@bongos/core 1.19.1041 → 1.19.1043

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 440 operations across 67 resource groups
+- 442 operations across 68 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -745,6 +745,8 @@ function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
+      getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
       getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
     },
@@ -948,6 +950,10 @@ function createClient(opts = {}) {
       // GET /sky/mine — rank: any-builder — GET /sky/mine
       getSkyMine: (args) => request("GET", "/sky/mine", { hasBody: false }, args),
     },
+    "softwareUpdate": {
+      // GET /software-update — rank: any-builder — GET /software-update
+      getSoftwareUpdate: (args) => request("GET", "/software-update", { hasBody: false }, args),
+    },
     "specialities": {
       // GET /specialities — rank: any-builder — GET /specialities
       getSpecialities: (args) => request("GET", "/specialities", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -744,6 +744,8 @@ function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
+      getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
       getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
     },
@@ -947,6 +949,10 @@ function createClient(opts = {}) {
       // GET /sky/mine — rank: any-builder — GET /sky/mine
       getSkyMine: (args) => request("GET", "/sky/mine", { hasBody: false }, args),
     },
+    "softwareUpdate": {
+      // GET /software-update — rank: any-builder — GET /software-update
+      getSoftwareUpdate: (args) => request("GET", "/software-update", { hasBody: false }, args),
+    },
     "specialities": {
       // GET /specialities — rank: any-builder — GET /specialities
       getSpecialities: (args) => request("GET", "/specialities", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -61,7 +61,7 @@ export interface GetConnectionsDegreeHandleResponse { handle: unknown; degree: u
 export interface GetConnectionsRequestsResponse { incoming: unknown; outgoing: unknown; incoming_count: unknown; outgoing_count: unknown }
 export interface GetConnectionsResponse { connections: unknown; count: unknown }
 export interface GetConnectionsSuggestionsResponse { suggestions: unknown; count: unknown }
-export interface GetCoreUpdateResponse { ok: boolean; update: unknown; deploy_url: unknown }
+export interface GetCoreUpdateResponse { ok: boolean; update: unknown }
 export interface GetCoreUpgradesResponse { ok: boolean; running: unknown; limit: unknown; upgrades: unknown }
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
 export interface GetDiscordChannelsSnapshotResponse { ok: boolean; guild_id: unknown; config: unknown; warnings: unknown }
@@ -157,6 +157,7 @@ export interface GetSecurityScansResponse { scans: unknown }
 export interface GetSessionsIdResponse { session: unknown }
 export interface GetSessionsMineResponse { sessions: unknown; count: unknown }
 export interface GetSessionsSearchResponse { sessions: unknown; count: unknown; total: unknown; totals: unknown; limit: unknown; offset: unknown; session_types: unknown }
+export interface GetSoftwareUpdateResponse { ok: boolean; update: unknown; door: unknown; can_update: unknown }
 export interface GetSpecialitiesIdDocumentsResponse { documents: unknown }
 export interface GetSpecialitiesIdResponse { speciality: unknown }
 export interface GetSpecialitiesOfferedResponse { suggestions: unknown }
@@ -1159,6 +1160,8 @@ export interface BongosClient {
     postMyProjectsJoin(args: RequestArgs & { body: PostMyProjectsJoinRequest }): Promise<PostMyProjectsJoinResponse>;
   };
   "npmRelease": {
+    /** GET /npm-release/task/{id} — rank: any-builder */
+    getNpmReleaseTaskId(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /npm-release/work — rank: archon */
     getNpmReleaseWork(args?: RequestArgs): Promise<ApiResponse>;
   };
@@ -1362,6 +1365,10 @@ export interface BongosClient {
     /** GET /sky/mine — rank: any-builder */
     getSkyMine(args?: RequestArgs): Promise<ApiResponse>;
   };
+  "softwareUpdate": {
+    /** GET /software-update — rank: any-builder */
+    getSoftwareUpdate(args?: RequestArgs): Promise<GetSoftwareUpdateResponse>;
+  };
   "specialities": {
     /** GET /specialities — rank: any-builder */
     getSpecialities(args?: RequestArgs): Promise<GetSpecialitiesResponse>;

package/clients/bongos-client/index.mjs

@@ -741,6 +741,8 @@ export function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
+      getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
       getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
     },
@@ -944,6 +946,10 @@ export function createClient(opts = {}) {
       // GET /sky/mine — rank: any-builder — GET /sky/mine
       getSkyMine: (args) => request("GET", "/sky/mine", { hasBody: false }, args),
     },
+    "softwareUpdate": {
+      // GET /software-update — rank: any-builder — GET /software-update
+      getSoftwareUpdate: (args) => request("GET", "/software-update", { hasBody: false }, args),
+    },
     "specialities": {
       // GET /specialities — rank: any-builder — GET /specialities
       getSpecialities: (args) => request("GET", "/specialities", { hasBody: false }, args),

package/docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md

@@ -131,6 +131,20 @@ live reference instance where the Builder 25 incident happened, so it carries it
 - The layer table above stands: Layer 1 is still not a trust boundary; the post-push main audit —
   since task 1002612 a CI job on every push to `main` — remains the authoritative layer.
 
+## The un-spoofable signal: attestation pass, flag-only (2026-09-26, task 1001433)
+
+The residual in the #863-followup section, that the git author name can be typed, gets its
+closure. The owner chose to build it on the mark the server already writes: the
+`gate-author-trust` commit status, posted on a ship's pushed tip only after the server has
+resolved the builder's CLI session to a Metic+ rank (ADR 0058). `main-audit.js` now traces
+each permission-sensitive commit to the pull request that brought it onto main (the second
+parent of its first-parent merge). It requires that head to carry a success of that context,
+**posted by the server's own GitHub identity**; anyone with write access can post a status
+of the same name, so the creator is the part checked. By the owner's ruling it is
+**flag-only**: an unattested commit is a `review` finding and never fails the audit or the
+deploy gate. Moving it to blocking is a later, separate decision. Measured against the last
+60 mainline merges: 32 protected commits, 0 flagged.
+
 ## Notes
 
 We did **not** take immediate action against Builder 25 — Lars was overseeing the session and the change itself was a legitimate bug fix. The point of this ADR is the *mechanism*, not the person: the system must make the bypass hard and visible regardless of intent.

package/docs/adr/0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md

@@ -5,6 +5,7 @@
 - **Task:** [task 1004174](https://cloudbongos.com/builders#/task/1004174) (goal 1000090 — BONGOS-V2)
 - **Deciders:** the owner, Lars. On 2026-09-22 he said "every project has the option to upgrade its version of bongos including bongos itself", and that the control belongs in that project's own hall. On 2026-09-26 he ruled that **only a project's owner upgrades it**, adding that for him "owners and archons are the same", because he owns the platform.
 - **Amends:** [ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md) D5 ("Archon-gated server-side"). The deploy door gains a second audience, as stated below. D1 (the web tier only asks, the control plane acts), D3, D4 and D6 are unchanged.
+- **Amended by:** [ADR 0340](0340-every-hall-takes-its-update-from-settings-and-deploy-is-the-platform-halls-page.md) (task 1004296) — D3's hand-off moves from the banner and the rail to Settings → Software update's Update button, and `GET /core-update` no longer answers `deploy_url`.
 - **Related:** [ADR 0328](0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md) (the owner-OR-operator gate shape this reuses), [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) (the `alsoAdmits` page-gate door this reuses), [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) (a hosted project's hub client id is its slug), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) / 0111 §2 (the web tier gains no capability)
 
 ## Context

package/docs/adr/0340-every-hall-takes-its-update-from-settings-and-deploy-is-the-platform-halls-page.md

@@ -0,0 +1,64 @@
+# ADR 0340 — Every hall takes its update from Settings, and /deploy is the platform hall's page
+
+- **Status:** Accepted
+- **Date:** 2026-09-26
+- **Task:** [task 1004296](https://cloudbongos.com/builders#/task/1004296) (goal 1000090 — BONGOS-V2), split out of [task 1002622](https://cloudbongos.com/builders#/task/1002622) §1.
+- **Deciders:** the owner, Lars. On 2026-09-25 he asked that each builders hall's Settings carry "a version description where they can pull the latest release. Just like iOS does", and ruled that `/deploy` is "only for bongos builders hall itself not for all production ones".
+- **Amends:** [ADR 0339](0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md) D3 (where a hosted hall uses the hub address) and the reach of [ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md)'s door page. Nothing about who may move a pin, or how the move runs, changes.
+
+## Context
+
+Before this change a project learned about a newer core in one place, the banner (task 1004045), and only a holder of `core.pin.move` ever saw it. The banner named two version numbers and nothing that had landed between them. The only per-version record of work is the `release-notes.json` each package carries (task 1004218); the changelog's CI lines name none.
+
+Every hall also served `/deploy`. The page's data and both of its acts are provisioning-module routes, so in a hall without that module (a hosted project, a self-hosted instance) it was a page with nothing behind it.
+
+## Decision
+
+### D1 — Settings → Software update, in the core, in every hall
+
+A sixth Settings group. It shows the running core, then either "up to date" or the newest release the update channel lets this project take, then what each version in between brings, read from the newest package's own release notes.
+
+- **Every signed-in builder reads it** (`GET /api/bongos/software-update`, `requireBuilder` only). It discloses nothing the public `GET /version` and npm do not already publish, so ADR 0043's vulnerability-window reason, which keeps the banner's reads on `core.pin.move`, does not apply here.
+- **The channel rule is the runner's own** (`resolveChannelTarget`), with no channel passed, exactly as the banner. The panel never offers a version the runner would refuse.
+- **"Up to date" is said only from an answer.** A failed registry read, a running version that cannot be named, and release notes that could not be read each render as what they are.
+
+### D2 — The Update button leads to the door; it is not the door
+
+The server names where this project's door is:
+
+- `local` — `/deploy`, where the hall runs the provisioning module.
+- `hub` — ADR 0339 D3's `<hub>/deploy?project=<slug>`, on a federated hosted project.
+- `cli` — neither, as on a self-hosted instance. The panel says `bongos upgrade` on the server takes the version, with the same health check and rollback.
+
+The button is drawn only when the viewer holds `core.pin.move`. That check is cosmetic; the door re-checks every request.
+
+### D3 — `/deploy` exists only where the door does
+
+In a hall that does not run the provisioning module, `GET /deploy` answers `302` to `/settings#software-update`. The redirect carries no gate, because it discloses nothing and Settings' own wall applies once it is followed. The platform's hall keeps `/deploy` behind its unchanged page gate. It remains the door for its own pin and, through `?project=`, for every hosted project's (ADR 0339).
+
+### D4 — The banner and the rail stop linking off-site
+
+On every hall but the platform's, the banner's Upgrade link opens Settings → Software update. On that panel itself the banner points rather than linking to the page it is on, the rule task 1004145 set for `/deploy`. The rail's Deploy item is no longer re-pointed at the hub, and it stays hidden wherever the module is off. `GET /core-update` no longer answers `deploy_url`. The hub address now lives only in `GET /software-update`'s `door`, which is ADR 0339 D3's hand-off moved from two places to one.
+
+### D5 — The registry reader is the core's
+
+`src/bongos/package-registry.js` holds the packument read, the in-process tarball stream and the small tar reader. It moved out of the npm-release module (task 1002622), because the one reader every hall needs cannot live inside a module that only one hall runs. Modules reach it through the doorway's `readPackageRegistry`, and both readers share one process-local cache.
+
+## Rejected
+
+- **A copy of the two-step door inside Settings.** It would put the confirmation, the busy states and the rollback display in two places for one act. Those are the rules ADR 0293 D4 exists to keep exact.
+- **Gating the panel on `core.pin.move`, as the banner is.** The owner asked for the version in every builder's Settings, and the panel offers no act of its own.
+- **Keeping `/deploy` on other halls with a "moved" notice.** A page that exists only to say it does not belong there is the dead end this replaces.
+
+## Consequences
+
+- **A hosted project gets the panel when it runs a core carrying this ADR**, like every in-hall change. Until then its banner still hands off as ADR 0339 D3 described.
+- **The first open of the panel after a new release downloads that package once per server process** (about 24 MB for 1.19.1040, under a second from a droplet), then serves it from memory. It is read only when the group opens, never with the page.
+- **What's new links each entry to its task only in the platform's hall**, whose ledger the ids belong to. Elsewhere the entries are plain text.
+- **Proof:** `tests/software_update.mjs`:
+  - the reading, over a real gzipped tar and packument;
+  - the route, over real requests;
+  - the panel, executed in a DOM stub against a live reading;
+  - `/deploy`, answered by two real servers, one with the module and one without.
+
+  `tests/core_upgrade_owner_door.mjs` covers the banner's new link. Each guard was deleted in turn and a test went red.

package/docs/adr/README.md

@@ -431,3 +431,4 @@ This keeps the decision history honest and traceable.
 | 0337 | [**The hub account is the person, a hall account is their seat in one project, so anything that spans projects lives on the hub** ([task 1004255](https://cloudbongos.com/builders#/task/1004255), goal 1000110 — the owner's hub/hall re-scope, 2026-09-24/25). Extends [ADR 0141](<redacted>.md) from identity to placement: (1) a surface about the person across projects, or about more than one project, goes on the HUB (`public-landing`, `platform-identity`): people directory, community, guilds, connections, recruiting, platform-account settings; one about this project goes in the HALL (`hall-ui`); "Builders you may know" is on both; `status-ui` is the status dashboard, not the hall; (2) no authority moves, and hub actions still land as the project's own rows; (3) hall `/people` retires, ADR 0334's recruiting directory moves unchanged to the hub community page, `/roster` is the in-project directory; (4) owner calls: the hidden-builder recruiter panel is recruiter-only while public search is unchanged (amends community-tab spec D8); platform-account settings get a new hub page; **guild totals count hidden and private members by default, with a notice on the join card and a per-guild off switch (`counted_in_totals`), rounded to a 1–2–5 band, only once a guild has at least 3 of them, refreshed weekly; size stays the public roster length** (supersedes ADR 0336 D5; relaxes the privacy spec's "`hide_stats` beats everything" for guild totals only, for a member who was told), with the fake-account padding limit stated and accepted.](0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) | platform identity / placement / privacy |
 | 0338 | [**Modules travel through a Bongos-hosted store, and an acquired module keeps working forever** ([task 1003782](https://cloudbongos.com/builders#/task/1003782), goal 1000091 — working area 5, owner Will). A module had no transport of its own: it reached an instance only inside the core (ADR 0107 §6) or in the instance's repo. Weighed npm packages, a Bongos-hosted store and git refs against the four things area 5's criteria require — entitlement before install, a per-version score, a tester channel, and a delist that stops distribution. npm and git refs fail entitlement and delist by construction. **D1:** Cloud Bongos hosts the store; a module version is a tarball + hash manifest in the same format `package-core.js` already emits (same `isPublishable()` gate), registry rows on the control-plane DB, artifacts in the already-paid DO Spaces bucket, served by the control plane only after an entitlement + channel check; free modules take the same path at price zero; install/update verify hashes on arrival; modules' own npm deps still travel via npm (ADR 0138). No new fixed cost. **D2 (owner):** delisting, author withdrawal or deletion removes a module from the catalog and stops new acquisitions and updates, but **an acquired module keeps working forever** — the store never disables or removes an installed copy and a delist never revokes an entitlement; the holder is told no more updates will come. Security issues are not a special case; a remote kill switch would need a superseding ADR. Rejected: npm, git refs, remote disable on delist.](0338-modules-travel-through-a-bongos-hosted-store.md) | modules / distribution / economy |
 | 0339 | [**A project's owner upgrades it, and a hosted project hands off to the hub's door** ([task 1004174](https://cloudbongos.com/builders#/task/1004174), goal 1000090 — the owner's ruling of 2026-09-26 that only a project's owner upgrades it). Amends ADR 0293 D5. **D1:** the deploy door's preview and move routes admit the OWNER of a tenant row (`co-tenant`/`cloud-host`) for that row, asked first; every other caller meets the unmodified `core.pin.move` gate, so a non-owner's refusal is unchanged whether or not the id exists and the widening can only admit. **D2:** the platform's own row stays atom-only. **D3:** `GET /core-update` names `<hub>/deploy?project=<slug>` on a federated project, and the hosted hall's banner and rail hand off there (the dead local Deploy item is gone); the hub's `/deploy` shell admits a project owner through `alsoAdmits: 'isProjectOwner'`. **D4:** the intent's actor records the door (`api:owner:<id>` / `api:archon:<id>`), both attributed on the `core_upgrades` ledger. Rejected: a tenant-side API that performs the upgrade, granting the system atom to owners, owners moving the platform row. ADR 0328 Phase 1 (task 1004159) should fold this gate into `requireProjectOwner`.](0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md) | provisioning / deploy door / permissions |
+| 0340 | [**Every hall takes its update from Settings, and /deploy is the platform hall's page** ([task 1004296](https://cloudbongos.com/builders#/task/1004296), goal 1000090 — the owner's 2026-09-25 asks: a Settings version panel "just like iOS", and /deploy only in the Bongos hall). Amends ADR 0339 D3 and the reach of ADR 0293's page. **D1:** Settings → Software update in the core — the running core, the newest release the runner's own channel rule allows, and what each version in between carries from the newest package's release notes; every signed-in builder reads it, and "up to date" is said only from an answer. **D2:** its Update button leads to the door (local /deploy, the hub's /deploy?project=, or a `bongos upgrade` sentence), drawn only for holders of core.pin.move. **D3:** /deploy 302s to Settings on a hall without the provisioning module. **D4:** the banner links Settings everywhere but the platform; the rail is no longer re-pointed; /core-update drops deploy_url. **D5:** the registry reader moved into the core (module-api readPackageRegistry). Rejected: a second copy of the two-step door, gating the panel on the atom, a "moved" page.](0340-every-hall-takes-its-update-from-settings-and-deploy-is-the-platform-halls-page.md) | deploy door / settings / core update |

package/docs/api/openapi.json

@@ -261,6 +261,10 @@
       "name": "sky",
       "description": "Endpoints under `/api/bongos/sky`."
     },
+    {
+      "name": "software-update",
+      "description": "Endpoints under `/api/bongos/software-update`."
+    },
     {
       "name": "specialities",
       "description": "Endpoints under `/api/bongos/specialities`."
@@ -13318,6 +13322,51 @@
         ]
       }
     },
+    "/npm-release/task/{id}": {
+      "get": {
+        "operationId": "get_npm_release_task_id",
+        "tags": [
+          "npm-release"
+        ],
+        "summary": "GET /npm-release/task/:id",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/npm-release/routes/task-where.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/npm-release/work": {
       "get": {
         "operationId": "get_npm_release_work",
@@ -17088,6 +17137,44 @@
         ]
       }
     },
+    "/software-update": {
+      "get": {
+        "operationId": "get_software_update",
+        "tags": [
+          "software-update"
+        ],
+        "summary": "GET /software-update",
+        "description": "GET /software-update — Settings → Software update (task 1004296): this project's core, the newest release its channel allows, what the versions between them carry, and where this project's Update button leads. Any signed-in builder (see the header).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/core-update.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetSoftwareUpdateResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/specialities": {
       "get": {
         "operationId": "get_specialities",
@@ -21129,13 +21216,11 @@
           "ok": {
             "type": "boolean"
           },
-          "update": {},
-          "deploy_url": {}
+          "update": {}
         },
         "required": [
           "ok",
-          "update",
-          "deploy_url"
+          "update"
         ]
       },
       "GetCoreUpgradesResponse": {
@@ -22383,6 +22468,23 @@
           "session_types"
         ]
       },
+      "GetSoftwareUpdateResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "update": {},
+          "door": {},
+          "can_update": {}
+        },
+        "required": [
+          "ok",
+          "update",
+          "door",
+          "can_update"
+        ]
+      },
       "GetSpecialitiesIdDocumentsResponse": {
         "type": "object",
         "properties": {
@@ -27938,9 +28040,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 440,
-  "x-schema-count": 481,
+  "x-endpoint-count": 442,
+  "x-schema-count": 482,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 329,
+  "x-response-schemas": 330,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 440 endpoints across 75 route files.
+> **Generated from the live route files** — the route file is authoritative. 442 endpoints across 76 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -521,10 +521,11 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/my-projects/invites/:clientId/decline` | `any-builder` | — | decline an invite (delete the pending row) for the caller's OWN account. |
 | POST | `/api/bongos/my-projects/join` | `any-builder` | `origin`, `note` | request to join a project. |
 
-## `npm-release` (1)
+## `npm-release` (2)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| GET | `/api/bongos/npm-release/task/:id` | `any-builder` | — |  |
 | GET | `/api/bongos/npm-release/work` | `archon` | — | Query: days (ledger window, default 14, max 60), before + limit (history paging). |
 
 ## `override-requests` (2)
@@ -679,6 +680,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sky` | `any-builder` | — | GET /sky, the whole project sky (task 1004230, ADR 0331). |
 | GET | `/api/bongos/sky/mine` | `any-builder` | — | GET /sky/mine, every thought the SIGNED-IN builder filed with its state, size and descent, capped at 1000 (task 1004230). |
 
+## `software-update` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/software-update` | `any-builder` | — | GET /software-update — Settings → Software update (task 1004296): this project's core, the newest release its channel allows, what the ve… |
+
 ## `specialities` (12)
 
 | Method | Path | Rank | Body | Description |