@bongos/core 1.18.19 → 1.19.2

package/clients/bongos-client/index.mjs

@@ -99,7 +99,7 @@ export function createClient(opts = {}) {
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),
     },
     "auditLog": {
-      // GET /audit-log — rank: archon — GET /audit-log
+      // GET /audit-log — rank: metic+archon — GET /audit-log
       getAuditLog: (args) => request("GET", "/audit-log", { hasBody: false }, args),
     },
     "auth": {
@@ -141,7 +141,7 @@ export function createClient(opts = {}) {
       getAuthWebStart: (args) => request("GET", "/auth/web/start", { hasBody: false }, args),
     },
     "autonomy": {
-      // GET /autonomy/precheck — rank: archon — GET /autonomy/precheck
+      // GET /autonomy/precheck — rank: metic+archon — GET /autonomy/precheck
       getAutonomyPrecheck: (args) => request("GET", "/autonomy/precheck", { hasBody: false }, args),
     },
     "backup": {
@@ -201,13 +201,13 @@ export function createClient(opts = {}) {
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
     },
     "boxes": {
-      // GET /boxes — rank: archon — GET /boxes
+      // GET /boxes — rank: metic+archon — GET /boxes
       getBoxes: (args) => request("GET", "/boxes", { hasBody: false }, args),
-      // PATCH /boxes/{builderId}/block — rank: archon — PATCH /boxes/:builderId/block
+      // PATCH /boxes/{builderId}/block — rank: metic+archon — PATCH /boxes/:builderId/block
       patchBoxesBuilderIdBlock: (args) => request("PATCH", "/boxes/{builderId}/block", { hasBody: true }, args),
-      // POST /boxes/{builderId}/close — rank: archon — POST /boxes/:builderId/close
+      // POST /boxes/{builderId}/close — rank: metic+archon — POST /boxes/:builderId/close
       postBoxesBuilderIdClose: (args) => request("POST", "/boxes/{builderId}/close", { hasBody: true }, args),
-      // GET /boxes/cost-ledger — rank: archon — GET /boxes/cost-ledger
+      // GET /boxes/cost-ledger — rank: metic+archon — GET /boxes/cost-ledger
       getBoxesCostLedger: (args) => request("GET", "/boxes/cost-ledger", { hasBody: false }, args),
     },
     "bugAttachments": {
@@ -215,9 +215,9 @@ export function createClient(opts = {}) {
       getBugAttachmentsName: (args) => request("GET", "/bug-attachments/{name}", { hasBody: false }, args),
     },
     "builders": {
-      // GET /builders/{id}/active-claims — rank: archon — GET /builders/:id/active-claims
+      // GET /builders/{id}/active-claims — rank: metic+archon — GET /builders/:id/active-claims
       getBuildersIdActiveClaims: (args) => request("GET", "/builders/{id}/active-claims", { hasBody: false }, args),
-      // PATCH /builders/{id}/budget — rank: archon — PATCH /builders/:id/budget
+      // PATCH /builders/{id}/budget — rank: metic+archon — PATCH /builders/:id/budget
       patchBuildersIdBudget: (args) => request("PATCH", "/builders/{id}/budget", { hasBody: true }, args),
       // GET /builders/{id}/onboarding — rank: public — GET /builders/:id/onboarding
       getBuildersIdOnboarding: (args) => request("GET", "/builders/{id}/onboarding", { hasBody: false }, args),
@@ -231,13 +231,13 @@ export function createClient(opts = {}) {
       getBuildersDirectory: (args) => request("GET", "/builders/directory", { hasBody: false }, args),
       // GET /builders/me/pending-rank-change — rank: any-builder — GET /builders/me/pending-rank-change
       getBuildersMePendingRankChange: (args) => request("GET", "/builders/me/pending-rank-change", { hasBody: false }, args),
-      // GET /builders/roster — rank: archon — GET /builders/roster
+      // GET /builders/roster — rank: metic+archon — GET /builders/roster
       getBuildersRoster: (args) => request("GET", "/builders/roster", { hasBody: false }, args),
     },
     "claims": {
       // POST /claims — rank: any-builder — POST /claims
       postClaims: (args) => request("POST", "/claims", { hasBody: true }, args),
-      // POST /claims/{id}/release-on-behalf — rank: archon — POST /claims/:id/release-on-behalf
+      // POST /claims/{id}/release-on-behalf — rank: metic+archon — POST /claims/:id/release-on-behalf
       postClaimsIdReleaseOnBehalf: (args) => request("POST", "/claims/{id}/release-on-behalf", { hasBody: true }, args),
       // POST /claims/{id}/resolve — rank: any-builder — POST /claims/:id/resolve
       postClaimsIdResolve: (args) => request("POST", "/claims/{id}/resolve", { hasBody: true }, args),
@@ -259,21 +259,21 @@ export function createClient(opts = {}) {
       postDependencies: (args) => request("POST", "/dependencies", { hasBody: true }, args),
     },
     "discord": {
-      // GET /discord/channels/plan — rank: archon — GET /discord/channels/plan
+      // GET /discord/channels/plan — rank: metic+archon — GET /discord/channels/plan
       getDiscordChannelsPlan: (args) => request("GET", "/discord/channels/plan", { hasBody: false }, args),
-      // POST /discord/channels/reconcile — rank: archon — POST /discord/channels/reconcile
+      // POST /discord/channels/reconcile — rank: metic+archon — POST /discord/channels/reconcile
       postDiscordChannelsReconcile: (args) => request("POST", "/discord/channels/reconcile", { hasBody: true }, args),
     },
     "doneWhen": {
       // POST /done-when/{criterionId}/satisfy — rank: metic+archon — POST /done-when/:criterionId/satisfy
       postDoneWhenCriterionIdSatisfy: (args) => request("POST", "/done-when/{criterionId}/satisfy", { hasBody: true }, args),
-      // POST /done-when/{criterionId}/unsatisfy — rank: archon — POST /done-when/:criterionId/unsatisfy
+      // POST /done-when/{criterionId}/unsatisfy — rank: metic+archon — POST /done-when/:criterionId/unsatisfy
       postDoneWhenCriterionIdUnsatisfy: (args) => request("POST", "/done-when/{criterionId}/unsatisfy", { hasBody: true }, args),
       // GET /done-when/pending-review — rank: metic+archon — GET /done-when/pending-review
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
     "gateApprovals": {
-      // GET /gate-approvals — rank: archon — GET /gate-approvals
+      // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
       getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
       // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
@@ -331,11 +331,29 @@ export function createClient(opts = {}) {
       patchGoalsIdVisibility: (args) => request("PATCH", "/goals/{id}/visibility", { hasBody: true }, args),
       // GET /goals/inbox — rank: any-builder — GET /goals/inbox
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
-      // POST /goals/reorder — rank: archon — POST /goals/reorder
+      // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
     },
+    "governance": {
+      // GET /governance/assignments — rank: archon — GET /governance/assignments
+      getGovernanceAssignments: (args) => request("GET", "/governance/assignments", { hasBody: false }, args),
+      // POST /governance/assignments — rank: archon — POST /governance/assignments
+      postGovernanceAssignments: (args) => request("POST", "/governance/assignments", { hasBody: true }, args),
+      // DELETE /governance/assignments/{builderId}/{roleKey} — rank: archon — DELETE /governance/assignments/:builderId/:roleKey
+      deleteGovernanceAssignmentsBuilderIdRoleKey: (args) => request("DELETE", "/governance/assignments/{builderId}/{roleKey}", { hasBody: false }, args),
+      // GET /governance/permissions — rank: archon — GET /governance/permissions
+      getGovernancePermissions: (args) => request("GET", "/governance/permissions", { hasBody: false }, args),
+      // GET /governance/roles — rank: archon — GET /governance/roles
+      getGovernanceRoles: (args) => request("GET", "/governance/roles", { hasBody: false }, args),
+      // POST /governance/roles — rank: archon — POST /governance/roles
+      postGovernanceRoles: (args) => request("POST", "/governance/roles", { hasBody: true }, args),
+      // DELETE /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — DELETE /governance/roles/:roleKey/permissions/:permissionKey
+      deleteGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("DELETE", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: false }, args),
+      // PUT /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — PUT /governance/roles/:roleKey/permissions/:permissionKey
+      putGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("PUT", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: true }, args),
+    },
     "grades": {
-      // GET /grades/by-builder — rank: archon — GET /grades/by-builder
+      // GET /grades/by-builder — rank: metic+archon — GET /grades/by-builder
       getGradesByBuilder: (args) => request("GET", "/grades/by-builder", { hasBody: false }, args),
     },
     "healthz": {
@@ -351,7 +369,7 @@ export function createClient(opts = {}) {
       getInboxId: (args) => request("GET", "/inbox/{id}", { hasBody: false }, args),
       // PATCH /inbox/{id} — rank: metic+archon — PATCH /inbox/:id
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
-      // POST /inbox/{id}/ratify — rank: archon — POST /inbox/:id/ratify
+      // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
     },
     "instance": {
@@ -429,9 +447,9 @@ export function createClient(opts = {}) {
       getMemoryBfgBuildersBuilderIdFiles: (args) => request("GET", "/memory/bfg/builders/{builderId}/files", { hasBody: false }, args),
       // POST /memory/builders/{builderId}/bfg-write — rank: bfg-principal — POST /memory/builders/:builderId/bfg-write
       postMemoryBuildersBuilderIdBfgWrite: (args) => request("POST", "/memory/builders/{builderId}/bfg-write", { hasBody: true }, args),
-      // GET /memory/builders/{builderId}/file — rank: archon — GET /memory/builders/:builderId/file
+      // GET /memory/builders/{builderId}/file — rank: metic+archon — GET /memory/builders/:builderId/file
       getMemoryBuildersBuilderIdFile: (args) => request("GET", "/memory/builders/{builderId}/file", { hasBody: false }, args),
-      // GET /memory/builders/{builderId}/files — rank: archon — GET /memory/builders/:builderId/files
+      // GET /memory/builders/{builderId}/files — rank: metic+archon — GET /memory/builders/:builderId/files
       getMemoryBuildersBuilderIdFiles: (args) => request("GET", "/memory/builders/{builderId}/files", { hasBody: false }, args),
       // DELETE /memory/file — rank: any-builder — DELETE /memory/file
       deleteMemoryFile: (args) => request("DELETE", "/memory/file", { hasBody: true }, args),
@@ -467,27 +485,27 @@ export function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "overrideRequests": {
-      // GET /override-requests — rank: archon — GET /override-requests
+      // GET /override-requests — rank: metic+archon — GET /override-requests
       getOverrideRequests: (args) => request("GET", "/override-requests", { hasBody: false }, args),
-      // POST /override-requests/{id}/decide — rank: archon — POST /override-requests/:id/decide
+      // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
     "projects": {
-      // GET /projects — rank: archon — GET /projects
+      // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),
-      // POST /projects — rank: archon — POST /projects
+      // POST /projects — rank: metic+archon — POST /projects
       postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
-      // PATCH /projects/{id}/featured — rank: archon — PATCH /projects/:id/featured
+      // PATCH /projects/{id}/featured — rank: metic+archon — PATCH /projects/:id/featured
       patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
       // GET /projects/featured — rank: public — GET /projects/featured
       getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
-      // POST /projects/invite — rank: archon — POST /projects/invite
+      // POST /projects/invite — rank: metic+archon — POST /projects/invite
       postProjectsInvite: (args) => request("POST", "/projects/invite", { hasBody: true }, args),
     },
     "provisioning": {
-      // GET /provisioning/fleet — rank: archon — GET /provisioning/fleet
+      // GET /provisioning/fleet — rank: metic+archon — GET /provisioning/fleet
       getProvisioningFleet: (args) => request("GET", "/provisioning/fleet", { hasBody: false }, args),
-      // GET /provisioning/fleet/cost-ledger — rank: archon — GET /provisioning/fleet/cost-ledger
+      // GET /provisioning/fleet/cost-ledger — rank: metic+archon — GET /provisioning/fleet/cost-ledger
       getProvisioningFleetCostLedger: (args) => request("GET", "/provisioning/fleet/cost-ledger", { hasBody: false }, args),
       // GET /provisioning/github-app/callback — rank: public — GET /provisioning/github-app/callback
       getProvisioningGithubAppCallback: (args) => request("GET", "/provisioning/github-app/callback", { hasBody: false }, args),
@@ -501,7 +519,7 @@ export function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
-      // POST /provisioning/instances/{id}/force-teardown — rank: archon — POST /provisioning/instances/:id/force-teardown
+      // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
@@ -551,7 +569,7 @@ export function createClient(opts = {}) {
       getPublicVersions: (args) => request("GET", "/public/versions", { hasBody: false }, args),
     },
     "scouting": {
-      // GET /scouting — rank: archon — GET /scouting
+      // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
     },
     "search": {
@@ -563,24 +581,28 @@ export function createClient(opts = {}) {
     "security": {
       // GET /security/adr — rank: metic+archon — GET /security/adr
       getSecurityAdr: (args) => request("GET", "/security/adr", { hasBody: false }, args),
-      // GET /security/docs — rank: archon — GET /security/docs
+      // GET /security/docs — rank: metic+archon — GET /security/docs
       getSecurityDocs: (args) => request("GET", "/security/docs", { hasBody: false }, args),
-      // POST /security/docs — rank: archon — POST /security/docs
+      // POST /security/docs — rank: metic+archon — POST /security/docs
       postSecurityDocs: (args) => request("POST", "/security/docs", { hasBody: true }, args),
-      // GET /security/docs/{slug} — rank: archon — GET /security/docs/:slug
+      // GET /security/docs/{slug} — rank: metic+archon — GET /security/docs/:slug
       getSecurityDocsSlug: (args) => request("GET", "/security/docs/{slug}", { hasBody: false }, args),
-      // GET /security/reports — rank: archon — GET /security/reports
+      // GET /security/reports — rank: metic+archon — GET /security/reports
       getSecurityReports: (args) => request("GET", "/security/reports", { hasBody: false }, args),
       // POST /security/reports — rank: metic+archon — POST /security/reports
       postSecurityReports: (args) => request("POST", "/security/reports", { hasBody: true }, args),
-      // POST /security/reports/{id}/confirm — rank: archon — POST /security/reports/:id/confirm
+      // POST /security/reports/{id}/confirm — rank: metic+archon — POST /security/reports/:id/confirm
       postSecurityReportsIdConfirm: (args) => request("POST", "/security/reports/{id}/confirm", { hasBody: true }, args),
-      // POST /security/reports/{id}/dispute — rank: archon — POST /security/reports/:id/dispute
+      // POST /security/reports/{id}/dispute — rank: metic+archon — POST /security/reports/:id/dispute
       postSecurityReportsIdDispute: (args) => request("POST", "/security/reports/{id}/dispute", { hasBody: true }, args),
-      // POST /security/reports/{id}/fix — rank: archon — POST /security/reports/:id/fix
+      // POST /security/reports/{id}/fix — rank: metic+archon — POST /security/reports/:id/fix
       postSecurityReportsIdFix: (args) => request("POST", "/security/reports/{id}/fix", { hasBody: true }, args),
-      // POST /security/reports/{id}/link-fix — rank: archon — POST /security/reports/:id/link-fix
+      // POST /security/reports/{id}/link-fix — rank: metic+archon — POST /security/reports/:id/link-fix
       postSecurityReportsIdLinkFix: (args) => request("POST", "/security/reports/{id}/link-fix", { hasBody: true }, args),
+      // GET /security/scans — rank: any-builder — GET /security/scans
+      getSecurityScans: (args) => request("GET", "/security/scans", { hasBody: false }, args),
+      // POST /security/scans — rank: metic+archon — POST /security/scans
+      postSecurityScans: (args) => request("POST", "/security/scans", { hasBody: true }, args),
     },
     "session": {
       // POST /session/optimize — rank: any-builder — POST /session/optimize
@@ -593,7 +615,7 @@ export function createClient(opts = {}) {
       getSessionsId: (args) => request("GET", "/sessions/{id}", { hasBody: false }, args),
       // GET /sessions/mine — rank: any-builder — GET /sessions/mine
       getSessionsMine: (args) => request("GET", "/sessions/mine", { hasBody: false }, args),
-      // GET /sessions/search — rank: archon — GET /sessions/search
+      // GET /sessions/search — rank: metic+archon — GET /sessions/search
       getSessionsSearch: (args) => request("GET", "/sessions/search", { hasBody: false }, args),
     },
     "sso": {
@@ -661,17 +683,17 @@ export function createClient(opts = {}) {
       getTasksClaimable: (args) => request("GET", "/tasks/claimable", { hasBody: false }, args),
       // GET /tasks/newcomer-floor — rank: any-builder — GET /tasks/newcomer-floor
       getTasksNewcomerFloor: (args) => request("GET", "/tasks/newcomer-floor", { hasBody: false }, args),
-      // POST /tasks/newcomer-restock — rank: archon — POST /tasks/newcomer-restock
+      // POST /tasks/newcomer-restock — rank: metic+archon — POST /tasks/newcomer-restock
       postTasksNewcomerRestock: (args) => request("POST", "/tasks/newcomer-restock", { hasBody: true }, args),
       // GET /tasks/peer-votes/feed — rank: any-builder — GET /tasks/peer-votes/feed
       getTasksPeerVotesFeed: (args) => request("GET", "/tasks/peer-votes/feed", { hasBody: false }, args),
-      // POST /tasks/peer-votes/tally — rank: archon — POST /tasks/peer-votes/tally
+      // POST /tasks/peer-votes/tally — rank: metic+archon — POST /tasks/peer-votes/tally
       postTasksPeerVotesTally: (args) => request("POST", "/tasks/peer-votes/tally", { hasBody: true }, args),
     },
     "versions": {
       // GET /versions — rank: public — GET /versions
       getVersions: (args) => request("GET", "/versions", { hasBody: false }, args),
-      // POST /versions — rank: archon — POST /versions
+      // POST /versions — rank: metic+archon — POST /versions
       postVersions: (args) => request("POST", "/versions", { hasBody: true }, args),
       // GET /versions/{id}/done-when — rank: public — GET /versions/:id/done-when
       getVersionsIdDoneWhen: (args) => request("GET", "/versions/{id}/done-when", { hasBody: false }, args),

package/docs/adr/0020-security-model-public-stub.md

@@ -59,7 +59,7 @@ The defense doesn't depend on the ADR's secrecy. Every protection mentioned in t
 - New builders see the public stub (this file) when reading the ADR index. The stub tells them how to read the full ADR once promoted to Metic+.
 - Any change to the *real* defenses (new gated route, new redaction rule, new rate-limit knob) updates the full ADR on the droplet. Significant structural changes (new threat-model attacker, new defense category) also update this public stub.
 - The `GET /api/gds/security/adr` endpoint exists *now* (V3.R68 / [#287](https://example.com/builders#/task/287)) but returns the not-provisioned placeholder until an Archon writes the file. That's intentional — the endpoint is the contract, the file is the content.
-- A Xenos hitting the endpoint sees `403 rank_forbidden` whether or not the file is provisioned — the rank gate runs before the file-existence check, so existence of the document isn't leaked downward.
+- A Xenos hitting the endpoint sees a `403` whether or not the file is provisioned — the gate runs before the file-existence check, so existence of the document isn't leaked downward. The code is `permission_forbidden` with `{ required, held }`: BV1.R104 migrated this route (and the `/security/docs*` store below it) from `requireRank` to `requirePermission`, which admits exactly the same builders via the atom's catalog floor (ADR 0151). It read `rank_forbidden` before that.
 
 ## Cross-references
 

package/docs/adr/0097-one-active-claim-per-session-and-worktree-binding.md

@@ -38,6 +38,8 @@ The default claim flow (`.claude/skills/builder-claim/SKILL.md`) ensures the tas
 - **Predicate divergence from the task spec, on purpose.** The spec cited `WHERE status='active'`, but `claims` has **no `status` column** — "active" is the table's `released_at IS NULL` convention (the row's lifecycle status lives on `tasks`). The index uses the real column.
 - **Migration safety.** A unique index *fails to create* if existing rows already violate it, which would block deploy. The migration first heals any current violation (keep the earliest active bound claim per session, close the rest — the same shape as migration 174), so the `CREATE` always succeeds; it is idempotent. The **app-layer guard is authoritative**; the index is belt-and-braces and must not break deploy.
 
+> **Amended 2026-08-06 (task 1002570 / `core_204`).** The index as shipped was *stricter* than the worktree-scoped guard above: keyed on `creator_session_id` alone, it refused at the DB layer the second-worktree parallel claim the guard deliberately allows — breaking the many-sessions-per-builder norm this ADR set out to preserve. `migrations/<redacted>.sql` re-keys it to `(creator_session_id, COALESCE(worktree_name, ''))` under the name `uniq_active_claim_per_session_worktree`, same partial predicate, so the backstop now enforces exactly the guard's boundary. The `COALESCE` fold (rather than PG15's `NULLS NOT DISTINCT`) is load-bearing: a plain composite index treats NULLs as distinct, so two worktree-less claims off one shared clone would both insert and re-open the commingling hole. A `23505` from either index generation surfaces as `session_already_has_bound_claim` (task 1002589), never the false `ALREADY_CLAIMED`.
+
 ## Consequences
 
 - A session can hold at most one active claim — commingled ships are structurally prevented, not just discouraged.

package/docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md

@@ -35,7 +35,7 @@ Stand up a **cloudbongos-native box plane** alongside (not replacing) the legacy
 
 ## Follow-ups (open)
 
-1. **Box first-boot convergence — ROOT-CAUSED + fixed (workaround live; proper fix open, task 1002243).** Symptom: provisioned boxes reached `active` but `cloudflared`/terminal never came up (`term-…` = CF 530) and SSH keys weren't applied. Root cause: **`box.js` provisioned droplets with EMPTY user-data** (`/var/lib/cloud/instance/user-data.txt` = 0 bytes; cloud-init logged "No user-data found"). `box.js` renders the box cloud-init from `<REPO_ROOT>/infra/` (the 26 KB `builder-box-cloud-init.yaml` + ~12 gz+b64-inlined scripts), and `fileGzB64` **silently returns `''` on a missing file**, so a missing `infra/` yields empty user-data with no error. The R89 split moved `scripts/gds/` into the `@bongos/core` package but **kept `infra/` in the instance repo** — yet `box.js` still resolves `infra/` relative to *its own* location (the vendored core), where `infra/` **isn't shipped at all** (0 files). So every box on any vendored/installed instance booted with only DigitalOcean's default user-data. **Workaround applied (temporary):** populated the vendored core's `infra/` from the instance's `infra/` (`/home/lars/cloudbongos/node_modules/@bongos/core/infra/`); re-provision then rendered a 62 KB user-data and the box converged — `cloudflared` active, `term-example-owner.cloudbongos.com` → 200 (authed), builder SSH key baked + working. **Proper fix (task 1002243):** ship `infra/` in the core publish-manifest, OR make `box.js` resolve `infra/` from the instance root (like `core-node.sh`'s candidate-base search), AND make `fileGzB64`/the template render **fail loudly** instead of emitting empty user-data. The workaround is under `node_modules` and will be lost on the next `npm ci`/core reinstall until the proper fix lands.
+1. **Box first-boot convergence — ROOT-CAUSED + CLOSED (proper fix landed; [ADR 0150](<redacted>.md), task 1002386).** Symptom: provisioned boxes reached `active` but `cloudflared`/terminal never came up (`term-…` = CF 530) and SSH keys weren't applied. Root cause: **`box.js` provisioned droplets with EMPTY user-data** (`/var/lib/cloud/instance/user-data.txt` = 0 bytes; cloud-init logged "No user-data found"). `box.js` renders the box cloud-init from `<REPO_ROOT>/infra/` (the 26 KB `builder-box-cloud-init.yaml` + ~12 gz+b64-inlined scripts), and `fileGzB64` **silently returns `''` on a missing file**, so a missing `infra/` yields empty user-data with no error. The R89 split moved `scripts/gds/` into the `@bongos/core` package but **kept `infra/` in the instance repo** — yet `box.js` still resolves `infra/` relative to *its own* location (the vendored core), where `infra/` **isn't shipped at all** (0 files). So every box on any vendored/installed instance booted with only DigitalOcean's default user-data. **Workaround applied (temporary):** populated the vendored core's `infra/` from the instance's `infra/` (`/home/lars/cloudbongos/node_modules/@bongos/core/infra/`); re-provision then rendered a 62 KB user-data and the box converged — `cloudflared` active, `term-example-owner.cloudbongos.com` → 200 (authed), builder SSH key baked + working. **Proper fix — LANDED (spike task 1002385 → [ADR 0150](<redacted>.md); build task 1002386, "R98").** `box.js` gained `boxInfraCandidates()`/`resolveBoxInfraDir()` (an ordered instance-root-first search, including the `node_modules` walk-up) plus `BOX_INFRA_TEMPLATE`; `readCloudInit` now routes every `infra/` read through the resolved dir and **throws** on a missing/incomplete `infra/` instead of silently emitting empty user-data, and `cmdProvision` refuses to provision on empty user-data. Pinned by [`tests/box_infra_resolve.mjs`](../../tests/box_infra_resolve.mjs). The temporary `node_modules` workaround described above is therefore no longer load-bearing. *(Superseded task 1002243 was closed as part of task 1002557.)*
 2. **Cloudflare token scope.** Provision warned the ADR 0053 cookie-strip Transform Rule was **not** applied — `CLOUDFLARE_API_TOKEN` lacks "Transform Rules" edit scope on the cloudbongos.com zone. Add the scope (or apply the rule once in the dashboard) **before** other builders get boxes on `*.cloudbongos.com`, so platform cookies (`cookieDomain=<redacted> aren't sent to box subdomains.
 3. **Cosmetic `otb-` prefix.** Tunnel names (`otb-term-<login>`) and the droplet name (`otb-box-<login>`) are still hardcoded in `box-onboard.js`/`box.js`. Harmless (fleet separation is by tag, and DNS is per-zone), but a branding leak worth parameterizing.
 4. **Phase 4 — retire the legacy example plane** (owner decision) — **part (a) DONE in task 1002248 (2026-07-15).** Pre-checked read-only that the legacy fleet was empty (0 `otb-builder-box` droplets on DigitalOcean; cohost intent queue `ran=0`), then `systemctl disable --now` on the four `cohost-box-*` timers (intent-runner / idle-suspend / drift-reconcile / dormant-reclaim) on the control-plane host — now `disabled`/`inactive`; the native `cloudbongos-box-*` timers were left `enabled`/`active`. **Part (b) — disabling the dev-box module on example.com itself — NOT reachable from the control plane, flagged to owner:** example's web app + instance checkout are not co-located on the cloudbongos droplet (no local checkout, no ssh alias) and the local example GDS token is expired, so a durable module-disable needs owner access to example's own config/host. Harmless meanwhile: with the runners stopped there is no cost/security impact — worst case is a box request on the legacy instance that now hangs unfulfilled.

package/docs/adr/0151-governance-permissions-as-atom-ranks-as-roles.md

@@ -99,7 +99,7 @@ The seed is what makes the cut-over behavior-identical. Four rank-roles are seed
 | **`xenos`** | own-work + public read: `task.claim.newcomer`, `task.ship`, `task.act.own`, `cost.log`, `learning.create`, `blocker.file`, `idea.file`, `box.manage.own`, `memory.manage.own`, `credential.manage.own`, `page.view.public` |
 | **`thetes`** | everything `xenos` has **+** `task.claim.any` (the whole general queue, still honoring each task's `requires_rank` floor), `page.view.builder` |
 | **`metic`** | everything `thetes` has **+** `me.wandering.set` (higher clamp) **+** the review/triage/authoring set: `idea.triage`, `blocker.review`, `task.{create,edit,promote,demote,vote}`, `task.dependency.manage`, `task.criterion.manage`, `criterion.satisfy`, `criterion.review`, `planning.run`, `priority.run`, `goal.create`, `goal.archive`, `goal.scope.widen`, `goal.manage.own`, `module.enable`, `module.submit`, `security.report.file`, `llm_cache.use`, `backup.manage`, `source.clone.local`, `box.source.full` |
-| **`archon`** | everything `metic` has **+** the **admin** operational set (`builder.status.set`, `builder.budget.set`, `task.abandon`, `criterion.unsatisfy`, `auth.session.revoke`, `access_request.review`, `security.report.adjudicate`, `provisioning.fleet.manage`, `box.fleet.manage`, `autonomy.precheck`, `discord.channels.manage`, `project.curate`, `override_request.decide`, `claim.release.any`, `idea.ratify`, `task.newcomer_restock`, `task.peer_votes.tally`, `goal.reorder`, `builder.roster.read`, `session.search`, `memory.read.any`, `audit_log.read`, `page.view.governance`) **+** the **`system`** set (`builder.rank.set`, `version.close`, `task.confirm.grade_bypass`, `dependency.cross_tier.manage`, `goal.scope.manage`, `governance.manage`, `gate_approval.decide`, `deploy.push_main`, `path.protected.modify`, `infra.ssh`). The `principal.*` permissions are **not** in any rank-role — they are held only by the machine-principal identities (`system_role='bfg'`/`'discord_bot'`), never by a human, not even an Archon (that is what gating on exact identity means). |
+| **`archon`** | everything `metic` has **+** the **admin** operational set (`builder.status.set`, `builder.budget.set`, `task.abandon`, `criterion.unsatisfy`, `version.create`, `auth.session.revoke`, `access_request.review`, `security.report.adjudicate`, `provisioning.fleet.manage`, `box.fleet.manage`, `autonomy.precheck`, `discord.channels.manage`, `project.curate`, `override_request.decide`, `claim.release.any`, `idea.ratify`, `task.newcomer_restock`, `task.peer_votes.tally`, `goal.reorder`, `builder.roster.read`, `session.search`, `memory.read.any`, `audit_log.read`, `page.view.governance`) **+** the **`system`** set (`builder.rank.set`, `version.close`, `task.confirm.grade_bypass`, `dependency.cross_tier.manage`, `goal.scope.manage`, `governance.manage`, `gate_approval.decide`, `deploy.push_main`, `path.protected.modify`, `infra.ssh`). The `principal.*` permissions are **not** in any rank-role — they are held only by the machine-principal identities (`system_role='bfg'`/`'discord_bot'`), never by a human, not even an Archon (that is what gating on exact identity means). |
 
 **Why cumulative preserves the threshold.** Today `requireRank('metic')` admits metic **and** archon (threshold = at-or-above). Because the seeded `archon` role ⊇ `metic` role, the resolver's union preserves exactly that: both roles grant `idea.triage`, so `requirePermission('idea.triage')` admits both — identical to the old threshold. A builder in the compat seed holds exactly **one** rank-role, so their effective set = that role's set = exactly their rank's threshold powers today. The parity test (R103) is the mechanical proof.
 
@@ -146,6 +146,7 @@ The `system` set is deliberately **tight** — only gates whose delegation would
 | `builder.budget.set` | `PATCH /builders/:id/budget` |
 | `task.abandon` | `POST /tasks/:id/abandon` — terminal scope removal |
 | `criterion.unsatisfy` | `POST /done-when/:id/unsatisfy` |
+| `version.create` | `POST /versions` — create a version + its done-when criteria. Added BV1.R105 (task 1001847): the route had no atom, so it was the one module write the migration could not finish. **Operational, not `system`,** even though `version.close` is `system` — the flag marks trust-boundary power, and creating a version is *authoring* (it confers no authority). Its siblings are `goal.create` / `task.create`. Close is the disposition that finalises a version's scope-truth; create opens it. |
 | `auth.session.revoke` | `POST /auth/revoke`, `/auth/revoke-all` |
 | `access_request.review` | `GET/PATCH /access-requests/:id` — admit a builder |
 | `security.report.adjudicate` | `POST /security/reports/:id/{confirm,dispute,fix,link-fix}`, `/security/docs` CRUD |

package/docs/adr/0155-adopt-private-repo-widen-oauth-scope.md

@@ -0,0 +1,51 @@
+# 0155 — Adopting a private repo: widen the onboarding OAuth scope to `repo`
+
+- **Status:** Accepted — built in task [#1002561](https://example.com/builders#/task/1002561).
+- **Date:** 2026-08-04
+- **Deciders:** the owner chose the credential approach after being shown the trade-off; Claude diagnosed + built.
+- **Amends:** [ADR 0143](<redacted>.md) §1 (its Decision 1 — scope choice). 0143 otherwise stands unchanged: opt-in per sign-in, lazy consent, encrypted short-TTL token store, personal repos only, 503-degrade. Per 0143's own append-only rule, this is a new ADR, not an edit.
+- **Related:** [ADR 0121](<redacted>.md) (greenfield vs brownfield onboarding).
+
+## Context
+
+Standing up a project on an **existing private repo** failed. Live evidence — `provisioning_instances` id=14, `example-owner/hermeslines-marketing`, `status='error'`:
+
+```
+git -C /srv/cloudbongos/hermeslines-marketing … push https://x-access-token@github.com/…  HEAD:main
+remote: Write access to repository not granted.
+fatal: … The requested URL returned error: 403
+```
+
+`scopeForWebFlow()` requested `read:user public_repo`. **`public_repo` grants write to *public* repos only**, so the provisioner's scaffold push to a private repo 403s.
+
+Three things confirm this was scope and not credentials:
+
+1. The live `github_oauth_tokens` row was `scope='public_repo,read:user'` and **still valid** during the failure window. A dead token returns `401 Bad credentials`; `403 Write access to repository not granted` is GitHub's canonical *scope-insufficient* response.
+2. Every **greenfield** project ever created worked, because `createUserRepo` hardcodes `private:false` — the platform only ever pushed to repos it had just made public. Adopt is the first flow where a private repo can be the target, so this had never been exercised.
+3. The picker already renders a **"Private" badge** (`public-landing/create.html`) — UI written for a case `public_repo` made unreachable, since `/user/repos` omits private repos under that scope.
+
+ADR 0143 §1 anticipated exactly this and named the exit: *"**Accepted limitation:** private repos can't be listed/adopted or created; revisit to `repo` only if private support is needed"*, with *"switching to `repo` (private support) is a one-line scope change"* under Consequences. This ADR takes that path.
+
+Options weighed with the owner:
+
+- **(A) Never let the server touch the user's repo.** For adopt, the user runs `bongos init --adopt` and pushes themselves — which the wizard already instructs — and provisioning only stands up server/DB/address. Keeps the narrow scope. Cost: a private repo still needs a read-only deploy key for the instance to *run*, and the "we set it up for you" promise weakens.
+- **(B) Widen the scope to `repo` and keep pushing on the user's behalf.** One consent screen, no extra steps, adopt works for public and private alike. Cost: the persisted token can write to **every repo the user owns**.
+- **(C) Public repos only.** Detect a private repo at the form and refuse early. Cheapest, but declines the feature.
+
+## Decision
+
+**Take (B) — `scopeForWebFlow({repos:true})` now returns `read:user repo`** — per the owner's explicit call, having been shown that this reverses 0143's least-privilege posture and enlarges what a leaked token can reach. Within that:
+
+1. **`repo`, and only on the wizard path.** 0143 §2 is unchanged and load-bearing: the broadened scope is requested *only* via `?repos=1` from `/create`. Hall web sign-in and the CLI Device Flow stay `read:user`. `scopeForWebFlow` remains the single place the string is decided, and the unit test now asserts both that the wizard gets `repo` and that the default path carries **no** repo-acting scope.
+2. **A stale-scope token must re-prompt, not degrade.** Widening the *request* does not upgrade tokens already stored. A surviving `public_repo` row still lists and creates *public* repos, so without a check the wizard would 200 while **silently omitting the user's private repos** — and the real failure would resurface minutes later as the same opaque push 403. New `grantedScopeCoversRepos()` parses GitHub's comma-separated granted scope and gates `resolveRepoToken`, which now returns the existing `repo_scope_required` (403) so the wizard's well-exercised reconnect path handles it. Parsing (not substring-matching) matters: `public_repo` *contains* `"repo"`, and a naive match would accept precisely the token this guards against.
+3. **A repo *we* create stays public.** `createUserRepo` keeps `private:false`. Under `repo` it *could* create a private repo; it doesn't, because a Cloud Bongos instance is open-source / capture-resistant by design. This is now a **product** choice rather than a credential limit, it is deliberately not a parameter, and a test pins it so the widen can't silently change what we create. A user wanting a private instance adopts a private repo they made themselves.
+4. **Consent is stated in our own words first.** GitHub's screen for `repo` reads as full control of all repositories. The wizard's connect copy now says plainly that this is the only scope that can write to a private repo, and what we do with it (read the repo you pick; push the setup commit), so the user does not first learn the breadth from GitHub's wording.
+
+## Consequences
+
+- **Security posture — the real cost.** The stored token is now a materially bigger honeypot: write access to every repo the user owns, public and private. 0143's containment still applies unchanged and is what makes this tolerable — encrypted at rest via secret-box, **1h TTL**, lazily swept, requested only on the wizard path, and never stored at all when secret-box is unconfigured. The blast radius is nonetheless larger than before, and this is the ADR to revisit first if a token ever leaks.
+- **A GitHub App remains the principled fix.** 0143 §Context option (B) — a central App with fine-grained `Contents:write` on *only* the selected repo — gives adopt-private without the account-wide grant. It was rejected then for the install step, and this decision makes the case for it stronger, not weaker. A future ADR adopting it would supersede this one.
+- **Returning users reconnect once.** Anyone holding a live pre-0155 token gets one `repo_scope_required` prompt. The 1h TTL means the affected window is small.
+- **The picker gains private repos** — `/user/repos` returns them under `repo`, lighting up the dormant "Private" badge.
+- **This alone does not make adopt work.** The second, independent defect is server-side: provisioning has no notion of adopt and unconditionally `git init`s a fresh tree and pushes to `main`, which an existing repo rejects as unrelated history. Task [#1002562](https://example.com/builders#/task/1002562) fixes that; [#1002563](https://example.com/builders#/task/1002563) verifies both live. **Because the wider scope makes a mistaken `--force` in that path a genuine data-loss route on a user's repo, the adopt push must never force, and 1002562 carries a test asserting it.**
+- **Reversal.** Narrowing back to `public_repo` is a one-line change plus dropping the scope guard, and re-accepts 0143's limitation.

package/docs/adr/0156-user-set-display-name-wins.md

@@ -0,0 +1,62 @@
+# 0156 — A builder's own display name wins, always
+
+- **Status:** Accepted
+- **Date:** 2026-08-04
+- **Deciders:** Lars (owner / Archon), Claude
+
+**Track:** `internal` (GDS / builder experience). Task [1002568](https://cloudbongos.com/builders#/task/1002568), under the **Builder experience** goal [1000025](https://cloudbongos.com/builders#/goal/1000025).
+
+---
+
+## Context
+
+A builder sets their display name in the hall's Settings page. It saves — the toast confirms it, the sub-header updates, the row really is written — and then it silently reverts to their GitHub account name the next time they sign in.
+
+The write path was never the problem. `PATCH /me/display-name` validates via `modules/builder-settings/display-name.js`, writes through `modules/builder-settings/db.js`, and every read surface (hall header, leaderboard, work feed) already prefers `display_name` over `github_login`.
+
+The problem is that `upsertBuilder` (`src/bongos/db-kernel.js`) is named for account creation but runs on **every authentication**. Its conflict branch re-synced the whole identity row from GitHub:
+
+```sql
+ON CONFLICT (github_id) DO UPDATE
+  SET github_login = EXCLUDED.github_login,
+      display_name = EXCLUDED.display_name,   -- ← the clobber
+      avatar_url   = EXCLUDED.avatar_url
+```
+
+`EXCLUDED.display_name` is whatever the caller just read off GitHub. All four login paths feed it: `pollDeviceFlow` (CLI setup/re-auth), `completeWebFlow` (browser hall sign-in), `completeIdpFlow` and `completeDeviceExchange` (federated hub). So the builder's own name survived exactly until their next sign-in — and because CLI re-auth counts, that is often the same working day.
+
+That re-sync is not a bug on its own. It is why a builder who changes their name on GitHub sees the change reflected here without doing anything. Keeping that is a real requirement; the row is seeded from GitHub in the first place.
+
+## Decision
+
+**Once a builder sets their own display name, GitHub never overwrites it. Builders who never renamed keep syncing from GitHub.**
+
+The row records *who last set the name*. A new core column, `builders.display_name_source text NOT NULL DEFAULT 'github'` (migration `<redacted>`, CHECK-constrained to `'github' | 'user'`), carries that one bit:
+
+- `setBuilderDisplayName` (the only path a builder can rename themselves through) stamps `display_name_source = 'user'` alongside the name.
+- `upsertBuilder`'s conflict branch guards the assignment:
+
+  ```sql
+  display_name = CASE WHEN builders.display_name_source = 'user'
+                      THEN builders.display_name
+                      ELSE EXCLUDED.display_name END
+  ```
+
+`github_login` and `avatar_url` keep re-syncing unconditionally — neither is user-editable, and `github_login` is identity, not a label.
+
+`'github'` is the correct default for every pre-existing row: before this change there was no durable user-set name, so whatever is stored *is* the GitHub-derived value. A builder who had been fighting the revert re-saves once and it sticks.
+
+### The rejected alternative: just delete the line
+
+The one-line fix is to drop `display_name = EXCLUDED.display_name` from the conflict branch entirely. No migration, no new column, no new state.
+
+It was rejected because it fixes one builder's problem by taking a feature away from everyone else. `display_name` would then be frozen at whatever GitHub reported the day the account was created. A builder who renames themselves on GitHub — or who had no GitHub display name at signup and so was seeded with their bare login — would be stuck with a stale label forever, with the hall Settings editor as the only way out. The revert bug affects builders who deliberately renamed; the frozen-name bug would affect everyone who never touched Settings, which is most of them. Trading a visible bug for a silent one is a bad trade.
+
+The chosen fix costs one boolean-shaped column and keeps both behaviours correct.
+
+## Consequences
+
+- **New core column.** `builders.display_name_source`. Core, not `modules/builder-settings/migrations/`: the column sits on the core `builders` table and the guard that reads it lives in core `db-kernel.js` on the auth path. A module migration may only touch its own namespaced objects ([ADR 0083](<redacted>.md) §Decision #5), and core schema must not depend on whether a module is enabled. Same placement as the other `builders`-table preference columns (037, 075, 119, 164).
+- **Not surfaced in the API.** `GET /me/display-name` and `docs/api/openapi.json` are unchanged. The flag is internal persistence state; no UI copy branches on whether a name is GitHub-derived, so exposing it would be surface with no consumer.
+- **The federated hub needs no matching guard.** `modules/platform-identity/platform-identity.js`'s `upsertAccount` does the same unconditional re-sync on `platform_identity_accounts`, and its `display_name` reaches an instance through `completeIdpFlow`. It does not need changing: the `CASE` above runs regardless of what `EXCLUDED` carries, so an instance's `builders.display_name` is protected no matter which login path supplied the value. And `platform_identity_accounts` is identity-only with no self-service editor — there is no user-set value there to protect.
+- **Regression-tested where it broke.** `tests/display_name.mjs` previously covered only the pure validator, which is exactly why this shipped: the half that was correct was the half under test. It now also reads the real SQL both halves emit and asserts the conflict branch's behaviour — a renamed builder keeps their name against a different incoming GitHub name, and a never-renamed builder still picks up a GitHub rename.

package/docs/adr/0157-archon-is-rank-and-identity-only.md

@@ -0,0 +1,93 @@
+# 0157 — Archon is rank and identity only; the operational block delegates to Metic
+
+- **Status:** Accepted
+- **Date:** 2026-08-05
+- **Deciders:** Lars (Archon), Claude
+
+**Builds on / amends:** [ADR 0016](<redacted>.md) (server-enforced trust boundary — **unchanged**, this ADR moves floors inside it, never the enforcement point), [ADR 0151](<redacted>.md) (permissions-as-atom — this ADR is only possible because the floor is declared once, in `catalog.js`), [ADR 0090](<redacted>.md) / [ADR 0152](<redacted>.md) (the two earlier one-power delegations this generalises), [ADR 0154](<redacted>.md) (**amends** — its "unsatisfy stays Archon" carve-out is superseded), [ADR 0086](<redacted>.md) (protected-scope goals — **unchanged**, `goal.scope.manage` stays Archon).
+
+**Track:** `internal` (GDS / methodology). Task [1002584](https://cloudbongos.com/builders#/task/1002584).
+
+---
+
+## Context
+
+The Archon rank had accumulated 50 route gates. Almost none of them were about *authority*; they were about **administration** — reading the roster, listing dev boxes, viewing the audit log, adjudicating a vulnerability report, tearing down an idle droplet, reordering a queue, ratifying an idea. Each arrived Archon-gated for the same defensible reason: [ADR 0016](<redacted>.md) sets the default posture for any new privileged route to `requireRank('archon')` until a lower rank is explicitly granted — fail closed. Nothing ever came back to lower them, so "fail closed" quietly became "the owner is the only operator."
+
+Two earlier ADRs had already delegated one power each on the same reasoning — [ADR 0090](<redacted>.md) (a rank trusted to *triage* ideas is trusted to *seed* the work they become) and [ADR 0152](<redacted>.md) (a rank trusted to author work is trusted to retire it). This ADR generalises that argument instead of relitigating it one route at a time.
+
+Lars's directive (2026-08-05): **"Move all of these to metic, and make archon just responsible for rank and identity."**
+
+### Why this is now a small change
+
+The literal reading of that directive — edit 41 `requireRank('archon')` call sites — was the wrong shape, and briefly the plan. BV1.R104/R105 (jaxri, tasks [1001846](https://cloudbongos.com/builders#/task/1001846)/[1001847](https://cloudbongos.com/builders#/task/1001847)) had migrated the route gates to `requirePermission(...)` and were sitting at `confirmed` — graded, verified, unmerged — for five days. They landed mid-session.
+
+Once every gate reads `requirePermission('<atom>')`, the rank floor is declared in exactly one place: `floor:` in [`modules/governance/catalog.js`](../../modules/governance/catalog.js). The delegation collapses from 41 call-site edits to **20 one-word floor changes in one table**. That is the ADR 0151 payoff arriving in practice, and it is worth recording as the concrete return on that refactor: the same owner decision was a 41-file diff on Monday and a 1-file diff on Tuesday.
+
+## Decision
+
+### 1. Archon retains rank, identity, and four escalation keys — 13 atoms
+
+| Atom | Why it stays |
+|---|---|
+| `builder.rank.set` | **rank** — the single writer of `builders.rank`. The whole point. |
+| `builder.status.set` | **identity** — offboard / (de)activate: who exists. |
+| `access_request.review` | **identity** — who is admitted at all. |
+| `auth.session.revoke` | **identity** — whose sessions are valid. |
+| `task.confirm.grade_bypass` | escalation key (below) |
+| `gate_approval.decide` | escalation key (below) |
+| `goal.scope.manage` | escalation key (below) |
+| `governance.manage` | escalation key (below) |
+| `deploy.push_main`, `path.protected.modify`, `infra.ssh` | substrate-enforced (pre-push hook, `main-audit.js`), outside the HTTP boundary — [ADR 0043](<redacted>.md). Not reachable to delegate here. |
+| `version.close` | see §3 |
+
+### 2. The four escalation keys, and why a literal reading of the directive was refused
+
+`builder.rank.set` staying Archon is **not sufficient** to keep "only the Archon sets rank" true. Four other atoms form a chain that ends in self-promotion, and every link was Archon-gated, which is why the chain was closed:
+
+1. Create a goal scoped to a **protected** module — the permission core itself (`goal.scope.manage`).
+2. Claim a task in it. **Already allowed**: `PROTECTED_GLOBS` floors at *metic*, by [ADR 0043](<redacted>.md)'s design.
+3. Write code deleting the rank check, then confirm past the failed grade (`task.confirm.grade_bypass`).
+4. Approve your own red CI deploy gate (`gate_approval.decide`) → it lands on `main`.
+
+Plus `governance.manage`, whose routes R110/R111 have not built yet: it grants roles and permissions directly, so holding it means granting yourself anything — the meta-escalation.
+
+Moving all 20 as literally asked would have opened that chain, making the delegation **self-reversible** — a Metic could reach Archon, at which point "Archon owns rank" is decoration. The concern was put to the owner with the chain spelled out; the owner chose to keep all four. Recording this because the reasoning is not visible from the floor values alone: *four of these look operational and are not.*
+
+**This is the load-bearing invariant of this ADR:** the delegated set must contain no path to raising your own rank. A future delegation must re-run that check rather than assume it.
+
+### 3. Two atoms held back beyond the four, each for a stated reason
+
+- **`version.close`** — [`docs/canonical-permissions.md`](../canonical-permissions.md) has long paired closing a version with setting rank as the two powers that never delegate. Closing a version is the disposition that finalises shipped scope-truth. Kept, and flagged to the owner as a judgment call rather than a derivation. Its sibling `version.create` **did** move: authoring opens a container, disposition finalises one — the asymmetry is deliberate and is now recorded at both atoms.
+- **`dependency.cross_tier.manage`** — `system: true`, and `tests/governance_catalog.mjs` enforces that no `system` permission is granted below archon. Moving it would mean clearing the `system` flag, which widens what any **custom role** can be granted — a second-order authority change nobody asked for. The flag is the wall; it was not quietly lowered to satisfy a floor change.
+
+### 4. `gate_approval.read` is minted, splitting the Gate page's read from its write
+
+`page.view.governance` moving to metic opens `/watch`, `/harbor`, `/gate` to the working rank. But `GET /gate-approvals` — the Gate page's only data endpoint — was still `requireRank('archon')`, one of three read routes R104/R105 deliberately skipped because their atom was declared over the module's *writes* only.
+
+Left alone, a Metic would open `/gate` and get a page rendering nothing but a 403. So: `gate_approval.read` (metic) for the list, `gate_approval.decide` (archon, `system`) for approving a held PR. The same "the atom must name the read" step resolves the other two skipped gates — `GET /projects` (`project.curate`) and `GET /security/reports` (`security.report.adjudicate`) — whose write atoms had already moved to metic, which would otherwise have left the **read stricter than the write**: a Metic able to confirm a vulnerability report but not list one.
+
+### 5. Pins move from ranks to atoms
+
+`EXPECTED_RANKS` / `MODULE_EXPECTED_RANKS` in [`route-rank-check.js`](../../src/bongos/route-rank-check.js) pinned these routes to the literal rank `'archon'`. Rank pins break on every floor change; `pinMismatch` compares **atom identity** for `perm:` pins. The affected pins are now `perm:<atom>`, so the guarded invariant is *"this route gates on this permission"* — which is the property actually worth protecting — and a future owner decision to move a floor needs no pin edit.
+
+## Consequences
+
+**What a Metic gains.** The Watch / Harbor / Gate pages and the session log; the dev-box and provisioning fleets (including force-teardown and per-builder blocks); security-report adjudication; the audit log; the builder roster and per-builder grades; cross-builder memory reads; project curation and scouting; budget setting; idea ratification; override-request decisions; release-on-behalf; criterion un-satisfy; goal reorder; newcomer restock; peer-vote tally; version creation.
+
+**The owner's remaining day-to-day surface** is rank changes, admissions, offboarding, session revocation, grade-bypass confirms, CI gate approvals, protected-scope goals, and version close. That is the intended shape: the owner sets *who may act and how far*; the working rank *acts*.
+
+**Two consequences worth a second look** (both flagged to the owner, neither blocking):
+
+1. **The exploit cookbook widened.** `security.report.adjudicate` guards `/security/docs` — the engagement-report store holding attacker-usable exploit detail — so that is now Metic-readable. Every other delegated atom widens who may *act*; this one widens who may *read*. If unwanted, the fix mirrors §4: split a `security.docs.read` at archon and let adjudication delegate. Recorded in `tests/security_docs.mjs` at the assertion that used to guard it.
+2. **The backward ratchet delegated.** [ADR 0154](<redacted>.md) made "unsatisfy stays Archon" the explicit safety argument for delegating criterion *create* — the forward ratchet moved, the backward one did not. `criterion.unsatisfy` is neither rank/identity nor an escalation key, so under this directive it moved, superseding that carve-out. What still holds is the part that never depended on rank: satisfy and unsatisfy remain **separate atoms**, so confirming a criterion never confers the power to un-confirm one.
+
+**A floor change needs a migration.** `governance_002`'s compat seed is run-once, so an edited `floor:` never reaches an already-migrated database. [`<redacted>.sql`](../../modules/governance/migrations/<redacted>.sql) grants the 20 to `metic` (+ `gate_approval.read` to both, since it is new). Lowering a floor is additive, so `tests/governance_seed.mjs`'s union model handles it and revokes nothing.
+
+**`requireArchonPage` is now a misnomer** — it resolves `page.view.governance`, floor metic. Renaming it touches serve-internal, auth, and several test files; left deliberately to keep this diff small in authz code, and filed separately. The hall nav group was relabelled **Archon → Governance**, because a header reading "Archon" over items a Metic can open misdescribes the ladder to exactly the builders still learning it.
+
+> **Resolved (2026-08-05, [#1002588](https://cloudbongos.com/builders#/task/1002588)).** That follow-up landed: the gate is now `requireGovernancePage`. It is a pure rename — same `page.view.governance` permission, same `deniedTo`, same audience. References to `requireArchonPage` in this ADR and in ADRs [0036](<redacted>.md) / [0058](<redacted>.md) / [0151](<redacted>.md) are left as written, since they describe what was true at the time; `src/bongos/auth.js` carries a comment naming the old spelling so a grep from any of them lands on the trail.
+
+**What did not change.** [ADR 0016](<redacted>.md) end to end: authority is still resolved server-side, per request, uncached, from `builders.rank` via the seeded rank-roles. A builder editing their checkout still cannot grant themselves anything. This ADR moves floors *inside* that boundary; it does not touch the boundary.
+
+**The ADR 0016 default posture still stands** for *new* routes: start at `requireRank('archon')` / an archon-floored atom and delegate deliberately. This ADR is that deliberate step taken in bulk for the accumulated backlog — not a licence to skip it.