@bongos/core 1.18.0 → 1.18.3

package/scripts/hall-preview/fixtures/inbox.json

@@ -1,330 +0,0 @@
-{
-  "ideas": [
-    {
-      "id": "535",
-      "title": "cloudbongos.com gate JS is Cloudflare-cached ~4h with no purge-on-deploy — gate fixes lag for users",
-      "body_md": "Surfaced while shipping task 2146 (gate minimap fix). The origin (cloudbongos.com droplet) pulled the fix within its 2-min timer, but real users kept getting the OLD gate JS because Cloudflare edge-cached it.\n\n**Root gap:** `brand/cloud-bongos/gate/*.js` is served with `cache-control: max-age=14400` (4h) and Cloudflare caches it at the edge. `scripts/deploy/deploy-cloudbongos.sh` has NO cache-purge step, and the box's only CF token (`/etc/cloudbongos/box.env`, DNS:Edit + Zone:Read scope) is rejected by `purge_cache` (code 10000). So every gate code change is invisible to users for up to ~4h after deploy.\n\n**Fix options:**\n- (a) Add `Zone:Cache Purge` to the box CF token, then append a targeted `purge_cache` call (for changed static files) to the end of `deploy-cloudbongos.sh`.\n- (b) Lower the asset `cache-control` and/or add a content-hash/version query to the `space.js` include in `gate/index.html` so a new deploy busts the cache automatically.\n\nOption (b) is the more robust, secret-free fix (no token widening).\n",
-      "kind": "infra",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-09T21:12:55.282Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "534",
-      "title": "package-core: consumer core still ships amazonprimea/OTB refs in SKILL.md + cli-lib API_BASE fallback (CLAUDE.md already stubbed)",
-      "body_md": "While verifying task 2131 (fresh demo re-provision on @bongos/core 1.17.1), the CLAUDE.md\nstub (task 2121) is confirmed clean — 18/18 core CLAUDE.md are stubs, 0 CLAUDE.md leak. BUT a\nwhole-tree sweep of the fresh demo checkout found ~213 files still referencing\n\"amazonprimea\"/\"off the boats\"/\"hermeslines\" — in .claude/skills/*/SKILL.md and the vendored\ncore copy (node_modules/@bongos/core/.claude/skills/). Characterized as NON-functional for a\nhosted instance (identity resolves from branding.neutral.json → demo.cloudbongos.com; web+CLI\nsign-in verified correct), because it's two things: (a) cli-lib.js's fallback default\n`const API_BASE = ic.resolveEnv('API_BASE') || 'https://amazonprimea.com'` — a consumer running\nthe raw CLI UNCONFIGURED would hit the OTB prod URL; (b) stale prose examples in SKILL.md docs.\nThis may be the deliberate \"verbatim functional files\" design (see memory\nproject-consumer-core-extraction-verbatim; CLAUDE.md stubbing was the exception). Proposal for\ntriage: decide whether package-core should also (1) neutralize the API_BASE fallback (resolve\nfrom branding publicOrigin, or no hardcoded default) and (2) scrub/neutralize brand refs in\nshipped SKILL.md, the way task 2121 did for CLAUDE.md. Relates to tasks 2121/1824, goal 26\n(CB↔OTB switchover / consumer cleanliness).\n",
-      "kind": "cleanup",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-09T17:21:24.975Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "533",
-      "title": "2103 rebrand/prune gaps + config-dir collision found live-refreshing demo (2102–2105 follow-ups)",
-      "body_md": "Found while live-refreshing ~/dev/demo (2026-07-08) to carry the 2102–2105 onboarding fixes. Three concrete follow-ups on the fixes just shipped:\n\n1. **Rebrand misses `User-Agent` product literals (2103 gap).** `buildRebrandRules`/`rebrandText` map origins, config-dirs and env-prefixes, but NOT the founder product name baked into HTTP `User-Agent` strings. After a full re-materialize of demo, 5 hooks still carry `amazonprimea-*` UA labels: `recall-hints.js`, `stop-refcheck.js`, `rank-change-greeting.js`, `conductor.js`, `pull-memory.js`. Cosmetic (the hooks target the right instance — only their self-identification leaks the founder brand), but it undercuts \"clean instance.\" Fix: add the `<founder-name>-` UA literal to the rebrand map (source brand identity.* → target).\n\n2. **Re-materialize never prunes now-excluded skills (2103 gap, upgrade path only).** `materializeClaude({overwrite:true})` copies-over but never DELETES. On a re-materialize/`bongos upgrade` over a prior materialize, every skill owned by a module that is disabled in the target lingers from the old copy — all 5 `otb-*` disabled-module skills stayed until pruned by hand. Fresh `bongos init` (empty .claude) is unaffected. Fix: after copying, remove instance skill dirs that are in `disabledModuleSkills()` (or, more general, reconcile — delete instance-side skill dirs not present in the new copy set).\n\n3. **Sibling instances collide on one session slot (config-dir gap).** `demo.cloudbongos.com` and `cloudbongos.com` both resolve configDir to the `cloudbongos` fallback → they share `~/.config/cloudbongos/gds-session.json`, so logging into one clobbers the other on the same machine. Consider pinning a per-instance `configDir` at provision (e.g. slug-derived) so several instances can be signed in side-by-side.\n\nAlso surfaced (separate, bigger): the packaged core deliberately excludes `.claude/hooks/` (publish-manifest), so hook fixes like 2105 can only reach an instance via a full-checkout materialize (control-plane provision), NOT via the vendored tarball / `bongos upgrade`. Fine today (all instances are control-plane-provisioned), but the future pure-npm-consumer path (task 2090) would ship an instance with skills and no hooks. And CORE_VERSION was NOT bumped for 2102–2105, so the version string no longer uniquely identifies a core tree.\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-08T23:22:27.719Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "531",
-      "title": "Provisioned instances ignore config/branding.json (GDS_BRANDING_FILE points at nonexistent branding.neutral.json)",
-      "body_md": "Provisioned standalone instances may ignore their own config/branding.json overrides.\n\nprovision.js `webEnvBody` writes `GDS_BRANDING_FILE=config/branding.neutral.json`, but the scaffold (init.js `writeConfigs`) writes the instance's identity/overrides to `config/branding.json`, NOT `branding.neutral.json`. On demo.cloudbongos.com the instance therefore loads the NEUTRAL base pack (no firstAdmin, default productName) and identity rides only web.env env-overrides (origins + the new `<prefix>_FIRST_ADMIN` from task 2079). So productName / worldName / currency set at `init` don't load until the owner re-brands.\n\nLikely fix: point `GDS_BRANDING_FILE` at `config/branding.json` (init.js's real output) OR have provision.js also emit those identity fields as env-overrides. Verify src/branding.js still merges the neutral base underneath (GDS_BRANDING_FILE = the OVERRIDES file, neutral = base).\n\nFound while fixing the FIRST_ADMIN gap (task 2079, goal 35 / criterion 165).\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-07T23:17:01.521Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "529",
-      "title": "Single-host standalone: /docs + /docs/openapi.json 404 at the edge (isModuleSurfaceHost skips apex-only routes when public/builders/status are one host)",
-      "body_md": "On a SINGLE-HOST standalone (demo.cloudbongos.com — publicOrigin = buildersOrigin = statusOrigin = one host), /docs and /docs/openapi.json return 404 at the public edge even though the files ship and loopback /docs -> 200.\n\nCAUSE: serve-internal.js gates /docs on `if (isModuleSurfaceHost(req)) return next();` (docs live on the apex, skipped for builders./status. surfaces). In single-host mode the apex host ALSO equals buildersOrigin/statusOrigin, so isModuleSurfaceHost(req) is TRUE for the apex host and /docs is wrongly skipped -> 404. Loopback (Host 127.0.0.1) doesn't match, so it serves.\n\nFIX DIRECTION: isModuleSurfaceHost must not treat the apex host as a module surface when public/builders/status collapse to one host — apex-only routes (/docs, /docs/openapi.json, /downloads/*) should still serve. Check other apex-only surfaces for the same single-host skip. Found during the task-2078 demo audit (2026-07-07).\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-07T18:06:08.665Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "528",
-      "title": "Standalone-on-control-plane TLS: bake proxied=true for wildcard-origin-cert subdomains (+ fix tls-check 404 on control plane)",
-      "body_md": "Discovered during task 2074 live activation (standing up demo.cloudbongos.com on the control-plane droplet 161.35.132.201).\n\nPROBLEM: provision.js/box-dns-cloudflare.sh create the instance A record with proxied=false (the co-tenant \"on-demand ACME / Let's Encrypt\" posture, ADR 0111 §4). But a *.cloudbongos.com subdomain on the CONTROL-PLANE box is shadowed by the wildcard Cloudflare Origin cert already loaded for the apexes (SAN *.cloudbongos.com, ADR 0126). Caddy serves that origin cert and never triggers on-demand ACME, so a DIRECT client (proxied=false) gets a publicly-UNTRUSTED cert (issuer: CloudFlare Origin CA) -> browser cert warning. It also exposes the control-plane's real IP in public DNS (worse here than for a game box, since this box holds the account tokens).\n\nSTOPGAP APPLIED: manually flipped demo.cloudbongos.com to proxied=true via the CF API (CF edge now fronts it with a public cert, origin cert valid behind Full-strict, IP hidden). Verified: public HTTPS returns a Google Trust Services cert, healthz ok.\n\nFIX (code): make the DNS proxied flag shape/placement-aware. For a STANDALONE instance whose domain falls under a zone where the control plane holds a wildcard origin cert (i.e. *.cloudbongos.com on this box), set proxied=true; otherwise keep proxied=false (co-tenant + custom-domain standalones still want on-demand ACME). Likely a boxExec-sibling decision in provision.js (dnsUpsertEnv) + a proxied param on box-dns-cloudflare.sh (currently hardcoded proxied:false). Consider an ADR — this is the TLS analogue of the task-2074 executor/IP shape-split.\n\nALSO: GET /api/bongos/provisioning/tls-check?domain=demo.cloudbongos.com returns 404 on the control-plane cloudbongos instance (the on-demand-TLS allow-list gate). Verify the provisioning module is enabled + current there; a 404 means on-demand ACME couldn't gate even if it did fire. Lower priority once proxied=true is the posture for *.cloudbongos.com.\n\nDepends on: task 2074 (shipped).\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-07T11:21:23.244Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "527",
-      "title": "Agents module goal cluster (#38/#39/#40): finalize criteria + seed tasks (Archon)",
-      "body_md": "# Agents module — goal cluster finalization bundle (2026-07-05/06)\n\n**Goals created (BONGOS-V1):** [#38] framework+registry · [#39] owner+builder authoring + event/on-demand roster · [#40] scheduled agents + spend guardrails. Created unscoped (scope wall rejects `agents` until the module is registered — retighten `scope_modules=['agents']` after Phase-1 task lands modules/agents/module.json).\n\n**Owner decisions (2026-07-05):** full framework + full roster; audiences owners+builders now, **end-users deferred** to a documented future goal (Phase 3); trigger types all three (event/cron/on-demand); **per-agent spend cap ~$5/mo** on top of the global ~$30/mo autonomy brake.\n\n**Load-bearing constraint (from adversarial critique):** the spawn primitive `grader.js runSubagent` is **fixed Read-only + bypassPermissions** (`--tools Read` hardcoded; only `model/cwd/timeout` are parametrizable). So **v1 agents are READ-ONLY observe-and-report** — no write principals, no Bash/Write/network, no tool-allowlist tiers in Phases 1–2. Trust model is **capability-equivalence, not rank-equivalence**: an agent's runtime authority = its tool set ∩ its (absent, in v1) service principal; author-rank only clamps what may be *declared*. Any write-capable/act-capable agent is DEFERRED to a future goal that first lands a parametrized-capability spawn path in grading (a PROTECTED_GLOBS edit, Archon-gated). Also drop the proposed new `grade.runSubagent` port — the existing `grade` provider already exposes `runSubagentCached`.\n\n**Finalization is Archon-gated** (jaxri is Metic): creating done-when criteria is `POST /api/bongos/versions/BONGOS-V1/done-when` (Archon-only), and core-touching tasks (grading/lifecycle/permission-paths) need Archon. Run `/planning-session` as Archon, or create criteria + tasks below, then link each criterion's gating tasks (`task_criteria`) and set `goal_id`.\n\n---\n\n## Goal #38 — Framework + registry (Phase 1)\n\n**Done-when criteria (outcome-shaped):**\n1. An agent declared in `.claude/agents/<name>.md` loads into the `agent_definitions` registry at boot, and `GET /api/bongos/agents` returns it with its resolved model tier + trigger type.\n2. A malformed definition (unknown trigger; missing persona; `trigger_spec.event` not in `EVENT_CATALOG`; scope exceeding an allowed module) is rejected by a pure `validateAgentDefinition()` with a clear error and does NOT mount (loader logs + skips, never crashes). `EVENT_CATALOG = ['task.shipped']` and fail-closed refuses any unwired event name.\n3. Every agent spawn goes through the existing `grade` port (`runSubagentCached`, read-only) and is billed to the LLM cost cache — no bespoke `child_process.spawn`; the modules-boundary fitness check stays green (no module→module require).\n4. An agent with no explicit `model_tier` defaults to `subagentDefault`; each spawn passes the branding-resolved concrete model id as `opts.model`.\n5. The built-in `historian` on-demand exemplar ships enabled and returns a cited result end-to-end via `scripts/gds/agent-invoke.js`.\n6. `agents-sync.js` reconciles `.claude/agents/*.md` → rows (`source=file`, never clobbering `source=db` rows), stamps `author_rank` from the committing builder's LIVE DB rank, re-runs the scope wall server-side (a definition scoped onto protected paths imports disabled+flagged, never armed), and every fire writes one `agent_runs` row (trigger_ref, gate decision, cost_usd, output_ref).\n\n**Seed tasks (deps in parens):**\n- T1 `modules/agents/module.json` (default:false; contributes routes/pollers/skills/migrations) validated by manifest-schema.js\n- T2 `modules/agents/migrations/agents_001_definitions.sql` — `agent_definitions` + `agent_runs`, namespaced\n- T3 `modules/agents/lib/validate.js` — pure `validateAgentDefinition(obj,{authorRank})` (EVENT_CATALOG=['task.shipped'], enum + scope-wall checks) (T1)\n- T4 `modules/agents/routes/agents.js` — `GET /agents`, `GET /agents/:name` (self-gated reads) (T1,T2)\n- T5 spawn adapter: resolve `model_tier`→concrete id via `api.branding()`, consume existing `grade.runSubagentCached`, write an `agent_runs` ledger row per fire (T2)\n- T6 `scripts/gds/agents-sync.js` — file↔DB reconcile at deploy; source=file upsert never clobbers source=db; stamps live author_rank + re-runs scope wall (T2,T3)\n- T7 `scripts/gds/agent-invoke.js` + `.claude/agents/historian.md` (reads ADR/session-log/learnings corpus, returns cited answers) (T4,T5)\n- T8 add `.claude/agents/` to permission-path awareness so a definition scoped onto permission paths is caught (T3)\n\n## Goal #39 — Owner + builder authoring + event/on-demand roster (Phase 2a) — depends on #38\n\n**Done-when criteria:**\n1. A Metic+ builder creates an agent via `POST /api/bongos/agents` and it appears in the registry with no Archon file edit; a sub-Metic author, or any author whose scope touches a protected/permission path, is refused server-side (DB-enforced; no file grants authority).\n2. Runtime authority is capability-equivalence: v1 agents are READ-ONLY (no write/service principal); author-rank clamps only what may be DECLARED (scope/trigger/model tier), enforced by the upward-only clamp + goalScopeCheck/permissionPathCheck scope wall.\n3. The on-ship event fabric fires on `task.shipped` only when the declarative `touches[]`-glob matches (cheap pre-filter BEFORE any model spawn), lands its finding in its declared sink (ideas.capture / Discord), and NEVER blocks the ship (observe-only; only the DB-gated Grader gates landing).\n4. Ships ≥1 working exemplar for event (`review-lens`) and on-demand (`historian`, `planner`), each defined in `.claude/agents/` not JS; `GET /agents` distinguishes built-in vs instance-authored provenance.\n5. Editing a definition + reload updates the row in place (no duplicate); disabling an agent stops it from being dispatched.\n\n**Seed tasks:**\n- rank-gated `POST/PATCH/DELETE/enable/disable/invoke` routes with the author-rank declaration clamp + scope wall\n- `modules/agents/pollers/event-router.js` — `api.on('task.shipped')` fan-out with the declarative touches[]-glob pre-filter + a depth/loop guard (never fire on an agent's own agent_runs-attributed ship) + spawn + route-output\n- roster `.claude/agents/*.md` (event): `review-lens`, `doc-link-keeper`, `dep-security-watch` (each on task.shipped + touches filter)\n- roster `.claude/agents/*.md` (on-demand): `historian`, `planner`, `onboarding-buddy`\n- clone-templates `art-tile-reviewer` + `world-consistency` marked `template:true` (load only where art-pipeline/game enabled)\n\n## Goal #40 — Scheduled agents + spend guardrails (Phase 2b) — depends on #39\n\n**Done-when criteria:**\n1. A scheduled agent runs on its `config/scheduled-routines.json` cadence via an in-process unref timer, opens with `autonomy-gate.decide()`, is inert until `OTB_AUTONOMY_ENABLED=1` if it writes state; an agent over the MTD ceiling is skipped with the skip recorded to `autonomy_runs`.\n2. Per-agent `spend_cap_usd` (default ~$5/mo) is enforced before spawn; agent spend is tagged `agent:<key>` and folded into the MTD rollup the deterministic gate reads, so cron + on-demand agent spend is visible to the brake.\n3. No roster agent re-executes an existing routine's state change — each wrapper declares `backing_routine` and either observes its output or replaces the routine (retiring the `scheduled-routines.json` entry in the same task). No double-run.\n4. The agents module's own tables/routes + `config/scheduled-routines.json` are covered by PROTECTED_GLOBS with a fitness assertion.\n5. The cron roster ships as `.claude/agents/*.md`: `ship-digest` (weekly), `link-sweep` (nightly), `criteria-watch` (nightly), `stale-claim-nudge` (daily).\n\n**Seed tasks:**\n- `modules/agents/pollers/cron-router.js` — one unref routine-timer per cadence bucket; each tick selects due cron agents + runs Step-0 autonomy precheck\n- extend MTD rollup + autonomy-gate so `source LIKE 'agent:%'` folds into the `cron:%` brake; add per-agent `spend_cap_usd` enforced before spawn (agents_002 migration)\n- add agents module tables/routes + `config/scheduled-routines.json` to PROTECTED_GLOBS (permission-path-check.js) + a fitness assertion\n- cron roster `.claude/agents/*.md`: ship-digest, link-sweep, criteria-watch, stale-claim-nudge (each declaring backing_routine; wrap, don't double-run)\n\n---\n\n## Deferred — Phase 3 (documented future goal, NOT created)\n**End-user-facing agent authorship** — the biggest trust jump (untrusted input meets a principal). Gated behind Phases 1–2. End-users get NO free-text authorship: they only instantiate an owner-published (Archon-only) template with typed/validated params; untrusted text enters strictly as delimited DATA. Capability-first defense: a dedicated low-priv `system_role=agent:enduser:<key>` principal, on-demand-only, `--tools Read`, output=return, `model=subagentRoutine`, SQL reads scoped to the end-user's own rows, per-user spend/rate quota, propose-never-dispose for any state change; operator global-disable flag; its own ADR. Create as a Phase-3 goal in a later planning pass once 1–2 are proven in production.\n\n## New ADRs to write during the build\n- Agents module architecture (definition format, registry, spawn-via-grade-port, trust = capability-equivalence, v1 read-only).\n- (Later) End-user agent trust model (Phase 3).\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-06T00:02:09.772Z",
-      "captured_by": "95",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "526",
-      "title": "cloudbongos own-provision runner unit missing on control plane (verify vs in-flight 2056)",
-      "body_md": "During the task 2071/2072 co-hosting-fleet migration (2026-07-05), I noticed the control-plane box (161.35.132.201) had `cloudbongos-provision-intent-runner.{service,timer}` installed + enabled + actively firing at ~22:36 UTC (task 2056's runner that drains cloudbongos.com's OWN provisioning_intents queue in the LOCAL cloudbongos DB). By ~23:2x UTC both unit files were GONE from /etc/systemd/system and `is-enabled` = not-found.\n\nMy 2071/2072 work never touched that name (I added cohost-* units + removed the differently-named provision-intent-runner-cloudbongos.* from task 2065; scp only added files). The control-plane pull-deploy only installs, never removes units. So this was removed by something else — most likely a parallel session's in-flight task 2056 (e2e standup) box work (that task is explicitly about updating the on-box provision-intent-runner; PR #772 from a parallel branch merged around the same window). It is a BOX-ONLY unit (not in repo infra/), so its removal leaves no git trace.\n\nImpact right now: LOW — the cloudbongos DB provisioning_intents queue is empty (0 pending, 0 provisioning_instances), so nothing is stuck. But if this was unintentional, cloudbongos.com's own instance-provisioning has NO drainer, and the next builders.cloudbongos.com instance request would sit forever (the \"queue never drains\" class 2056 was meant to fix).\n\nACTION: whoever owns task 2056 — confirm this removal is intended by the in-flight standup restructuring. If NOT intended, restore/re-enable a local-cloudbongos-DB provisioning runner on the control plane. Do NOT confuse it with cohost-provision-intent-runner (task 2071), which drains the AMAZONPRIMEA queue via the SSH tunnel, not the local cloudbongos DB.\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-05T23:27:47.112Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "524",
-      "title": "Deploy-time reconcile of the live Caddyfile vs repo infra/Caddyfile (on_demand_tls global + sites import)",
-      "body_md": "Surfaced during the goal-35 standup (task 2066 gap 2): the droplet's live /etc/caddy/Caddyfile drifts from repo infra/Caddyfile with no auto-sync. The `on_demand_tls { ask http://127.0.0.1:3002/api/bongos/provisioning/tls-check }` global + `import /etc/caddy/sites/*.caddy` had to be hand-applied on 161.35.132.201 (and 104.236.254.243). provision.js writes per-instance snippets into /etc/caddy/sites but ASSUMES the global import + on_demand_tls ask already exist.\n\nProposal: a deploy-time (or provision-preflight) reconcile step that idempotently ensures the base Caddyfile carries the on_demand_tls global + the sites/*.caddy import, runs `caddy validate`, then gracefully reloads — so a fresh control-plane box is provisioning-ready without manual Caddyfile surgery. Complements ADR 0128 (the privilege model) — that fixed the runner's ability to WRITE the snippets; this ensures the base config actually IMPORTS them.\n",
-      "kind": "infra",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-05T21:34:40.548Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "523",
-      "title": "search-ingest-md: a NUL byte rolls back the whole /recall ingest",
-      "body_md": "`scripts/gds/search-ingest-md.js` rolls back the ENTIRE ingest when any one chunk body contains a NUL byte (U+0000): Postgres rejects it with `invalid byte sequence for encoding \"UTF8\": 0x00`, so `/recall` never re-indexes.\n\n- **Surfaced by** the new cloudbongos deploy timer (task 2064) — the deploy's search-index step logged it (non-fatal, so the deploy is unaffected).\n- **Pre-existing + affects the co-hosting box identically** — same tree-walk + same code; there it's swallowed the same way, so amazonprimea.com's `/recall` may also be silently stale.\n- No *tracked* `.md` contains a raw NUL, so the byte is introduced in the chunk pipeline (`modules/memory/search-chunker.js`) or a generated/untracked `.md` on the box — worth a quick root-cause check.\n- **Fix:** strip the NUL (U+0000) from chunk bodies in `chunkFile()` (or right after `fs.readFileSync(abs,'utf8')`) before the upsert — NUL is invalid in a PG text column and meaningless in prose. Low-risk; fixes both boxes at once.\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-05T21:27:59.832Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "522",
-      "title": "Builder profile: shareable-by-login deep links (?builder=<login>)",
-      "body_md": "The v1 builder profile page (task 1467) resolves by numeric ?id=N, matching /builders/:id/onboarding. Friendlier, more shareable portfolio links would accept a github_login (/builders/profile?builder=<login>) and resolve login->id server-side — either a login lookup in the GET /builders/:id/profile route or a sibling by-login route in src/bongos/routes/builders.js. Small fast-follow to goal 25 bx-identity.\n",
-      "kind": "feature",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-05T20:01:18.464Z",
-      "captured_by": "95",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "521",
-      "title": "Repo deploy-prod.sh mirror is stale vs droplet ~/deploy.sh (missing ADR 0122 block)",
-      "body_md": "Repo deploy-script mirror is stale vs the droplet.\n\n`scripts/deploy/deploy-prod.sh` (the version-controlled mirror) is missing the ADR 0122 onboarding-diagram-render block (~17 lines, task 2027) that IS live in `/home/lars/deploy.sh` on prod. The file header explicitly warns that this exact drift is what hid the task-1026 healthcheck race for so long.\n\nFix: pull the droplet's current `~/deploy.sh` back into `scripts/deploy/deploy-prod.sh` so the two are byte-faithful again. Verify with `diff` after.\n\nFound while inspecting the deploy path for task 2020 (observability stand-up).\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-05T16:31:34.762Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "520",
-      "title": "Wire Grafana dashboard-sync into the prod deploy hook (task 2020 follow-up)",
-      "body_md": "Wire Grafana dashboard-sync into the prod deploy hook.\n\nAfter `git reset --hard origin/main`, the deploy should `cp infra/grafana/dashboards/*.json` + `provisioning/*` into `/etc/grafana` so a repo dashboard edit actually reaches live Grafana (its file provider auto-reloads every 30s). Today (post task 2020) the stack is live and dashboards render, but a repo dashboard edit needs a manual on-box `cp` to propagate.\n\nDo-with / blocked-on: reconcile the `scripts/deploy/deploy-prod.sh` repo mirror against the droplet's `~/deploy.sh` first (see sibling capture) so adding the sync step doesn't regress the drifted diagram-render block.\n\nNB: a symlink into the repo checkout will NOT work — the packaged `grafana-server` unit sets `ProtectHome=true`, so the grafana process cannot read a repo under `/home`. The copy must land in `/etc/grafana` (or be done by a root-run sync).\n\nDiscovered standing up the observability stack (task 2020).\n",
-      "kind": "infra",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-05T16:31:34.363Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "518",
-      "title": "Make goal # more direct in UI for users to reference, offer an easy copy paste on the goal so they can just make progress on what is priority in that goal",
-      "body_md": "Make goal # more direct in UI for users to reference, offer an easy copy paste on the goal so they can just make progress on what is priority in that goal\n\n— filed from Discord #ideas by lars589",
-      "kind": "feature",
-      "suggested_version": null,
-      "suggested_priority": null,
-      "captured_at": "2026-07-05T15:59:24.532Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "517",
-      "title": "Default-goal (goal 3 'BONGOS-V1 general') is blocked by goal 26 → every default POST /tasks task is born un-claimable",
-      "body_md": "Goal 3 (\"BONGOS-V1 — general\") — the auto-created catch-all that every `POST /tasks` task defaults into when no `goal_id` is given — carries an unsatisfied goal→goal dependency on goal 26 (\"Cloud Bongos productization and self-host\", status open).\n\nBecause `claimTask`'s `unsatisfiedDeps` inherits the task's goal dependencies (ADR 0086 §5, modules/lifecycle/db.js), EVERY task created via the default path is born `ready` but un-claimable — it fails `DEPS_NOT_SHIPPED` on goal 26 until goal 26 is achieved.\n\nHit while filing the box.js teardown bug (task 2034): the task defaulted into goal 3 and couldn't be claimed; I had to recreate it under goal 25 (\"Builder experience — hall, dev box, and skills\") to proceed.\n\nThis looks like a misconfigured/backwards edge — a catch-all \"general\" goal shouldn't gate on a specific feature goal, and it silently makes the most common create path produce dead tasks.\n\nFix candidates (verify intent first):\n- (a) remove the goal 3 → goal 26 dependency edge; or\n- (b) make the default-goal picker (generalGoalIdForVersion) skip a blocked goal, or never inherit deps from the catch-all general goal.\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-04T16:30:59.466Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "516",
-      "title": "Land task 1952: convert its ~20 pre-ADR-0116 flat errors (or run R04 sweep 1991) so the ratchet passes",
-      "body_md": "Task 1952 (Private goals API, branch claude/reverent-ellis-4774d9) is confirmed, merged-with-main, and green EXCEPT the ADR-0116 flat-error ratchet: its ~20 new routes in modules/lifecycle/routes/goals.js use the old flat `res.status(n).json({error:'x'})` style (branch predates the convention), pushing FLAT_ERROR_BASELINE over 562 → api_error_envelope_buildcheck + fitness fail.\n\nTo land: either (a) convert those ~20 sites to `res.fail('code',{status,message})` — safe, consumers key on HTTP status not the .error string (verified for 1658's expand endpoint) — then re-push + nudge publish-status; or (b) let the R04 sweep (task 1991) convert them wholesale.\n\nSystemic: the same ratchet will block ANY in-flight PR (of the ~20 open) that adds routes with flat errors. Consider sequencing the R04 sweep before/alongside landing the in-flight route-adding PRs.\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-04T15:13:00.205Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "515",
-      "title": "[task 2028 follow-up] Fitness guard: no hardcoded host identity in scheduled-routine prose",
-      "body_md": "Add a fitness check extending the \"portable code carries no hardcoded host identity\" spirit to .claude/scheduled-tasks/*/SKILL.md prose (grep the instance domain + ~/.config/<slug> patterns; hardFail on match). Task 2028 swept all 7 offending routine files clean and verified by re-grep, but the existing fitness host-identity check only scans src/gds + modules + kernel CLIs, so a future edit could reintroduce a hardcoded amazonprimea.com / ~/.config/otb into a routine with nothing to catch it. Deliberately NOT bolted onto 2028 to avoid adding an instance-wide CI gate under a docs-sweep task. Low-risk: after 2028 there are zero matches, so the guard passes immediately.",
-      "kind": "cleanup",
-      "suggested_version": null,
-      "suggested_priority": null,
-      "captured_at": "2026-07-04T14:46:22.115Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "511",
-      "title": "Goal managers can properly edit tasks (abandon, prioritize, and add dependencies on tasks from the UI)",
-      "body_md": "Goal managers can properly edit tasks (abandon, prioritize, and add dependencies on tasks from the UI)\n\n— filed from Discord #ideas by lars589",
-      "kind": "feature",
-      "suggested_version": null,
-      "suggested_priority": null,
-      "captured_at": "2026-07-04T11:57:12.146Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "510",
-      "title": "Goal 3 (general) has an unintended dep edge on goal 26 — blocks all general tasks",
-      "body_md": "Goal 3 (\"BONGOS-V1 — general\") carries a dependency edge on goal 26 (Cloud Bongos productization, status open). Via `db.js` `unsatisfiedDeps()` goal-dependency inheritance, ANY task under the general goal is unclaimable (409 DEPS_NOT_SHIPPED) until goal 26 is achieved.\n\nAlmost certainly unintended — \"general\" work should not be gated on productization shipping. Found 2026-07-04 while landing goal 36 (the meta planning task 1987 hit this 409 before being re-parented onto goal 36).\n\nFix: verify the `dependencies` row (from_kind=goal, from_id=3, to_kind=goal, to_id=26) and delete it if unintended. Also worth an audit for other surprising goal→goal edges.\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-04T11:16:51.960Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "509",
-      "title": "Emersonian droplet needs a GitHub deploy key for one-command core-pin upgrades",
-      "body_md": "The emersonian-circles droplet checkout (/home/lars/emersonian-circles) can't `git pull` from the private repo github.com/lars589/emersonian-circles — no deploy key (`Permission denied (publickey)`). During the task-1973 de-fork, the intended \"pin-bump upgrade flow\" (git pull + npm ci + restart) couldn't run, so the upgrade shipped via a scp'd git bundle instead.\n\nFix: add a read-only GitHub **deploy key** (or switch the remote to an https-token URL) on the droplet so future core-pin bumps are a one-command `git pull && npm ci && npm run migrate && systemctl restart`.\n\nRelevant to goal 26 R86 (task 1690 — make `bongos upgrade` a real update channel) and the standalone-instance provisioning direction (a provisioned standalone instance needs a deploy path from its private repo).\n",
-      "kind": "feature",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-04T00:58:44.176Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "508",
-      "title": "more achievements to promote full platform usage",
-      "body_md": "more achievements to promote full platform usage\n\n— filed from Discord #ideas by scootermack",
-      "kind": "feature",
-      "suggested_version": null,
-      "suggested_priority": null,
-      "captured_at": "2026-07-03T22:34:10.998Z",
-      "captured_by": "94",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "507",
-      "title": "Durable module enable/disable persistence past a deploy",
-      "body_md": "The hall Modules-tab toggle (task 1776, ADR 0107 §9) writes config/modules.json\nand reloads the live in-process module cache, so the effect is immediate on the\nbox. But deploy-prod.sh runs `git reset --hard origin/main` on every deploy,\nwhich would silently wipe an uncommitted toggle. Today the route deliberately\ndoes NOT auto-commit/push (an HTTP handler pushing to main bypasses the ship/\ngrade/deploy pipeline entirely — a bigger risk than the toggle not persisting).\n\nOptions to revisit: (a) a DB-backed override layer in src/modules.js's\nresolution precedence (checked above the instance config file, below env) so\nenablement survives a `git reset --hard` with no extra step, matching \"the GDS\nDB is the source of truth for live state\"; or (b) a reviewed, narrowly-scoped\nauto-commit-and-push path for this one config file if that's judged safe\nenough. See src/gds/routes/modules.js's top-of-file comment for the full\ntradeoff as reasoned through in task 1776.\n",
-      "kind": "feature",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-03T20:38:28.576Z",
-      "captured_by": "94",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "506",
-      "title": "tests/sandbox_stage.mjs no-op check fails on macOS (/var symlink); realpath both sides in syncWorktreeToServed",
-      "body_md": "tests/sandbox_stage.mjs — the sub-test \"syncWorktreeToServed: no-op when the session checkout IS the served root\" (~line 414) FAILS on macOS but passes on Linux CI.\n\nRoot cause: syncWorktreeToServed (scripts/gds/sandbox-stage.js:246) decides \"no-op\" via `path.resolve(sessionRoot) === path.resolve(servedRoot)`. sessionRoot comes from `git rev-parse --show-toplevel`, which git realpaths to `/private/var/folders/...` on macOS, while servedRoot is the raw `os.tmpdir()` path `/var/folders/...`. path.resolve does NOT resolve the macOS `/var → /private/var` symlink, so the two mismatch, the no-op branch is skipped, and `synced` returns true instead of false. On Linux CI `/tmp` has no such symlink, so it passes.\n\nFix: `fs.realpathSync` both paths before comparing (in the function, which also hardens the real box behavior, or at minimum in the test setup). Low priority — macOS-local test-run only; does not affect prod or CI. Surfaced while shipping task 1439 (the failure looked scary in the local unit gate but is environmental).\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-03T20:16:28.581Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "505",
-      "title": "Neutralize per-branch auth error prose (heading/detail still hardcode Archon/gate) — idea 351 follow-up to task 1439",
-      "body_md": "Task 1439 made renderAuthErrorPage's TEMPLATE strings brand-aware (title suffix / epigraph / h1 / default subtitle / default CTA now come from the branding pack `copy.authError`). But the `heading` + `detail` arguments passed by each call site in src/gds/routes/auth.js (the /auth/web/callback error branches, roughly lines 270–463) still hardcode OTB lore that renders on cloudbongos.com and every other instance:\n\n- \"...Start over and the gate will open.\" (state-mismatch branch)\n- \"...an Archon has already approved...\" / \"...an Archon will approve you...\" (NOT_APPROVED branch, incl. its opts.subtitle/note)\n- \"...the Archon must investigate the server logs.\" (500 branch)\n\nFix: source these per-branch strings from the branding pack too (add more `copy.authError.*` keys, or rephrase neutrally using rankLabels for \"Archon\"→\"Owner\"), mirroring the 1439 approach. This is the broader \"neutralize ALL auth-page copy\" pass that 1439 deliberately scoped out (1439 = the template defaults only). From idea 351 follow-up.\n",
-      "kind": "bug",
-      "suggested_version": "BONGOS-V1",
-      "suggested_priority": null,
-      "captured_at": "2026-07-03T20:16:28.166Z",
-      "captured_by": "1",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    },
-    {
-      "id": "504",
-      "title": "goal due dates",
-      "body_md": "goal due dates\n\n— filed from Discord #ideas by jaxri",
-      "kind": "feature",
-      "suggested_version": null,
-      "suggested_priority": null,
-      "captured_at": "2026-07-03T18:46:38.300Z",
-      "captured_by": "95",
-      "status": "open",
-      "promoted_to_task_id": null,
-      "reviewed_at": null
-    }
-  ],
-  "open_count": 151
-}

package/scripts/hall-preview/fixtures/inbox__detail.json

@@ -1,15 +0,0 @@
-{
-  "idea": {
-    "id": "1",
-    "title": "Preview-harness idea record — serves any #/idea/N deep-link",
-    "body_md": "Synthetic record for the shared deep-link overlay (task-detail.js). One fixture serves every id via the inbox/\\d+ fallback.",
-    "kind": "feature",
-    "suggested_version": "BONGOS-V1",
-    "suggested_priority": null,
-    "captured_at": "2026-07-01T12:00:00.000Z",
-    "captured_by": "1",
-    "status": "open",
-    "promoted_to_task_id": null,
-    "reviewed_at": null
-  }
-}

package/scripts/hall-preview/fixtures/instance.json

@@ -1,124 +0,0 @@
-{
-  "schema": "instance-manifest/v1",
-  "name": "Off the Boats",
-  "brand": {
-    "identity": {
-      "productName": "Off the Boats",
-      "worldName": "Amazonprimea",
-      "company": {
-        "name": "Hermeslines"
-      }
-    },
-    "currency": {
-      "label": "drachmae",
-      "symbol": ""
-    },
-    "theme": {
-      "colors": {
-        "bg": "#ece0c2",
-        "bgCard": "#f6ecd2",
-        "bgDeep": "#ddc99c",
-        "bgFrame": "#e3d0a4",
-        "ink": "#2a2110",
-        "inkSoft": "#6e5b3a",
-        "inkFaint": "#735f3d",
-        "rule": "#8b6f2c",
-        "ruleSoft": "#b89a55",
-        "accent": "#4a7d5c",
-        "accentDeep": "#2f5a3f",
-        "sea": "#2d6e7e",
-        "terracotta": "#a85530"
-      },
-      "fonts": {
-        "display": "\"Cinzel\", \"Cormorant Garamond\", \"Trajan Pro\", \"Iowan Old Style\", Georgia, serif",
-        "body": "\"EB Garamond\", \"Iowan Old Style\", \"Hoefler Text\", Georgia, serif",
-        "links": [
-          "https://fonts.googleapis.com/css2?family=Cinzel:wght@500;700&family=EB+Garamond:ital,wght@0,400;0,500;0,600;1,400;1,500&display=swap"
-        ]
-      },
-      "favicon": "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='serif'>Α</text></svg>",
-      "backdrop": "linear-gradient(180deg, #fde8c8 0%, #fff4e6 45%, #fffdfa 100%)"
-    },
-    "copy": {
-      "tagline": "Goods straight off the boats.",
-      "hallName": "Builders' Hall",
-      "notFound": "You've washed ashore on the wrong island."
-    },
-    "rankLabels": {
-      "xenos": "Xenos",
-      "thetes": "Thetes",
-      "metic": "Metic",
-      "archon": "Archon"
-    }
-  },
-  "modules": {
-    "enabled": {
-      "art-pipeline": true,
-      "autonomy": true,
-      "builder-settings": true,
-      "character-anim": true,
-      "demo": true,
-      "dev-box": true,
-      "discord": true,
-      "economy": true,
-      "game": true,
-      "grading": true,
-      "hall-ui": true,
-      "ideas": true,
-      "lifecycle": true,
-      "memory": true,
-      "onboarding": true,
-      "provisioning": true,
-      "security": true,
-      "sessions": true,
-      "status-ui": true
-    },
-    "disciplines": [
-      "engineer",
-      "ideator",
-      "artist"
-    ]
-  },
-  "ranks": [
-    {
-      "key": "xenos",
-      "tier": 1,
-      "label": "Xenos"
-    },
-    {
-      "key": "thetes",
-      "tier": 2,
-      "label": "Thetes"
-    },
-    {
-      "key": "metic",
-      "tier": 3,
-      "label": "Metic"
-    },
-    {
-      "key": "archon",
-      "tier": 4,
-      "label": "Archon"
-    }
-  ],
-  "repo": {
-    "owner": "lars589",
-    "repo": "amazonprimea",
-    "branch": "main",
-    "url": "https://github.com/lars589/amazonprimea"
-  },
-  "auth": {
-    "methods": [
-      "device-flow",
-      "web",
-      "app-pair"
-    ],
-    "configured": true
-  },
-  "admission": {
-    "policy": "invite-only"
-  },
-  "devBox": {
-    "available": true
-  }
-}