@bongos/core 1.18.19 → 1.19.3

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 258 endpoints across 42 route files.
+> **Generated from the live route files** — the route file is authoritative. 268 endpoints across 44 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -32,7 +32,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/audit-log` | `archon` | — | GET /api/gds/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
+| GET | `/api/bongos/audit-log` | `metic+archon` | — | GET /api/gds/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
 
 ## `auth` (18)
 
@@ -61,14 +61,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/autonomy/precheck` | `archon` | — |  |
+| GET | `/api/bongos/autonomy/precheck` | `metic+archon` | — |  |
 
 ## `backup` (2)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/backup/status` | `metic+archon` | — | any working builder may check or trigger a backup. |
-| POST | `/api/bongos/backup/trigger` | `metic+archon` | — |  |
+| POST | `/api/bongos/backup/trigger` | `metic+archon` | — | kicks off a fresh dump; same gate as the status read. |
 
 ## `blockers` (5)
 
@@ -77,7 +77,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/blockers` | `public` | — | List currently-open blockers + the tasks each is blocking. |
 | POST | `/api/bongos/blockers` | `any-builder` | `title`, `body_md`, `source`, `source_ref` | FILE a blocker (contribution, not resolution). |
 | GET | `/api/bongos/blockers/:id` | `any-builder` | — | single blocker detail read. |
-| POST | `/api/bongos/blockers/:id/link` | `metic+archon` | `task_id` | Link an existing blocker to a task (puts the task in 'blocked' status if it's currently 'backlog' or 'ready'). |
+| POST | `/api/bongos/blockers/:id/link` | `metic+archon` | `task_id` | Link an existing blocker to a task. |
 | POST | `/api/bongos/blockers/:id/resolve` | `metic+archon` | `resolution_note` | Resolve. |
 
 ## `box` (18)
@@ -107,10 +107,10 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/boxes` | `archon` | — | GET /boxes — full roster across all builders. |
-| PATCH | `/api/bongos/boxes/:builderId/block` | `archon` | `blocked`, `reason`, `close_current` | PATCH /boxes/:builderId/block — Archon bars (or un-bars) a builder from OPENING dev boxes (idea 257 / task 1163; migration 104). |
-| POST | `/api/bongos/boxes/:builderId/close` | `archon` | — | POST /boxes/:builderId/close — Archon force-closes ANY builder's box (idea 257 / task 1163). |
-| GET | `/api/bongos/boxes/cost-ledger` | `archon` | — | GET /boxes/cost-ledger — the full per-builder container-cost ledger + totals (task 602). |
+| GET | `/api/bongos/boxes` | `metic+archon` | — | GET /boxes — full roster across all builders. |
+| PATCH | `/api/bongos/boxes/:builderId/block` | `metic+archon` | `blocked`, `reason`, `close_current` | PATCH /boxes/:builderId/block — Archon bars (or un-bars) a builder from OPENING dev boxes (idea 257 / task 1163; migration 104). |
+| POST | `/api/bongos/boxes/:builderId/close` | `metic+archon` | — | POST /boxes/:builderId/close — Archon force-closes ANY builder's box (idea 257 / task 1163). |
+| GET | `/api/bongos/boxes/cost-ledger` | `metic+archon` | — | GET /boxes/cost-ledger — the full per-builder container-cost ledger + totals (task 602). |
 
 ## `bug-attachments` (1)
 
@@ -122,22 +122,22 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/builders/:id/active-claims` | `archon` | — | GET /builders/:id/active-claims — V3.R14 (task 238). |
-| PATCH | `/api/bongos/builders/:id/budget` | `archon` | `monthly_budget_usd` | PATCH /builders/:id/budget — set or clear a builder's monthly spend ceiling (V3.R84 task 302, criterion C3). |
+| GET | `/api/bongos/builders/:id/active-claims` | `metic+archon` | — | GET /builders/:id/active-claims — V3.R14 (task 238). |
+| PATCH | `/api/bongos/builders/:id/budget` | `metic+archon` | `monthly_budget_usd` | PATCH /builders/:id/budget — set or clear a builder's monthly spend ceiling (V3.R84 task 302, criterion C3). |
 | GET | `/api/bongos/builders/:id/onboarding` | `public` | — | GET /builders/:id/onboarding — V3.R75 (task 294) onboarding checklist read. |
 | GET | `/api/bongos/builders/:id/profile` | `public` | — | GET /builders/:id/profile — the viewable builder profile page's read (task 1467, goal 25 "bx-identity"). |
 | PATCH | `/api/bongos/builders/:id/rank` | `archon` | `rank` | sole chokepoint that mutates builders.rank; ADR 0016 §enforcement. |
 | PATCH | `/api/bongos/builders/:id/status` | `archon` | `status`, `reason` | PATCH /builders/:id/status — graceful exit + reactivation (V3.R88 task 307). |
 | GET | `/api/bongos/builders/directory` | `any-builder` | — | GET /builders/directory — the any-builder-readable picker roster (task 1877): every ACTIVE builder's identity, for a client-side invite d… |
 | GET | `/api/bongos/builders/me/pending-rank-change` | `any-builder` | — | GET /builders/me/pending-rank-change — V3.R28 / task 249 ceremony signal task 3. |
-| GET | `/api/bongos/builders/roster` | `archon` | — | GET /builders/roster — V3.R14 (task 238) onboarding observability. |
+| GET | `/api/bongos/builders/roster` | `metic+archon` | — | GET /builders/roster — V3.R14 (task 238) onboarding observability. |
 
 ## `claims` (6)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | POST | `/api/bongos/claims` | `any-builder` | `task_id`, `worktree_name`, `head_sha`, `bind_session`, `enforce_touches` | own work (claim a ready task); Xenos additionally filtered to newcomer_friendly rows inside db.claimTask (returns rank_too_low_for_task 4… |
-| POST | `/api/bongos/claims/:id/release-on-behalf` | `archon` | `reason` | POST /claims/:id/release-on-behalf — V3.R14 (task 238). |
+| POST | `/api/bongos/claims/:id/release-on-behalf` | `metic+archon` | `reason` | POST /claims/:id/release-on-behalf — V3.R14 (task 238). |
 | POST | `/api/bongos/claims/:id/resolve` | `any-builder` | `outcome`, `notes_md`, `value_summary`, `verification`, `force`, `committed_files`, `sandbox_review` | resolve own claim (ship/abandon); ownership checked in db.resolveClaim (NOT_YOUR_CLAIM). |
 | POST | `/api/bongos/claims/batch` | `any-builder` | `task_ids`, `worktree_name`, `bind_session` | Atomic multi-claim. |
 | POST | `/api/bongos/claims/batch/release` | `any-builder` | `claim_ids`, `force` | Bulk release (task 1758) — the batch twin of resolve(outcome='abandoned'). |
@@ -160,22 +160,22 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/discord/channels/plan` | `archon` | — | GET /api/bongos/discord/channels/plan — dry run. |
-| POST | `/api/bongos/discord/channels/reconcile` | `archon` | — | POST /api/bongos/discord/channels/reconcile — apply the config to Discord now. |
+| GET | `/api/bongos/discord/channels/plan` | `metic+archon` | — | GET /api/bongos/discord/channels/plan — dry run. |
+| POST | `/api/bongos/discord/channels/reconcile` | `metic+archon` | — | POST /api/bongos/discord/channels/reconcile — apply the config to Discord now. |
 
 ## `done-when` (3)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | POST | `/api/bongos/done-when/:criterionId/satisfy` | `metic+archon` | `satisfied_by_task_id` | Auth (Metic+): confirm a criterion — flip it to satisfied. |
-| POST | `/api/bongos/done-when/:criterionId/unsatisfy` | `archon` | — | Auth: flip a criterion back to unsatisfied (rare; for corrections). |
+| POST | `/api/bongos/done-when/:criterionId/unsatisfy` | `metic+archon` | — | Auth: flip a criterion back to unsatisfied (rare; for corrections). |
 | GET | `/api/bongos/done-when/pending-review` | `metic+archon` | — | Auth (Metic+): the criterion review queue — every criterion auto-flagged "met — pending review" (≥1 linked task, all shipped, not yet con… |
 
 ## `gate-approvals` (2)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/gate-approvals` | `archon` | — | GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. |
+| GET | `/api/bongos/gate-approvals` | `metic+archon` | — | GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. |
 | POST | `/api/bongos/gate-approvals/:pr/approve` | `archon` | — | POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and re-run the gate-review check so it clears. |
 
 ## `github` (2)
@@ -212,13 +212,26 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/goals/:id/transfer` | `any-builder` | `builder_id` | POST /goals/:id/transfer — hand the goal to a new owner (task 1735). |
 | PATCH | `/api/bongos/goals/:id/visibility` | `any-builder` | `visibility` | PATCH /goals/:id/visibility — make a goal public\|private (task 1952 / ADR 0112). |
 | GET | `/api/bongos/goals/inbox` | `any-builder` | — | GET /goals/inbox — the caller's private-goals inbox (task 1952 / ADR 0112): { invitations: invites addressed to me (accept/decline); join… |
-| POST | `/api/bongos/goals/reorder` | `archon` | `version_id`, `ordered_ids` | POST /goals/reorder — Archon drag-to-reorder: set the priority order of every goal WITHIN one version (task 1760). |
+| POST | `/api/bongos/goals/reorder` | `metic+archon` | `version_id`, `ordered_ids` | POST /goals/reorder — Archon drag-to-reorder: set the priority order of every goal WITHIN one version (task 1760). |
+
+## `governance` (8)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/governance/assignments` | `archon` | — | governance.manage — every builder↔role assignment row. |
+| POST | `/api/bongos/governance/assignments` | `archon` | `builder_id`, `role_key` | governance.manage — assign a CUSTOM role to a builder. |
+| DELETE | `/api/bongos/governance/assignments/:builderId/:roleKey` | `archon` | — | governance.manage — remove a custom-role assignment. |
+| GET | `/api/bongos/governance/permissions` | `archon` | — | governance.manage — the permission catalog + principals, straight from code (the catalog is CODE, not a table); no DB read. |
+| GET | `/api/bongos/governance/roles` | `archon` | — | governance.manage — the full role list with each role's grants. |
+| POST | `/api/bongos/governance/roles` | `archon` | `role_key`, `label`, `description` | governance.manage — create a CUSTOM role (is_system false, no seeded_rank — the seeded four exist only via governance_002). |
+| PUT | `/api/bongos/governance/roles/:roleKey/permissions/:permissionKey` | `archon` | — | governance.manage — grant one OPERATIONAL permission to a custom role (the toggle's ON half). |
+| DELETE | `/api/bongos/governance/roles/:roleKey/permissions/:permissionKey` | `archon` | — | governance.manage — revoke a grant (the toggle's OFF half). |
 
 ## `grades` (1)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/grades/by-builder` | `archon` | — | GET /grades/by-builder?days=30 — per-builder grade breakdown (task 726). |
+| GET | `/api/bongos/grades/by-builder` | `metic+archon` | — | GET /grades/by-builder?days=30 — per-builder grade breakdown (task 726). |
 
 ## `healthz` (1)
 
@@ -234,7 +247,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/inbox` | `any-builder` | `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority` | for ordinary ideas; metic+ for kind='criterion-proposal'. |
 | GET | `/api/bongos/inbox/:id` | `any-builder` | — | single idea read for the "#NNN" deep-link resolver (task 1047). |
 | PATCH | `/api/bongos/inbox/:id` | `metic+archon` | `status`, `kind`, `promoted_to_task_id`, `reviewed_at`, `merged_into_idea_id`, `triage_note` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
-| POST | `/api/bongos/inbox/:id/ratify` | `archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |
+| POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |
 
 ## `instance` (1)
 
@@ -301,8 +314,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/memory/bfg/builders/:builderId/file` | `bfg-principal` | — |  |
 | GET | `/api/bongos/memory/bfg/builders/:builderId/files` | `bfg-principal` | — |  |
 | POST | `/api/bongos/memory/builders/:builderId/bfg-write` | `bfg-principal` | `kind`, `slug`, `title`, `body_md`, `rationale`, `karma_delta` | ----------------------------------------------------------------------- BFG CROSS-BUILDER WRITE (task 446 / ADR 0026 §6C) — the FIRST cro… |
-| GET | `/api/bongos/memory/builders/:builderId/file` | `archon` | — | GET /memory/builders/:builderId/file?path=... |
-| GET | `/api/bongos/memory/builders/:builderId/files` | `archon` | — | GET /memory/builders/:builderId/files — Archon lists ANOTHER builder's memory file metadata. |
+| GET | `/api/bongos/memory/builders/:builderId/file` | `metic+archon` | — | GET /memory/builders/:builderId/file?path=... |
+| GET | `/api/bongos/memory/builders/:builderId/files` | `metic+archon` | — | GET /memory/builders/:builderId/files — Archon lists ANOTHER builder's memory file metadata. |
 | GET | `/api/bongos/memory/file` | `any-builder` | — | GET /memory/file?path=... |
 | DELETE | `/api/bongos/memory/file` | `any-builder` | validated | DELETE /memory/file?path=... |
 | GET | `/api/bongos/memory/files` | `any-builder` | — | GET /memory/files — list the AUTHENTICATED builder's memory files (metadata only, no content). |
@@ -332,32 +345,32 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/override-requests` | `archon` | — | GET /override-requests?status=open — Archon queue. |
-| POST | `/api/bongos/override-requests/:id/decide` | `archon` | `decision`, `note` | POST /override-requests/:id/decide — body: { decision: 'approve'\|'deny', note? } On approve, atomically flips the task completed→confirme… |
+| GET | `/api/bongos/override-requests` | `metic+archon` | — | GET /override-requests?status=open — Archon queue. |
+| POST | `/api/bongos/override-requests/:id/decide` | `metic+archon` | `decision`, `note` | POST /override-requests/:id/decide — body: { decision: 'approve'\|'deny', note? } On approve, atomically flips the task completed→confirme… |
 
 ## `projects` (5)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/projects` | `archon` | — | the full curation list (includes unfeatured + owner attribution). |
-| POST | `/api/bongos/projects` | `archon` | `origin`, `name`, `tagline`, `art_url` | create / update a catalog entry (manual seed for hand-wired instances; federated projects auto-catalogue at registration). |
-| PATCH | `/api/bongos/projects/:id/featured` | `archon` | `featured` | the feature / unfeature control (the ADR 0141 §5 curation gate). |
+| GET | `/api/bongos/projects` | `metic+archon` | — | the full curation list (includes unfeatured + owner attribution). |
+| POST | `/api/bongos/projects` | `metic+archon` | `origin`, `name`, `tagline`, `art_url` | create / update a catalog entry (manual seed for hand-wired instances; federated projects auto-catalogue at registration). |
+| PATCH | `/api/bongos/projects/:id/featured` | `metic+archon` | `featured` | the feature / unfeature control (the ADR 0141 §5 curation gate). |
 | GET | `/api/bongos/projects/featured` | `public` | — | a curated public showcase; no auth by design. |
-| POST | `/api/bongos/projects/invite` | `archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |
+| POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |
 
 ## `provisioning` (13)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/provisioning/fleet` | `archon` | — | GET /provisioning/fleet — the full instance roster across all owners. |
-| GET | `/api/bongos/provisioning/fleet/cost-ledger` | `archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. |
+| GET | `/api/bongos/provisioning/fleet` | `metic+archon` | — | GET /provisioning/fleet — the full instance roster across all owners. |
+| GET | `/api/bongos/provisioning/fleet/cost-ledger` | `metic+archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total. |
 | GET | `/api/bongos/provisioning/github-app/callback` | `public` | — | GET /provisioning/github-app/callback?code=&state= — GitHub redirects the owner's BROWSER here after they approve the App Manifest (task … |
 | GET | `/api/bongos/provisioning/github-app/status` | `public` | — | GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding callback page polls (task 2096) to know when setup… |
 | GET | `/api/bongos/provisioning/health` | `public` | — | GET /provisioning/health — liveness + the core version this module mounted against. |
 | GET | `/api/bongos/provisioning/instances` | `any-builder` | — | GET /provisioning/instances — the caller's own instances + each open intent. |
-| POST | `/api/bongos/provisioning/instances` | `any-builder` | `slug`, `target_ref`, `hosting_shape`, `domain`, `tier` | POST /provisioning/instances — request a new instance. |
+| POST | `/api/bongos/provisioning/instances` | `any-builder` | `slug`, `target_ref`, `hosting_shape`, `domain`, `tier`, `onboard_mode` | POST /provisioning/instances — request a new instance. |
 | GET | `/api/bongos/provisioning/instances/:id` | `any-builder` | — | GET /provisioning/instances/:id — read one of the caller's own instances. |
-| POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
+| POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |
 | GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: "the c… |
@@ -390,7 +403,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/scouting` | `archon` | — | the internal talent directory across every project. |
+| GET | `/api/bongos/scouting` | `metic+archon` | — | the internal talent directory across every project. |
 
 ## `search` (2)
 
@@ -399,20 +412,22 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/search` | `any-builder` | `expand`, `q`, `source_kind`, `limit` | POST /search — two modes (ADR 0095 C1 / task 1658, progressive disclosure): 1. |
 | POST | `/api/bongos/search/mark` | `any-builder` | `chunk_id`, `useful` | POST /search/mark — the write half of the memory-usefulness feedback loop (ADR 0095 C3, task 1660). |
 
-## `security` (10)
+## `security` (12)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/security/adr` | `metic+archon` | — | GET /api/gds/security/adr Metic+ only. |
-| GET | `/api/bongos/security/docs` | `archon` | — | GET /api/gds/security/docs — list doc METADATA (no content). |
-| POST | `/api/bongos/security/docs` | `archon` | `slug`, `title`, `content_md` | POST /api/gds/security/docs — upsert a doc by slug. |
-| GET | `/api/bongos/security/docs/:slug` | `archon` | — | GET /api/gds/security/docs/:slug — one doc WITH content, or 404. |
-| GET | `/api/bongos/security/reports` | `archon` | — | GET /api/bongos/security/reports?status=<status> Archon-only, newest-first. |
+| GET | `/api/bongos/security/docs` | `metic+archon` | — | GET /api/gds/security/docs — list doc METADATA (no content). |
+| POST | `/api/bongos/security/docs` | `metic+archon` | `slug`, `title`, `content_md` | POST /api/gds/security/docs — upsert a doc by slug. |
+| GET | `/api/bongos/security/docs/:slug` | `metic+archon` | — | GET /api/gds/security/docs/:slug — one doc WITH content, or 404. |
+| GET | `/api/bongos/security/reports` | `metic+archon` | — | GET /api/bongos/security/reports?status=<status> Archon-only, newest-first. |
 | POST | `/api/bongos/security/reports` | `metic+archon` | `target`, `severity`, `title`, `description`, `repro_steps_md` | POST /api/bongos/security/reports — file a new vulnerability report. |
-| POST | `/api/bongos/security/reports/:id/confirm` | `archon` | `drachmae_awarded` | POST /api/bongos/security/reports/:id/confirm Body: { drachmae_awarded?: integer } — defaults to the severity tier bounty if omitted. |
-| POST | `/api/bongos/security/reports/:id/dispute` | `archon` | — | POST /api/bongos/security/reports/:id/dispute Marks the report disputed and clears drachmae_awarded. |
-| POST | `/api/bongos/security/reports/:id/fix` | `archon` | — | POST /api/bongos/security/reports/:id/fix Marks the report fixed and stamps fixed_at. |
-| POST | `/api/bongos/security/reports/:id/link-fix` | `archon` | `task_id` | POST /api/bongos/security/reports/:id/link-fix Body: { task_id: integer } — attaches a fix-task FK. |
+| POST | `/api/bongos/security/reports/:id/confirm` | `metic+archon` | `drachmae_awarded` | POST /api/bongos/security/reports/:id/confirm Body: { drachmae_awarded?: integer } — defaults to the severity tier bounty if omitted. |
+| POST | `/api/bongos/security/reports/:id/dispute` | `metic+archon` | — | POST /api/bongos/security/reports/:id/dispute Marks the report disputed and clears drachmae_awarded. |
+| POST | `/api/bongos/security/reports/:id/fix` | `metic+archon` | — | POST /api/bongos/security/reports/:id/fix Marks the report fixed and stamps fixed_at. |
+| POST | `/api/bongos/security/reports/:id/link-fix` | `metic+archon` | `task_id` | POST /api/bongos/security/reports/:id/link-fix Body: { task_id: integer } — attaches a fix-task FK. |
+| GET | `/api/bongos/security/scans` | `any-builder` | — | GET /api/bongos/security/scans?content_hash=<64 hex> "Have these exact bytes been scanned before, and what did the scan say?" Newest first. |
+| POST | `/api/bongos/security/scans` | `metic+archon` | `target_url`, `artifact_kind`, `resolved_sha`, `content_hash`, `file_count`, `total_bytes`, `tier`, `verdict`, `completion`, `abort_code`, `findings_critical`, `findings_high`, `findings_medium`, `findings_low`, `findings_summary`, `action_taken`, `engine_version` | POST /api/bongos/security/scans — record one scan run. |
 
 ## `session` (1)
 
@@ -427,7 +442,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/sessions` | `any-builder` | `session_id`, `task_ids`, `total_tokens`, `duration_seconds`, `started_at`, `ended_at`, `detail`, `metrics`, `model_usage` | upload your OWN session digest. |
 | GET | `/api/bongos/sessions/:id` | `any-builder` | — | own session full detail (deep-dive); cross-builder fetch requires Archon + a fail-closed audit row (BFG-principal posture until 6C.1). |
 | GET | `/api/bongos/sessions/mine` | `any-builder` | — | your OWN sessions (self-serve; no audit needed). |
-| GET | `/api/bongos/sessions/search` | `archon` | — | cross-builder corpus search (BFG-principal posture until 6C.1). |
+| GET | `/api/bongos/sessions/search` | `metic+archon` | — | cross-builder corpus search (BFG-principal posture until 6C.1). |
 
 ## `sso` (7)
 
@@ -469,16 +484,16 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/tasks/:id/vote` | `metic+archon` | `vote` | POST /tasks/:id/vote { vote: 1 \| -1 \| 0 } — cast/change/clear a peer vote on a confirmed/shipped task. |
 | GET | `/api/bongos/tasks/claimable` | `any-builder` | — | NOTE: /tasks/claimable must come BEFORE /tasks/:id or Express will route 'claimable' to the :id param. |
 | GET | `/api/bongos/tasks/newcomer-floor` | `any-builder` | — | GET /tasks/newcomer-floor — supply gauge for the newcomer queue (task 614). |
-| POST | `/api/bongos/tasks/newcomer-restock` | `archon` | — | POST /tasks/newcomer-restock (task 1168) — bring every evergreen newcomer chore's standing pool up to its configured floor. |
+| POST | `/api/bongos/tasks/newcomer-restock` | `metic+archon` | — | POST /tasks/newcomer-restock (task 1168) — bring every evergreen newcomer chore's standing pool up to its configured floor. |
 | GET | `/api/bongos/tasks/peer-votes/feed` | `any-builder` | — | GET /tasks/peer-votes/feed — recent confirmed/shipped work by OTHER builders, each with its net vote total and the caller's own current v… |
-| POST | `/api/bongos/tasks/peer-votes/tally` | `archon` | — | POST /tasks/peer-votes/tally — fold matured votes (≥7 days old, not yet counted) into karma_log, one net row per shipping builder, then m… |
+| POST | `/api/bongos/tasks/peer-votes/tally` | `metic+archon` | — | POST /tasks/peer-votes/tally — fold matured votes (≥7 days old, not yet counted) into karma_log, one net row per shipping builder, then m… |
 
 ## `versions` (7)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/versions` | `public` | — | read-only version list; mirrors /public/versions. |
-| POST | `/api/bongos/versions` | `archon` | `id`, `name`, `status`, `done_when`, `scope_doc_path`, `criteria` | POST /versions — create a version + its done-when criteria in one call. |
+| POST | `/api/bongos/versions` | `metic+archon` | `id`, `name`, `status`, `track`, `done_when`, `scope_doc_path`, `criteria` | POST /versions — create a version + its done-when criteria in one call. |
 | GET | `/api/bongos/versions/:id/done-when` | `public` | — | Public: status.example.com fetches this every 60s alongside other public/* surfaces. |
 | POST | `/api/bongos/versions/:id/done-when` | `metic+archon` | `criterion_id`, `criterion_md`, `goal_id`, `sort_order` | Auth (Metic+, then the goal's own authority): create a done-when criterion at RUNTIME. |
 | GET | `/api/bongos/versions/:id/progress` | `public` | — | Per-criterion progress rollup: each done-when criterion → the tasks that gate it (task_criteria, migration 055) → live statuses → what re… |

package/docs/architecture.md

@@ -231,7 +231,7 @@ markdown describes, the DB enforces.**
 
 - **`example.com`** — game (Phaser + Colyseus). Static files from `public/`. `/builders` + `/builders/*` now **301-redirect to `builders.example.com/<rest>`** ([#739](https://example.com/builders#/task/739) then promoted to permanent 301 in [#741](https://example.com/builders#/task/741), ADR 0036 cutover); the apex no longer serves the builder surface directly.
 - **`status.example.com`** — public build dashboard. **Carved to the `status-ui` module in BV1.R84** ([ADR 0093](adr/<redacted>.md) §1): the surface moved from `public-status/` to `modules/status-ui/public/`, now served by the loader's web-surface seam (`moduleWebSurfaces` → `serve-internal.js`, routed on the `status.` Host prefix the manifest declares) instead of a hardcoded block — no behavior change. Layout reorganized in [#726](https://example.com/builders#/task/726) (ADR 0036): Pulse / Watch(uptime) / Architects / Works / Treasury / Lately Inscribed / The World — the grade-aggregate, estimation-drift, and repo-health tablets moved to the Archon `/watch` page. **⚠ Served OFF the droplet** (ADR 0029, outage resilience): the live page is **GitHub Pages from the separate repo `example-owner/example-status`** (CNAME → Fastly), reading data cross-origin from the droplet's `/api/gds/public/*` (CORS open) and an availability banner from the prober's `status-data` branch. The droplet still serves `modules/status-ui/public/` (on the `status.` host) as a same-origin fallback, but **DNS points at Pages, not the droplet** — so a droplet deploy does NOT update the live page. Changes to the surface publish to the mirror via `scripts/status-mirror-sync.js` (re-pointed at `modules/status-ui/public/`; status.js/style.css/cursors are byte-identical copies; index.html gets the off-box bits injected), run automatically by `.github/workflows/sync-status-mirror.yml` (needs the `STATUS_MIRROR_TOKEN` secret) ([#737](https://example.com/builders#/task/737)). **⚠ FOLLOW-UP (R84):** that workflow's path trigger still watches `public-status/**` and must be re-pointed at `modules/status-ui/public/**` by an owner/Archon — the GitHub App can't push `.github/workflows/*` (learning 107), so until then the mirror sync won't auto-fire on future status edits.
-- **`builders.example.com`** — dedicated builder surface (`isBuildersHost`, ADR 0036). **Carved to the `hall-ui` module in BV1.R85** ([ADR 0093](adr/<redacted>.md) §1): the surface moved from `public-builders/` to `modules/hall-ui/public/` (~13k LOC, the largest module) and is a loader-discovered web-surface module (`contributes.webSurfaces` host `builders.`). UNLIKE the generic status surface it keeps its **dedicated** serving block in `serve-internal.js` (`BUILDERS_DIR = modules/hall-ui/public/`), partitioned out of the generic web-surface loop on the `isBuildersHost` predicate. A thin rewrite shim maps every non-API path onto the existing `/builders/*` tree (so all serving + gating + asset-stamping is reused), serving the hall (`/`), the Archon-only **`/watch`** monitoring page (gated by `requireArchonPage`), **`/settings`** (Voices + Craft prefs), plus ranks/sessions/primer/diagrams. No behavior change — byte-identical (only `window.__MODULES__.enabled` gains `hall-ui:true`). **Additive** — until its DNS A record + cert are live, the whole surface stays reachable at `example.com/builders/*`. No `.github/workflows/*` follow-up: unlike R84, no workflow path-trigger watches `public-builders/**`.
+- **`builders.example.com`** — dedicated builder surface (`isBuildersHost`, ADR 0036). **Carved to the `hall-ui` module in BV1.R85** ([ADR 0093](adr/<redacted>.md) §1): the surface moved from `public-builders/` to `modules/hall-ui/public/` (~13k LOC, the largest module) and is a loader-discovered web-surface module (`contributes.webSurfaces` host `builders.`). UNLIKE the generic status surface it keeps its **dedicated** serving block in `serve-internal.js` (`BUILDERS_DIR = modules/hall-ui/public/`), partitioned out of the generic web-surface loop on the `isBuildersHost` predicate. A thin rewrite shim maps every non-API path onto the existing `/builders/*` tree (so all serving + gating + asset-stamping is reused), serving the hall (`/`), the Metic+ **`/watch`** monitoring page (gated by `requireGovernancePage`), **`/settings`** (Voices + Craft prefs), plus ranks/sessions/primer/diagrams. No behavior change — byte-identical (only `window.__MODULES__.enabled` gains `hall-ui:true`). **Additive** — until its DNS A record + cert are live, the whole surface stays reachable at `example.com/builders/*`. No `.github/workflows/*` follow-up: unlike R84, no workflow path-trigger watches `public-builders/**`.
 - **`/downloads/devbox/*`** (every host, mounted right after the API so the builders-host shim can't rewrite it — [#904](https://example.com/builders#/task/904), [ADR 0045](adr/<redacted>.md)): branded download surface for the Dev Box desktop app. `/{mac-arm64,mac-x64,win-x64}` (+ `mac`/`win` aliases) 302 to the release assets on the public releases repo named in [`config/devbox-app.json`](../config/devbox-app.json); `latest.json` feeds the app's update check. Logic in [`src/devbox-downloads.js`](../src/devbox-downloads.js); the installers never ride the git deploy.
 - The `/api/gds/*` surface is reachable from every host. **Cross-subdomain sign-in:** the `gds_session` cookie is scoped to `.example.com` on the production hosts (apex/www/builders/status) and host-only on localhost/staging (no cross-env token bleed); the OAuth handshake runs on the canonical origin with a validated `?return=` (open-redirect-guarded) so the subdomain can land a builder back on itself.
 - Caddy gets a site block per host ([`infra/Caddyfile`](../infra/Caddyfile)), all reverse-proxying to `127.0.0.1:3000`.

package/docs/canonical-permissions.md

@@ -55,11 +55,17 @@ ranks are a no-op until code grants them privileges. As of **[#692](https://exam
 forming the ordered claim-gate tier **`xenos` (1) < `thetes` (2) < `metic` (3) < `archon` (4)**
 (`REQUIRES_RANK_TIER` in `src/bongos/db.js`):
 
-- **`archon`** — Lars (`github_login = 'example-owner'`, set by migration 023). Top authority: everything a
-  Metic can do, plus grader-bypass confirm, set **version-level** scope (a `done-when` criterion with no
-  `goal_id`, any criterion outside an open version or outside a goal they own, and `done-when/:id/unsatisfy`
-  — [ADR 0154](adr/<redacted>.md)),
-  grant/revoke ranks, offboard builders, version close, infra. Overrides any claim. The authority that
+- **`archon`** — Lars (`github_login = 'example-owner'`, set by migration 023). **Since
+  [ADR 0157](adr/<redacted>.md) (2026-08-05) the Archon rank is responsible for
+  RANK and IDENTITY, not day-to-day administration.** It is everything a Metic can do, plus: **rank**
+  (grant/revoke — the single writer), **identity** (offboard/(de)activate, admit an access request, revoke
+  sessions), the **four escalation keys** that would otherwise make that delegation self-reversible
+  (grader-bypass confirm, CI gate approval, protected-module goal scope, and `governance.manage`),
+  **version close**, cross-tier dependency edges, and the substrate floors (push `main`, protected paths,
+  ssh — ADR 0043). Version-**level** criteria (a `done-when` with no `goal_id`, or one outside an open
+  version / outside a goal they own) also stay Archon per
+  [ADR 0154](adr/<redacted>.md), though that ADR's `done-when/:id/unsatisfy`
+  carve-out was superseded — unsatisfy is Metic now. Overrides any claim. The authority that
   stays *exclusively* Archon — never delegated to Metic — is **setting rank** (`PATCH /builders/:id/rank`)
   and **closing versions**.
 - **`metic`** — the Archon-approved **working rank**. Full claim/ship of any ready task (own work),
@@ -126,15 +132,33 @@ index = higher authority). So `requireRank('archon')` admits `archon` **and the
 silently *lost* all archon-gated authority — while still denying everything below the floor. Unknown
 or missing ranks fail closed.
 
-- **Archon-only** — ratification / scope / infra: `POST /api/gds/tasks/:id/confirm` (grader-bypass past
-  a failed grade), `POST /api/gds/done-when/:id/unsatisfy`, `PATCH /api/gds/builders/:id/{rank,status}`, and the
-  cross-tier `POST|DELETE /api/gds/dependencies` + goal-scope edges ([ADR 0086](adr/<redacted>.md)).
-  **Task authoring itself — `POST /api/gds/tasks`, `PATCH /api/gds/tasks/:id` (incl. the
-  `newcomer_friendly` flag), `POST /api/gds/tasks/:id/promote`, and the `tasks/:id/{dependencies,criteria}`
-  CRUD — moved to Metic+ in [ADR 0090](adr/<redacted>.md)**, and **task retirement —
-  `POST /api/gds/tasks/:id/abandon`, plus the `abandoned → backlog` restore on `/promote` — in
-  [ADR 0152](adr/<redacted>.md)** (see the Metic+Archon bullet).
-  Setting rank and closing versions never delegate below Archon. **A manual promotion advances exactly
+- **Archon-only** — **rank, identity, and the four escalation keys ([ADR 0157](adr/<redacted>.md), owner decision 2026-08-05).**
+  That ADR narrowed Archon from ~50 route gates to 9 live ones, on the rule *"the Archon rank is
+  responsible for rank and identity only"*:
+  - **rank** — `PATCH /api/gds/builders/:id/rank` (the single writer).
+  - **identity** — `PATCH /api/gds/builders/:id/status` (offboard/(de)activate), `GET|PATCH /api/gds/access-requests[/:id]`
+    (who is admitted), `POST /api/gds/auth/revoke[-all]` (whose sessions are valid).
+  - **the four escalation keys**, which look operational but are not: `POST /api/gds/tasks/:id/confirm`
+    (grader-bypass), `POST /api/gds/gate-approvals/:pr/approve` (CI deploy-gate override), protected-module
+    **goal scope** ([ADR 0086](adr/<redacted>.md)), and `governance.manage` (the
+    roles/permissions tab). Delegating any one of them lets a Metic reach Archon in four steps — create a
+    protected-scope goal in the permission core, claim a task there (protected paths already floor at
+    *metic* per [ADR 0043](adr/<redacted>.md)), confirm
+    past the failed grade, approve their own red gate — so keeping rank Archon-only depends on keeping
+    these Archon-only too. **Any future delegation must re-check that chain.**
+  - plus `version.close` (paired with rank as the powers that never delegate), the cross-tier
+    `POST|DELETE /api/gds/dependencies` (`system: true` — no system permission is grantable below archon),
+    and the substrate floors (`deploy.push_main` / `path.protected.modify` / `infra.ssh`, ADR 0043).
+
+  Earlier one-power delegations that ADR 0157 generalises: **task authoring** — `POST /api/gds/tasks`,
+  `PATCH /api/gds/tasks/:id` (incl. the `newcomer_friendly` flag), `POST /api/gds/tasks/:id/promote`, and the
+  `tasks/:id/{dependencies,criteria}` CRUD — moved to Metic+ in [ADR 0090](adr/<redacted>.md),
+  and **task retirement** — `POST /api/gds/tasks/:id/abandon`, plus the `abandoned → backlog` restore on
+  `/promote` — in [ADR 0152](adr/<redacted>.md) (see the Metic+Archon bullet).
+  `POST /api/gds/done-when/:id/unsatisfy` **was** Archon-only and moved to Metic in ADR 0157, superseding
+  [ADR 0154](adr/<redacted>.md)'s "the backward ratchet stays Archon" carve-out;
+  satisfy and unsatisfy remain separate permissions, so confirming a criterion still never confers
+  un-confirming one. **A manual promotion advances exactly
   ONE live rung at a time** (`xenos→thetes→metic→archon`; [#707](https://example.com/builders#/task/707)) — a multi-rung jump (e.g. `xenos→metic`) returns
   `400 multi_rung_promotion` naming the next allowed rung. Demotions are unconstrained (offboarding
   drops straight to `xenos`); the automatic `xenos→thetes` graduation is +1 and unaffected.
@@ -147,10 +171,31 @@ or missing ranks fail closed.
   [ADR 0154](adr/<redacted>.md), also `POST /api/gds/versions/:id/done-when`
   (criterion **create**) — but walled by goal ownership, not by rank alone: a non-Archon must name a
   `goal_id`, on an open (`planning`/`building`) version, in an `open` goal they **own or manage** (the same
-  `authorizeGoalManagement` wall as goal visibility/invites/roles). Version-level criteria and
-  `done-when/:id/unsatisfy` stay Archon. The floor here is
+  `authorizeGoalManagement` wall as goal visibility/invites/roles). Version-level criteria stay Archon;
+  `done-when/:id/unsatisfy` moved here in [ADR 0157](adr/<redacted>.md). The floor here is
   `metic`, so **`thetes` does NOT pass these** — it sits below `metic` on the ladder and inherits none
   of its grants (ADR 0034); `archon` and the divine tiers above it do.
+
+  **[ADR 0157](adr/<redacted>.md) added the whole operational block here** —
+  20 permissions that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
+  the governance/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.governance`) and
+  `GET /api/gds/sessions/search`; the **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
+  `POST /boxes/:b/close`, `PATCH .../block`, `GET /provisioning/fleet[/cost-ledger]`,
+  `POST .../force-teardown`); **security adjudication** (`GET /security/reports`,
+  `POST /security/reports/:id/{confirm,dispute,fix,link-fix}`, `/security/docs` CRUD);
+  `GET /api/gds/audit-log`; the **roster reads** (`GET /builders/roster`, `/grades/by-builder`,
+  `/builders/:id/active-claims`); **cross-builder memory reads** (`GET /memory/builders/:id/file[s]`);
+  **project curation + scouting**; `PATCH /builders/:id/budget`; `POST /inbox/:id/ratify`;
+  `GET /override-requests` + `POST .../:id/decide`; `POST /claims/:id/release-on-behalf`;
+  `POST /done-when/:id/unsatisfy`; `POST /goals/reorder`; `POST /versions`;
+  `POST /tasks/newcomer-restock`; `POST /tasks/peer-votes/tally`; `GET /discord/channels/plan` +
+  `POST .../reconcile`; `GET /autonomy/precheck`. Plus `GET /gate-approvals`, whose read was split out as
+  `gate_approval.read` so the Gate page is usable at Metic while **approving** stays Archon.
+
+  > **Note the one confidentiality widening:** `/security/docs` (the engagement-report store with
+  > attacker-usable exploit detail) is now Metic-readable, because it shares `security.report.adjudicate`
+  > with the report-adjudication writes. Every other delegated permission widens who may *act*; this one
+  > widens who may *read*. ADR 0157 §Consequences records the split that would undo it if wanted.
 - **Any authenticated builder** — own work: claim/ship/cost/learnings/file-blocker/file-idea. Two
   row-level claim rules apply (enforced in `db.claimTask` / `claimTasksBatch`, not by `requireRank`):
   a **`xenos` can only CLAIM tasks flagged `newcomer_friendly`** (returns `rank_too_low_for_task`),

package/docs/design/vanilla-hall-ui-redesign-scope.md

@@ -268,7 +268,7 @@ The hall has hard architectural constraints (see `modules/hall-ui/CLAUDE.md`). P
 - **Widget registry is the source of truth.** A fitness check (`scripts/gds/fitness.js checkHallSectionRegistry`) reds the build if a `<section class="scroll">` is hardcoded into `<main>`. Views must mount registered widgets, not inline them.
 - **No framework, no build step.** Static HTML/CSS/JS polling `/api/gds/*`. The shell is hand-rolled CSS + a small amount of JS — no framework may be introduced.
 - **Dedicated serving block.** `src/bongos/serve-internal.js` serves this from `BUILDERS_DIR` with the subdomain rewrite shim, canonical redirects, page gates, and asset-stamping. New assets must carry the content-hash `?v=` stamp.
-- **Server-side gates stay authoritative.** Hiding a sidebar item is cosmetic; `requireArchonPage` and the sign-in redirects remain the real access control.
+- **Server-side gates stay authoritative.** Hiding a sidebar item is cosmetic; `requireGovernancePage` and the sign-in redirects remain the real access control.
 - **Brand pack drives copy.** Neutralizing voice = a neutral default pack + removing hardcoded lore, not English strings baked into markup.
 - **Module-contributed widgets keep working.** The shell must give a stable mount point so a module's `hall-widget.js` lands in the right view (`injectModuleHallWidgets` seam).
 

package/docs/file-map.md

@@ -11,6 +11,7 @@
 ├── README.md                    ← public-facing one-paragraph summary
 ├── .gitignore
 ├── package.json / package-lock.json
+├── CODEOWNERS                   ← owner review on the merge-gate surfaces (real since task 1002611, ADR 0159); inert until branch protection is on (scripts/gds/gating.js) — keep aligned with gate-review.js HARD_FLOOR_GLOBS
 ├── server.js                    ← game boot: Express + Colyseus + the shared internal surface (mountInternalSurfaces), binds 127.0.0.1:3000
 │
 ├── .devcontainer/               ← the Example Dev Box, defined as code (ADR 0031 §3) — builds identically on a DO box + a laptop
@@ -111,7 +112,7 @@
 │   ├── grading/                ← CORE-DOMAIN carve (BV1.R73, default-on): the grade-a-diff adversarial worker panel + deterministic pre-passes + rubric; registers the `grade` kernel port. CLAUDE.md, module.json, routes/grade.js, grader.js, grader-rubric.json.
 │   ├── economy/                ← CORE-DOMAIN carve (BV1.R77, default-on): credit allocation + cost ledger + streaks + achievements + leaderboard; registers the `reward` kernel port. CLAUDE.md, module.json, routes/{cost,leaderboard,reward}.js, credits.js, cost.js, cost-classify.js, cost-summary-shape.js, streak.js, achievements.js, reward.js.
 │   ├── ideas/                  ← CORE-DOMAIN carve (BV1.R78, default-on): the idea_inbox capture/triage/criterion-proposal flow + the blockers queue; registers the `ideas.capture` kernel port (retired the `captureIdea` doorway leak). CLAUDE.md, module.json, routes/{inbox,blockers}.js, inbox.js, blockers.js.
-│   ├── security/                ← CORE-DOMAIN carve (BV1.R79, default-on): red-team/vulnerability report intake + the env-aware bounty payout table (Metic+); registers the `security` kernel port the core /public/bounty-table resolves. <redacted> (permission-path-check, route-rank-check) stays kernel — this is <redacted>. CLAUDE.md, module.json, routes/reports.js, security.js, secret-scrub.js.
+│   ├── security/                ← CORE-DOMAIN carve (BV1.R79, default-on): red-team/vulnerability report intake + the env-aware bounty payout table (Metic+); registers the `security` kernel port the core /public/bounty-table resolves. <redacted> (permission-path-check, route-rank-check) stays kernel — this is <redacted>. CLAUDE.md, module.json, routes/{reports,scans}.js, security.js, secret-scrub.js, scan-store.js. **artifact-scan/** (goal 1000055, /scan-before-install): fetch.js (hardened clone), quarantine.js (holding pen), manifest.js (content hash), mirror.js (scrubbed reading-room), fence-local.js (vendored scrub/fence), floor.js + detectors/ (zero-LLM deterministic floor — npm-lifecycle, hooks, mcp, permissions, credentials, network, injection, dependencies, capabilities; persisted before any model reads).
 │   ├── builder-settings/        ← CORE-DOMAIN carve (BV1.R80, default-on): per-builder prefs — wandering level, per-skill model ceilings, sound/render toggles — + builder-needs. `GET /me` resolves the `builder-settings` kernel port for these slices. CLAUDE.md, module.json, routes/settings.js, wandering-prefs.js, skill-prefs.js, sound-prefs.js, event-sound-prefs.js, render-prefs.js, model-alloc-prefs.js, interaction-prefs.js, display-name.js, builder-needs.js.
 │   ├── onboarding/              ← CORE-DOMAIN carve (BV1.R81, default-on): admission (access-request → Archon approval), the server-ticked onboarding state machine, the friction analyzer, and evergreen newcomer-chore restock; registers the `onboarding` kernel port. CLAUDE.md, module.json, routes/access-requests.js, onboarding.js, onboarding-state.js, newcomer-restock.js, approval-broadcast.js.
 │   ├── sessions/                ← CORE-DOMAIN carve (BV1.R82, default-on): the session_records corpus + data plane (upload, cross-builder search/deep-dive), the BFG read-the-room scorer, session-pulse/stale-claim helpers. Registers no port — reached via HTTP POST to its own /sessions route; resolves the economy `reward` port for the cost-plus token reward. CLAUDE.md, module.json, routes/sessions.js, bfg.js, pulse.js.
@@ -160,6 +161,7 @@
 │       ├── release.js           ← resolve claim as abandoned (`/builder-release`)
 │       ├── cost.js              ← log a cost entry (`/builder-cost`)
 │       ├── me.js                ← current builder profile + leaderboard
+│       ├── goal.js              ← goal board CLI: `list` (rollup per goal) + `show <id>` (criteria, tasks, waits-on, next claimable)
 │       ├── seed-v3-tasks.js     ← V3 Planning Session #1: 80 net-new GDS-V3 tasks (V3.R01–V3.R89) + 10 idea_inbox promotions; idempotent on source_ref
 │       ├── backfill-cost.js     ← read art ledger → POST /api/gds/cost (idempotent)
 │       ├── smoke-write.sh       ← write-path smoke (create→claim→ship round-trip)
@@ -362,6 +364,7 @@ tests/
 ├── priority-session/SKILL.md      ← /priority-session — a trusted builder answers plain-speech questions; the answers reweight the idea_inbox + suggest what to build next
 ├── read-session-export/SKILL.md   ← /read-session-export — read a Claude Code /export zip fast (prompts + thinking + tool calls → stdout); reads the existing export, doesn't make one. Backed by scripts/gds/read-session-export.js
 ├── recall/SKILL.md                ← /recall — one-call project-knowledge search across repo docs + DB prose (tasks, learnings, session logs)
+├── scan-before-install/SKILL.md   ← /scan-before-install — quarantine-fetch a third-party repo/plugin, deterministic floor + tiered subagent panel over the scrubbed mirror, arithmetic verdict + honest-limits report to the builder's own config dir; prints install commands (pinned SHA only), never installs (goal 1000055)
 ├── session-handoff/SKILL.md       ← /session-handoff — compose a clean, paste-ready next-steps prompt to START a fresh session with (keeps context light by curating what carries forward); read-only, distinct from /builder-ship's ledger notes and /builder-end's close-out
 └── status/SKILL.md                ← /status — what's the status of X / what's left for criterion Cn (read-only rollup)
 ```

package/docs/onboarding/diagrams/assertions.json

@@ -22,10 +22,10 @@
     ],
     "default_rank": "xenos",
     "wired_ranks": [
-      "archon",
-      "metic",
       "xenos",
-      "thetes"
+      "archon",
+      "thetes",
+      "metic"
     ],
     "_wired_note": "A rank is 'wired' if it has behavior: it appears in a requireRank(...) call, is the column default, is SET by a migration, or is a key in the live REQUIRES_RANK_TIER claim-gate map (db.js). archon = requireRank + seeded; metic + thetes + xenos = tier-map members (claim-floor comparison); xenos = column default + set on /builder-exit (migration 025); thetes = the auto-graduation target (xenos→thetes after 3 confirmed tasks, #692 / ADR 0034)."
   },