@bongos/core 1.18.19 → 1.19.2

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -102,7 +102,7 @@ function createClient(opts = {}) {
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),
     },
     "auditLog": {
-      // GET /audit-log — rank: archon — GET /audit-log
+      // GET /audit-log — rank: metic+archon — GET /audit-log
       getAuditLog: (args) => request("GET", "/audit-log", { hasBody: false }, args),
     },
     "auth": {
@@ -144,7 +144,7 @@ function createClient(opts = {}) {
       getAuthWebStart: (args) => request("GET", "/auth/web/start", { hasBody: false }, args),
     },
     "autonomy": {
-      // GET /autonomy/precheck — rank: archon — GET /autonomy/precheck
+      // GET /autonomy/precheck — rank: metic+archon — GET /autonomy/precheck
       getAutonomyPrecheck: (args) => request("GET", "/autonomy/precheck", { hasBody: false }, args),
     },
     "backup": {
@@ -204,13 +204,13 @@ function createClient(opts = {}) {
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
     },
     "boxes": {
-      // GET /boxes — rank: archon — GET /boxes
+      // GET /boxes — rank: metic+archon — GET /boxes
       getBoxes: (args) => request("GET", "/boxes", { hasBody: false }, args),
-      // PATCH /boxes/{builderId}/block — rank: archon — PATCH /boxes/:builderId/block
+      // PATCH /boxes/{builderId}/block — rank: metic+archon — PATCH /boxes/:builderId/block
       patchBoxesBuilderIdBlock: (args) => request("PATCH", "/boxes/{builderId}/block", { hasBody: true }, args),
-      // POST /boxes/{builderId}/close — rank: archon — POST /boxes/:builderId/close
+      // POST /boxes/{builderId}/close — rank: metic+archon — POST /boxes/:builderId/close
       postBoxesBuilderIdClose: (args) => request("POST", "/boxes/{builderId}/close", { hasBody: true }, args),
-      // GET /boxes/cost-ledger — rank: archon — GET /boxes/cost-ledger
+      // GET /boxes/cost-ledger — rank: metic+archon — GET /boxes/cost-ledger
       getBoxesCostLedger: (args) => request("GET", "/boxes/cost-ledger", { hasBody: false }, args),
     },
     "bugAttachments": {
@@ -218,9 +218,9 @@ function createClient(opts = {}) {
       getBugAttachmentsName: (args) => request("GET", "/bug-attachments/{name}", { hasBody: false }, args),
     },
     "builders": {
-      // GET /builders/{id}/active-claims — rank: archon — GET /builders/:id/active-claims
+      // GET /builders/{id}/active-claims — rank: metic+archon — GET /builders/:id/active-claims
       getBuildersIdActiveClaims: (args) => request("GET", "/builders/{id}/active-claims", { hasBody: false }, args),
-      // PATCH /builders/{id}/budget — rank: archon — PATCH /builders/:id/budget
+      // PATCH /builders/{id}/budget — rank: metic+archon — PATCH /builders/:id/budget
       patchBuildersIdBudget: (args) => request("PATCH", "/builders/{id}/budget", { hasBody: true }, args),
       // GET /builders/{id}/onboarding — rank: public — GET /builders/:id/onboarding
       getBuildersIdOnboarding: (args) => request("GET", "/builders/{id}/onboarding", { hasBody: false }, args),
@@ -234,13 +234,13 @@ function createClient(opts = {}) {
       getBuildersDirectory: (args) => request("GET", "/builders/directory", { hasBody: false }, args),
       // GET /builders/me/pending-rank-change — rank: any-builder — GET /builders/me/pending-rank-change
       getBuildersMePendingRankChange: (args) => request("GET", "/builders/me/pending-rank-change", { hasBody: false }, args),
-      // GET /builders/roster — rank: archon — GET /builders/roster
+      // GET /builders/roster — rank: metic+archon — GET /builders/roster
       getBuildersRoster: (args) => request("GET", "/builders/roster", { hasBody: false }, args),
     },
     "claims": {
       // POST /claims — rank: any-builder — POST /claims
       postClaims: (args) => request("POST", "/claims", { hasBody: true }, args),
-      // POST /claims/{id}/release-on-behalf — rank: archon — POST /claims/:id/release-on-behalf
+      // POST /claims/{id}/release-on-behalf — rank: metic+archon — POST /claims/:id/release-on-behalf
       postClaimsIdReleaseOnBehalf: (args) => request("POST", "/claims/{id}/release-on-behalf", { hasBody: true }, args),
       // POST /claims/{id}/resolve — rank: any-builder — POST /claims/:id/resolve
       postClaimsIdResolve: (args) => request("POST", "/claims/{id}/resolve", { hasBody: true }, args),
@@ -262,21 +262,21 @@ function createClient(opts = {}) {
       postDependencies: (args) => request("POST", "/dependencies", { hasBody: true }, args),
     },
     "discord": {
-      // GET /discord/channels/plan — rank: archon — GET /discord/channels/plan
+      // GET /discord/channels/plan — rank: metic+archon — GET /discord/channels/plan
       getDiscordChannelsPlan: (args) => request("GET", "/discord/channels/plan", { hasBody: false }, args),
-      // POST /discord/channels/reconcile — rank: archon — POST /discord/channels/reconcile
+      // POST /discord/channels/reconcile — rank: metic+archon — POST /discord/channels/reconcile
       postDiscordChannelsReconcile: (args) => request("POST", "/discord/channels/reconcile", { hasBody: true }, args),
     },
     "doneWhen": {
       // POST /done-when/{criterionId}/satisfy — rank: metic+archon — POST /done-when/:criterionId/satisfy
       postDoneWhenCriterionIdSatisfy: (args) => request("POST", "/done-when/{criterionId}/satisfy", { hasBody: true }, args),
-      // POST /done-when/{criterionId}/unsatisfy — rank: archon — POST /done-when/:criterionId/unsatisfy
+      // POST /done-when/{criterionId}/unsatisfy — rank: metic+archon — POST /done-when/:criterionId/unsatisfy
       postDoneWhenCriterionIdUnsatisfy: (args) => request("POST", "/done-when/{criterionId}/unsatisfy", { hasBody: true }, args),
       // GET /done-when/pending-review — rank: metic+archon — GET /done-when/pending-review
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
     "gateApprovals": {
-      // GET /gate-approvals — rank: archon — GET /gate-approvals
+      // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
       getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
       // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
@@ -334,11 +334,29 @@ function createClient(opts = {}) {
       patchGoalsIdVisibility: (args) => request("PATCH", "/goals/{id}/visibility", { hasBody: true }, args),
       // GET /goals/inbox — rank: any-builder — GET /goals/inbox
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
-      // POST /goals/reorder — rank: archon — POST /goals/reorder
+      // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
     },
+    "governance": {
+      // GET /governance/assignments — rank: archon — GET /governance/assignments
+      getGovernanceAssignments: (args) => request("GET", "/governance/assignments", { hasBody: false }, args),
+      // POST /governance/assignments — rank: archon — POST /governance/assignments
+      postGovernanceAssignments: (args) => request("POST", "/governance/assignments", { hasBody: true }, args),
+      // DELETE /governance/assignments/{builderId}/{roleKey} — rank: archon — DELETE /governance/assignments/:builderId/:roleKey
+      deleteGovernanceAssignmentsBuilderIdRoleKey: (args) => request("DELETE", "/governance/assignments/{builderId}/{roleKey}", { hasBody: false }, args),
+      // GET /governance/permissions — rank: archon — GET /governance/permissions
+      getGovernancePermissions: (args) => request("GET", "/governance/permissions", { hasBody: false }, args),
+      // GET /governance/roles — rank: archon — GET /governance/roles
+      getGovernanceRoles: (args) => request("GET", "/governance/roles", { hasBody: false }, args),
+      // POST /governance/roles — rank: archon — POST /governance/roles
+      postGovernanceRoles: (args) => request("POST", "/governance/roles", { hasBody: true }, args),
+      // DELETE /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — DELETE /governance/roles/:roleKey/permissions/:permissionKey
+      deleteGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("DELETE", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: false }, args),
+      // PUT /governance/roles/{roleKey}/permissions/{permissionKey} — rank: archon — PUT /governance/roles/:roleKey/permissions/:permissionKey
+      putGovernanceRolesRoleKeyPermissionsPermissionKey: (args) => request("PUT", "/governance/roles/{roleKey}/permissions/{permissionKey}", { hasBody: true }, args),
+    },
     "grades": {
-      // GET /grades/by-builder — rank: archon — GET /grades/by-builder
+      // GET /grades/by-builder — rank: metic+archon — GET /grades/by-builder
       getGradesByBuilder: (args) => request("GET", "/grades/by-builder", { hasBody: false }, args),
     },
     "healthz": {
@@ -354,7 +372,7 @@ function createClient(opts = {}) {
       getInboxId: (args) => request("GET", "/inbox/{id}", { hasBody: false }, args),
       // PATCH /inbox/{id} — rank: metic+archon — PATCH /inbox/:id
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
-      // POST /inbox/{id}/ratify — rank: archon — POST /inbox/:id/ratify
+      // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
     },
     "instance": {
@@ -432,9 +450,9 @@ function createClient(opts = {}) {
       getMemoryBfgBuildersBuilderIdFiles: (args) => request("GET", "/memory/bfg/builders/{builderId}/files", { hasBody: false }, args),
       // POST /memory/builders/{builderId}/bfg-write — rank: bfg-principal — POST /memory/builders/:builderId/bfg-write
       postMemoryBuildersBuilderIdBfgWrite: (args) => request("POST", "/memory/builders/{builderId}/bfg-write", { hasBody: true }, args),
-      // GET /memory/builders/{builderId}/file — rank: archon — GET /memory/builders/:builderId/file
+      // GET /memory/builders/{builderId}/file — rank: metic+archon — GET /memory/builders/:builderId/file
       getMemoryBuildersBuilderIdFile: (args) => request("GET", "/memory/builders/{builderId}/file", { hasBody: false }, args),
-      // GET /memory/builders/{builderId}/files — rank: archon — GET /memory/builders/:builderId/files
+      // GET /memory/builders/{builderId}/files — rank: metic+archon — GET /memory/builders/:builderId/files
       getMemoryBuildersBuilderIdFiles: (args) => request("GET", "/memory/builders/{builderId}/files", { hasBody: false }, args),
       // DELETE /memory/file — rank: any-builder — DELETE /memory/file
       deleteMemoryFile: (args) => request("DELETE", "/memory/file", { hasBody: true }, args),
@@ -470,27 +488,27 @@ function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "overrideRequests": {
-      // GET /override-requests — rank: archon — GET /override-requests
+      // GET /override-requests — rank: metic+archon — GET /override-requests
       getOverrideRequests: (args) => request("GET", "/override-requests", { hasBody: false }, args),
-      // POST /override-requests/{id}/decide — rank: archon — POST /override-requests/:id/decide
+      // POST /override-requests/{id}/decide — rank: metic+archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
     "projects": {
-      // GET /projects — rank: archon — GET /projects
+      // GET /projects — rank: metic+archon — GET /projects
       getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),
-      // POST /projects — rank: archon — POST /projects
+      // POST /projects — rank: metic+archon — POST /projects
       postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
-      // PATCH /projects/{id}/featured — rank: archon — PATCH /projects/:id/featured
+      // PATCH /projects/{id}/featured — rank: metic+archon — PATCH /projects/:id/featured
       patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
       // GET /projects/featured — rank: public — GET /projects/featured
       getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
-      // POST /projects/invite — rank: archon — POST /projects/invite
+      // POST /projects/invite — rank: metic+archon — POST /projects/invite
       postProjectsInvite: (args) => request("POST", "/projects/invite", { hasBody: true }, args),
     },
     "provisioning": {
-      // GET /provisioning/fleet — rank: archon — GET /provisioning/fleet
+      // GET /provisioning/fleet — rank: metic+archon — GET /provisioning/fleet
       getProvisioningFleet: (args) => request("GET", "/provisioning/fleet", { hasBody: false }, args),
-      // GET /provisioning/fleet/cost-ledger — rank: archon — GET /provisioning/fleet/cost-ledger
+      // GET /provisioning/fleet/cost-ledger — rank: metic+archon — GET /provisioning/fleet/cost-ledger
       getProvisioningFleetCostLedger: (args) => request("GET", "/provisioning/fleet/cost-ledger", { hasBody: false }, args),
       // GET /provisioning/github-app/callback — rank: public — GET /provisioning/github-app/callback
       getProvisioningGithubAppCallback: (args) => request("GET", "/provisioning/github-app/callback", { hasBody: false }, args),
@@ -504,7 +522,7 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
-      // POST /provisioning/instances/{id}/force-teardown — rank: archon — POST /provisioning/instances/:id/force-teardown
+      // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
@@ -554,7 +572,7 @@ function createClient(opts = {}) {
       getPublicVersions: (args) => request("GET", "/public/versions", { hasBody: false }, args),
     },
     "scouting": {
-      // GET /scouting — rank: archon — GET /scouting
+      // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
     },
     "search": {
@@ -566,24 +584,28 @@ function createClient(opts = {}) {
     "security": {
       // GET /security/adr — rank: metic+archon — GET /security/adr
       getSecurityAdr: (args) => request("GET", "/security/adr", { hasBody: false }, args),
-      // GET /security/docs — rank: archon — GET /security/docs
+      // GET /security/docs — rank: metic+archon — GET /security/docs
       getSecurityDocs: (args) => request("GET", "/security/docs", { hasBody: false }, args),
-      // POST /security/docs — rank: archon — POST /security/docs
+      // POST /security/docs — rank: metic+archon — POST /security/docs
       postSecurityDocs: (args) => request("POST", "/security/docs", { hasBody: true }, args),
-      // GET /security/docs/{slug} — rank: archon — GET /security/docs/:slug
+      // GET /security/docs/{slug} — rank: metic+archon — GET /security/docs/:slug
       getSecurityDocsSlug: (args) => request("GET", "/security/docs/{slug}", { hasBody: false }, args),
-      // GET /security/reports — rank: archon — GET /security/reports
+      // GET /security/reports — rank: metic+archon — GET /security/reports
       getSecurityReports: (args) => request("GET", "/security/reports", { hasBody: false }, args),
       // POST /security/reports — rank: metic+archon — POST /security/reports
       postSecurityReports: (args) => request("POST", "/security/reports", { hasBody: true }, args),
-      // POST /security/reports/{id}/confirm — rank: archon — POST /security/reports/:id/confirm
+      // POST /security/reports/{id}/confirm — rank: metic+archon — POST /security/reports/:id/confirm
       postSecurityReportsIdConfirm: (args) => request("POST", "/security/reports/{id}/confirm", { hasBody: true }, args),
-      // POST /security/reports/{id}/dispute — rank: archon — POST /security/reports/:id/dispute
+      // POST /security/reports/{id}/dispute — rank: metic+archon — POST /security/reports/:id/dispute
       postSecurityReportsIdDispute: (args) => request("POST", "/security/reports/{id}/dispute", { hasBody: true }, args),
-      // POST /security/reports/{id}/fix — rank: archon — POST /security/reports/:id/fix
+      // POST /security/reports/{id}/fix — rank: metic+archon — POST /security/reports/:id/fix
       postSecurityReportsIdFix: (args) => request("POST", "/security/reports/{id}/fix", { hasBody: true }, args),
-      // POST /security/reports/{id}/link-fix — rank: archon — POST /security/reports/:id/link-fix
+      // POST /security/reports/{id}/link-fix — rank: metic+archon — POST /security/reports/:id/link-fix
       postSecurityReportsIdLinkFix: (args) => request("POST", "/security/reports/{id}/link-fix", { hasBody: true }, args),
+      // GET /security/scans — rank: any-builder — GET /security/scans
+      getSecurityScans: (args) => request("GET", "/security/scans", { hasBody: false }, args),
+      // POST /security/scans — rank: metic+archon — POST /security/scans
+      postSecurityScans: (args) => request("POST", "/security/scans", { hasBody: true }, args),
     },
     "session": {
       // POST /session/optimize — rank: any-builder — POST /session/optimize
@@ -596,7 +618,7 @@ function createClient(opts = {}) {
       getSessionsId: (args) => request("GET", "/sessions/{id}", { hasBody: false }, args),
       // GET /sessions/mine — rank: any-builder — GET /sessions/mine
       getSessionsMine: (args) => request("GET", "/sessions/mine", { hasBody: false }, args),
-      // GET /sessions/search — rank: archon — GET /sessions/search
+      // GET /sessions/search — rank: metic+archon — GET /sessions/search
       getSessionsSearch: (args) => request("GET", "/sessions/search", { hasBody: false }, args),
     },
     "sso": {
@@ -664,17 +686,17 @@ function createClient(opts = {}) {
       getTasksClaimable: (args) => request("GET", "/tasks/claimable", { hasBody: false }, args),
       // GET /tasks/newcomer-floor — rank: any-builder — GET /tasks/newcomer-floor
       getTasksNewcomerFloor: (args) => request("GET", "/tasks/newcomer-floor", { hasBody: false }, args),
-      // POST /tasks/newcomer-restock — rank: archon — POST /tasks/newcomer-restock
+      // POST /tasks/newcomer-restock — rank: metic+archon — POST /tasks/newcomer-restock
       postTasksNewcomerRestock: (args) => request("POST", "/tasks/newcomer-restock", { hasBody: true }, args),
       // GET /tasks/peer-votes/feed — rank: any-builder — GET /tasks/peer-votes/feed
       getTasksPeerVotesFeed: (args) => request("GET", "/tasks/peer-votes/feed", { hasBody: false }, args),
-      // POST /tasks/peer-votes/tally — rank: archon — POST /tasks/peer-votes/tally
+      // POST /tasks/peer-votes/tally — rank: metic+archon — POST /tasks/peer-votes/tally
       postTasksPeerVotesTally: (args) => request("POST", "/tasks/peer-votes/tally", { hasBody: true }, args),
     },
     "versions": {
       // GET /versions — rank: public — GET /versions
       getVersions: (args) => request("GET", "/versions", { hasBody: false }, args),
-      // POST /versions — rank: archon — POST /versions
+      // POST /versions — rank: metic+archon — POST /versions
       postVersions: (args) => request("POST", "/versions", { hasBody: true }, args),
       // GET /versions/{id}/done-when — rank: public — GET /versions/:id/done-when
       getVersionsIdDoneWhen: (args) => request("GET", "/versions/{id}/done-when", { hasBody: false }, args),

package/modules/dev-box/routes/box.js

@@ -214,7 +214,7 @@ module.exports = function buildBoxRouter() {
 
   // GET /boxes — full roster across all builders. rank: archon (exposes every
   // builder's box + IP + cost; same gate as the rest of roster management).
-  router.get('/boxes', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/boxes', auth.requireBuilder, auth.requirePermission('box.fleet.manage'), async (req, res) => {
     try {
       const state = req.query.state || undefined;
       const rows = await boxes.listBoxes(pool, { state });
@@ -249,7 +249,7 @@ module.exports = function buildBoxRouter() {
   // (#602). rank: archon — cost oversight across every builder without a DB query.
   // Declared among the archon routes (archon-first) so the route-rank auditor's
   // 20-line lookahead classifies it correctly.
-  router.get('/boxes/cost-ledger', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/boxes/cost-ledger', auth.requireBuilder, auth.requirePermission('box.fleet.manage'), async (req, res) => {
     try {
       // R14 (#2001 / ADR 0119): shared helper; per-endpoint cap preserved (default 500, max 2000).
       const { limit } = api.parsePagination(req, { defaultLimit: 500, maxLimit: 2000 });
@@ -268,7 +268,7 @@ module.exports = function buildBoxRouter() {
   // §9.4). rank: archon (acts on another builder's paid infrastructure).
   // Declared among the archon routes (archon-first) so the route-rank auditor's
   // 20-line lookahead classifies it correctly.
-  router.post('/boxes/:builderId/close', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.post('/boxes/:builderId/close', auth.requireBuilder, auth.requirePermission('box.fleet.manage'), async (req, res) => {
     const builderId = Number(req.params.builderId);
     if (!Number.isInteger(builderId) || builderId < 1) {
       return res.fail('bad_builder_id', 400);
@@ -315,7 +315,7 @@ module.exports = function buildBoxRouter() {
   // it does NOT touch a box that is already active. close_current adds the
   // explicit teardown the owner asked be optional ("options for both"). rank:
   // archon. Archon-first ordering (see above).
-  router.patch('/boxes/:builderId/block', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.patch('/boxes/:builderId/block', auth.requireBuilder, auth.requirePermission('box.fleet.manage'), async (req, res) => {
     const builderId = Number(req.params.builderId);
     if (!Number.isInteger(builderId) || builderId < 1) {
       return res.fail('bad_builder_id', 400);
@@ -610,7 +610,7 @@ module.exports = function buildBoxRouter() {
       if (state !== 'active') {
         return res.fail('box_not_active', { status: 409, message: state === 'none' || state === 'destroyed'
             ? 'No active box to close.'
-            : `Box is currently '${state}' — wait for it to finish or contact an Archon.`, details: { state } });
+            : `Box is currently '${state}' — wait for it to finish or ask a Metic+ operator.`, details: { state } });
       }
       const { intent, created } = await boxes.enqueueIntent(
         pool, req.builder.id, 'deprovision', 'api:self'
@@ -802,13 +802,15 @@ module.exports = function buildBoxRouter() {
           error: 'BOX_PROVISION_DENIED', reason: decision.reason,
           required: decision.required ?? null, actual: decision.actual ?? null,
         };
-        // idea 257 / task 1163: when an Archon block is the cause, tell the
+        // idea 257 / task 1163: when an operator block is the cause, tell the
         // builder WHY (the recorded reason) rather than a bare denial — this is
-        // the `message` the box-panel surfaces to the builder verbatim.
+        // the `message` the box-panel surfaces to the builder verbatim. The block
+        // is written by a Metic+ operator (box.fleet.manage, ADR 0157), so don't
+        // attribute it to an Archon specifically.
         if (decision.reason === 'BOX_PROVISION_BLOCKED') {
           payload.message = builder && builder.box_blocked_reason
-            ? `An Archon has paused thy dev-box access: ${builder.box_blocked_reason}`
-            : 'An Archon has paused thy dev-box access. Ask in Discord #support.';
+            ? `An operator has paused thy dev-box access: ${builder.box_blocked_reason}`
+            : 'An operator has paused thy dev-box access. Ask in Discord #support.';
         }
         return res.status(403).json(payload);
       }

package/modules/discord/auth.js

@@ -4,7 +4,8 @@
 // `const auth = require('./auth')` call sites unchanged:
 //
 //   • KERNEL gates, re-exported off the published doorway — requireBuilder /
-//     requireRank (the same rank machinery every route uses; ADR 0016).
+//     requireRank / requirePermission (the same authority machinery every route
+//     uses; ADR 0016, ADR 0151).
 //
 //   • DISCORD-SPECIFIC helpers VENDORED here — the snowflake validator + the bot-
 //     token loader. These are deliberately NOT on the kernel doorway: the doorway
@@ -48,6 +49,7 @@ module.exports = {
   // kernel gates (doorway)
   requireBuilder: api.requireBuilder,
   requireRank: api.requireRank,
+  requirePermission: api.requirePermission,
   // vendored discord-specific helpers
   isValidDiscordUserId,
   loadDiscordBotToken,

package/modules/discord/routes/discord.js

@@ -31,6 +31,9 @@ const roleSync = require('../discord-role-sync');
 //     unlink; degrades to { guildId: null } so the callback simply skips the join.
 //   • EVENT task.shipped — core (publish-reconciler / routes/tasks) emits it on the
 //     confirmed→shipped transition; we post the #ship-news / #ship-feed broadcast.
+//   • EVENT task.strand-flagged — the publish-reconciler emits it the moment a
+//     confirmed task is newly flagged needs_rebase (task 1002606); we post the
+//     strand notice so the builder hears about it before their next session.
 //   • EVENT builder.role-sync-needed { builderId } — core emits it on a rank change
 //     (routes/builders.js) + after a link (routes/auth.js); we repair the Discord
 //     rank-role badge. Fire-and-forget; the listener owns its own error handling.
@@ -38,6 +41,7 @@ const roleSync = require('../discord-role-sync');
 // hasProvider-guarded; listeners are replaced (off→on) so a test re-instantiating
 // the router never accumulates duplicates.
 let _shipListenerOff = null;
+let _strandListenerOff = null;
 let _roleSyncListenerOff = null;
 function registerSeams() {
   if (!api.hasProvider('discord.isLinked')) {
@@ -52,6 +56,8 @@ function registerSeams() {
   }
   if (_shipListenerOff) _shipListenerOff();
   _shipListenerOff = api.on('task.shipped', (task) => shipBroadcast.postShipBroadcast(task));
+  if (_strandListenerOff) _strandListenerOff();
+  _strandListenerOff = api.on('task.strand-flagged', (info) => shipBroadcast.postStrandNotice(info));
   if (_roleSyncListenerOff) _roleSyncListenerOff();
   _roleSyncListenerOff = api.on('builder.role-sync-needed', ({ builderId }) =>
     roleSync.syncBuilderRole(builderId).catch((e) =>
@@ -66,7 +72,7 @@ module.exports = function buildDiscordRouter() {
   // apply to make Discord match docs/discord/channels.json, plus warnings. No
   // writes. 503 when the bot is disabled / not connected to a guild.
   // rank: archon — channel administration command.
-  router.get('/discord/channels/plan', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/discord/channels/plan', auth.requireBuilder, auth.requirePermission('discord.channels.manage'), async (req, res) => {
     try {
       const channels = require('../discord-channels');
       const plan = channels.computePlan();
@@ -84,7 +90,7 @@ module.exports = function buildDiscordRouter() {
   // Best-effort; returns how many ops applied/failed. 503 when the bot is
   // disabled / not connected.
   // rank: archon — channel administration command.
-  router.post('/discord/channels/reconcile', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.post('/discord/channels/reconcile', auth.requireBuilder, auth.requirePermission('discord.channels.manage'), async (req, res) => {
     try {
       const channels = require('../discord-channels');
       const result = await channels.reconcileChannels();

package/modules/discord/ship-broadcast.js

@@ -75,4 +75,51 @@ async function postShipBroadcast(task, deps = {}) {
   return result;
 }
 
-module.exports = { chooseBroadcastTargets, postShipBroadcast };
+// task 1002606 (finding P-3) — the strand notice. Until now Discord fired only on
+// task.shipped, so a STRAND (needs_rebase flagged by the publish-reconciler) had no
+// push channel — the builder discovered it at their next /builder-start, up to a
+// whole session later. The reconciler now emits `task.strand-flagged` the moment a
+// strand is detected; this poster carries it to the builder channel.
+//
+// PURE routing, same discipline as chooseBroadcastTargets: a security-sensitive
+// task's strand notice goes ONLY to the Archon-only #security-ship-feed (the reason
+// string can name conflicted files of an unpatched fix). The line deliberately does
+// NOT start with `#<taskId>` — a LEADING task marker is what the applause bot maps
+// 👍 reactions onto (discord-reaction.parseShipMarker), and a strand is not
+// applaudable shipped work.
+function chooseStrandTargets({ securitySensitive, taskId, reason }) {
+  if (taskId == null) return [];
+  const line = `⚠️ task ${taskId} stranded at 'confirmed' (${reason || 'unknown'}) — its builder must fix + re-land it, or release it.`;
+  if (securitySensitive) {
+    return [{ channel: 'security_ship_feed', line }];
+  }
+  return [{ channel: 'ship_feed', line }];
+}
+
+// Best-effort server-side strand poster — fired by the `task.strand-flagged` seam
+// listener. `info` is the reconciler's event payload: { id, builder_id, title,
+// security_sensitive, reason }. FAIL CLOSED on the security flag exactly like
+// postShipBroadcast: if it is not a definite boolean the notice is suppressed
+// entirely rather than risk naming an unpatched fix on a builder channel. Never
+// throws — a channel failure is logged and swallowed.
+async function postStrandNotice(info, deps = {}) {
+  const result = { posted: [], skipped: null };
+  if (!info || info.id == null) { result.skipped = 'no_task'; return result; }
+  const sec = info.security_sensitive;
+  if (sec !== true && sec !== false) { result.skipped = 'security_flag_indeterminate'; return result; }
+
+  const postWebhook = deps.postWebhook || require('./webhook').postWebhook;
+  const log = deps.log || console.log;
+  const targets = chooseStrandTargets({ securitySensitive: sec, taskId: info.id, reason: info.reason });
+  for (const { channel, line } of targets) {
+    try {
+      await postWebhook(channel, line);
+      result.posted.push(channel);
+    } catch (e) {
+      log(`[gds] strand notice: #${channel.replace(/_/g, '-')} post failed (non-blocking): ${e && e.message ? e.message : e}`);
+    }
+  }
+  return result;
+}
+
+module.exports = { chooseBroadcastTargets, postShipBroadcast, chooseStrandTargets, postStrandNotice };

package/modules/governance/catalog.js

@@ -90,7 +90,7 @@ const PERMISSIONS = [
   { key: 'task.confirm.grade_bypass', system: true, floor: 'archon', guards: 'POST /tasks/:id/confirm — ratify past a failed grade (env-relaxable, ADR 0041)' },
   { key: 'dependency.cross_tier.manage', system: true, floor: 'archon', guards: 'POST|DELETE /dependencies — cross-tier structural edges (ADR 0086)' },
   { key: 'goal.scope.manage', system: true, floor: 'archon', guards: 'cross-tier goal-scope edges + protected-scope admission (ADR 0086)' },
-  { key: 'governance.manage', system: true, floor: 'archon', guards: 'the governance tab write routes (roles/perms/assignments) — meta-escalation' },
+  { key: 'governance.manage', system: true, floor: 'archon', guards: 'the governance tab routes (roles/perms/assignments CRUD, reads included — R110) — meta-escalation' },
   { key: 'gate_approval.decide', system: true, floor: 'archon', guards: 'POST /gate-approvals/:pr/approve — CI deploy-gate override' },
   { key: 'deploy.push_main', system: true, floor: 'archon', guards: 'git push origin main / the deploy — substrate-enforced (pre-push, main-audit)' },
   { key: 'path.protected.modify', system: true, floor: 'archon', guards: 'modifying a PROTECTED_GLOBS path below the Metic floor — substrate (ADR 0043)' },
@@ -99,27 +99,21 @@ const PERMISSIONS = [
   { key: 'principal.discord_bot', system: true, floor: null, principal: 'discord_bot', guards: 'Discord bot routes — requireDiscordBot (exact system_role; dormant)' },
 
   // ── operational — floor archon (admin ops; grantable to a custom role) ────────
+  //
+  // ADR 0157 (owner decision, 2026-08-05) narrowed this block to IDENTITY: the Archon
+  // rank is responsible for rank and identity only. Nineteen keys that sat here for
+  // administrative convenience moved to floor `metic` below; each carries a
+  // "(ADR 0157, was archon)" note there. What remains answers "who exists, who is
+  // admitted, and whose sessions are valid" — the identity half of the rank/identity
+  // mandate, with rank itself covered by `builder.rank.set` (system, above).
+  //
+  // The four trust-boundary keys that ALSO stay Archon are system:true above
+  // (`task.confirm.grade_bypass`, `gate_approval.decide`, `goal.scope.manage`,
+  // `governance.manage`) — see the ADR's escalation-chain argument for why moving any
+  // one of them would make this delegation self-reversible.
   { key: 'builder.status.set', system: false, floor: 'archon', guards: 'PATCH /builders/:id/status — offboard / (de)activate' },
-  { key: 'builder.budget.set', system: false, floor: 'archon', guards: 'PATCH /builders/:id/budget' },
-  { key: 'criterion.unsatisfy', system: false, floor: 'archon', guards: 'POST /done-when/:id/unsatisfy' },
   { key: 'auth.session.revoke', system: false, floor: 'archon', guards: 'POST /auth/revoke, /auth/revoke-all' },
   { key: 'access_request.review', system: false, floor: 'archon', guards: 'GET/PATCH /access-requests/:id — admit a builder' },
-  { key: 'security.report.adjudicate', system: false, floor: 'archon', guards: 'POST /security/reports/:id/{confirm,dispute,fix,link-fix}, /security/docs CRUD' },
-  { key: 'provisioning.fleet.manage', system: false, floor: 'archon', guards: 'GET /provisioning/fleet[/cost-ledger], POST .../force-teardown' },
-  { key: 'box.fleet.manage', system: false, floor: 'archon', scope: 'any', resource: 'box', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block' },
-  { key: 'autonomy.precheck', system: false, floor: 'archon', guards: 'GET /autonomy/precheck — unsupervised-runner gate' },
-  { key: 'discord.channels.manage', system: false, floor: 'archon', guards: 'GET /discord/channels/plan, POST .../reconcile' },
-  { key: 'project.curate', system: false, floor: 'archon', guards: 'platform-identity: POST /projects, /projects/invite, PATCH /projects/:id/featured, GET /scouting' },
-  { key: 'override_request.decide', system: false, floor: 'archon', guards: 'GET /override-requests, POST .../:id/decide' },
-  { key: 'claim.release.any', system: false, floor: 'archon', scope: 'any', resource: 'claim', guards: 'POST /claims/:id/release-on-behalf' },
-  { key: 'idea.ratify', system: false, floor: 'archon', guards: 'POST /inbox/:id/ratify' },
-  { key: 'task.newcomer_restock', system: false, floor: 'archon', guards: 'POST /tasks/newcomer-restock' },
-  { key: 'task.peer_votes.tally', system: false, floor: 'archon', guards: 'POST /tasks/peer-votes/tally' },
-  { key: 'goal.reorder', system: false, floor: 'archon', guards: 'POST /goals/reorder' },
-  { key: 'builder.roster.read', system: false, floor: 'archon', guards: 'GET /builders/roster, /grades/by-builder, /builders/:id/active-claims' },
-  { key: 'session.search', system: false, floor: 'archon', guards: 'GET /sessions/search' },
-  { key: 'memory.read.any', system: false, floor: 'archon', scope: 'any', resource: 'memory', guards: 'GET /memory/builders/:id/file[s] — cross-builder memory read' },
-  { key: 'audit_log.read', system: false, floor: 'archon', guards: 'GET /audit-log' },
 
   // ── operational — floor metic (the working rank's review/triage/authoring) ────
   { key: 'idea.triage', system: false, floor: 'metic', guards: 'PATCH /inbox/:id' },
@@ -152,6 +146,57 @@ const PERMISSIONS = [
   { key: 'source.clone.local', system: false, floor: 'metic', guards: 'Metic+ local clone / collaborator invite (ADR 0035)' },
   { key: 'box.source.full', system: false, floor: 'metic', guards: 'GET /box/source-access → full (vs starter); boxScopeForRank' },
 
+  // ── delegated archon→metic by ADR 0157 (owner decision, 2026-08-05) ───────────
+  //
+  // "Archon is responsible for rank and identity." These nineteen are administration
+  // and operations: they spend, read, adjudicate, and shuffle work, but none of them
+  // decides WHO HOLDS AUTHORITY, so the trusted working rank carries them. All were
+  // floor 'archon' before this ADR; none is system:true, so all were already
+  // delegable to a custom role — this only lowers the seeded floor.
+  //
+  // Deliberately NOT in this block, though the owner's rule would otherwise reach them:
+  //   • `version.close` — retained at archon; it is the DISPOSITION that finalises a
+  //     version's scope-truth, and canonical-permissions has long paired it with rank
+  //     as the two powers that never delegate. ADR 0157 keeps that pairing.
+  //   • `dependency.cross_tier.manage` — system:true, and the catalog's own invariant
+  //     (tests/governance_catalog.mjs) forbids granting a system key to metic. Moving
+  //     it would mean clearing the system flag, which widens what any CUSTOM role can
+  //     be granted — a second-order change beyond the delegation that was asked for.
+  { key: 'builder.budget.set', system: false, floor: 'metic', guards: 'PATCH /builders/:id/budget (ADR 0157, was archon)' },
+  { key: 'criterion.unsatisfy', system: false, floor: 'metic', guards: 'POST /done-when/:id/unsatisfy (ADR 0157, was archon)' },
+  // BV1.R105. system:false DELIBERATELY, despite `version.close` being system:true.
+  // The `system` flag marks TRUST-BOUNDARY power — things that escalate or bypass the
+  // boundary (deploy, protected-path, rank-set, grade-bypass, cross-tier, principals).
+  // Creating a version is AUTHORING: it confers no authority on anyone. Its real
+  // siblings are `goal.create` and `task.create`, both operational. Close is the
+  // DISPOSITION that finalises a version's scope-truth; create opens it — the symmetry
+  // argument was considered and rejected, because system:true would permanently bar
+  // delegating version authoring to a custom role for no trust-boundary reason.
+  // ADR 0157 then lowered create's floor to metic while close stayed archon, which is
+  // the same asymmetry read from the other side: authoring delegates, disposition does not.
+  { key: 'version.create', system: false, floor: 'metic', guards: 'POST /versions — create a version + its done-when criteria (ADR 0157, was archon)' },
+  { key: 'security.report.adjudicate', system: false, floor: 'metic', guards: 'GET /security/reports, POST /security/reports/:id/{confirm,dispute,fix,link-fix}, /security/docs CRUD (ADR 0157, was archon)' },
+  { key: 'provisioning.fleet.manage', system: false, floor: 'metic', guards: 'GET /provisioning/fleet[/cost-ledger], POST .../force-teardown (ADR 0157, was archon)' },
+  { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },
+  { key: 'autonomy.precheck', system: false, floor: 'metic', guards: 'GET /autonomy/precheck — unsupervised-runner gate (ADR 0157, was archon)' },
+  { key: 'discord.channels.manage', system: false, floor: 'metic', guards: 'GET /discord/channels/plan, POST .../reconcile (ADR 0157, was archon)' },
+  { key: 'project.curate', system: false, floor: 'metic', guards: 'platform-identity: GET/POST /projects, /projects/invite, PATCH /projects/:id/featured, GET /scouting (ADR 0157, was archon)' },
+  { key: 'override_request.decide', system: false, floor: 'metic', guards: 'GET /override-requests, POST .../:id/decide (ADR 0157, was archon)' },
+  { key: 'claim.release.any', system: false, floor: 'metic', scope: 'any', resource: 'claim', guards: 'POST /claims/:id/release-on-behalf (ADR 0157, was archon)' },
+  { key: 'idea.ratify', system: false, floor: 'metic', guards: 'POST /inbox/:id/ratify (ADR 0157, was archon)' },
+  { key: 'task.newcomer_restock', system: false, floor: 'metic', guards: 'POST /tasks/newcomer-restock (ADR 0157, was archon)' },
+  { key: 'task.peer_votes.tally', system: false, floor: 'metic', guards: 'POST /tasks/peer-votes/tally (ADR 0157, was archon)' },
+  { key: 'goal.reorder', system: false, floor: 'metic', guards: 'POST /goals/reorder (ADR 0157, was archon)' },
+  { key: 'builder.roster.read', system: false, floor: 'metic', guards: 'GET /builders/roster, /grades/by-builder, /builders/:id/active-claims (ADR 0157, was archon)' },
+  { key: 'session.search', system: false, floor: 'metic', guards: 'GET /sessions/search (ADR 0157, was archon)' },
+  { key: 'memory.read.any', system: false, floor: 'metic', scope: 'any', resource: 'memory', guards: 'GET /memory/builders/:id/file[s] — cross-builder memory read (ADR 0157, was archon)' },
+  { key: 'audit_log.read', system: false, floor: 'metic', guards: 'GET /audit-log (ADR 0157, was archon)' },
+  // ADR 0157 §4. Split from `gate_approval.decide` (system, archon) so the Gate PAGE
+  // can open to Metic while APPROVING a held PR stays Archon. Without the split, a
+  // Metic could reach /gate via `page.view.governance` and then 403 on its only data
+  // endpoint — a page that renders nothing but an error.
+  { key: 'gate_approval.read', system: false, floor: 'metic', guards: 'GET /gate-approvals — the Gate page read side (approve = gate_approval.decide, archon)' },
+
   // ── ownership-scoped + baseline own-work (floor thetes / xenos) ───────────────
   { key: 'task.claim.any', system: false, floor: 'thetes', guards: 'claim the general queue (per-task requires_rank floor still applies)' },
   { key: 'page.view.builder', system: false, floor: 'thetes', guards: 'authenticated hall pages (requireNonXenosPage / requireBuilderPage)' },
@@ -174,7 +219,12 @@ const PERMISSIONS = [
   { key: 'blocker.file', system: false, floor: 'xenos', guards: 'POST /blockers' },
   { key: 'idea.file', system: false, floor: 'xenos', guards: 'POST /inbox (own idea capture)' },
   { key: 'page.view.public', system: false, floor: 'xenos', guards: 'public read surfaces (incl. xenos)' },
-  { key: 'page.view.governance', system: false, floor: 'archon', guards: 'the Archon governance page (requireArchonPage; write = governance.manage)' },
+  // ADR 0157: floor archon→metic, which is what opens /watch, /harbor and /gate to the
+  // working rank. The gate FUNCTION was renamed to match (`requireArchonPage` →
+  // `requireGovernancePage`) once the floor moved. Viewing is all this grants: every
+  // write those pages reach is its own atom, and `governance.manage` (the
+  // roles/permissions tab) stayed archon.
+  { key: 'page.view.governance', system: false, floor: 'metic', guards: 'the governance/monitoring pages — /watch, /harbor, /gate (requireGovernancePage; write = governance.manage, archon)' },
 ];
 
 // ── invariants asserted at module load (fail loud on an authoring typo) ─────────