@bongos/core 1.18.19 → 1.19.2

package/src/bongos/auth.js

@@ -56,18 +56,47 @@ const { branding, userAgent } = require('../branding');
 
 const SCOPE = 'read:user';
 
+// The repo-acting scope the onboarding wizard opts into. `repo`, NOT `public_repo`.
+//
+// ADR 0143 §1 originally chose `public_repo` precisely to avoid the all-or-nothing
+// `repo`, and named its own reversal path: "revisit to `repo` only if private
+// support is needed". It is needed. `public_repo` grants write to PUBLIC repos
+// only, so ADOPTING an existing PRIVATE repo dies at the provisioner's scaffold
+// push with GitHub 403 "Write access to repository not granted" — observed live on
+// lars589/hermeslines-marketing. ADR 0155 takes the reversal at the owner's
+// explicit call, accepting the cost it names: a token we persist can now write to
+// EVERY repo the user owns, not just their public ones.
+const REPO_SCOPE = 'repo';
+
 // Web-flow OAuth scope. Identity (`read:user`) is all the builders'-hall sign-in
 // and the CLI Device Flow ever need. The onboarding wizard
-// (public-landing/create.html), however, lists + creates the signed-in user's own
-// GitHub repos (task 1002099) — which `read:user` cannot do — so it OPTS IN to a
-// broader scope. We add `public_repo`, NOT the all-or-nothing `repo`: it still
-// lists/creates PUBLIC repos (the norm for open-source Cloud Bongos instances)
-// but shows a far gentler consent screen and shrinks the blast radius of the
-// token we then persist (ADR 0143). Only the wizard passes { repos:true }; every
-// other sign-in stays identity-only. Pure + exported so the exact scope string
-// (a security-critical value) is unit-testable.
+// (public-landing/create.html), however, lists + creates + is pushed to by the
+// provisioner on the signed-in user's own GitHub repos (task 1002099) — which
+// `read:user` cannot do — so it OPTS IN to REPO_SCOPE. Only the wizard passes
+// { repos:true }; every other sign-in stays identity-only. Pure + exported so the
+// exact scope string (a security-critical value) is unit-testable.
 function scopeForWebFlow({ repos = false } = {}) {
-  return repos ? `${SCOPE} public_repo` : SCOPE;
+  return repos ? `${SCOPE} ${REPO_SCOPE}` : SCOPE;
+}
+
+// Does a scope string GitHub ACTUALLY GRANTED still satisfy the repo surfaces?
+//
+// WHY THIS EXISTS. Widening scopeForWebFlow does NOT upgrade tokens already in
+// `github_oauth_tokens` — a row minted before ADR 0155 carries `public_repo`, which
+// is enough to list and create PUBLIC repos. So every wizard call would still 200
+// while silently omitting the user's PRIVATE repos from the picker, and the failure
+// would resurface far downstream at the provisioner's push. Callers check this and
+// re-prompt (repo_scope_required) instead of degrading quietly.
+//
+// GitHub returns granted scopes comma-separated in its own order (e.g.
+// "public_repo,read:user"), so parse rather than substring-match — `public_repo`
+// CONTAINS "repo" and a naive match would accept exactly the stale token this
+// guards against. `repo` implies `public_repo`, so `repo` alone is sufficient.
+function grantedScopeCoversRepos(granted) {
+  return String(granted || '')
+    .split(/[,\s]+/)
+    .map((s) => s.trim())
+    .includes(REPO_SCOPE);
 }
 
 // In-memory map of device_code → { interval, expires_at, last_polled_at, github_creds }
@@ -1263,7 +1292,23 @@ function sessionScope(...keys) {
 const allowBoxScope = sessionScope(...((sessionScopeFor('box') || { permissions: [] }).permissions));
 
 async function requireBuilder(req, res, next) {
-  const session = await resolveSession(req);
+  let session;
+  try {
+    session = await resolveSession(req);
+  } catch (err) {
+    // REQUIRED, not defensive: Express 4 discards a middleware's returned promise
+    // (Layer.handle_request wraps only synchronous throws), so an uncaught rejection
+    // here reaches no handler — the request hangs AND the process dies. Every async
+    // middleware mounted directly on a router must own its rejection.
+    //
+    // next(err) rather than res.fail(): the envelope handler already renders and logs
+    // it, and inventing a code here would need an api-errors registration to avoid
+    // classifying as 500. Denying is correct regardless — if the session cannot be
+    // resolved, the caller's identity is unknown, so admitting is never an option.
+    // runPageGate below holds the same guard; the two auth paths must not diverge.
+    next(err);
+    return;
+  }
   if (!session) {
     res.fail('unauthenticated', 401);
     return;
@@ -1335,6 +1380,11 @@ async function requireBuilder(req, res, next) {
     // reach the write path (ADR 0026 §6C). Read fresh per request like rank.
     system_role: session.system_role ?? null,
   };
+  // The session-load fold (task 1002556): raw grant keys the session query
+  // carried, read as fresh as rank above. requirePermission feeds them to the
+  // pure catalog-drop instead of a second round-trip; null (fold off, or a test
+  // stub without the column) means the gate falls back to the DB resolve.
+  req.rawPermissionKeys = Array.isArray(session.raw_permission_keys) ? session.raw_permission_keys : null;
   next();
 }
 
@@ -1373,9 +1423,12 @@ function signInWithReturn(req) {
 // R107 replaced each gate's hand-rolled rank test with the catalog key sitting at
 // that gate's EXISTING rank floor, so the audience is unchanged over the four live
 // ranks (catalog.RANK_ORDER):
-//   requireBuilderPage   was "any session"        floor xenos  → page.view.public
-//   requireNonXenosPage  was rank !== 'xenos'     floor thetes → page.view.builder
-//   requireArchonPage    was rank === 'archon'    floor archon → page.view.governance
+//   requireBuilderPage     was "any session"      floor xenos  → page.view.public
+//   requireNonXenosPage    was rank !== 'xenos'   floor thetes → page.view.builder
+//   requireGovernancePage  was rank === 'archon'  floor archon → page.view.governance
+// That third gate was spelled `requireArchonPage` until ADR 0157 lowered
+// page.view.governance's floor archon→metic and the name stopped being true; the
+// floor now lives in modules/governance/catalog.js, not in the function's name.
 // The one accepted divergence is the one governance_002 already documents
 // (tests/governance_parity.mjs Part D): a builder on a reserved/divine rank holds
 // no seeded role, so they now fail a page gate a bare rank test would have
@@ -1384,14 +1437,16 @@ function signInWithReturn(req) {
 // `deniedTo` is NEVER the sign-in flow. A visitor on that branch already HAS a
 // session, so bouncing them into sign-in returns them to the same gate — an
 // infinite loop. Every destination below is an ungated hall page:
-//   - /builders          the hall home. A signed-in non-Archon IS a citizen, just
-//                        not the Ruling Hand, so send them home.
+//   - /builders          the hall home. A signed-in builder who lacks the page's
+//                        permission IS still a citizen, so send them home.
 //   - /builders/not-ready the friendly notice for the orientation reading rooms;
 //                        it shows the rank ladder and a way back to the hall.
 const PAGE_GATES = Object.freeze({
   requireBuilderPage: Object.freeze({ permission: 'page.view.public', deniedTo: '/builders' }),
   requireNonXenosPage: Object.freeze({ permission: 'page.view.builder', deniedTo: '/builders/not-ready' }),
-  requireArchonPage: Object.freeze({ permission: 'page.view.governance', deniedTo: '/builders' }),
+  requireGovernancePage: Object.freeze({ permission: 'page.view.governance', deniedTo: '/builders' }),
+  requireGovernanceManagePage: Object.freeze({ permission: 'governance.manage', deniedTo: '/builders' }),
+  requireProjectCuratePage: Object.freeze({ permission: 'project.curate', deniedTo: '/builders' }),
 });
 
 // A builder's effective permission set, or NULL when authority cannot be
@@ -1399,14 +1454,31 @@ const PAGE_GATES = Object.freeze({
 // threw). Every caller must read null as a DENIAL: admitting when the authority
 // system is missing would make disabling a module a privilege escalation — the
 // inversion ADR 0016 exists to prevent. Resolved per request, never memoised.
-async function resolveHeldPermissions(builderId) {
+//
+// The session-load FOLD (task 1002556): when the caller's session row already
+// carried the raw grant keys (db-kernel's lookupSession aggregates them in the
+// same round-trip when governance is enabled), the catalog-drop runs pure via the
+// port — same instant, same request, one round-trip instead of two. This is a
+// query fold, not the cross-request memo ADR 0016 forbids. Anything unexpected —
+// no raw keys on the row, an older port without the pure half, a throw — falls
+// through to the DB resolve, so the fold can only ever be an optimization.
+async function resolveHeldPermissions(builderId, rawKeys) {
   if (builderId === null || builderId === undefined || builderId === '') return null;
   const governance = seams.resolveOptional('governance');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
+  if (Array.isArray(rawKeys) && typeof governance.effectivePermissions === 'function') {
+    try {
+      return new Set(governance.effectivePermissions(rawKeys));
+    } catch (err) {
+      console.error('[gds] permission fold failed:', err && err.message);
+      // fall through to the DB resolve
+    }
+  }
   try {
     return new Set((await governance.resolveBuilderPermissions(builderId)) || []);
   } catch (err) {
-    console.error('[gds] permission resolve failed', err);
+    // Message only — a resolver error can carry query text or row data.
+    console.error('[gds] permission resolve failed:', err && err.message);
     return null;
   }
 }
@@ -1428,7 +1500,7 @@ async function runPageGate(name, req, res, next) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
-  const held = await resolveHeldPermissions(session.builder_id);
+  const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
   if (held === null || !held.has(permission)) {
     res.redirect(302, deniedTo);
     return;
@@ -1445,12 +1517,32 @@ async function requireBuilderPage(req, res, next) {
 }
 
 // The /watch monitoring surface, the /harbor dev-box page and the /gate page
-// (#726, idea 257, task 1179) — Archon-only. Defense-in-depth: every data endpoint
-// these pages call is independently gated server-side, so no cross-builder data
-// leaks even if this gate were bypassed; it keeps a non-Archon from ever seeing
-// the page shell.
-async function requireArchonPage(req, res, next) {
-  return runPageGate('requireArchonPage', req, res, next);
+// (#726, idea 257, task 1179) — Metic and up, per `page.view.governance`'s catalog
+// floor. Named `requireArchonPage` until ADR 0157 lowered that floor archon→metic
+// (older ADRs still use the old name; this line is the trail). Defense-in-depth:
+// every data endpoint these pages call is independently gated server-side, so no
+// cross-builder data leaks even if this gate were bypassed; it keeps a builder
+// without the permission from ever seeing the page shell.
+async function requireGovernancePage(req, res, next) {
+  return runPageGate('requireGovernancePage', req, res, next);
+}
+
+// The /governance roles-and-permissions tab (BV1.R113) — gated on the
+// `governance.manage` ATOM itself (system, archon floor), the same key every
+// /governance/* data route checks, so the page layer can never drift wider than
+// the API it fronts. Defense-in-depth as above: the data endpoints are all
+// independently gated; this keeps the tab shell from rendering for anyone else.
+async function requireGovernanceManagePage(req, res, next) {
+  return runPageGate('requireGovernanceManagePage', req, res, next);
+}
+
+// The /people builder-directory page (task 1002577) — gated on the
+// `project.curate` ATOM, the same key its one data route (GET /scouting,
+// modules/platform-identity) checks, so the page layer can never drift wider
+// than the API it fronts. Spec R14 (goal 1000045) widens the atom's audience
+// later; this gate follows it automatically.
+async function requireProjectCuratePage(req, res, next) {
+  return runPageGate('requireProjectCuratePage', req, res, next);
 }
 
 // The orientation reading rooms (the citizen's primer, the system-maps/diagrams)
@@ -1590,6 +1682,11 @@ function requireRank(...allowed) {
 // UNCACHED — resolved on the request that needs it, exactly as requireRank reads
 // the live rank. No memo here and none in resolver.js (ADR 0016).
 //
+// The round-trip this costs (where requireRank compared in memory) IS the
+// guarantee: a revoked role stops working on the very next request. A hot route
+// should shed the gate, not the freshness — see task 1002556 for folding the
+// resolve into requireBuilder's existing session query.
+//
 // The 403 body mirrors requireRank's: `required` is the literal permission list
 // the gate names, and `held` is the subset of THOSE the builder actually holds —
 // or null when the set could not be resolved at all (the requireRank `actual ??
@@ -1606,7 +1703,9 @@ function requirePermission(...perms) {
     if (required.length === 0) return deny(null);
     // Shared with the page gates (R107): null = authority could not be established
     // (no port / malformed port / a throwing resolver) and is always a denial.
-    const held = await resolveHeldPermissions(builderId);
+    // req.rawPermissionKeys rides the fold (task 1002556) when the session query
+    // carried the grant keys; absent, the DB resolve runs exactly as before.
+    const held = await resolveHeldPermissions(builderId, req.rawPermissionKeys);
     if (held === null) return deny(null);
     if (required.every((key) => held.has(key))) return next();
     return deny(required.filter((key) => held.has(key)));
@@ -1663,6 +1762,7 @@ module.exports = {
   pollDeviceFlow,
   buildAuthorizeUrl,
   scopeForWebFlow,
+  grantedScopeCoversRepos,
   buildIdpAuthorizeUrl,
   idpAuthorizeUrl,
   completeWebFlow,
@@ -1683,8 +1783,10 @@ module.exports = {
   SESSION_SCOPES,
   requireBuilder,
   requireBuilderPage,
-  requireArchonPage,
+  requireGovernancePage,
+  requireGovernanceManagePage,
   requireNonXenosPage,
+  requireProjectCuratePage,
   requireRank,
   rankMeetsThreshold,
   requirePermission,

package/src/bongos/db-kernel.js

@@ -12,9 +12,11 @@
 // (grading) lift their query clusters into modules/<key>/db.js the same way,
 // reaching these kernel helpers + `pool` through the doorway.
 //
-// Boundary: this file depends ONLY on ./pool (the singleton Postgres pool). It
-// must NEVER require ./db (that would invert the base→monolith direction and
-// risk a load cycle); db.js requires THIS file, not the reverse.
+// Boundary: this file depends only on ./pool (the singleton Postgres pool) and
+// ../module-seams (the kernel switchboard — kernel→kernel, added for the
+// session-grants fold, task 1002556). It must NEVER require ./db (that would
+// invert the base→monolith direction and risk a load cycle); db.js requires
+// THIS file, not the reverse.
 //
 // db.js re-exports every name below, so its 23 importers + its own internal
 // uses are byte-identical — nothing downstream knows the slice moved.
@@ -22,6 +24,7 @@
 'use strict';
 
 const { pool } = require('./pool');
+const seams = require('../module-seams');
 
 // withTx(fn, {pool}) — run fn(client) inside BEGIN/COMMIT, ROLLBACK+rethrow on
 // error, always release. The pool option preserves the deps.pool test seam.
@@ -115,6 +118,17 @@ async function insertAuditLog({
 // module can compare ranks without reaching core internals.
 const LIVE_RANK_LADDER = ['xenos', 'thetes', 'metic', 'archon'];
 
+// RANK_TIER — the ladder as a 1-based rank → tier map, DERIVED so it cannot
+// drift (BV1.R108). THE canonical tier map: importable code reads this via the
+// doorway (api.RANK_TIER). The few deliberately-local copies — dependency-free
+// substrate (permission-path-check), standalone CLIs, hall browser statics, and
+// src/bongos/db.js whose literal gate-review.js + diagram-facts.js parse as
+// SOURCE TEXT — are each pinned to this map by tests/rank_tier_single_source.mjs,
+// which also fails on any NEW parallel rank-tier map or ladder literal.
+const RANK_TIER = Object.freeze(
+  Object.fromEntries(LIVE_RANK_LADDER.map((rank, i) => [rank, i + 1])),
+);
+
 // RANKS — the FULL historical rank vocabulary, ordered high→low (lower index =
 // higher authority). ORDER IS LOAD-BEARING: setBuilderRank + auth's requireRank
 // threshold both use RANKS.indexOf to compare authority. A kernel constant
@@ -132,13 +146,23 @@ const RANKS = [
 // `pool`; db.js re-exports every name so its other importers are unchanged.
 
 // upsertBuilder — create or update the builder row for a GitHub identity.
+//
+// This runs on EVERY sign-in, not just at account creation, so the conflict
+// branch is a re-sync from GitHub — which used to clobber a builder's
+// self-chosen display name on their next authentication (task 1002568). The
+// display_name CASE below is the "your name wins, always" guard: GitHub keeps
+// seeding and re-syncing the name for anyone who never renamed
+// (display_name_source='github'), and never overwrites one the builder set
+// themselves ('user', stamped by setBuilderDisplayName). See ADR 0156.
 async function upsertBuilder({ githubId, githubLogin, displayName, avatarUrl }) {
   const { rows } = await pool.query(
     `INSERT INTO builders (github_id, github_login, display_name, avatar_url)
      VALUES ($1, $2, $3, $4)
      ON CONFLICT (github_id) DO UPDATE
        SET github_login = EXCLUDED.github_login,
-           display_name = EXCLUDED.display_name,
+           display_name = CASE WHEN builders.display_name_source = 'user'
+                               THEN builders.display_name
+                               ELSE EXCLUDED.display_name END,
            avatar_url   = EXCLUDED.avatar_url
      RETURNING id, github_id, github_login, display_name, avatar_url, total_credits, created_at, rank, preferred_disciplines`,
     [String(githubId), githubLogin, displayName, avatarUrl ?? null]
@@ -234,12 +258,47 @@ async function createSession({ builderId, token, source, userAgent, expiresAt })
 // builder identity, and refresh-on-use (bump last_used_at + roll expiry forward,
 // fire-and-forget). Returns null for missing/revoked/expired. Read fresh per
 // request, never cached (ADR 0016).
+//
+// The governance FOLD (task 1002556): when the governance module is enabled, the
+// same round-trip also aggregates the builder's raw permission grant keys, so
+// requirePermission/runPageGate need no second query — one snapshot per request,
+// still uncached (this is a query fold, not the cross-request memo ADR 0016
+// forbids). Enablement is boot-static config, so the SQL shape is chosen once at
+// load; on a governance-less instance the base query runs (the tables may not
+// exist there) and permission gates keep failing closed via the missing port.
+// The kernel stays MODULE-AGNOSTIC (ADR 0083 §Decision #4 — no module key may be
+// hardcoded here): the fragment arrives through the capability-named seam
+// 'session-grants-sql', which the authority module registers at boot alongside
+// its resolver port. The fragment is that module's own SQL over its own tables —
+// a trusted boot-time constant, never user input — and it must yield a single
+// `raw_permission_keys` column against the alias `s` (builder_sessions). No
+// provider (module disabled, or a boot path that never mounts routes) → the base
+// query runs and permission gates keep failing closed via their missing port.
+// Latched only once FOUND: registration order vs the first lookup is a boot
+// race, and resolveOptional on a miss is a cheap map lookup.
+//
+// Shape guard: the fragment must be exactly one comma-led parenthesized scalar
+// subquery aliased raw_permission_keys, with no statement separator. A module
+// registering seams is in-process trusted code (it could reach the pool
+// directly), so this guards MISREGISTRATION — a malformed or mis-aimed
+// fragment degrades to the base query instead of corrupting the session SQL.
+const FRAGMENT_SHAPE = /^,\s*\(SELECT[^;]*\)\s*AS raw_permission_keys\s*$/;
+let SESSION_PERMS_SELECT = null;
+function sessionPermsSelect() {
+  if (SESSION_PERMS_SELECT !== null) return SESSION_PERMS_SELECT;
+  const provider = seams.resolveOptional('session-grants-sql');
+  if (!provider || typeof provider.selectFragment !== 'string' || !FRAGMENT_SHAPE.test(provider.selectFragment)) {
+    return '';
+  }
+  SESSION_PERMS_SELECT = provider.selectFragment;
+  return SESSION_PERMS_SELECT;
+}
 async function lookupSession(token) {
   if (!token) return null;
   const { rows } = await pool.query(
     `SELECT s.id AS session_id, s.builder_id, s.expires_at, s.revoked_at, s.source,
             b.github_id, b.github_login, b.display_name, b.avatar_url, b.total_credits,
-            b.rank, b.status, b.system_role, b.anthropic_user_id
+            b.rank, b.status, b.system_role, b.anthropic_user_id${sessionPermsSelect()}
        FROM builder_sessions s
        JOIN builders b ON b.id = s.builder_id
       WHERE s.token = $1`,
@@ -263,10 +322,12 @@ async function lookupSession(token) {
 
 module.exports = {
   withTx,
+  sessionPermsSelect,
   getBuilderById,
   listActiveBuilders,
   insertAuditLog,
   LIVE_RANK_LADDER,
+  RANK_TIER,
   RANKS,
   SESSION_TTL_MS,
   upsertBuilder,

package/src/bongos/db.js

@@ -298,13 +298,12 @@ async function deleteGithubToken({ builderId, p = pool }) {
 // shipped." Pure decision helper is exported so tests/rank_gate.mjs can exercise
 // the threshold without a DB.
 
-// REQUIRES_RANK_TIER — the canonical rank → tier (1-based) map: the rank "brain".
-// MUST stay byte-identical to permission-path-check.js RANK_TIER and
-// modules/lifecycle/db.js REQUIRES_RANK_TIER (tests/permission_path.mjs guards the
-// drift; gate-review.js + diagram-facts.js parse this literal by regex, so keep it
-// an inline object literal). Restores the binding the LIVE_RANK_LADDER carve
-// (ADR 0102) left dangling — both singleRungPromotionError below and the
-// db.REQUIRES_RANK_TIER export depend on it.
+// REQUIRES_RANK_TIER — the rank "brain" literal. The CANONICAL map is now
+// db-kernel.RANK_TIER, derived from LIVE_RANK_LADDER (BV1.R108); this stays an
+// inline object literal ONLY because gate-review.js (the root-of-trust region
+// watch) and diagram-facts.js parse it as SOURCE TEXT, which a derived value
+// would break. tests/rank_tier_single_source.mjs pins it byte-identical to the
+// kernel map (and permission-path-check.js RANK_TIER to both — the #863 class).
 const REQUIRES_RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 
 function singleRungPromotionError(oldRank, newRank) {

package/src/bongos/github-repos.js

@@ -3,10 +3,11 @@
 //
 // Raw `fetch` against GitHub's REST API (the house style — see auth.js
 // fetchGithubUser; no octokit dependency). The user-to-server token these take is
-// the `public_repo`-scoped token the web callback captured and stored (db.js
-// github_oauth_tokens); callers pass the decrypted token in, this module never
-// touches storage. `fetchImpl` is injectable so tests can drive it with a mock and
-// never hit the network.
+// the `repo`-scoped token the web callback captured and stored (db.js
+// github_oauth_tokens; `repo` since ADR 0155 — `public_repo` could not write a
+// private repo, so private repos were unadoptable); callers pass the decrypted
+// token in, this module never touches storage. `fetchImpl` is injectable so tests
+// can drive it with a mock and never hit the network.
 
 const { userAgent } = require('../branding');
 
@@ -39,6 +40,10 @@ function ghHeaders(token, extra = {}) {
 // `login/repo` and the org-OAuth-policy complexity is out of scope for v1),
 // most-recently-updated first, optionally filtered by a case-insensitive substring
 // `q` on the full name. Returns [{ full_name, name, owner, private }].
+//
+// No `visibility` filter: under `repo` (ADR 0155) GitHub returns the user's PRIVATE
+// repos here too, which is the point — they are adoptable now. That is what lights
+// up the picker's long-dormant "Private" badge (public-landing/create.html).
 async function listUserRepos(token, { q = '', fetchImpl = fetch } = {}) {
   const out = [];
   for (let page = 1; page <= MAX_PAGES; page++) {
@@ -68,9 +73,16 @@ async function listUserRepos(token, { q = '', fetchImpl = fetch } = {}) {
 
 // Create an EMPTY repo in the signed-in user's personal account. auto_init:false =
 // no README/first commit (exactly the "leave it completely empty" the manual step
-// demanded); private:false because we hold only `public_repo`. Returns
-// { full_name, html_url }. A 422 (name already exists / invalid) becomes a typed
-// `name_taken` error the route maps to a friendly 409 rather than an opaque 500.
+// demanded).
+//
+// private:false is now a PRODUCT choice, not a credential limit: since ADR 0155 the
+// token holds `repo` and COULD create a private repo, but a Cloud Bongos instance is
+// open-source / capture-resistant by design, so a repo WE create defaults to public.
+// A user who wants a private instance adopts a private repo they made themselves.
+// Deliberately not a parameter — nothing should be able to flip this implicitly.
+//
+// Returns { full_name, html_url }. A 422 (name already exists / invalid) becomes a
+// typed `name_taken` error the route maps to a friendly 409 rather than an opaque 500.
 async function createUserRepo(token, { name, fetchImpl = fetch } = {}) {
   const res = await fetchImpl(`${GH_API}/user/repos`, {
     method: 'POST',

package/src/bongos/goal-scope-check.js

@@ -110,7 +110,7 @@ function check(goalScopeModules, touches, builderRank) {
   if (!prot.ok) {
     const hits = prot.protected_hits.map((h) => h.file);
     return deny('protected_path',
-      `Builder rank '${builderRank}' is below Metic and may not author a task touching protected path(s): ${hits.join(', ')} (ADR 0016, SEC #863). An Archon must own this work.`,
+      `Builder rank '${builderRank}' is below Metic and may not author a task touching protected path(s): ${hits.join(', ')} (ADR 0016, SEC #863). A Metic+ builder must own this work.`,
       { protected_hits: prot.protected_hits });
   }
 

package/src/bongos/module-scope-map.js

@@ -215,7 +215,9 @@ const MODULE_GLOBS = {
   //     provisioning / bring-up work (BV1.R91, goal 1000051 C2), not just modules/dev-box/.
   //     The box BRING-UP scripts (infra/box-*.sh — box-source-fetch, heartbeat, terminal
   //     units) are INSTANCE-VENDORED (ADR 0144; not tracked in core), so they are not
-  //     listed here yet — they come under this key when de-vendored (task 1002243).
+  //     listed here yet — they come under this key when de-vendored. (ADR 0150 /
+  //     task 1002386 made box.js RESOLVE infra/ from the instance root and fail
+  //     loudly when it is missing; de-vendoring infra/ into core is still open.)
   'dev-box': [
     'modules/dev-box/', 'devbox-app/',
     'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',

package/src/bongos/permission-path-check.js

@@ -223,7 +223,7 @@ function checkPermissionPaths({ changedFiles, builderRank } = {}) {
         `${h.file} is a permission-sensitive surface (matches \`${h.glob}\`). `
         + `Builder rank '${builderRank}' is below ${floorLabel} and may not modify the rank / permission / `
         + `ship-grade / deploy / migration machinery (ADR 0016, SEC #863). `
-        + `If this change is genuinely needed, an Archon must own it.`,
+        + `If this change is genuinely needed, a ${floorLabel}+ builder must own it.`,
     });
   }
   return {