "/my-projects/join": {
+      "post": {
+        "operationId": "post_my_projects_join",
         "tags": [
-          "provisioning"
+          "my-projects"
         ],
-        "summary": "GET /provisioning/fleet/cost-ledger",
-        "description": "GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent). Declared among the archon routes (archon-first) for correct auditor classification.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
-        "x-rank": "archon",
-        "x-source": "modules/provisioning/routes/provisioning.js",
+        "summary": "POST /my-projects/join",
+        "description": "request to join a project. The hub RELAYS the request to the target project's own admission surface (it does NOT admit locally — authority stays local). SSRF guard: only relay to an origin that is a REGISTERED, active client — never an arbitrary builder-supplied URL.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/my-projects.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostMyProjectsJoinRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMyProjectsJoinResponse"
+                }
+              }
+            }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
@@ -6819,100 +7287,169 @@
         ]
       }
     },
-    "/provisioning/github-app/callback": {
-      "get": {
-        "operationId": "get_provisioning_github_app_callback",
+    "/my-projects/{clientId}/leave": {
+      "post": {
+        "operationId": "post_my_projects_clientId_leave",
         "tags": [
-          "provisioning"
+          "my-projects"
+        ],
+        "summary": "POST /my-projects/:clientId/leave",
+        "description": "leave a project from the caller's OWN membership list.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/my-projects.js",
+        "parameters": [
+          {
+            "name": "clientId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `clientId`."
+          }
         ],
-        "summary": "GET /provisioning/github-app/callback",
-        "description": "GET /provisioning/github-app/callback?code=&state= — GitHub redirects the owner's BROWSER here after they approve the App Manifest (task 2080, ADR 0133). It is a browser redirect with no session guaranteed, so it is PUBLIC — the unguessable, single-use, TTL'd `state` token (minted only for the signed-in owner and matched against provisioning_oauth_manifests) is the authorization, exactly as GitHub's own conversion `code` is \"the code IS the auth\". The web tier ONLY stores the code + flips status → 'code_received'; the control-plane runner (the sole token-holder) exchanges it for the client secret and places it in web.env. The secret NEVER touches the browser or the web tier. rank: public — no session, no mutation of authority, no secret revealed; a bad/expired/replayed state is a no-op error page.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "modules/provisioning/routes/provisioning.js",
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMyProjectsClientIdLeaveResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
-          }
-        },
-        "security": []
-      }
-    },
-    "/provisioning/github-app/status": {
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/override-requests": {
       "get": {
-        "operationId": "get_provisioning_github_app_status",
+        "operationId": "get_override_requests",
         "tags": [
-          "provisioning"
+          "override-requests"
         ],
-        "summary": "GET /provisioning/github-app/status",
-        "description": "GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding callback page polls (task 2096) to know when setup is done + where to send the owner. Same public-by-state model as the callback: the unguessable, single-use `state` token is the only key, and the response reveals only the manifest lifecycle status + the instance's own (already-public) domain — never a secret. Per-IP rate-limited because the page polls it every ~3s. `ready` is true iff the manifest reached 'done' (creds placed + /healthz verified) — the page then auto-redirects to https://<domain>. rank: public — no session, no mutation, no secret; an unknown state is a 404 no-op.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "modules/provisioning/routes/provisioning.js",
+        "summary": "GET /override-requests",
+        "description": "GET /override-requests?status=open — Archon queue. Status defaults to open; pass ?status=approved or ?status=denied for the resolved history. rank: archon — same gate as the audit log + Archon view.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/lifecycle/routes/tasks.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetProvisioningGithubAppStatusResponse"
+                  "$ref": "#/components/schemas/GetOverrideRequestsResponse"
                 }
               }
             }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         },
-        "security": []
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
       }
     },
-    "/provisioning/health": {
-      "get": {
-        "operationId": "get_provisioning_health",
+    "/override-requests/{id}/decide": {
+      "post": {
+        "operationId": "post_override_requests_id_decide",
         "tags": [
-          "provisioning"
+          "override-requests"
         ],
-        "summary": "GET /provisioning/health",
-        "description": "GET /provisioning/health — liveness + the core version this module mounted against. rank: public (a plain liveness read; no write, no sensitive data).\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "modules/provisioning/routes/provisioning.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetProvisioningHealthResponse"
-                }
+        "summary": "POST /override-requests/:id/decide",
+        "description": "POST /override-requests/:id/decide — body: { decision: 'approve'|'deny', note? } On approve, atomically flips the task completed→confirmed and awards the credits to the original requester (NOT the Archon). On deny, only the row updates; the task stays at completed and the builder must release or re-ship after fixing whatever the grader caught. rank: archon — grader-bypass authority; same gate as POST /tasks/:id/confirm.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/lifecycle/routes/tasks.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostOverrideRequestsIdDecideRequest"
               }
             }
           },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         },
-        "security": []
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
       }
     },
-    "/provisioning/instances": {
+    "/projects": {
       "get": {
-        "operationId": "get_provisioning_instances",
+        "operationId": "get_projects",
         "tags": [
-          "provisioning"
+          "projects"
         ],
-        "summary": "GET /provisioning/instances",
-        "description": "GET /provisioning/instances — the caller's own instances + each open intent. rank: any authenticated builder (own resource read).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/provisioning/routes/provisioning.js",
+        "summary": "GET /projects",
+        "description": "the full curation list (includes unfeatured + owner attribution).\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/platform-identity/routes/projects.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetProvisioningInstancesResponse"
+                  "$ref": "#/components/schemas/GetProjectsResponse"
                 }
               }
             }
@@ -6934,20 +7471,20 @@
         ]
       },
       "post": {
-        "operationId": "post_provisioning_instances",
+        "operationId": "post_projects",
         "tags": [
-          "provisioning"
+          "projects"
         ],
-        "summary": "POST /provisioning/instances",
-        "description": "POST /provisioning/instances — request a new instance. rank: any authenticated builder (own resource). ENQUEUES a 'provision' intent + records the request; the runner (task P3) does the real standup. Idempotent on slug for the SAME owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409. Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated), domain?, tier? }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/provisioning/routes/provisioning.js",
+        "summary": "POST /projects",
+        "description": "create / update a catalog entry (manual seed for hand-wired instances; federated projects auto-catalogue at registration).\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/platform-identity/routes/projects.js",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PostProvisioningInstancesRequest"
+                "$ref": "#/components/schemas/PostProjectsRequest"
               }
             }
           },
@@ -6955,7 +7492,14 @@
         },
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostProjectsResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -6974,101 +7518,67 @@
         ]
       }
     },
-    "/provisioning/instances/{id}": {
+    "/projects/featured": {
       "get": {
-        "operationId": "get_provisioning_instances_id",
+        "operationId": "get_projects_featured",
         "tags": [
-          "provisioning"
-        ],
-        "summary": "GET /provisioning/instances/:id",
-        "description": "GET /provisioning/instances/:id — read one of the caller's own instances. rank: any authenticated builder (own resource). 404 when the id isn't the caller's (own-scoped; does not leak another owner's instance existence).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/provisioning/routes/provisioning.js",
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `id`."
-          }
+          "projects"
         ],
+        "summary": "GET /projects/featured",
+        "description": "a curated public showcase; no auth by design.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/projects.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetProvisioningInstancesIdResponse"
+                  "$ref": "#/components/schemas/GetProjectsFeaturedResponse"
                 }
               }
             }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
           }
         },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
+        "security": []
       }
     },
-    "/provisioning/instances/{id}/force-teardown": {
+    "/projects/invite": {
       "post": {
-        "operationId": "post_provisioning_instances_id_force_teardown",
+        "operationId": "post_projects_invite",
         "tags": [
-          "provisioning"
+          "projects"
         ],
-        "summary": "POST /provisioning/instances/:id/force-teardown",
-        "description": "POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. Trust-safe by the same mechanism as the owner's own teardown: it ENQUEUES a 'teardown' intent for the control-plane runner; the web tier never holds cloud tokens. rank: archon (acts on another owner's infrastructure). Declared among the archon routes (archon-first).\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "summary": "POST /projects/invite",
+        "description": "invite a builder into a project (ADR 0141 §5, task #1002115). Pre-seeds a 'pending' membership the invitee accepts from My Projects. V1 invites by github_login and requires the invitee to already have a platform account (they build on some project); inviting someone entirely new to the platform (GitHub-id resolution) is a follow-up.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
         "x-rank": "archon",
-        "x-source": "modules/provisioning/routes/provisioning.js",
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `id`."
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostProvisioningInstancesIdForceTeardownResponse"
-                }
+        "x-source": "modules/platform-identity/routes/projects.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostProjectsInviteRequest"
               }
             }
           },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
           },
           "403": {
             "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
           }
         },
         "security": [
@@ -7078,16 +7588,16 @@
         ]
       }
     },
-    "/provisioning/instances/{id}/github-app": {
-      "post": {
-        "operationId": "post_provisioning_instances_id_github_app",
+    "/projects/{id}/featured": {
+      "patch": {
+        "operationId": "patch_projects_id_featured",
         "tags": [
-          "provisioning"
+          "projects"
         ],
-        "summary": "POST /provisioning/instances/:id/github-app",
-        "description": "POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated builder (own resource). Returns the pre-filled manifest + the GitHub form-POST target (personal + org variants) + a one-time `state`; the browser POSTs the manifest to GitHub, the owner approves, and GitHub redirects back to the public callback below. The web tier only RECORDS the attempt (state token) — the control-plane runner does the token exchange + cred placement (trust boundary intact, ADR 0111 §2). Body: { account? ('personal'|'org') }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/provisioning/routes/provisioning.js",
+        "summary": "PATCH /projects/:id/featured",
+        "description": "the feature / unfeature control (the ADR 0141 §5 curation gate).\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/platform-identity/routes/projects.js",
         "parameters": [
           {
             "name": "id",
@@ -7100,11 +7610,11 @@
           }
         ],
         "requestBody": {
-          "required": false,
+          "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PostProvisioningInstancesIdGithubAppRequest"
+                "$ref": "#/components/schemas/PatchProjectsIdFeaturedRequest"
               }
             }
           },
@@ -7116,7 +7626,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PostProvisioningInstancesIdGithubAppResponse"
+                  "$ref": "#/components/schemas/PatchProjectsIdFeaturedResponse"
                 }
               }
             }
@@ -7141,34 +7651,23 @@
         ]
       }
     },
-    "/provisioning/instances/{id}/teardown": {
-      "post": {
-        "operationId": "post_provisioning_instances_id_teardown",
+    "/provisioning/fleet": {
+      "get": {
+        "operationId": "get_provisioning_fleet",
         "tags": [
           "provisioning"
         ],
-        "summary": "POST /provisioning/instances/:id/teardown",
-        "description": "POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. rank: any authenticated builder (own resource). Enqueues a 'teardown' intent; the runner executes it (web tier holds no tokens). 404 when the id isn't the caller's; 409 when the instance isn't in a teardownable state.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
+        "summary": "GET /provisioning/fleet",
+        "description": "GET /provisioning/fleet — the full instance roster across all owners. rank: archon (exposes every owner's instance + cost; the /boxes precedent).\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
         "x-source": "modules/provisioning/routes/provisioning.js",
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `id`."
-          }
-        ],
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PostProvisioningInstancesIdTeardownResponse"
+                  "$ref": "#/components/schemas/GetProvisioningFleetResponse"
                 }
               }
             }
@@ -7181,9 +7680,6 @@
           },
           "403": {
             "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
           }
         },
         "security": [
@@ -7193,9 +7689,414 @@
         ]
       }
     },
-    "/provisioning/onboard-plan": {
+    "/provisioning/fleet/cost-ledger": {
       "get": {
-        "operationId": "get_provisioning_onboard_plan",
+        "operationId": "get_provisioning_fleet_cost_ledger",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/fleet/cost-ledger",
+        "description": "GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent). Declared among the archon routes (archon-first) for correct auditor classification.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/provisioning/github-app/callback": {
+      "get": {
+        "operationId": "get_provisioning_github_app_callback",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/github-app/callback",
+        "description": "GET /provisioning/github-app/callback?code=&state= — GitHub redirects the owner's BROWSER here after they approve the App Manifest (task 2080, ADR 0133). It is a browser redirect with no session guaranteed, so it is PUBLIC — the unguessable, single-use, TTL'd `state` token (minted only for the signed-in owner and matched against provisioning_oauth_manifests) is the authorization, exactly as GitHub's own conversion `code` is \"the code IS the auth\". The web tier ONLY stores the code + flips status → 'code_received'; the control-plane runner (the sole token-holder) exchanges it for the client secret and places it in web.env. The secret NEVER touches the browser or the web tier. rank: public — no session, no mutation of authority, no secret revealed; a bad/expired/replayed state is a no-op error page.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/provisioning/github-app/status": {
+      "get": {
+        "operationId": "get_provisioning_github_app_status",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/github-app/status",
+        "description": "GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding callback page polls (task 2096) to know when setup is done + where to send the owner. Same public-by-state model as the callback: the unguessable, single-use `state` token is the only key, and the response reveals only the manifest lifecycle status + the instance's own (already-public) domain — never a secret. Per-IP rate-limited because the page polls it every ~3s. `ready` is true iff the manifest reached 'done' (creds placed + /healthz verified) — the page then auto-redirects to https://<domain>. rank: public — no session, no mutation, no secret; an unknown state is a 404 no-op.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningGithubAppStatusResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/provisioning/health": {
+      "get": {
+        "operationId": "get_provisioning_health",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/health",
+        "description": "GET /provisioning/health — liveness + the core version this module mounted against. rank: public (a plain liveness read; no write, no sensitive data).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningHealthResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/provisioning/instances": {
+      "get": {
+        "operationId": "get_provisioning_instances",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/instances",
+        "description": "GET /provisioning/instances — the caller's own instances + each open intent. rank: any authenticated builder (own resource read).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningInstancesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_provisioning_instances",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances",
+        "description": "POST /provisioning/instances — request a new instance. rank: any authenticated builder (own resource). ENQUEUES a 'provision' intent + records the request; the runner (task P3) does the real standup. Idempotent on slug for the SAME owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409. Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated), domain?, tier? }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostProvisioningInstancesRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/provisioning/instances/{id}": {
+      "get": {
+        "operationId": "get_provisioning_instances_id",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/instances/:id",
+        "description": "GET /provisioning/instances/:id — read one of the caller's own instances. rank: any authenticated builder (own resource). 404 when the id isn't the caller's (own-scoped; does not leak another owner's instance existence).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningInstancesIdResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/provisioning/instances/{id}/force-teardown": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_force_teardown",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/force-teardown",
+        "description": "POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. Trust-safe by the same mechanism as the owner's own teardown: it ENQUEUES a 'teardown' intent for the control-plane runner; the web tier never holds cloud tokens. rank: archon (acts on another owner's infrastructure). Declared among the archon routes (archon-first).\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostProvisioningInstancesIdForceTeardownResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/provisioning/instances/{id}/github-app": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_github_app",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/github-app",
+        "description": "POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated builder (own resource). Returns the pre-filled manifest + the GitHub form-POST target (personal + org variants) + a one-time `state`; the browser POSTs the manifest to GitHub, the owner approves, and GitHub redirects back to the public callback below. The web tier only RECORDS the attempt (state token) — the control-plane runner does the token exchange + cred placement (trust boundary intact, ADR 0111 §2). Body: { account? ('personal'|'org') }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostProvisioningInstancesIdGithubAppRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostProvisioningInstancesIdGithubAppResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/provisioning/instances/{id}/teardown": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_teardown",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/teardown",
+        "description": "POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. rank: any authenticated builder (own resource). Enqueues a 'teardown' intent; the runner executes it (web tier holds no tokens). 404 when the id isn't the caller's; 409 when the instance isn't in a teardownable state.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostProvisioningInstancesIdTeardownResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/provisioning/onboard-plan": {
+      "get": {
+        "operationId": "get_provisioning_onboard_plan",
         "tags": [
           "provisioning"
         ],
@@ -7233,7 +8134,259 @@
         "x-source": "modules/provisioning/routes/provisioning.js",
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/analytics/ecosystem": {
+      "get": {
+        "operationId": "get_public_analytics_ecosystem",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/analytics/ecosystem",
+        "description": "ecosystem-wide dev-curve aggregate; individuals stripped.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/lifecycle/routes/analytics.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/blockers/{id}": {
+      "get": {
+        "operationId": "get_public_blockers_id",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/blockers/:id",
+        "description": "Public blocker resolver (task 654) — same minimal-projection posture as the idea resolver. id + status ONLY (title/body/resolution_note are all internal). rank: public — id/status only.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/public.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPublicBlockersIdResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/bounty-table": {
+      "get": {
+        "operationId": "get_public_bounty_table",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/bounty-table",
+        "description": "V3.R65 task 284: red-team bounty payout table by severity. Single source of truth is modules/security/security.js (defaults + env overrides), carved to the `security` kernel PORT (BV1.R79 / ADR 0093 §1); the /builders hall renders this under \"Red-team rewards\". Same port-resolve pattern as /public/cost-summary resolving the `reward` port. No auth — it's just the public reward schedule (security is default-on). rank: public — red-team bounty payout table (reward schedule).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/public.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPublicBountyTableResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/branding": {
+      "get": {
+        "operationId": "get_public_branding",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/branding",
+        "description": "the client-safe branding projection (R56 task 1195, ADR 0062 §3). Lets the hall + the OFF-BOX status page (served from GitHub Pages, so it can only read branding cross-origin — it can't be server-injected) resolve instance strings from config instead of hard-coding them. R56 exposes the configurable currency label; R57 (task 1196) extends clientBranding() with identity + theme + copy. Long cache: the pack is committed config, not live state, and the resolver is a boot-time singleton.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/public.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/cost-summary": {
+      "get": {
+        "operationId": "get_public_cost_summary",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/cost-summary",
+        "description": "GDS task 118: `daily` + `daily_credits` are guaranteed gap-free (one row per day from the earliest event through CURRENT_DATE, server timezone) so the treasury chart's cumulative line carries forward on idle days and always reaches today. The gap-fill is implemented inside db.costSummary() via generate_series + LEFT JOIN. System 1 / task 1345: the same payload now also carries additive by_source / by_tier / savings blocks (existing keys keep their shape) — a pure passthrough; the shaping + the savings-table guard live in costSummary(). rank: public — treasury chart feed.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/public.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/estimation-drift": {
+      "get": {
+        "operationId": "get_public_estimation_drift",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/estimation-drift",
+        "description": "est-vs-actual aggregate.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/public.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/grades": {
+      "get": {
+        "operationId": "get_public_grades",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/grades",
+        "description": "PMS-V2 task 197: rolling 7d quality-grade tile + 30d trend for the dashboard. rank: public — rolling quality-grade tile + 30d trend.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/public.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPublicGradesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/ideas/{id}": {
+      "get": {
+        "operationId": "get_public_ideas_id",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/ideas/:id",
+        "description": "Public idea resolver (task 654) — the open-web counterpart to the hall's authenticated /inbox/:id. Minimal projection ONLY (id, status, kind): an idea's title/body is internal and may name unshipped work, so it is NEVER returned here. The status dashboard renders this as a minimal card + an \"open in Builders' Hall\" link (where a signed-in builder sees the full record). SELECT only the non-sensitive columns so the title never even leaves the DB. rank: public — id/status/type only.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/public.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPublicIdeasIdResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": []
+      }
+    },
+    "/public/leaderboard": {
+      "get": {
+        "operationId": "get_public_leaderboard",
+        "tags": [
+          "public"
+        ],
+        "summary": "GET /public/leaderboard",
+        "description": "PMS-V2 task 188: each row now carries an `achievements` string[] (top 5 unlocked IDs by sort_order) so the dashboard can render inline emoji rows without a follow-up API call. Single SQL query — no N+1. rank: public — leaderboard with achievements; dashboard render.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/public.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPublicLeaderboardResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
@@ -7242,16 +8395,16 @@
         "security": []
       }
     },
-    "/public/analytics/ecosystem": {
+    "/public/modules": {
       "get": {
-        "operationId": "get_public_analytics_ecosystem",
+        "operationId": "get_public_modules",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/analytics/ecosystem",
-        "description": "ecosystem-wide dev-curve aggregate; individuals stripped.\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/modules",
+        "description": "the client-safe feature-module set (R54 task 1193, ADR 0062 §4). Lets the off-box status page (served from GitHub Pages, cross-origin) hide UI sections for disabled modules, the same way /public/branding feeds it instance strings. Module flags are booleans — nothing secret. Long cache: committed config, resolved as a boot-time singleton.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
-        "x-source": "modules/lifecycle/routes/analytics.js",
+        "x-source": "src/bongos/routes/public.js",
         "responses": {
           "200": {
             "description": "Success."
@@ -7263,56 +8416,42 @@
         "security": []
       }
     },
-    "/public/blockers/{id}": {
+    "/public/progress": {
       "get": {
-        "operationId": "get_public_blockers_id",
+        "operationId": "get_public_progress",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/blockers/:id",
-        "description": "Public blocker resolver (task 654) — same minimal-projection posture as the idea resolver. id + status ONLY (title/body/resolution_note are all internal). rank: public — id/status only.\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/progress",
+        "description": "version progress aggregate.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `id`."
-          }
-        ],
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicBlockersIdResponse"
+                  "$ref": "#/components/schemas/GetPublicProgressResponse"
                 }
               }
             }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
           }
         },
         "security": []
       }
     },
-    "/public/bounty-table": {
+    "/public/recent-shipped": {
       "get": {
-        "operationId": "get_public_bounty_table",
+        "operationId": "get_public_recent_shipped",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/bounty-table",
-        "description": "V3.R65 task 284: red-team bounty payout table by severity. Single source of truth is modules/security/security.js (defaults + env overrides), carved to the `security` kernel PORT (BV1.R79 / ADR 0093 §1); the /builders hall renders this under \"Red-team rewards\". Same port-resolve pattern as /public/cost-summary resolving the `reward` port. No auth — it's just the public reward schedule (security is default-on). rank: public — red-team bounty payout table (reward schedule).\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/recent-shipped",
+        "description": "GDS task 191: `?days=7|30|90` restricts to that trailing window; `?days=all` or omitted with no query returns the historical 30-row \"recent\" feed. Any other value falls back to all-time (still capped by the row limit) so a malformed query never produces an empty list. rank: public — recent shipped tasks (windowed).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
@@ -7321,7 +8460,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicBountyTableResponse"
+                  "$ref": "#/components/schemas/GetPublicRecentShippedResponse"
                 }
               }
             }
@@ -7333,40 +8472,26 @@
         "security": []
       }
     },
-    "/public/branding": {
-      "get": {
-        "operationId": "get_public_branding",
-        "tags": [
-          "public"
-        ],
-        "summary": "GET /public/branding",
-        "description": "the client-safe branding projection (R56 task 1195, ADR 0062 §3). Lets the hall + the OFF-BOX status page (served from GitHub Pages, so it can only read branding cross-origin — it can't be server-injected) resolve instance strings from config instead of hard-coding them. R56 exposes the configurable currency label; R57 (task 1196) extends clientBranding() with identity + theme + copy. Long cache: the pack is committed config, not live state, and the resolver is a boot-time singleton.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          }
-        },
-        "security": []
-      }
-    },
-    "/public/cost-summary": {
+    "/public/ref-ids": {
       "get": {
-        "operationId": "get_public_cost_summary",
+        "operationId": "get_public_ref_ids",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/cost-summary",
-        "description": "GDS task 118: `daily` + `daily_credits` are guaranteed gap-free (one row per day from the earliest event through CURRENT_DATE, server timezone) so the treasury chart's cumulative line carries forward on idle days and always reaches today. The gap-fill is implemented inside db.costSummary() via generate_series + LEFT JOIN. System 1 / task 1345: the same payload now also carries additive by_source / by_tier / savings blocks (existing keys keep their shape) — a pure passthrough; the shaping + the savings-table guard live in costSummary(). rank: public — treasury chart feed.\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/ref-ids",
+        "description": "The id allow-list the doc-ref linkifier (scripts/gds/linkify-refs.js) and its CI gate consult to decide which bare \"#NNN\" are real references worth rewriting — and to WHICH resolver (task 629: task vs idea vs blocker, since the hall resolves /#/task/N, /#/idea/N, /#/blocker/N). IDs only — no titles or bodies — so it exposes nothing beyond what a number already implies, and it needs no builder token (so CI can call it). Cached longer than the live feeds: the id sets grow slowly and a few minutes of staleness only delays linkifying a brand-new reference. `tasks` stays the first key for back-compat with the pre-task 629 linkifier shape. rank: public — task/idea/blocker id allow-lists for the linkifier + CI gate.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPublicRefIdsResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
@@ -7375,19 +8500,26 @@
         "security": []
       }
     },
-    "/public/estimation-drift": {
+    "/public/repo-health": {
       "get": {
-        "operationId": "get_public_estimation_drift",
+        "operationId": "get_public_repo_health",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/estimation-drift",
-        "description": "est-vs-actual aggregate.\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/repo-health",
+        "description": "V3.R91 task 352: repo-health substrate. Latest daily snapshot from repo_health_snapshots (written by scripts/gds/repo-metrics.js) + a small trailing trend so the status page can draw LOC / dead-exports / stale- branch lines over time. Same auth-free + cached + JSON-shape contract as the other public surfaces above. `?days=N` (1..90, default 30) sizes the trend window. rank: public — repo-health substrate (LOC, dead exports, stale branches).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPublicRepoHealthResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
@@ -7396,14 +8528,14 @@
         "security": []
       }
     },
-    "/public/grades": {
+    "/public/repo-info": {
       "get": {
-        "operationId": "get_public_grades",
+        "operationId": "get_public_repo_info",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/grades",
-        "description": "PMS-V2 task 197: rolling 7d quality-grade tile + 30d trend for the dashboard. rank: public — rolling quality-grade tile + 30d trend.\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/repo-info",
+        "description": "GitHub URL bases for the deployed checkout (V3.R13-followup-2 task 411). Derived from `git remote get-url origin` at server boot, cached. Used by /builders/primer to rewrite repo-relative markdown links to GitHub blob/tree URLs without hardcoding the repo identity in implementation code (V3.R12 task 236 rule). When ownership transfers, the deploy's git remote changes and the served links follow with no code edits.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
@@ -7412,7 +8544,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicGradesResponse"
+                  "$ref": "#/components/schemas/GetPublicRepoInfoResponse"
                 }
               }
             }
@@ -7424,14 +8556,14 @@
         "security": []
       }
     },
-    "/public/ideas/{id}": {
+    "/public/tasks/{id}": {
       "get": {
-        "operationId": "get_public_ideas_id",
+        "operationId": "get_public_tasks_id",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/ideas/:id",
-        "description": "Public idea resolver (task 654) — the open-web counterpart to the hall's authenticated /inbox/:id. Minimal projection ONLY (id, status, kind): an idea's title/body is internal and may name unshipped work, so it is NEVER returned here. The status dashboard renders this as a minimal card + an \"open in Builders' Hall\" link (where a signed-in builder sees the full record). SELECT only the non-sensitive columns so the title never even leaves the DB. rank: public — id/status/type only.\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/tasks/:id",
+        "description": "Single-task resolver for \"#NNN\" deep links. Our docs reference GDS task IDs as bare \"#NNN\"; read on github.com those collide with GitHub's own PR/issue autolinker (a separate number space) and mis-link, so they are rewritten to status-dashboard permalinks (status.amazonprimea.com/#/task/N) that resolve here. Privacy gate: a full title/summary is exposed ONLY for already-public work (status shipped|confirmed — same surface as /public/recent-shipped). In-flight tasks return status + version with the title WITHHELD, so unshipped or security-sensitive task names never leak to the open web. `kind`/`priority` are non-sensitive and always returned. rank: public — single-task resolver for doc deep links (title gated to shipped/confirmed).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "parameters": [
@@ -7451,7 +8583,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicIdeasIdResponse"
+                  "$ref": "#/components/schemas/GetPublicTasksIdResponse"
                 }
               }
             }
@@ -7466,14 +8598,14 @@
         "security": []
       }
     },
-    "/public/leaderboard": {
+    "/public/uptime": {
       "get": {
-        "operationId": "get_public_leaderboard",
+        "operationId": "get_public_uptime",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/leaderboard",
-        "description": "PMS-V2 task 188: each row now carries an `achievements` string[] (top 5 unlocked IDs by sort_order) so the dashboard can render inline emoji rows without a follow-up API call. Single SQL query — no N+1. rank: public — leaderboard with achievements; dashboard render.\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/uptime",
+        "description": "Uptime: current status + 90-day history bucketed by hour. Returns per-service: current_status, uptime_pct_90d, history (array of { hour: ISO string, up: n, total: n } for the last 90*24 hours). rank: public — uptime feed (90-day hourly history).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
@@ -7482,7 +8614,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicLeaderboardResponse"
+                  "$ref": "#/components/schemas/GetPublicUptimeResponse"
                 }
               }
             }
@@ -7494,19 +8626,26 @@
         "security": []
       }
     },
-    "/public/modules": {
+    "/public/versions": {
       "get": {
-        "operationId": "get_public_modules",
+        "operationId": "get_public_versions",
         "tags": [
           "public"
         ],
-        "summary": "GET /public/modules",
-        "description": "the client-safe feature-module set (R54 task 1193, ADR 0062 §4). Lets the off-box status page (served from GitHub Pages, cross-origin) hide UI sections for disabled modules, the same way /public/branding feeds it instance strings. Module flags are booleans — nothing secret. Long cache: committed config, resolved as a boot-time singleton.\n\n**Rank:** `public` — No authentication — any caller.",
+        "summary": "GET /public/versions",
+        "description": "read-only surface for status.amazonprimea.com.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetPublicVersionsResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
@@ -7515,165 +8654,270 @@
         "security": []
       }
     },
-    "/public/progress": {
+    "/scouting": {
       "get": {
-        "operationId": "get_public_progress",
+        "operationId": "get_scouting",
         "tags": [
-          "public"
+          "scouting"
         ],
-        "summary": "GET /public/progress",
-        "description": "version progress aggregate.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
+        "summary": "GET /scouting",
+        "description": "the internal talent directory across every project. The Archon gate here is the load-bearing protection (\"NOT shown to builders\"): a non-Archon is 403'd before any cross-builder data is read.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/platform-identity/routes/scouting.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicProgressResponse"
+                  "$ref": "#/components/schemas/GetScoutingResponse"
                 }
               }
             }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         },
-        "security": []
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
       }
     },
-    "/public/recent-shipped": {
-      "get": {
-        "operationId": "get_public_recent_shipped",
+    "/search": {
+      "post": {
+        "operationId": "post_search",
         "tags": [
-          "public"
+          "search"
         ],
-        "summary": "GET /public/recent-shipped",
-        "description": "GDS task 191: `?days=7|30|90` restricts to that trailing window; `?days=all` or omitted with no query returns the historical 30-row \"recent\" feed. Any other value falls back to all-time (still capped by the row limit) so a malformed query never produces an empty list. rank: public — recent shipped tasks (windowed).\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
+        "summary": "POST /search",
+        "description": "POST /search — two modes (ADR 0095 C1 / task 1658, progressive disclosure): 1. SUMMARY (default): body { q: string, limit?: 1..50, source_kind? }. Returns the ranked compact layer — each hit carries a snippet plus `snippet_tokens` (what you already see) and `full_tokens` (what a full expansion would COST), so the caller sees the price before paying it. 2. EXPAND: body { expand: <chunkId> } (with q optional). Returns that one chunk's FULL body + `body_tokens`, scoped exactly like search (rank + owner from the session), so expand can't widen visibility. Both shapes stay backward-compatible: the old { q } request still returns { query, count, results } — the new per-hit fields are additive. Single-line opener so the deterministic route-rank auditor classifies the chain (requireBuilder → 'any-builder') — ADR 0016 / route-rank-check.js.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/memory/routes/search.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSearchRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicRecentShippedResponse"
+                  "$ref": "#/components/schemas/PostSearchResponse"
                 }
               }
             }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/search/mark": {
+      "post": {
+        "operationId": "post_search_mark",
+        "tags": [
+          "search"
+        ],
+        "summary": "POST /search/mark",
+        "description": "POST /search/mark — the write half of the memory-usefulness feedback loop (ADR 0095 C3, task 1660). Body { chunk_id: int, useful?: bool }. Records that a recalled chunk did (useful=true, the default) or did NOT (useful=false) help, so the ranker lifts the useful and fades the dead-end. SCOPING (ADR 0016): the caller's id + rank come ONLY from the session, never the body — searchChunks-equivalent scope is re-applied in the UPDATE WHERE, so a chunk the caller couldn't have seen can't be voted on (→ updated:false). Single-line opener so the route-rank auditor classifies the chain.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/memory/routes/search.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSearchMarkRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         },
-        "security": []
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
       }
     },
-    "/public/ref-ids": {
+    "/security/adr": {
       "get": {
-        "operationId": "get_public_ref_ids",
+        "operationId": "get_security_adr",
         "tags": [
-          "public"
+          "security"
         ],
-        "summary": "GET /public/ref-ids",
-        "description": "The id allow-list the doc-ref linkifier (scripts/gds/linkify-refs.js) and its CI gate consult to decide which bare \"#NNN\" are real references worth rewriting — and to WHICH resolver (task 629: task vs idea vs blocker, since the hall resolves /#/task/N, /#/idea/N, /#/blocker/N). IDs only — no titles or bodies — so it exposes nothing beyond what a number already implies, and it needs no builder token (so CI can call it). Cached longer than the live feeds: the id sets grow slowly and a few minutes of staleness only delays linkifying a brand-new reference. `tasks` stays the first key for back-compat with the pre-task 629 linkifier shape. rank: public — task/idea/blocker id allow-lists for the linkifier + CI gate.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
+        "summary": "GET /security/adr",
+        "description": "GET /api/gds/security/adr Metic+ only. Returns the full security ADR as { adr_md, source, fetched_at } when the file is provisioned; otherwise 404 with a structured hint. The rank gate runs BEFORE the file-existence check so a Xenos sees 403 regardless of whether the document is provisioned — we don't want existence-or-not to leak below the rank line. rank: metic+archon — trust-tier access to the threat model + defenses inventory (ADR 0020).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/security.js",
         "responses": {
           "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetPublicRefIdsResponse"
-                }
-              }
-            }
+            "description": "Success."
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         },
-        "security": []
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
       }
     },
-    "/public/repo-health": {
+    "/security/docs": {
       "get": {
-        "operationId": "get_public_repo_health",
+        "operationId": "get_security_docs",
         "tags": [
-          "public"
+          "security"
         ],
-        "summary": "GET /public/repo-health",
-        "description": "V3.R91 task 352: repo-health substrate. Latest daily snapshot from repo_health_snapshots (written by scripts/gds/repo-metrics.js) + a small trailing trend so the status page can draw LOC / dead-exports / stale- branch lines over time. Same auth-free + cached + JSON-shape contract as the other public surfaces above. `?days=N` (1..90, default 30) sizes the trend window. rank: public — repo-health substrate (LOC, dead exports, stale branches).\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
+        "summary": "GET /security/docs",
+        "description": "GET /api/gds/security/docs — list doc METADATA (no content). rank: archon — index of exploit-detail engagement reports.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/security.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicRepoHealthResponse"
+                  "$ref": "#/components/schemas/GetSecurityDocsResponse"
                 }
               }
             }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         },
-        "security": []
-      }
-    },
-    "/public/repo-info": {
-      "get": {
-        "operationId": "get_public_repo_info",
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_security_docs",
         "tags": [
-          "public"
+          "security"
         ],
-        "summary": "GET /public/repo-info",
-        "description": "GitHub URL bases for the deployed checkout (V3.R13-followup-2 task 411). Derived from `git remote get-url origin` at server boot, cached. Used by /builders/primer to rewrite repo-relative markdown links to GitHub blob/tree URLs without hardcoding the repo identity in implementation code (V3.R12 task 236 rule). When ownership transfers, the deploy's git remote changes and the served links follow with no code edits.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
+        "summary": "POST /security/docs",
+        "description": "POST /api/gds/security/docs — upsert a doc by slug. The director uploads each dated engagement report here after deploy. Body: { slug, title, content_md }. content_md uses a large explicit cap (full reports), NOT the small LIMITS.DESCRIPTION. Returns 201 + the row. rank: archon — writes exploit-detail report bodies.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/security.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSecurityDocsRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicRepoInfoResponse"
+                  "$ref": "#/components/schemas/PostSecurityDocsResponse"
                 }
               }
             }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         },
-        "security": []
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
       }
     },
-    "/public/tasks/{id}": {
+    "/security/docs/{slug}": {
       "get": {
-        "operationId": "get_public_tasks_id",
+        "operationId": "get_security_docs_slug",
         "tags": [
-          "public"
+          "security"
         ],
-        "summary": "GET /public/tasks/:id",
-        "description": "Single-task resolver for \"#NNN\" deep links. Our docs reference GDS task IDs as bare \"#NNN\"; read on github.com those collide with GitHub's own PR/issue autolinker (a separate number space) and mis-link, so they are rewritten to status-dashboard permalinks (status.amazonprimea.com/#/task/N) that resolve here. Privacy gate: a full title/summary is exposed ONLY for already-public work (status shipped|confirmed — same surface as /public/recent-shipped). In-flight tasks return status + version with the title WITHHELD, so unshipped or security-sensitive task names never leak to the open web. `kind`/`priority` are non-sensitive and always returned. rank: public — single-task resolver for doc deep links (title gated to shipped/confirmed).\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
+        "summary": "GET /security/docs/:slug",
+        "description": "GET /api/gds/security/docs/:slug — one doc WITH content, or 404. rank: archon — reads the full exploit-detail report body.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/security.js",
         "parameters": [
           {
-            "name": "id",
+            "name": "slug",
             "in": "path",
             "required": true,
             "schema": {
               "type": "string"
             },
-            "description": "Path parameter `id`."
+            "description": "Path parameter `slug`."
           }
         ],
         "responses": {
@@ -7682,7 +8926,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicTasksIdResponse"
+                  "$ref": "#/components/schemas/GetSecurityDocsSlugResponse"
                 }
               }
             }
@@ -7690,85 +8934,75 @@
           "400": {
             "$ref": "#/components/responses/BadRequest"
           },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
           "404": {
             "$ref": "#/components/responses/NotFound"
           }
         },
-        "security": []
-      }
-    },
-    "/public/uptime": {
-      "get": {
-        "operationId": "get_public_uptime",
-        "tags": [
-          "public"
-        ],
-        "summary": "GET /public/uptime",
-        "description": "Uptime: current status + 90-day history bucketed by hour. Returns per-service: current_status, uptime_pct_90d, history (array of { hour: ISO string, up: n, total: n } for the last 90*24 hours). rank: public — uptime feed (90-day hourly history).\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetPublicUptimeResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
+        "security": [
+          {
+            "builderSession": []
           }
-        },
-        "security": []
+        ]
       }
     },
-    "/public/versions": {
+    "/security/reports": {
       "get": {
-        "operationId": "get_public_versions",
+        "operationId": "get_security_reports",
         "tags": [
-          "public"
+          "security"
         ],
-        "summary": "GET /public/versions",
-        "description": "read-only surface for status.amazonprimea.com.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/public.js",
+        "summary": "GET /security/reports",
+        "description": "GET /api/bongos/security/reports?status=<status> Archon-only, newest-first. The Archon dashboard view fetches this on load + after each adjudication action. ?status= narrows to one lifecycle bucket (open / repro_attempted / confirmed / disputed / fixed / wontfix); omitted = all. rank: archon — adjudication surface; reading every builder's reports.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/security/routes/reports.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetPublicVersionsResponse"
+                  "$ref": "#/components/schemas/GetSecurityReportsResponse"
                 }
               }
             }
           },
           "400": {
             "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
           }
         },
-        "security": []
-      }
-    },
-    "/search": {
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
       "post": {
-        "operationId": "post_search",
+        "operationId": "post_security_reports",
         "tags": [
-          "search"
+          "security"
         ],
-        "summary": "POST /search",
-        "description": "POST /search — two modes (ADR 0095 C1 / task 1658, progressive disclosure): 1. SUMMARY (default): body { q: string, limit?: 1..50, source_kind? }. Returns the ranked compact layer — each hit carries a snippet plus `snippet_tokens` (what you already see) and `full_tokens` (what a full expansion would COST), so the caller sees the price before paying it. 2. EXPAND: body { expand: <chunkId> } (with q optional). Returns that one chunk's FULL body + `body_tokens`, scoped exactly like search (rank + owner from the session), so expand can't widen visibility. Both shapes stay backward-compatible: the old { q } request still returns { query, count, results } — the new per-hit fields are additive. Single-line opener so the deterministic route-rank auditor classifies the chain (requireBuilder → 'any-builder') — ADR 0016 / route-rank-check.js.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/memory/routes/search.js",
+        "summary": "POST /security/reports",
+        "description": "POST /api/bongos/security/reports — file a new vulnerability report. V3.R64 (task 283). Used by the /builder-redteam skill. Metic+ only — Xenos can't open the bounty surface (the rank gate keeps the noise-floor sane; a Xenos who finds a real flaw can flag it through normal channels). Body: { target, severity, title, description?, repro_steps_md? } Returns 201 + the inserted row (status='open' by default; the Archon view picks it up immediately). rank: metic+archon — bounty intake; Xenos kept out by design (V3.R63).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/security/routes/reports.js",
         "requestBody": {
-          "required": false,
+          "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PostSearchRequest"
+                "$ref": "#/components/schemas/PostSecurityReportsRequest"
               }
             }
           },
@@ -7780,7 +9014,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PostSearchResponse"
+                  "$ref": "#/components/schemas/PostSecurityReportsResponse"
                 }
               }
             }
@@ -7802,22 +9036,33 @@
         ]
       }
     },
-    "/search/mark": {
+    "/security/reports/{id}/confirm": {
       "post": {
-        "operationId": "post_search_mark",
+        "operationId": "post_security_reports_id_confirm",
         "tags": [
-          "search"
+          "security"
+        ],
+        "summary": "POST /security/reports/:id/confirm",
+        "description": "POST /api/bongos/security/reports/:id/confirm Body: { drachmae_awarded?: integer } — defaults to the severity tier bounty if omitted. Marks the report confirmed, stamps confirmed_at, and sets drachmae_awarded. rank: archon — confirms a payout-eligible report.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/security/routes/reports.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
         ],
-        "summary": "POST /search/mark",
-        "description": "POST /search/mark — the write half of the memory-usefulness feedback loop (ADR 0095 C3, task 1660). Body { chunk_id: int, useful?: bool }. Records that a recalled chunk did (useful=true, the default) or did NOT (useful=false) help, so the ranker lifts the useful and fades the dead-end. SCOPING (ADR 0016): the caller's id + rank come ONLY from the session, never the body — searchChunks-equivalent scope is re-applied in the UPDATE WHERE, so a chunk the caller couldn't have seen can't be voted on (→ updated:false). Single-line opener so the route-rank auditor classifies the chain.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/memory/routes/search.js",
         "requestBody": {
           "required": false,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PostSearchMarkRequest"
+                "$ref": "#/components/schemas/PostSecurityReportsIdConfirmRequest"
               }
             }
           },
@@ -7825,7 +9070,14 @@
         },
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostSecurityReportsIdConfirmResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -7835,32 +9087,46 @@
           },
           "403": {
             "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         },
         "security": [
           {
             "builderSession": []
           }
-        ]
-      }
-    },
-    "/security/docs": {
-      "get": {
-        "operationId": "get_security_docs",
-        "tags": [
-          "security"
+        ]
+      }
+    },
+    "/security/reports/{id}/dispute": {
+      "post": {
+        "operationId": "post_security_reports_id_dispute",
+        "tags": [
+          "security"
+        ],
+        "summary": "POST /security/reports/:id/dispute",
+        "description": "POST /api/bongos/security/reports/:id/dispute Marks the report disputed and clears drachmae_awarded. rank: archon — dispute adjudication.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "x-rank": "archon",
+        "x-source": "modules/security/routes/reports.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
         ],
-        "summary": "GET /security/docs",
-        "description": "GET /api/gds/security/docs — list doc METADATA (no content). rank: archon — index of exploit-detail engagement reports.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
-        "x-rank": "archon",
-        "x-source": "src/bongos/routes/security.js",
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetSecurityDocsResponse"
+                  "$ref": "#/components/schemas/PostSecurityReportsIdDisputeResponse"
                 }
               }
             }
@@ -7873,6 +9139,9 @@
           },
           "403": {
             "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         },
         "security": [
@@ -7880,46 +9149,51 @@
             "builderSession": []
           }
         ]
-      },
+      }
+    },
+    "/security/reports/{id}/fix": {
       "post": {
-        "operationId": "post_security_docs",
+        "operationId": "post_security_reports_id_fix",
         "tags": [
           "security"
         ],
-        "summary": "POST /security/docs",
-        "description": "POST /api/gds/security/docs — upsert a doc by slug. The director uploads each dated engagement report here after deploy. Body: { slug, title, content_md }. content_md uses a large explicit cap (full reports), NOT the small LIMITS.DESCRIPTION. Returns 201 + the row. rank: archon — writes exploit-detail report bodies.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "summary": "POST /security/reports/:id/fix",
+        "description": "POST /api/bongos/security/reports/:id/fix Marks the report fixed and stamps fixed_at. Does not change fix_task_id — link that separately via /link-fix. rank: archon — fix-confirmation adjudication.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
         "x-rank": "archon",
-        "x-source": "src/bongos/routes/security.js",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostSecurityDocsRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
+        "x-source": "modules/security/routes/reports.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PostSecurityDocsResponse"
+                  "$ref": "#/components/schemas/PostSecurityReportsIdFixResponse"
                 }
               }
             }
           },
           "400": {
-            "$ref": "#/components/responses/ValidationFailed"
+            "$ref": "#/components/responses/BadRequest"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
           },
           "403": {
             "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         },
         "security": [
@@ -7929,40 +9203,51 @@
         ]
       }
     },
-    "/security/docs/{slug}": {
-      "get": {
-        "operationId": "get_security_docs_slug",
+    "/security/reports/{id}/link-fix": {
+      "post": {
+        "operationId": "post_security_reports_id_link_fix",
         "tags": [
           "security"
         ],
-        "summary": "GET /security/docs/:slug",
-        "description": "GET /api/gds/security/docs/:slug — one doc WITH content, or 404. rank: archon — reads the full exploit-detail report body.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
+        "summary": "POST /security/reports/:id/link-fix",
+        "description": "POST /api/bongos/security/reports/:id/link-fix Body: { task_id: integer } — attaches a fix-task FK. Doesn't change status (a confirmed report can have a linked fix-task while still open work). 422 if the referenced task doesn't exist. rank: archon — linking a report to its fix-task in the queue.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
         "x-rank": "archon",
-        "x-source": "src/bongos/routes/security.js",
+        "x-source": "modules/security/routes/reports.js",
         "parameters": [
           {
-            "name": "slug",
+            "name": "id",
             "in": "path",
             "required": true,
             "schema": {
               "type": "string"
             },
-            "description": "Path parameter `slug`."
+            "description": "Path parameter `id`."
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSecurityReportsIdLinkFixRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/GetSecurityDocsSlugResponse"
+                  "$ref": "#/components/schemas/PostSecurityReportsIdLinkFixResponse"
                 }
               }
             }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
@@ -8193,11 +9478,241 @@
             "$ref": "#/components/responses/NotFound"
           }
         },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/sso/activity/rollup": {
+      "post": {
+        "operationId": "post_sso_activity_rollup",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/activity/rollup",
+        "description": "POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). Server-to-server, client_id+client_secret auth. Keyed to the AUTHENTICATED client_id. Descriptive analytics for the Archon-only scouting view — never authority. rank: public — authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoActivityRollupRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostSsoActivityRollupResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
+    "/sso/authorize": {
+      "get": {
+        "operationId": "get_sso_authorize",
+        "tags": [
+          "sso"
+        ],
+        "summary": "GET /sso/authorize",
+        "description": "GET /sso/authorize?client_id=&redirect_uri=&state= — the browser authorize leg. rank: public — this is an authentication entry point, not an authorization surface. It is gated on a LIVE HUB SESSION (resolved inline via resolveSession; a missing session 302s to the hub's own web sign-in and returns here), NOT on a builder RANK. It mints identity-only codes.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/sso/device/poll": {
+      "post": {
+        "operationId": "post_sso_device_poll",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/device/poll",
+        "description": "POST /sso/device/poll — poll the hub device flow. On GitHub approval, upsert the platform account and mint an audience-scoped EdDSA assertion for the client that was BOUND at start (from the origin) — the poll takes NO client_id, so the CLI cannot influence the audience. Returns the SAME poll states as the core device flow, plus { state:'ok', assertion } on success. rank: public — the device_code (GitHub's) is the bearer; the assertion carries identity ONLY and is useless to anyone but the origin-bound client (aud-scoped).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoDevicePollRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
+    "/sso/device/start": {
+      "post": {
+        "operationId": "post_sso_device_start",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/device/start",
+        "description": "POST /sso/device/start — begin CLI federation. The client is resolved from the USER-TYPED instance ORIGIN via the registry (getClientByOrigin) and BOUND to the device flow — the CLI never names the audience. This closes the confused-deputy where a malicious instance manifest could steer the mint at a victim client_id (ADR 0141 §1 security fix). Runs the GitHub device flow against the HUB's app and returns the codes. Identity is established as a platform ACCOUNT at poll time — never a hub-builder session (ADR 0141: identity federated, authority local). rank: public — an authentication entry point; the origin is public, and the poll's GitHub approval is the real gate.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoDeviceStartRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
+    "/sso/membership/check-in": {
+      "post": {
+        "operationId": "post_sso_membership_check_in",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/membership/check-in",
+        "description": "POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). Server-to-server, authed by client_id + client_secret (same constant-time check as /sso/token). Upserts the account (so a CLI-only builder still appears in My Projects) + the membership with a COARSE role. The client_id is taken from the AUTHENTICATED client — the caller cannot report membership for a project it doesn't hold the secret for. rank: public — authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoMembershipCheckInRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostSsoMembershipCheckInResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
+    "/sso/pubkey": {
+      "get": {
+        "operationId": "get_sso_pubkey",
+        "tags": [
+          "sso"
+        ],
+        "summary": "GET /sso/pubkey",
+        "description": "GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). An instance provisioned WITHOUT the key in env can fetch it here; the value is public by design (it only VERIFIES assertions, never signs). rank: public — a public key is not a secret; no auth needed.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetSsoPubkeyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
+    "/sso/token": {
+      "post": {
+        "operationId": "post_sso_token",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/token",
+        "description": "POST /sso/token — server-to-server code redemption. rank: public — authenticated by client_id + client_secret (constant-time hash compare in clientSecretValid), NOT a builder session/rank. This is the confidential-client leg; the instance calls it from its server, never the browser. Returns IDENTITY ONLY (github_id, login, display_name, avatar_url).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoTokenRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostSsoTokenResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
       }
     },
     "/tasks": {
@@ -8567,8 +10082,8 @@
           "tasks"
         ],
         "summary": "POST /tasks/:id/abandon",
-        "description": "POST /tasks/:id/abandon — terminal \"retire this task\" transition (task 987). The lifecycle had promote/ship/confirm/resolve but no first-class way to KILL a task that is no longer relevant: the only paths to status='abandoned' were offboarding a builder or a raw SQL UPDATE, so stale/moot tasks lingered in 'ready' as claimable noise. Refuses on a shipped task (immutable history) and on a task with an active claim (release it first); idempotent on an already- abandoned task. The abandon + its `reason` land in audit_log via the writing middleware, so the ledger keeps a record of who retired what. rank: archon — terminal lifecycle mutation / scope removal (ADR 0016). This is the inverse of /promote and belongs to the same archon-gated scope-control surface, never self-serviceable by a lower rank.\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
-        "x-rank": "archon",
+        "description": "POST /tasks/:id/abandon — terminal \"retire this task\" transition (task 987). The lifecycle had promote/ship/confirm/resolve but no first-class way to KILL a task that is no longer relevant: the only paths to status='abandoned' were offboarding a builder or a raw SQL UPDATE, so stale/moot tasks lingered in 'ready' as claimable noise. Refuses on a shipped task (immutable history) and on a task with an active claim (release it first); idempotent on an already- abandoned task. The abandon + its `reason` land in audit_log via the writing middleware, so the ledger keeps a record of who retired what. rank: metic+archon — scope removal; the inverse of /promote, and re-ranked to match it (ADR 0152, was archon under ADR 0090). A Metic who may author, shape, and promote work may also retire it: leaving the kill switch an Archon rung higher than the create switch only forced the owner to clean up after the triage they already delegated. Not one-way any more — /promote restores an abandoned task to backlog at the same rank — and the guards below (shipped refused, active claim refused) plus the audit_log entry are unchanged.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
+        "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/tasks.js",
         "parameters": [
           {
@@ -9322,7 +10837,7 @@
           "tasks"
         ],
         "summary": "POST /tasks/:id/promote",
-        "description": "backlog→ready promotion; scope mutation; ADR 0090 (was archon).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
+        "description": "backlog→ready promotion; scope mutation; ADR 0090 (was archon). Also the UN-ABANDON path (ADR 0152): 'abandoned' → 'backlog'. When abandon moved down to Metic+ it needed an undo at the same rank, or a Metic's mis-retire would be unrecoverable without Archon SQL (no other route restores an abandoned task — PATCH refuses `status` outright). A restore lands in **backlog**, never straight to ready: the task was retired for a reason, so it re-enters as un-workable and takes a second, deliberate promote to become claimable again.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/tasks.js",
         "parameters": [
@@ -9761,8 +11276,8 @@
           "versions"
         ],
         "summary": "POST /versions/:id/done-when",
-        "description": "Auth (Archon): create a done-when criterion at RUNTIME. ADR 0105 moved scope-truth seeds (versions/goals/criteria) out of the normal migration path, so a brand-new criterion on a RUNNING instance can no longer be added by a plain migration (migrations/instance/ applies only under the owner opt-in GDS_APPLY_INSTANCE_SEEDS=1, a DR step). This is the vector a planning session uses to add a criterion to a live version WITHOUT a droplet migrate. Archon- only — done_when_criteria is scope-shaping (mirrors the criterion-proposal ratify gate). Pinned in route-rank-check.MODULE_EXPECTED_RANKS. rank: archon — scope-truth write (a new criterion on a version).\n\n**Rank:** `archon` — Archon only (the single owner — ratification, infra, rank changes).",
-        "x-rank": "archon",
+        "description": "Auth (Metic+, then the goal's own authority): create a done-when criterion at RUNTIME. ADR 0105 moved scope-truth seeds (versions/goals/criteria) out of the normal migration path, so a brand-new criterion on a RUNNING instance can no longer be added by a plain migration (migrations/instance/ applies only under the owner opt-in GDS_APPLY_INSTANCE_SEEDS=1, a DR step). This is the vector a planning session uses to add a criterion to a live version WITHOUT a droplet migrate. ADR 0154 — authority over a GOAL's criteria follows GOAL OWNERSHIP, not global rank. A Metic who may create the goal (POST /goals) and author the tasks under it (POST /tasks, ADR 0090) may now write the criteria those tasks gate — but only inside a goal they own or manage. Deliberately NOT a flat re-rank: - An unsatisfied criterion permanently blocks version close (version-close.js counts satisfied === total per VERSION, regardless of goal) and goal auto-achieve (db.achieveGoalIfComplete). There is NO delete route, so it cannot be undone via the API — the same backward ratchet as unsatisfy, which stays Archon. - So a non-Archon must name a goal_id (version-level criteria stay Archon), must be that goal's OWNER or MANAGER (isGoalOwnerOrManager — the same predicate behind visibility/invite/role management), and the goal must be open on a planning/building version. That bounds the blast radius to a workspace they already hold. An unauthorized caller is masked behind bad_goal_id so the route is not an existence oracle (ADR 0112). Pinned in route-rank-check.MODULE_EXPECTED_RANKS. rank: metic+archon — criterion create, walled by goal ownership (ADR 0154).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).",
+        "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/done-when.js",
         "parameters": [
           {
@@ -10018,18 +11533,33 @@
           "status"
         ]
       },
+      "GetAuthWebAdmissionStatusResponse": {
+        "type": "object",
+        "properties": {
+          "admitted": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "admitted"
+        ]
+      },
       "GetBackupStatusResponse": {
         "type": "object",
         "properties": {
           "backup_dir": {},
           "db_name": {},
           "latest_dump": {},
+          "stale": {},
+          "age_hours": {},
           "trigger_running": {}
         },
         "required": [
           "backup_dir",
           "db_name",
           "latest_dump",
+          "stale",
+          "age_hours",
           "trigger_running"
         ]
       },
@@ -10229,6 +11759,15 @@
           "count"
         ]
       },
+      "GetGithubReposResponse": {
+        "type": "object",
+        "properties": {
+          "repos": {}
+        },
+        "required": [
+          "repos"
+        ]
+      },
       "GetGoalsIdConflictsResponse": {
         "type": "object",
         "properties": {
@@ -10478,6 +12017,50 @@
           "files"
         ]
       },
+      "GetMemoryBuildersBuilderIdFileResponse": {
+        "type": "object",
+        "properties": {
+          "builder_id": {},
+          "forensic": {
+            "type": "boolean"
+          },
+          "path": {},
+          "content": {},
+          "sha256": {},
+          "byte_len": {},
+          "mtime": {},
+          "updated_at": {},
+          "created_at": {}
+        },
+        "required": [
+          "builder_id",
+          "forensic",
+          "path",
+          "content",
+          "sha256",
+          "byte_len",
+          "mtime",
+          "updated_at",
+          "created_at"
+        ]
+      },
+      "GetMemoryBuildersBuilderIdFilesResponse": {
+        "type": "object",
+        "properties": {
+          "builder_id": {},
+          "forensic": {
+            "type": "boolean"
+          },
+          "count": {},
+          "files": {}
+        },
+        "required": [
+          "builder_id",
+          "forensic",
+          "count",
+          "files"
+        ]
+      },
       "GetMemoryFileResponse": {
         "type": "object",
         "properties": {
@@ -10540,6 +12123,26 @@
           "submissions"
         ]
       },
+      "GetMyProjectsInvitesResponse": {
+        "type": "object",
+        "properties": {
+          "invites": {}
+        },
+        "required": [
+          "invites"
+        ]
+      },
+      "GetMyProjectsResponse": {
+        "type": "object",
+        "properties": {
+          "owned": {},
+          "building": {}
+        },
+        "required": [
+          "owned",
+          "building"
+        ]
+      },
       "GetOverrideRequestsResponse": {
         "type": "object",
         "properties": {
@@ -10549,6 +12152,24 @@
           "requests"
         ]
       },
+      "GetProjectsFeaturedResponse": {
+        "type": "object",
+        "properties": {
+          "projects": {}
+        },
+        "required": [
+          "projects"
+        ]
+      },
+      "GetProjectsResponse": {
+        "type": "object",
+        "properties": {
+          "projects": {}
+        },
+        "required": [
+          "projects"
+        ]
+      },
       "GetProvisioningFleetResponse": {
         "type": "object",
         "properties": {
@@ -10776,6 +12397,15 @@
           "page"
         ]
       },
+      "GetScoutingResponse": {
+        "type": "object",
+        "properties": {
+          "builders": {}
+        },
+        "required": [
+          "builders"
+        ]
+      },
       "GetSecurityDocsResponse": {
         "type": "object",
         "properties": {
@@ -10794,6 +12424,19 @@
           "doc"
         ]
       },
+      "GetSecurityReportsResponse": {
+        "type": "object",
+        "properties": {
+          "reports": {},
+          "bounty_table": {},
+          "statuses": {}
+        },
+        "required": [
+          "reports",
+          "bounty_table",
+          "statuses"
+        ]
+      },
       "GetSessionsIdResponse": {
         "type": "object",
         "properties": {
@@ -10833,6 +12476,19 @@
           "offset"
         ]
       },
+      "GetSsoPubkeyResponse": {
+        "type": "object",
+        "properties": {
+          "alg": {},
+          "format": {},
+          "public_key_b64": {}
+        },
+        "required": [
+          "alg",
+          "format",
+          "public_key_b64"
+        ]
+      },
       "GetTasksClaimableResponse": {
         "type": "object",
         "properties": {
@@ -11156,7 +12812,14 @@
             "type": "integer",
             "minimum": 1
           },
-          "reviewed_at": {}
+          "reviewed_at": {},
+          "merged_into_idea_id": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "triage_note": {
+            "type": "string"
+          }
         },
         "additionalProperties": false
       },
@@ -11258,6 +12921,27 @@
           "known_sounds"
         ]
       },
+      "PatchProjectsIdFeaturedRequest": {
+        "type": "object",
+        "properties": {
+          "featured": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "featured"
+        ],
+        "additionalProperties": false
+      },
+      "PatchProjectsIdFeaturedResponse": {
+        "type": "object",
+        "properties": {
+          "project": {}
+        },
+        "required": [
+          "project"
+        ]
+      },
       "PatchTasksIdRequest": {
         "type": "object",
         "properties": {
@@ -11408,6 +13092,30 @@
           "interval"
         ]
       },
+      "PostAuthBackchannelLogoutRequest": {
+        "type": "object",
+        "properties": {
+          "logout_token": {
+            "type": "string",
+            "maxLength": 4096
+          }
+        },
+        "required": [
+          "logout_token"
+        ],
+        "additionalProperties": false
+      },
+      "PostAuthBackchannelLogoutResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
       "PostAuthCliTokenIssueResponse": {
         "type": "object",
         "properties": {
@@ -11427,6 +13135,30 @@
           "paste_command"
         ]
       },
+      "PostAuthDeviceExchangeRequest": {
+        "type": "object",
+        "properties": {
+          "assertion": {
+            "type": "string",
+            "maxLength": 4096
+          }
+        },
+        "required": [
+          "assertion"
+        ],
+        "additionalProperties": false
+      },
+      "PostAuthDeviceExchangeResponse": {
+        "type": "object",
+        "properties": {
+          "token": {},
+          "builder": {}
+        },
+        "required": [
+          "token",
+          "builder"
+        ]
+      },
       "PostAuthDevicePollRequest": {
         "type": "object",
         "properties": {
@@ -11939,13 +13671,15 @@
           "claim": {},
           "task": {},
           "just_unlocked": {},
-          "overlap_warning": {}
+          "overlap_warning": {},
+          "reward": {}
         },
         "required": [
           "claim",
           "task",
           "just_unlocked",
-          "overlap_warning"
+          "overlap_warning",
+          "reward"
         ]
       },
       "PostCostRequest": {
@@ -12114,6 +13848,28 @@
           "message"
         ]
       },
+      "PostGithubReposRequest": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "maxLength": 100
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "additionalProperties": false
+      },
+      "PostGithubReposResponse": {
+        "type": "object",
+        "properties": {
+          "repo": {}
+        },
+        "required": [
+          "repo"
+        ]
+      },
       "PostGoalsIdArchiveResponse": {
         "type": "object",
         "properties": {
@@ -12570,6 +14326,16 @@
           "succeeds_goal_id"
         ]
       },
+      "PostInboxIdRatifyRequest": {
+        "type": "object",
+        "properties": {
+          "notes_md": {
+            "type": "string",
+            "maxLength": 10000
+          }
+        },
+        "additionalProperties": false
+      },
       "PostInboxRequest": {
         "type": "object",
         "properties": {
@@ -12681,7 +14447,9 @@
       "PostLlmCacheLookupResponse": {
         "type": "object",
         "properties": {
-          "hit": {},
+          "hit": {
+            "type": "boolean"
+          },
           "result": {}
         },
         "required": [
@@ -12701,7 +14469,9 @@
       "PostLlmCacheStoreResponse": {
         "type": "object",
         "properties": {
-          "stored": {},
+          "stored": {
+            "type": "boolean"
+          },
           "result_cost_usd": {}
         },
         "required": [
@@ -12824,24 +14594,97 @@
       "PostModulesKeySubmitRequest": {
         "type": "object",
         "properties": {
-          "signed_by": {
+          "signed_by": {
+            "type": "string",
+            "maxLength": 200
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostModulesKeySubmitResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "submission": {}
+        },
+        "required": [
+          "ok",
+          "submission"
+        ]
+      },
+      "PostMyProjectsClientIdLeaveResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "left": {}
+        },
+        "required": [
+          "ok",
+          "left"
+        ]
+      },
+      "PostMyProjectsInvitesClientIdAcceptResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "accepted": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok",
+          "accepted"
+        ]
+      },
+      "PostMyProjectsInvitesClientIdDeclineResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "accepted": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok",
+          "accepted"
+        ]
+      },
+      "PostMyProjectsJoinRequest": {
+        "type": "object",
+        "properties": {
+          "origin": {
             "type": "string",
-            "maxLength": 200
+            "maxLength": 512
           }
         },
+        "required": [
+          "origin"
+        ],
         "additionalProperties": false
       },
-      "PostModulesKeySubmitResponse": {
+      "PostMyProjectsJoinResponse": {
         "type": "object",
         "properties": {
           "ok": {
             "type": "boolean"
           },
-          "submission": {}
+          "status": {},
+          "project": {},
+          "message": {}
         },
         "required": [
           "ok",
-          "submission"
+          "status",
+          "project",
+          "message"
         ]
       },
       "PostOverrideRequestsIdDecideRequest": {
@@ -12860,6 +14703,59 @@
         ],
         "additionalProperties": false
       },
+      "PostProjectsInviteRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "github_login": {
+            "type": "string",
+            "maxLength": 200
+          }
+        },
+        "required": [
+          "client_id",
+          "github_login"
+        ],
+        "additionalProperties": false
+      },
+      "PostProjectsRequest": {
+        "type": "object",
+        "properties": {
+          "origin": {
+            "type": "string",
+            "maxLength": 512
+          },
+          "name": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "tagline": {
+            "type": "string",
+            "maxLength": 400
+          },
+          "art_url": {
+            "type": "string",
+            "maxLength": 2048
+          }
+        },
+        "required": [
+          "origin",
+          "name"
+        ],
+        "additionalProperties": false
+      },
+      "PostProjectsResponse": {
+        "type": "object",
+        "properties": {
+          "project": {}
+        },
+        "required": [
+          "project"
+        ]
+      },
       "PostProvisioningInstancesIdForceTeardownResponse": {
         "type": "object",
         "properties": {
@@ -13036,6 +14932,109 @@
           "doc"
         ]
       },
+      "PostSecurityReportsIdConfirmRequest": {
+        "type": "object",
+        "properties": {
+          "drachmae_awarded": {}
+        },
+        "additionalProperties": false
+      },
+      "PostSecurityReportsIdConfirmResponse": {
+        "type": "object",
+        "properties": {
+          "report": {}
+        },
+        "required": [
+          "report"
+        ]
+      },
+      "PostSecurityReportsIdDisputeResponse": {
+        "type": "object",
+        "properties": {
+          "report": {}
+        },
+        "required": [
+          "report"
+        ]
+      },
+      "PostSecurityReportsIdFixResponse": {
+        "type": "object",
+        "properties": {
+          "report": {}
+        },
+        "required": [
+          "report"
+        ]
+      },
+      "PostSecurityReportsIdLinkFixRequest": {
+        "type": "object",
+        "properties": {
+          "task_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          }
+        },
+        "required": [
+          "task_id"
+        ],
+        "additionalProperties": false
+      },
+      "PostSecurityReportsIdLinkFixResponse": {
+        "type": "object",
+        "properties": {
+          "report": {}
+        },
+        "required": [
+          "report"
+        ]
+      },
+      "PostSecurityReportsRequest": {
+        "type": "object",
+        "properties": {
+          "target": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200
+          },
+          "severity": {
+            "type": "string",
+            "maxLength": 32
+          },
+          "title": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200
+          },
+          "description": {
+            "type": "string",
+            "maxLength": 50000
+          },
+          "repro_steps_md": {
+            "type": "string",
+            "maxLength": 50000
+          }
+        },
+        "required": [
+          "target",
+          "severity",
+          "title"
+        ],
+        "additionalProperties": false
+      },
+      "PostSecurityReportsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "report": {},
+          "bounty_table": {}
+        },
+        "required": [
+          "ok",
+          "report",
+          "bounty_table"
+        ]
+      },
       "PostSessionOptimizeRequest": {
         "type": "object",
         "properties": {
@@ -13105,6 +15104,172 @@
           "token_reward": {}
         }
       },
+      "PostSsoActivityRollupRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "client_secret": {
+            "type": "string",
+            "maxLength": 512
+          },
+          "github_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          },
+          "credits": {
+            "type": "number"
+          },
+          "tasks_shipped": {
+            "type": "number"
+          },
+          "karma": {
+            "type": "number"
+          },
+          "rank": {
+            "type": "string",
+            "maxLength": 32
+          },
+          "disciplines": {}
+        },
+        "required": [
+          "client_id",
+          "client_secret",
+          "github_id"
+        ],
+        "additionalProperties": false
+      },
+      "PostSsoActivityRollupResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
+      "PostSsoDevicePollRequest": {
+        "type": "object",
+        "properties": {
+          "device_code": {
+            "type": "string",
+            "maxLength": 512
+          }
+        },
+        "required": [
+          "device_code"
+        ],
+        "additionalProperties": false
+      },
+      "PostSsoDeviceStartRequest": {
+        "type": "object",
+        "properties": {
+          "origin": {
+            "type": "string",
+            "maxLength": 512
+          }
+        },
+        "required": [
+          "origin"
+        ],
+        "additionalProperties": false
+      },
+      "PostSsoMembershipCheckInRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "client_secret": {
+            "type": "string",
+            "maxLength": 512
+          },
+          "github_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          },
+          "github_login": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "display_name": {
+            "type": "string",
+            "maxLength": 400
+          },
+          "avatar_url": {
+            "type": "string",
+            "maxLength": 2048
+          },
+          "role": {
+            "type": "string",
+            "maxLength": 16
+          }
+        },
+        "required": [
+          "client_id",
+          "client_secret",
+          "github_id",
+          "github_login"
+        ],
+        "additionalProperties": false
+      },
+      "PostSsoMembershipCheckInResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
+      "PostSsoTokenRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "client_secret": {
+            "type": "string",
+            "maxLength": 512
+          },
+          "code": {
+            "type": "string",
+            "maxLength": 512
+          },
+          "redirect_uri": {
+            "type": "string",
+            "maxLength": 2048
+          }
+        },
+        "required": [
+          "client_id",
+          "client_secret",
+          "code",
+          "redirect_uri"
+        ],
+        "additionalProperties": false
+      },
+      "PostSsoTokenResponse": {
+        "type": "object",
+        "properties": {
+          "github_id": {},
+          "github_login": {},
+          "display_name": {},
+          "avatar_url": {}
+        },
+        "required": [
+          "github_id",
+          "github_login",
+          "display_name",
+          "avatar_url"
+        ]
+      },
       "PostTasksIdAbandonRequest": {
         "type": "object",
         "properties": {
@@ -13719,9 +15884,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 223,
-  "x-schema-count": 244,
+  "x-endpoint-count": 258,
+  "x-schema-count": 288,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 166,
+  "x-response-schemas": 194,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }